Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
500)});g("#refreshOD").addEventListener("click",function(){null!=L&&(e(null),F.apply(this,L))});D&&g("#odBackBtn").addEventListener("click",D);A&&g("#odSubmitBtn").addEventListener("click",q);null!=H?(D=H.pop(),"sharepoint"==H[0].driveId&&I(g("#odSharepoint")),C=H,F(D.driveId,D.folderId,D.siteId,D.name)):F()};App=function(b,e,f){EditorUi.call(this,b,e,null!=f?f:"1"==urlParams.lightbox||"min"==uiTheme&&"0"!=urlParams.chrome);mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||(window.onunload=mxUtils.bind(this,function(){var c=this.getCurrentFile();if(null!=c&&c.isModified()){var k={category:"DISCARD-FILE-"+c.getHash(),action:(c.savingFile?"saving":"")+(c.savingFile&&null!=c.savingFileTime?"_"+Math.round((Date.now()-c.savingFileTime.getTime())/1E3):"")+(null!=c.saveLevel?"-sl_"+c.saveLevel:"")+"-age_"+(null!=
c.ageStart?Math.round((Date.now()-c.ageStart.getTime())/1E3):"x")+(this.editor.autosave?"":"-nosave")+(c.isAutosave()?"":"-noauto")+"-open_"+(null!=c.opened?Math.round((Date.now()-c.opened.getTime())/1E3):"x")+"-save_"+(null!=c.lastSaved?Math.round((Date.now()-c.lastSaved.getTime())/1E3):"x")+"-change_"+(null!=c.lastChanged?Math.round((Date.now()-c.lastChanged.getTime())/1E3):"x")+"-alive_"+Math.round((Date.now()-App.startTime.getTime())/1E3),label:null!=c.sync?"client_"+c.sync.clientId:"nosync"};
c.constructor==DriveFile&&null!=c.desc&&null!=this.drive&&(k.label+=(null!=this.drive.user?"-user_"+this.drive.user.id:"-nouser")+"-rev_"+c.desc.headRevisionId+"-mod_"+c.desc.modifiedDate+"-size_"+c.getSize()+"-mime_"+c.desc.mimeType);EditorUi.logEvent(k)}}));this.editor.addListener("autosaveChanged",mxUtils.bind(this,function(){var c=this.getCurrentFile();null!=c&&EditorUi.logEvent({category:(this.editor.autosave?"ON":"OFF")+"-AUTOSAVE-FILE-"+c.getHash(),action:"changed",label:"autosave_"+(this.editor.autosave?