Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
e+"?ref="+D;var A={Authorization:"token "+b};u=e.split("/");this.ui.convertFile(l,0<u.length?u[u.length-1]:e,null,this.extension,f,c,null,A)}else c({message:mxResources.get("accessDenied")});else u="&t="+(new Date).getTime(),e=new mxXmlRequest(this.baseUrl+"/repos/"+x+"/"+E+"/contents/"+e+"?ref="+D+u,null,"GET"),this.executeRequest(e,mxUtils.bind(this,function(K){try{f(this.createGitHubFile(x,E,D,JSON.parse(K.getText()),k))}catch(H){c(H)}}),c)};GitHubClient.prototype.createGitHubFile=function(e,f,
c,k,l){e={org:e,repo:f,ref:c,name:k.name,path:k.path,sha:k.sha,html_url:k.html_url,download_url:k.download_url};f=k.content;"base64"===k.encoding&&(/\.jpe?g$/i.test(k.name)?f="data:image/jpeg;base64,"+f:/\.gif$/i.test(k.name)?f="data:image/gif;base64,"+f:/\.png$/i.test(k.name)?(k=this.ui.extractGraphModelFromPng(f),f=null!=k&&0<k.length?k:"data:image/png;base64,"+f):f=Base64.decode(f));return l?new GitHubLibrary(this.ui,f,e):new GitHubFile(this.ui,f,e)};GitHubClient.prototype.insertLibrary=function(e,