Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DropboxFile.prototype.getRevisions=function(b,e){var f=this.ui.dropbox.client.filesListRevisions({path:this.stat.path_lower,limit:100});f.then(mxUtils.bind(this,function(c){try{for(var k=[],l=c.entries.length-1;0<=l;l--)mxUtils.bind(this,function(u){k.push({modifiedDate:u.client_modified,fileSize:u.size,getXml:mxUtils.bind(this,function(x,E){this.ui.dropbox.readFile({path:this.stat.path_lower,rev:u.rev},x,E)}),getUrl:mxUtils.bind(this,function(x){return this.ui.getUrl(window.location.pathname+"?rev="+
u.rev+"&chrome=0&nav=1&layers=1&edit=_blank"+(null!=x?"&page="+x:""))+window.location.hash})})})(c.entries[l]);b(k)}catch(u){e(u)}}));f["catch"](function(c){e(c)})};DropboxFile.prototype.getLatestVersion=function(b,e){this.ui.dropbox.getFile(this.getId(),b,e)};DropboxFile.prototype.updateDescriptor=function(b){this.stat=b.stat};DropboxFile.prototype.save=function(b,e,f,c,k){this.doSave(this.getTitle(),b,e,f,c,k)};DropboxFile.prototype.saveAs=function(b,e,f){this.doSave(b,!1,e,f)};