Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(e,f){try{var c=JSON.parse(e.getText());null!=c&&null!=c.message&&(f=c.message)}catch(k){}return f};GitHubClient.prototype.showAuthorizeDialog=function(e,f){this.ui.showError(mxResources.get("accessDenied"),mxResources.get("authorizationRequired"),mxResources.get("help"),mxUtils.bind(this,function(){this.ui.openLink("https://www.drawio.com/blog/single-repository-diagrams")}),e,mxResources.get("authorize"),mxUtils.bind(this,function(){this.ui.openLink("test.draw.io"==window.location.hostname?
"https://github.com/apps/diagrams-net-app-test":"https://github.com/apps/draw-io-app")}),mxResources.get("cancel"),f,480,null,!1)};GitHubClient.prototype.executeRequest=function(e,f,c,k,l){var u=mxUtils.bind(this,function(E){var D=!0,A=window.setTimeout(mxUtils.bind(this,function(){D=!1;c({code:App.ERROR_TIMEOUT,retry:x})}),this.ui.timeout),K=this.authToken+" "+b;e.setRequestHeaders=function(H,d){H.setRequestHeader("Authorization",K)};e.send(mxUtils.bind(this,function(){window.clearTimeout(A);var H=