Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
!0)};GitHubClient.prototype.saveFile=function(e,f,c,k,l){var u=e.meta.org,x=e.meta.repo,E=e.meta.ref,D=e.meta.path,A=mxUtils.bind(this,function(H,d){this.writeFile(u,x,E,D,l,d,H,mxUtils.bind(this,function(g){delete e.meta.isNew;f(JSON.parse(g.getText()).content.sha)}),mxUtils.bind(this,function(g){c(g)}))}),K=mxUtils.bind(this,function(){if(this.ui.useCanvasForExport&&/(\.png)$/i.test(D)){var H=this.ui.getPngFileProperties(this.ui.fileNode);this.ui.getEmbeddedPng(mxUtils.bind(this,function(d){A(e.meta.sha,
d)}),c,this.ui.getCurrentFile()!=e?e.getData():null,H.scale,H.border)}else A(e.meta.sha,Base64.encode(e.getData()))});k?this.getSha(u,x,D,E,mxUtils.bind(this,function(H){e.meta.sha=H;K()}),c):K()};GitHubClient.prototype.pickLibrary=function(e){this.pickFile(e)};GitHubClient.prototype.pickFolder=function(e){this.showGitHubDialog(!1,e,!0)};GitHubClient.prototype.pickFile=function(e){e=null!=e?e:mxUtils.bind(this,function(f){this.ui.loadFile("H"+encodeURIComponent(f))});this.showGitHubDialog(!0,e)};