Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
else if(15E7<=f.length)k({message:mxResources.get("drawingTooLarge")+" ("+this.ui.formatFileSize(f.length)+" / 150 MB)"});else{l=null!=l?l:"";var u=mxUtils.bind(this,function(){return this.client.filesUpload({path:"/"+l+e,mode:{".tag":"overwrite"},mute:!0,contents:new Blob([f],{type:"text/plain"})})});this.executePromise(u,c,k)}};DropboxClient.prototype.pickLibrary=function(e){Dropbox.choose({linkType:"direct",cancel:mxUtils.bind(this,function(){}),success:mxUtils.bind(this,function(f){if(this.ui.spinner.spin(document.body,
mxResources.get("loading"))){var c=mxUtils.bind(this,function(u){this.ui.spinner.stop();this.ui.handleError(u)}),k=f[0].link.indexOf(this.appPath);if(0<k){var l=decodeURIComponent(f[0].link.substring(k+this.appPath.length-1));this.readFile({path:l},mxUtils.bind(this,function(u,x){if(null!=x&&x.id==f[0].id)try{this.ui.spinner.stop(),e(l.substring(1),new DropboxLibrary(this.ui,u,x))}catch(E){this.ui.handleError(E)}else this.createLibrary(f[0],e,c)}),c)}else this.createLibrary(f[0],e,c)}})})};DropboxClient.prototype.createLibrary=