Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxResources.get("loading"))&&c.getPublicUrl(c.getCurrentFile(),function(y){c.spinner.stop();null!=y?(y=new EmbedDialog(c,'<img src="'+(p.constructor!=DriveFile?y:"https://drive.google.com/uc?id="+p.getId())+'"/>'),c.showDialog(y.container,450,240,!0,!0),y.init()):c.handleError({message:mxResources.get("invalidPublicUrl")})})}));c.actions.put("embedImage",new Action(mxResources.get("image")+"...",function(){c.showEmbedImageDialog(function(p,y,C,L,m,z){c.spinner.spin(document.body,mxResources.get("loading"))&&