Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DriveClient.prototype.authorize=function(f,c,k,l,u){this.isExtAuth&&!f?window.parent.driveAuth(mxUtils.bind(this,function(x){this.updateAuthInfo(x,!0,!0,c,k)}),k):(new mxXmlRequest(this.redirectUri+"?getState=1",null,"GET")).send(mxUtils.bind(this,function(x){200<=x.getStatus()&&299>=x.getStatus()?this.authorizeStep2(x.getText(),f,c,k,l,u):null!=k&&k(x)}),k)};DriveClient.prototype.updateAuthInfo=function(f,c,k,l,u){b=f.access_token;delete f.access_token;f.expires=Date.now()+1E3*parseInt(f.expires_in);