Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
JSON.stringify(c)+"\r\n---------314159265358979323846\r\nContent-Type: application/octect-stream\r\nContent-Transfer-Encoding: base64\r\n\r\n"+(null!=k?u?k:!window.btoa||mxClient.IS_IE||mxClient.IS_IE11?Base64.encode(k):Graph.base64EncodeUnicode(k):"")+"\r\n---------314159265358979323846--"};l||(f.fullUrl+="&newRevision=false");E&&(f.fullUrl+="&pinned=true");return f};DriveClient.prototype.createLinkPicker=function(){var f=e.linkPicker;if(null==f||e.linkPickerToken!=b){e.linkPickerToken=b;f=(new google.picker.DocsView(google.picker.ViewId.FOLDERS)).setParent("root").setIncludeFolders(!0).setSelectFolderEnabled(!0);
var c=(new google.picker.DocsView).setIncludeFolders(!0).setSelectFolderEnabled(!0),k=(new google.picker.DocsView).setIncludeFolders(!0).setEnableDrives(!0).setSelectFolderEnabled(!0);f=(new google.picker.PickerBuilder).setAppId(this.appId).setLocale(mxLanguage).setOAuthToken(e.linkPickerToken).enableFeature(google.picker.Feature.SUPPORT_DRIVES).addView(f).addView(c).addView(k).addView(google.picker.ViewId.RECENTLY_PICKED)}return f};DriveClient.prototype.pickFile=function(f,c,k){this.filePickerCallback=