Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.ui.getEmbeddedPng(mxUtils.bind(this,function(d){z(e.meta.last_commit_id,d)}),c,this.ui.getCurrentFile()!=e?e.getData():null,I.scale,I.border)}else z(e.meta.last_commit_id,Base64.encode(e.getData()))});k?this.getFile(x+"/"+y+"/"+E+"/"+D,mxUtils.bind(this,function(I){e.meta.last_commit_id=I.meta.last_commit_id;M()}),c):M()};GitLabClient.prototype.pickFolder=function(e){this.showGitLabDialog(!1,e,!0)};GitLabClient.prototype.pickFile=function(e){e=null!=e?e:mxUtils.bind(this,function(f){this.ui.loadFile("A"+