Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var SaveDialog=function(b,f,l,d,q){function u(y,A,G,C,V,S){V=null!=V?V:b.getTitleForService(y);var N=null;if(0<=mxUtils.indexOf(p,y)||null!=b.getServiceForName(y)){N=document.createElement("option");if(S)N.innerHTML=mxUtils.htmlEntities(V)+"&nbsp;&nbsp;&#8211&nbsp;&nbsp;"+mxUtils.htmlEntities(mxResources.get("pickFolder"))+"...",N.setAttribute("value","pickFolder-"+y),N.setAttribute("title",V+" - "+mxResources.get("pickFolder")+"...");else{S=y+(null!=G?"-"+G:"");var O=t[S];null!=O&&null!=O.option&&
O.option.parentNode.removeChild(O.option);O=null;if(null!=A){"/"==A.charAt(A.length-1)&&(A=A.substring(0,A.length-1));"/"==A.charAt(0)&&(A=A.substring(1));O=A;var Q=O.lastIndexOf("/");0<=Q&&(O=O.substring(Q+1));25<O.length&&(O=O.substring(0,25)+"...")}N.innerHTML=(null!=O?mxUtils.htmlEntities(O)+"&nbsp;&nbsp;&#8211&nbsp;&nbsp;":"")+mxUtils.htmlEntities(V);N.setAttribute("title",V+(null!=A?" ("+A+")":"")+(null!=G&&decodeURIComponent(G)!=A?" ["+G+"]":""));N.setAttribute("value",S);t[S]={option:N,mode:y,
path:A,id:G};null==C&&null==G&&(C=b.mode==y);C&&N.setAttribute("selected","selected")}k.appendChild(N)}return N}function z(y){b.pickFolder(y,function(A){var G=null;y==App.MODE_GOOGLE&&null!=A.docs&&0<A.docs.length?G={mode:y,path:A.docs[0].name,id:A.docs[0].id}:y==App.MODE_ONEDRIVE&&null!=A.value&&0<A.value.length?G={mode:y,path:A.value[0].name,id:A.value[0].id}:(y==App.MODE_GITHUB||y==App.MODE_GITLAB)&&null!=A&&0<A.length&&(G={mode:y,path:decodeURIComponent(A),id:A});null!=G&&(n.style.display="",