Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"?inline=false",last_commit_id:k.last_commit_id,refPos:u};k=this.getFileContent(k);return l?new GitLabLibrary(this.ui,k,e):new GitLabFile(this.ui,k,e)};GitLabClient.prototype.insertFile=function(e,f,c,k,l,u,x){l=null!=l?l:!1;u=u.split("/");this.getRefIndex(u,!0,mxUtils.bind(this,function(E,D){var A=Math.max(D-1,0),K=E.slice(0,A).join("/"),H=E[A],d=E[D];path=E.slice(D+1,E.length).join("/");0<path.length&&(path+="/");path+=e;this.checkExists(K+"/"+H+"/"+d+"/"+path,!0,mxUtils.bind(this,function(g,n){g?
l?(x||(f=Base64.encode(f)),this.showCommitDialog(e,!0,mxUtils.bind(this,function(q){this.writeFile(K,H,d,path,q,f,n,mxUtils.bind(this,function(t){try{var v=JSON.parse(t.getText());c(this.createGitLabFile(K,H,d,null!=v.content?v.content:v,l,D))}catch(B){k(B)}}),k)}),k)):(g=DRAWIO_GITLAB_URL+"/",c(new GitLabFile(this.ui,f,{org:K,repo:H,ref:d,name:e,path:path,html_url:g+K+"/"+H+"/blob/"+d+"/"+path,download_url:g+K+"/"+H+"/raw/"+d+"/"+path+"?inline=false",refPos:D,last_commit_id:n,isNew:!0}))):k()}))}),
k,null,4>=u.length)};GitLabClient.prototype.checkExists=function(e,f,c){this.getFile(e,mxUtils.bind(this,function(k){if(f){var l=this.ui.spinner.pause();this.ui.confirm(mxResources.get("replaceIt",[e]),function(){l();c(!0,k.getCurrentEtag())},function(){l();c(!1)})}else this.ui.spinner.stop(),this.ui.showError(mxResources.get("error"),mxResources.get("fileExists"),mxResources.get("ok"),function(){c(!1)})}),mxUtils.bind(this,function(k){c(!0)}),null,!0)};GitLabClient.prototype.writeFile=function(e,