Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.ui.getEmbeddedPng(mxUtils.bind(this,function(d){A(e.meta.last_commit_id,d)}),c,this.ui.getCurrentFile()!=e?e.getData():null,H.scale,H.border)}else A(e.meta.last_commit_id,Base64.encode(e.getData()))});k?this.getFile(u+"/"+x+"/"+E+"/"+D,mxUtils.bind(this,function(H){e.meta.last_commit_id=H.meta.last_commit_id;K()}),c):K()};GitLabClient.prototype.pickFolder=function(e){this.showGitLabDialog(!1,e,!0)};GitLabClient.prototype.pickFile=function(e){e=null!=e?e:mxUtils.bind(this,function(f){this.ui.loadFile("A"+
encodeURIComponent(f))});this.showGitLabDialog(!0,e)};GitLabClient.prototype.showGitLabDialog=function(e,f,c){var k=null,l=null,u=null,x=null,E=document.createElement("div");E.style.whiteSpace="nowrap";E.style.overflow="hidden";E.style.height="304px";var D=document.createElement("h3");mxUtils.write(D,mxResources.get(e?"selectFile":"selectFolder"));D.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:12px";E.appendChild(D);var A=document.createElement("div");A.style.whiteSpace=