Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
b);var D=new XMLHttpRequest;D.responseType="json";D.onreadystatechange=mxUtils.bind(this,function(){if(4===D.readyState&&(window.clearTimeout(x),u))if(200==D.status){var A=D.response;A.compoundId=f+this.SEPARATOR+A.id;c(A)}else 401==D.status?this.authenticate(l,k,!0):k()});D.open("POST",this.baseUrl+"cards/"+f+"/attachments");D.send(E)});this.authenticate(l,k)}else k({message:mxResources.get("unknownError")})};TrelloClient.prototype.pickLibrary=function(b){this.pickFile(b)};