Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var GoogleSitesDialog=function(b,e){function f(){var U=null!=F&&null!=F.getTitle()?F.getTitle():this.defaultFilename;if(G.checked&&""!=H.value){var R="https://www.draw.io/gadget.xml?type=4&diagram="+encodeURIComponent(mxUtils.htmlEntities(H.value));null!=U&&(R+="&title="+encodeURIComponent(U));0<I.length&&(R+="&s="+I);""!=d.value&&"0"!=d.value&&(R+="&border="+d.value);""!=L.value&&(R+="&height="+L.value);R+="&pan="+(g.checked?"1":"0");R+="&zoom="+(n.checked?"1":"0");R+="&fit="+(B.checked?"1":"0");
R+="&resize="+(x.checked?"1":"0");R+="&x0="+Number(A.value);R+="&y0="+E;k.mathEnabled&&(R+="&math=1");t.checked?R+="&edit=_blank":q.checked&&(R+="&edit="+encodeURIComponent(mxUtils.htmlEntities(window.location.href)));D.value=R}else F.constructor==DriveFile||F.constructor==DropboxFile?(R="https://www.draw.io/gadget.xml?embed=0&diagram=",""!=H.value?R+=encodeURIComponent(mxUtils.htmlEntities(H.value))+"&type=3":(R+=F.getHash().substring(1),R=F.constructor==DropboxFile?R+"&type=2":R+"&type=1"),null!=
U&&(R+="&title="+encodeURIComponent(U)),""!=L.value&&(U=parseInt(L.value)+parseInt(A.value),R+="&height="+U),D.value=R):D.value=""}var c=document.createElement("div"),k=b.editor.graph,m=k.getGraphBounds(),u=k.view.scale,v=Math.floor(m.x/u-k.view.translate.x),E=Math.floor(m.y/u-k.view.translate.y);mxUtils.write(c,mxResources.get("googleGadget")+":");mxUtils.br(c);var D=document.createElement("input");D.setAttribute("type","text");D.style.marginBottom="8px";D.style.marginTop="2px";D.style.width="410px";