Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
500)});g("#refreshOD").addEventListener("click",function(){null!=T&&(e(null),H.apply(this,T))});D&&g("#odBackBtn").addEventListener("click",D);z&&g("#odSubmitBtn").addEventListener("click",t);null!=I?(D=I.pop(),"sharepoint"==I[0].driveId&&L(g("#odSharepoint")),N=I,H(D.driveId,D.folderId,D.siteId,D.name)):H()};App=function(b,e,f){EditorUi.call(this,b,e,null!=f?f:"1"==urlParams.lightbox||"min"==uiTheme&&"0"!=urlParams.chrome);mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||(window.onunload=mxUtils.bind(this,function(){var c=this.getCurrentFile();if(null!=c&&c.isModified()){var k={category:"DISCARD-FILE-"+c.getHash(),action:(c.savingFile?"saving":"")+(c.savingFile&&null!=c.savingFileTime?"_"+Math.round((Date.now()-c.savingFileTime.getTime())/1E3):"")+(null!=c.saveLevel?"-sl_"+c.saveLevel:"")+"-age_"+(null!=
c.ageStart?Math.round((Date.now()-c.ageStart.getTime())/1E3):"x")+(this.editor.autosave?"":"-nosave")+(c.isAutosave()?"":"-noauto")+"-open_"+(null!=c.opened?Math.round((Date.now()-c.opened.getTime())/1E3):"x")+"-save_"+(null!=c.lastSaved?Math.round((Date.now()-c.lastSaved.getTime())/1E3):"x")+"-change_"+(null!=c.lastChanged?Math.round((Date.now()-c.lastChanged.getTime())/1E3):"x")+"-alive_"+Math.round((Date.now()-App.startTime.getTime())/1E3),label:null!=c.sync?"client_"+c.sync.clientId:"nosync"};
c.constructor==DriveFile&&null!=c.desc&&null!=this.drive&&(k.label+=(null!=this.drive.user?"-user_"+this.drive.user.id:"-nouser")+"-rev_"+c.desc.headRevisionId+"-mod_"+c.desc.modifiedDate+"-size_"+c.getSize()+"-mime_"+c.desc.mimeType);EditorUi.logEvent(k)}}));this.editor.addListener("autosaveChanged",mxUtils.bind(this,function(){var c=this.getCurrentFile();null!=c&&EditorUi.logEvent({category:(this.editor.autosave?"ON":"OFF")+"-AUTOSAVE-FILE-"+c.getHash(),action:"changed",label:"autosave_"+(this.editor.autosave?