Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"/sites?search=";N=[{name:mxResources.get("sharepointSites",null,"Sharepoint Sites"),driveId:Q}];ea=1;break;case "site":N.push({name:Y,driveId:Q,folderId:V,siteId:X});qa="/sites/"+X+"/drives";ea=2;break;case "subsite":N.push({name:Y,driveId:Q,folderId:V,siteId:X});qa="/drives/"+X+(V?"/items/"+V:"/root")+"/children";break;case "search":Q=P;N=[{driveId:Q,name:mxResources.get("back",null,"Back")}];Z=encodeURIComponent(Z.replace(/'/g,"\\'"));qa=Q?"/drives/"+Q+"/root/search(q='"+Z+"')":"/me/drive/root/search(q='"+
Z+"')";break;default:null==V?N=[{driveId:Q}]:N.push({name:Y,driveId:Q,folderId:V}),qa=(Q?"/drives/"+Q:"/me/drive")+(V?"/items/"+V:"/root")+"/children"}ea||(qa+=(0<qa.indexOf("?")?"&":"?")+"select=id,name,description,parentReference,file,createdBy,lastModifiedBy,lastModifiedDateTime,size,folder,remoteItem,@microsoft.graph.downloadUrl");var ia=[];da()}}function L(Q){U.className=U.className.replace("odCatSelected","");U=Q;U.className+=" odCatSelected"}function F(Q){O||(W=null,H("search",null,null,null,