Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
B=mxUtils.bind(this,function(R){f.saveLevel=9;if(R||null==T)m(R);else{var U=!0,W=null;try{W=window.setTimeout(mxUtils.bind(this,function(){U=!1;I({code:App.ERROR_TIMEOUT})}),3*this.ui.timeout)}catch(Q){}this.executeRequest({url:"/files/"+f.getId()+"?supportsAllDrives=true&fields="+this.catchupFields},mxUtils.bind(this,function(Q){window.clearTimeout(W);if(U){f.saveLevel=10;try{null!=Q&&Q.headRevisionId==u?("1"==urlParams.test&&T!=Q.etag&&EditorUi.debug("DriveClient: Preflight Etag Update","from",
T,"to",Q.etag,"rev",f.desc.headRevisionId,"response",[Q],"file",[f]),T=Q.etag,m(R)):I({error:{code:412}},Q)}catch(V){d(V)}}}),mxUtils.bind(this,function(Q){window.clearTimeout(W);U&&(f.saveLevel=11,I(Q))}))}});if(v&&null==S){f.saveLevel=8;var K=new Image;K.onload=mxUtils.bind(this,function(){try{var R=this.thumbnailWidth/K.width,U=document.createElement("canvas");U.width=this.thumbnailWidth;U.height=Math.floor(K.height*R);U.getContext("2d").drawImage(K,0,0,U.width,U.height);var W=U.toDataURL();W=