Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"/sites?search=";C=[{name:mxResources.get("sharepointSites",null,"Sharepoint Sites"),driveId:V}];ba=1;break;case "site":C.push({name:Z,driveId:V,folderId:Q,siteId:X});qa="/sites/"+X+"/drives";ba=2;break;case "subsite":C.push({name:Z,driveId:V,folderId:Q,siteId:X});qa="/drives/"+X+(Q?"/items/"+Q:"/root")+"/children";break;case "search":V=p;C=[{driveId:V,name:mxResources.get("back",null,"Back")}];Y=encodeURIComponent(Y.replace(/'/g,"\\'"));qa=V?"/drives/"+V+"/root/search(q='"+Y+"')":"/me/drive/root/search(q='"+
Y+"')";break;default:null==Q?C=[{driveId:V}]:C.push({name:Z,driveId:V,folderId:Q}),qa=(V?"/drives/"+V:"/me/drive")+(Q?"/items/"+Q:"/root")+"/children"}ba||(qa+=(0<qa.indexOf("?")?"&":"?")+"select=id,name,description,parentReference,file,createdBy,lastModifiedBy,lastModifiedDateTime,size,folder,remoteItem,@microsoft.graph.downloadUrl");var la=[];ca()}}function I(V){T.className=T.className.replace("odCatSelected","");T=V;T.className+=" odCatSelected"}function G(V){y||(W=null,F("search",null,null,null,