Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!S)if("sharepoint"==O)H("site",null,F.id,F.displayName);else if("site"==O)H("subsite",null,F.id,F.name);else{var P=F.folder;F=F.remoteItem?F.remoteItem:F;var V=(F.parentReference?F.parentReference.driveId:null)||O,X=F.id;P?H(V,X,null,F.name):t()}}function H(P,V,X,Y,Z){function da(ya){q.stop();var xa=document.createElement("table");xa.className="odFileListGrid";for(var ta=null,Ka=0,oa=0;null!=ya&&oa<ya.length;oa++){var sa=ya[oa];if(1!=ea||!sa.webUrl||0<sa.webUrl.indexOf("sharepoint.com/sites/")||0>
sa.webUrl.indexOf("sharepoint.com/")){var va=sa.displayName||sa.name,Ea=mxUtils.htmlEntities(sa.description||va);ea&&(sa.folder=2==ea?{isRoot:!0}:!0);var Da=null!=sa.folder;if(!E||Da){var Qa=document.createElement("tr");Qa.className=Ka++%2?"odOddRow":"odEvenRow";var Fa=document.createElement("td");Fa.style.width="36px";var Ra=document.createElement("img");Ra.src="/images/"+(Da?"folder.png":"file.png");Ra.className="odFileImg";Fa.appendChild(Ra);Qa.appendChild(Fa);Fa=document.createElement("td");Da=
document.createElement("div");Da.className="odFileTitle";Da.innerHTML=mxUtils.htmlEntities(va);Da.setAttribute("title",Ea);Fa.appendChild(Da);Qa.appendChild(Fa);xa.appendChild(Qa);null==ta&&(ta=Qa,ta.className+=" odRowSelected",F=sa,O=P,d||e(F));(function(Ga,Va){Qa.addEventListener("dblclick",B);Qa.addEventListener("click",function(){ta!=Va&&(ta.className=ta.className.replace("odRowSelected",""),ta=Va,ta.className+=" odRowSelected",F=Ga,O=P,d||e(F))})})(sa,Qa)}}}0==Ka?(ya=document.createElement("div"),
ya.className="odEmptyFolder",ya.innerHTML=mxUtils.htmlEntities(mxResources.get("folderEmpty",null,"Folder is empty!")),Ba.appendChild(ya)):Ba.appendChild(xa);v();S=!1}function ba(ya){f(ya?ya:qa,function(xa){if(ma){var ta=xa.value||[];if(d||ea)Array.prototype.push.apply(ia,ta);else for(var Ka=0;Ka<ta.length;Ka++){var oa=ta[Ka],sa=oa.file?oa.file.mimeType:null;(oa.folder||"text/html"==sa||"text/xml"==sa||"application/xml"==sa||"image/png"==sa||/\.svg$/.test(oa.name)||/\.html$/.test(oa.name)||/\.xml$/.test(oa.name)||