Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
M&&!y)if("sharepoint"==p)F("site",null,M.id,M.displayName);else if("site"==p)F("subsite",null,M.id,M.name);else{var V=M.folder;M=M.remoteItem?M.remoteItem:M;var Q=(M.parentReference?M.parentReference.driveId:null)||p,X=M.id;V?F(Q,X,null,M.name):q()}}function F(V,Q,X,Z,Y){function aa(ya){N.stop();var Ca=document.createElement("table");Ca.className="odFileListGrid";for(var ta=null,Fa=0,pa=0;null!=ya&&pa<ya.length;pa++){var ra=ya[pa];if(1!=ba||!ra.webUrl||0<ra.webUrl.indexOf("sharepoint.com/sites/")||
0>ra.webUrl.indexOf("sharepoint.com/")){var ua=ra.displayName||ra.name,Ga=mxUtils.htmlEntities(ra.description||ua);ba&&(ra.folder=2==ba?{isRoot:!0}:!0);var Ea=null!=ra.folder;if(!E||Ea){var Qa=document.createElement("tr");Qa.className=Fa++%2?"odOddRow":"odEvenRow";var Ha=document.createElement("td");Ha.style.width="36px";var Ra=document.createElement("img");Ra.src="/images/"+(Ea?"folder.png":"file.png");Ra.className="odFileImg";Ha.appendChild(Ra);Qa.appendChild(Ha);Ha=document.createElement("td");
Ea=document.createElement("div");Ea.className="odFileTitle";Ea.innerHTML=mxUtils.htmlEntities(ua);Ea.setAttribute("title",Ga);Ha.appendChild(Ea);Qa.appendChild(Ha);Ca.appendChild(Qa);null==ta&&(ta=Qa,ta.className+=" odRowSelected",M=ra,p=V,d||e(M));(function(Ia,Va){Qa.addEventListener("dblclick",B);Qa.addEventListener("click",function(){ta!=Va&&(ta.className=ta.className.replace("odRowSelected",""),ta=Va,ta.className+=" odRowSelected",M=Ia,p=V,d||e(M))})})(ra,Qa)}}}0==Fa?(ya=document.createElement("div"),
ya.className="odEmptyFolder",ya.innerHTML=mxUtils.htmlEntities(mxResources.get("folderEmpty",null,"Folder is empty!")),za.appendChild(ya)):za.appendChild(Ca);v();y=!1}function ca(ya){f(ya?ya:qa,function(Ca){if(da){var ta=Ca.value||[];if(d||ba)Array.prototype.push.apply(la,ta);else for(var Fa=0;Fa<ta.length;Fa++){var pa=ta[Fa],ra=pa.file?pa.file.mimeType:null;(pa.folder||"text/html"==ra||"text/xml"==ra||"application/xml"==ra||"image/png"==ra||/\.svg$/.test(pa.name)||/\.html$/.test(pa.name)||/\.xml$/.test(pa.name)||