Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){b.spinner.stop();if(null==b.linkPicker){var A=b.drive.createLinkPicker();b.linkPicker=A.setCallback(function(H){LinkDialog.filePicked(H)}).build()}b.linkPicker.setVisible(!0)}))});"undefined"!=typeof Dropbox&&"undefined"!=typeof Dropbox.choose&&y(IMAGE_PATH+"/dropbox-logo.svg",mxResources.get("dropbox"),function(){Dropbox.choose({linkType:"direct",cancel:function(){},success:function(A){z.value=A[0].link;z.focus()}})});null!=b.oneDrive&&y(IMAGE_PATH+"/onedrive-logo.svg",mxResources.get("oneDrive"),