Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
z=window.open(z,"odauth",["width=525,height=525","top="+(window.screenY+Math.max(window.outerHeight-525,0)/2),"left="+(window.screenX+Math.max(window.outerWidth-525,0)/2),"status=no,resizable=yes,toolbar=no,menubar=no,scrollbars=yes"].join());null!=z&&(window.onOneDriveCallback=mxUtils.bind(this,function(M,I){if(x){window.onOneDriveCallback=null;x=!1;try{null==M?c({message:mxResources.get("accessDenied"),retry:l}):(null!=D&&D(),this.updateAuthInfo(M,E,!0,f,c))}catch(d){c(d)}finally{null!=I&&I.close()}}else null!=
I&&I.close()}),z.focus())}),mxUtils.bind(this,function(){x&&(window.onOneDriveCallback=null,x=!1,c({message:mxResources.get("accessDenied"),retry:l}))}))});l()}else c({code:App.ERROR_BUSY})};OneDriveClient.prototype.getAccountTypeAndEndpoint=function(e,f){this.get(this.baseUrl+"/me/drive/root",mxUtils.bind(this,function(c){try{if(200<=c.getStatus()&&299>=c.getStatus()){var k=JSON.parse(c.getText());0<k.webUrl.indexOf(".sharepoint.com")?this.endpointHint=k.webUrl.replace("/Documents","/_layouts/15/onedrive.aspx"):