Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DriveComment.prototype.deleteComment=function(b,e){this.file.ui.drive.executeRequest(this.pCommentId?{url:"/files/"+this.file.getId()+"/comments/"+this.pCommentId+"/replies/"+this.id,method:"DELETE"}:{url:"/files/"+this.file.getId()+"/comments/"+this.id,method:"DELETE"},b,e)};function mxODPicker(b,e,f,c,k,l,u,x,E,D,A,K,H,d){function g(V,Q){Q=Q||document;return Q.querySelector(V)}function n(V,Q,X){if(null==V["@microsoft.graph.downloadUrl"])if(null==V.parentReference)X();else{c(V.id,V.parentReference.driveId,function(aa){n(aa,Q,X)},X);return}var Z=new XMLHttpRequest;Z.open("GET",V["@microsoft.graph.downloadUrl"]);var Y=V.file?"image/png"==V.file.mimeType:!1;Z.onreadystatechange=function(){if(4==this.readyState){if(200<=this.status&&299>=this.status)try{var aa=Z.responseText;