Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxClient.IS_CHROMEAPP)&&this.addMenuItems(l,["showStartScreen"],y),this.addMenuItems(l,["configuration"],y),l.addSeparator(y),"1"==urlParams.newTempDlg&&(c.actions.addAction("templates",function(){function G(p){return{id:p.id,isExt:!0,url:p.downloadUrl,title:p.title,imgUrl:p.thumbnailLink,changedBy:p.lastModifyingUserName,lastModifiedOn:p.modifiedDate}}var P=new TemplatesDialog(c,function(p){console.log(arguments)},null,null,null,"user",function(p,z,I){var Q=new Date;Q.setDate(Q.getDate()-7);c.drive.listFiles(null,