Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ya.className="odEmptyFolder",ya.innerHTML=mxUtils.htmlEntities(mxResources.get("folderEmpty",null,"Folder is empty!")),Ba.appendChild(ya)):Ba.appendChild(xa);v();O=!1}function da(ya){f(ya?ya:qa,function(xa){if(ma){var ta=xa.value||[];if(d||ea)Array.prototype.push.apply(ia,ta);else for(var Ka=0;Ka<ta.length;Ka++){var oa=ta[Ka],sa=oa.file?oa.file.mimeType:null;(oa.folder||"text/html"==sa||"text/xml"==sa||"application/xml"==sa||"image/png"==sa||/\.svg$/.test(oa.name)||/\.html$/.test(oa.name)||/\.xml$/.test(oa.name)||
/\.png$/.test(oa.name)||/\.drawio$/.test(oa.name)||/\.drawiolib$/.test(oa.name))&&ia.push(oa)}xa["@odata.nextLink"]&&1E3>ia.length?da(xa["@odata.nextLink"]):(clearTimeout(za),ca(ia))}},function(xa){if(ma){clearTimeout(za);var ta=null;try{ta=JSON.parse(xa.responseText).error.message}catch(Ka){}y(mxResources.get("errorFetchingFolder",null,"Error fetching folder items")+(null!=ta?" ("+ta+")":""));O=!1;q.stop()}},null!=ya)}if(!O){g(".odCatsList").style.display="block";g(".odFilesSec").style.display="block";