Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Q))}var S="";null==e&&(e=u,S='<div style="text-align: center;" class="odPreview"></div>');null==k&&(k=function(){var Q=null;try{Q=JSON.parse(localStorage.getItem("mxODPickerRecentList"))}catch(V){}return Q});null==l&&(l=function(Q){if(null!=Q){var V=k()||{};delete Q["@microsoft.graph.downloadUrl"];V[Q.id]=Q;localStorage.setItem("mxODPickerRecentList",JSON.stringify(V))}});S='<div class="odCatsList"><div class="odCatsListLbl">OneDrive</div><div id="odFiles" class="odCatListTitle odCatSelected">'+mxUtils.htmlEntities(mxResources.get("files"))+