Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DriveComment.prototype.deleteComment=function(b,e){this.file.ui.drive.executeRequest(this.pCommentId?{url:"/files/"+this.file.getId()+"/comments/"+this.pCommentId+"/replies/"+this.id,method:"DELETE"}:{url:"/files/"+this.file.getId()+"/comments/"+this.id,method:"DELETE"},b,e)};function mxODPicker(b,e,f,c,k,l,x,y,E,D,z,M,I,d){function g(Q,V){V=V||document;return V.querySelector(Q)}function n(Q,V,X){if(null==Q["@microsoft.graph.downloadUrl"])if(null==Q.parentReference)X();else{c(Q.id,Q.parentReference.driveId,function(ca){n(ca,V,X)},X);return}var Y=new XMLHttpRequest;Y.open("GET",Q["@microsoft.graph.downloadUrl"]);var Z=Q.file?"image/png"==Q.file.mimeType:!1;Y.onreadystatechange=function(){if(4==this.readyState){if(200<=this.status&&299>=this.status)try{var ca=Y.responseText;