Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
DriveComment.prototype.deleteComment=function(b,e){this.file.ui.drive.executeRequest(this.pCommentId?{url:"/files/"+this.file.getId()+"/comments/"+this.pCommentId+"/replies/"+this.id,method:"DELETE"}:{url:"/files/"+this.file.getId()+"/comments/"+this.id,method:"DELETE"},b,e)};function mxODPicker(b,e,f,c,k,l,x,y,E,D,z,M,I,d){function g(Q,V){V=V||document;return V.querySelector(Q)}function n(Q,V,X){if(null==Q["@microsoft.graph.downloadUrl"])if(null==Q.parentReference)X();else{c(Q.id,Q.parentReference.driveId,function(ca){n(ca,V,X)},X);return}var Y=new XMLHttpRequest;Y.open("GET",Q["@microsoft.graph.downloadUrl"]);var Z=Q.file?"image/png"==Q.file.mimeType:!1;Y.onreadystatechange=function(){if(4==this.readyState){if(200<=this.status&&299>=this.status)try{var ca=Y.responseText;
Z&&(ca="data:image/png;base64,"+Editor.base64Encode(ca),ca=Editor.extractGraphModelFromPng(ca));var da=mxUtils.parseXml(ca),ma="mxlibrary"==da.documentElement.nodeName?da.documentElement:Editor.extractGraphModel(da.documentElement);if(null!=ma){V(ma.ownerDocument);return}}catch(ea){}X()}};Z&&Y.overrideMimeType&&Y.overrideMimeType("text/plain; charset=x-user-defined");Y.send()}function t(){M&&null!=J?C.exportToCanvas(function(Q){Q=EditorUi.prototype.createImageDataUri(Q,null,"png");x(G,Q);l(G)},400,