Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!O)if("sharepoint"==P)H("site",null,G.id,G.displayName);else if("site"==P)H("subsite",null,G.id,G.name);else{var Q=G.folder;G=G.remoteItem?G.remoteItem:G;var V=(G.parentReference?G.parentReference.driveId:null)||P,X=G.id;Q?H(V,X,null,G.name):t()}}function H(Q,V,X,Y,Z){function ca(ya){q.stop();var xa=document.createElement("table");xa.className="odFileListGrid";for(var ta=null,Ka=0,oa=0;null!=ya&&oa<ya.length;oa++){var sa=ya[oa];if(1!=ea||!sa.webUrl||0<sa.webUrl.indexOf("sharepoint.com/sites/")||0>
sa.webUrl.indexOf("sharepoint.com/")){var va=sa.displayName||sa.name,Ea=mxUtils.htmlEntities(sa.description||va);ea&&(sa.folder=2==ea?{isRoot:!0}:!0);var Da=null!=sa.folder;if(!E||Da){var Qa=document.createElement("tr");Qa.className=Ka++%2?"odOddRow":"odEvenRow";var Fa=document.createElement("td");Fa.style.width="36px";var Ra=document.createElement("img");Ra.src="/images/"+(Da?"folder.png":"file.png");Ra.className="odFileImg";Fa.appendChild(Ra);Qa.appendChild(Fa);Fa=document.createElement("td");Da=
document.createElement("div");Da.className="odFileTitle";Da.innerHTML=mxUtils.htmlEntities(va);Da.setAttribute("title",Ea);Fa.appendChild(Da);Qa.appendChild(Fa);xa.appendChild(Qa);null==ta&&(ta=Qa,ta.className+=" odRowSelected",G=sa,P=Q,d||e(G));(function(Ga,Va){Qa.addEventListener("dblclick",A);Qa.addEventListener("click",function(){ta!=Va&&(ta.className=ta.className.replace("odRowSelected",""),ta=Va,ta.className+=" odRowSelected",G=Ga,P=Q,d||e(G))})})(sa,Qa)}}}0==Ka?(ya=document.createElement("div"),
ya.className="odEmptyFolder",ya.innerHTML=mxUtils.htmlEntities(mxResources.get("folderEmpty",null,"Folder is empty!")),Ba.appendChild(ya)):Ba.appendChild(xa);v();O=!1}function da(ya){f(ya?ya:qa,function(xa){if(ma){var ta=xa.value||[];if(d||ea)Array.prototype.push.apply(ia,ta);else for(var Ka=0;Ka<ta.length;Ka++){var oa=ta[Ka],sa=oa.file?oa.file.mimeType:null;(oa.folder||"text/html"==sa||"text/xml"==sa||"application/xml"==sa||"image/png"==sa||/\.svg$/.test(oa.name)||/\.html$/.test(oa.name)||/\.xml$/.test(oa.name)||