Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CommentsWindow=function(b,f,m,d,u,v){function E(){for(var n=t.getElementsByTagName("div"),z=0,C=0;C<n.length;C++)"none"!=n[C].style.display&&n[C].parentNode==t&&z++;x.style.display=0==z?"block":"none"}function F(n,z,C,D){function M(){z.removeChild(V);z.removeChild(k);O.style.display="block";K.style.display="block"}g={div:z,comment:n,saveCallback:C,deleteOnCancel:D};var K=z.querySelector(".geCommentTxt"),O=z.querySelector(".geCommentActionsList"),V=document.createElement("textarea");V.className=