Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){function W(){y(q,m,function(){D(m);q.editComment(q.content,function(){M(m)},function(Q){z(m);W();b.handleError(Q,null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))})})}W()},q.isResolved),O(mxResources.get("delete"),function(){b.confirm(mxResources.get("areYouSure"),function(){D(m);q.deleteComment(function(W){if(!0===W){W=m.querySelector(".geCommentTxt");W.innerText="";mxUtils.write(W,mxResources.get("msgDeleted"));var Q=m.querySelectorAll(".geCommentAction");for(W=