Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	regExDate: function (str, p1, p2, offset, s) {
		var date = str.substring(1).replace('"', '');
		if (date.substring(0, 7) == "\\\/Date(") {
			var d = date.match(/Date\((.*?)\)/)[1];
			return "new Date(" + parseInt(d) + ")";
		}
		else { // ISO Date 2007-12-31T23:59:59Z                                     
			var matches = date.split(/[-,:,T,Z]/);
			if (matches.length == 7) {
				matches[1] = (parseInt(matches[1], 0) - 1).toString();
				var isDate = true;
				var s = "";
				for (var i = 0; i < matches.length; i++) {
					if (isNaN(parseInt(matches[i], 10))) {
						isDate = false;
						break;
					}
					if (i > 0) {
						s += ",";
                    }
					s += parseInt(matches[i], 10);
				}
				if (isDate) {
					return "new Date(Date.UTC(" + s + "))";
				}
			}
		}
		return str;
	},