Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
p();this.refreshComments=p;H=mxUtils.bind(this,function(){function q(O){var N=J[O.id];if(null!=N)for(E(O,N),N=0;null!=O.replies&&N<O.replies.length;N++)q(O.replies[N])}if(this.window.isVisible()){for(var C=v.querySelectorAll(".geCommentDate"),J={},G=0;G<C.length;G++){var P=C[G];J[P.getAttribute("data-commentId")]=P}for(G=0;G<S.length;G++)q(S[G])}});setInterval(H,6E4);this.refreshCommentsTime=H;this.window=new mxWindow(mxResources.get("comments"),t,e,f,c,k,!0,!0);this.window.minimumSize=new mxRectangle(0,