Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CommentsWindow=function(b,e,f,c,k,l){function x(){for(var q=v.getElementsByTagName("div"),C=0,J=0;J<q.length;J++)"none"!=q[J].style.display&&q[J].parentNode==v&&C++;A.style.display=0==C?"block":"none"}function y(q,C,J,G){function P(){C.removeChild(T);C.removeChild(m);N.style.display="block";O.style.display="block"}n={div:C,comment:q,saveCallback:J,deleteOnCancel:G};var O=C.querySelector(".geCommentTxt"),N=C.querySelector(".geCommentActionsList"),T=document.createElement("textarea");T.className=