Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.htmlEntities(mxResources.get("error")+(ma&&ma.message?": "+ma.message:""));this.hasError=!0})):B.innerHTML=mxUtils.htmlEntities(mxResources.get("error"))});da();this.refreshComments=da;M=mxUtils.bind(this,function(){function ca(X){var P=ma[X.id];if(null!=P)for(S(X,P),P=0;null!=X.replies&&P<X.replies.length;P++)ca(X.replies[P])}if(this.window.isVisible()){for(var ia=B.querySelectorAll(".geCommentDate"),ma={},aa=0;aa<ia.length;aa++){var la=ia[aa];ma[la.getAttribute("data-commentId")]=la}for(aa=