Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ca.addReply(Ba,function(Ma){Ba.id=Ma;ca.replies.push(Ba);R(za);ha&&ha()},function(Ma){xa();L(za);b.handleError(Ma,null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))},qa,ra)}function xa(){K(Ba,za,function(Ma){pa()},!0)}var Ca=P().pdiv,Ba=b.newComment(Z,b.getCurrentUser());Ba.pCommentId=ca.id;null==ca.replies&&(ca.replies=[]);var za=V(Ba,ca.replies,Ca,aa+1);ba?xa():pa()}if(la||!ca.isResolved){F.style.display="none";var k=document.createElement("div");k.className="geCommentContainer";