Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))},X,Y)}function ca(){F(na,ea,function(za){Z()},!0)}var ha=O().pdiv,na=b.newComment(U,b.getCurrentUser());na.pCommentId=n.id;null==n.replies&&(n.replies=[]);var ea=J(na,n.replies,ha,D+1);T?ca():Z()}if(M||!n.isResolved){x.style.display="none";var k=document.createElement("div");k.className="geCommentContainer";k.setAttribute("data-commentId",n.id);k.style.marginLeft=20*D+5+"px";n.isResolved&&!Editor.isDarkMode()&&(k.style.backgroundColor=