Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CommentsWindow=function(b,f,m,d,u,v){function D(){for(var n=t.getElementsByTagName("div"),z=0,E=0;E<n.length;E++)"none"!=n[E].style.display&&n[E].parentNode==t&&z++;x.style.display=0==z?"block":"none"}function F(n,z,E,A){function N(){z.removeChild(U);z.removeChild(g);L.style.display="block";Q.style.display="block"}k={div:z,comment:n,saveCallback:E,deleteOnCancel:A};var Q=z.querySelector(".geCommentTxt"),L=z.querySelector(".geCommentActionsList"),U=document.createElement("textarea");U.className=
"geCommentEditTxtArea";U.style.minHeight=Q.offsetHeight+"px";U.value=n.content;z.insertBefore(U,Q);var g=document.createElement("div");g.className="geCommentEditBtns";var y=mxUtils.button(mxResources.get("cancel"),function(){A?(z.parentNode.removeChild(z),D()):N();k=null});y.className="geCommentEditBtn";g.appendChild(y);var H=mxUtils.button(mxResources.get("save"),function(){Q.innerText="";n.content=U.value;mxUtils.write(Q,n.content);N();E(n);k=null});mxEvent.addListener(U,"keydown",mxUtils.bind(this,
function(O){mxEvent.isConsumed(O)||((mxEvent.isControlDown(O)||mxClient.IS_MAC&&mxEvent.isMetaDown(O))&&13==O.keyCode?(H.click(),mxEvent.consume(O)):27==O.keyCode&&(y.click(),mxEvent.consume(O)))}));H.focus();H.className="geCommentEditBtn gePrimaryBtn";g.appendChild(H);z.insertBefore(g,Q);L.style.display="none";Q.style.display="none";U.focus()}function K(n,z){z.innerText="";n=new Date(n.modifiedDate);var E=b.timeSince(n);null==E&&(E=mxResources.get("lessThanAMinute"));mxUtils.write(z,mxResources.get("timeAgo",