Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"geCommentActionLnk";mxUtils.write(Z,V);X.appendChild(Z);mxEvent.addListener(Z,"click",function(Y){R(Y,n);Y.preventDefault();mxEvent.consume(Y)});P.appendChild(X);W&&(X.style.display="none")}function L(){function V(X){R.push(W);if(null!=X.replies)for(var Z=0;Z<X.replies.length;Z++)W=W.nextSibling,V(X.replies[Z])}var R=[],W=g;V(n);return{pdiv:W,replies:R}}function U(V,R,W,X,Z){function Y(){M(da);n.addReply(na,function(za){na.id=za;n.replies.push(na);S(da);W&&W()},function(za){ea();G(da);b.handleError(za,
null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))},X,Z)}function ea(){F(na,da,function(za){Y()},!0)}var fa=L().pdiv,na=b.newComment(V,b.getCurrentUser());na.pCommentId=n.id;null==n.replies&&(n.replies=[]);var da=J(na,n.replies,fa,A+1);R?ea():Y()}if(N||!n.isResolved){x.style.display="none";var g=document.createElement("div");g.className="geCommentContainer";g.setAttribute("data-commentId",n.id);g.style.marginLeft=20*A+5+"px";n.isResolved&&!Editor.isDarkMode()&&(g.style.backgroundColor=