Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(R){mxEvent.isConsumed(R)||((mxEvent.isControlDown(R)||mxClient.IS_MAC&&mxEvent.isMetaDown(R))&&13==R.keyCode?(K.click(),mxEvent.consume(R)):27==R.keyCode&&(B.click(),mxEvent.consume(R)))}));K.focus();K.className="geCommentEditBtn gePrimaryBtn";m.appendChild(K);C.insertBefore(m,O);N.style.display="none";O.style.display="none";T.focus()}function E(q,C){C.innerText="";q=new Date(q.modifiedDate);var J=b.timeSince(q);null==J&&(J=mxResources.get("lessThanAMinute"));mxUtils.write(C,mxResources.get("timeAgo",
[J],"{1} ago"));C.setAttribute("title",q.toLocaleDateString()+" "+q.toLocaleTimeString())}function D(q){var C=document.createElement("img");C.className="geCommentBusyImg";C.src=IMAGE_PATH+"/spin.gif";q.appendChild(C);q.busyImg=C}function z(q){q.style.border="1px solid red";q.removeChild(q.busyImg)}function M(q){q.style.border="";q.removeChild(q.busyImg)}function I(q,C,J,G,P){function O(W,Q,V){var X=document.createElement("li");X.className="geCommentAction";var Y=document.createElement("a");Y.className=