Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
	parse: function (text) {
		// not yet possible as we still return new type() JSON
		//		if (!(!(/[^,:{}\[\]0-9.\-+Eaeflnr-u \n\r\t]/.test(
		//		text.replace(/"(\\.|[^"\\])*"/g, '')))  ))
		//			throw new Error("Invalid characters in JSON parse string.");                 
		var regEx = /(\"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}.*?\")|(\"\\\/Date\(.*?\)\\\/")/g;
		text = text.replace(regEx, this.regExDate);
		return eval('(' + text + ')');
	},