Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CommentsWindow=function(b,e,f,c,k,l){function x(){for(var q=v.getElementsByTagName("div"),C=0,J=0;J<q.length;J++)"none"!=q[J].style.display&&q[J].parentNode==v&&C++;A.style.display=0==C?"block":"none"}function y(q,C,J,G){function P(){C.removeChild(T);C.removeChild(m);N.style.display="block";O.style.display="block"}n={div:C,comment:q,saveCallback:J,deleteOnCancel:G};var O=C.querySelector(".geCommentTxt"),N=C.querySelector(".geCommentActionsList"),T=document.createElement("textarea");T.className=
"geCommentEditTxtArea";T.style.minHeight=O.offsetHeight+"px";T.value=q.content;C.insertBefore(T,O);var m=document.createElement("div");m.className="geCommentEditBtns";var B=mxUtils.button(mxResources.get("cancel"),function(){G?(C.parentNode.removeChild(C),x()):P();n=null});B.className="geCommentEditBtn";m.appendChild(B);var K=mxUtils.button(mxResources.get("save"),function(){O.innerText="";q.content=T.value;mxUtils.write(O,q.content);P();J(q);n=null});mxEvent.addListener(T,"keydown",mxUtils.bind(this,
function(R){mxEvent.isConsumed(R)||((mxEvent.isControlDown(R)||mxClient.IS_MAC&&mxEvent.isMetaDown(R))&&13==R.keyCode?(K.click(),mxEvent.consume(R)):27==R.keyCode&&(B.click(),mxEvent.consume(R)))}));K.focus();K.className="geCommentEditBtn gePrimaryBtn";m.appendChild(K);C.insertBefore(m,O);N.style.display="none";O.style.display="none";T.focus()}function E(q,C){C.innerText="";q=new Date(q.modifiedDate);var J=b.timeSince(q);null==J&&(J=mxResources.get("lessThanAMinute"));mxUtils.write(C,mxResources.get("timeAgo",