Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
  function formatComments(comments) {
    const headline = `<h2>${t('Responses')}</h2>`;
    const markup = comments
      .map((c) => {
        const image = reactImage(c, true);

        let source = entities(c.url.split('/')[2]);
        if (c.author && c.author.name) {
          source = entities(c.author.name);
        }
        const link = `<a class="source" rel="nofollow ugc" href="${c[mentionSource]}">${source}</a>`;

        let linkclass = "name";
        let linktext = `(${t("mention")})`;
        if (c.name) {
          linkclass = "name";
          linktext = c.name;
        } else if (c.content && c.content.text) {
          linkclass = "text";
          linktext = extractComment(c);
        }

        const type = `<span class="${linkclass}">${linktext}</span>`;

        return `<li>${image} ${link} ${type}</li>`;
      })
    .join('');
    return `
      ${headline}
      <ul class="comments">${markup}</ul>
    `;
  }