Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CommentsWindow=function(b,f,m,d,u,v){function E(){for(var n=t.getElementsByTagName("div"),z=0,C=0;C<n.length;C++)"none"!=n[C].style.display&&n[C].parentNode==t&&z++;x.style.display=0==z?"block":"none"}function F(n,z,C,D){function M(){z.removeChild(V);z.removeChild(k);O.style.display="block";K.style.display="block"}g={div:z,comment:n,saveCallback:C,deleteOnCancel:D};var K=z.querySelector(".geCommentTxt"),O=z.querySelector(".geCommentActionsList"),V=document.createElement("textarea");V.className=
"geCommentEditTxtArea";V.style.minHeight=K.offsetHeight+"px";V.value=n.content;z.insertBefore(V,K);var k=document.createElement("div");k.className="geCommentEditBtns";var y=mxUtils.button(mxResources.get("cancel"),function(){D?(z.parentNode.removeChild(z),E()):M();g=null});y.className="geCommentEditBtn";k.appendChild(y);var G=mxUtils.button(mxResources.get("save"),function(){K.innerText="";n.content=V.value;mxUtils.write(K,n.content);M();C(n);g=null});mxEvent.addListener(V,"keydown",mxUtils.bind(this,
function(P){mxEvent.isConsumed(P)||((mxEvent.isControlDown(P)||mxClient.IS_MAC&&mxEvent.isMetaDown(P))&&13==P.keyCode?(G.click(),mxEvent.consume(P)):27==P.keyCode&&(y.click(),mxEvent.consume(P)))}));G.focus();G.className="geCommentEditBtn gePrimaryBtn";k.appendChild(G);z.insertBefore(k,K);O.style.display="none";K.style.display="none";V.focus()}function L(n,z){z.innerText="";n=new Date(n.modifiedDate);var C=b.timeSince(n);null==C&&(C=mxResources.get("lessThanAMinute"));mxUtils.write(z,mxResources.get("timeAgo",