Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxUtils.write(ia,mxResources.get("timeAgo",[ma],"{1} ago"));ia.setAttribute("title",ca.toLocaleDateString()+" "+ca.toLocaleTimeString())}function G(ca){var ia=document.createElement("img");ia.className="geCommentBusyImg";ia.src=IMAGE_PATH+"/spin.gif";ca.appendChild(ia);ca.busyImg=ia}function L(ca){ca.style.border="1px solid red";ca.removeChild(ca.busyImg)}function R(ca){ca.style.border="";ca.removeChild(ca.busyImg)}function V(ca,ia,ma,aa,la){function X(Z,ba,ha){var qa=document.createElement("li");
qa.className="geCommentAction";var ra=document.createElement("a");ra.className="geCommentActionLnk";mxUtils.write(ra,Z);qa.appendChild(ra);mxEvent.addListener(ra,"click",function(pa){ba(pa,ca);pa.preventDefault();mxEvent.consume(pa)});T.appendChild(qa);ha&&(qa.style.display="none")}function P(){function Z(qa){ba.push(ha);if(null!=qa.replies)for(var ra=0;ra<qa.replies.length;ra++)ha=ha.nextSibling,Z(qa.replies[ra])}var ba=[],ha=k;Z(ca);return{pdiv:ha,replies:ba}}function U(Z,ba,ha,qa,ra){function pa(){G(za);