Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    function renderScmInstance(instance) {

        return '<li class="instance">'
                + '<div title="' + instance.revision + '" class="revision"><span>Revision: </span>' + '<a href="' + instance.locator + '">' + instance.revision + '</a>' + ' </div>'
                + '<div class="usercomment wraptext">' + parseComment(instance.comment) + '</div>'
                + '<div class="author">'
                + '<p>' + _.escape(instance.user) + ' </p>'
                + '<p>' + instance.modified_time + '</p>'
                + '</div>'
                + '</li>';
    }