Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    function parseCommentForTooltip(comment) {
        if (/"TYPE":"PACKAGE_MATERIAL"/.test(comment)) {
            var comment_tooltip = "";
            var comment_map = JSON.parse(comment);
            var package_comment = comment_map['COMMENT'];
            var trackback_url = comment_map['TRACKBACK_URL'];
            if (typeof package_comment !== "undefined" || package_comment != null) {
                comment_tooltip = package_comment + "\n";
            }
            if (typeof trackback_url !== "undefined" || trackback_url != null) {
                return comment_tooltip + "Trackback: " + trackback_url;
            }
            return comment_tooltip + "Trackback: " + "Not Provided";
        }
        return _.escape(comment);
    }