Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
qa.className="geCommentAction";var ra=document.createElement("a");ra.className="geCommentActionLnk";mxUtils.write(ra,aa);qa.appendChild(ra);mxEvent.addListener(ra,"click",function(pa){Y(pa,ca);pa.preventDefault();mxEvent.consume(pa)});U.appendChild(qa);ka&&(qa.style.display="none")}function P(){function aa(qa){Y.push(ka);if(null!=qa.replies)for(var ra=0;ra<qa.replies.length;ra++)ka=ka.nextSibling,aa(qa.replies[ra])}var Y=[],ka=l;aa(ca);return{pdiv:ka,replies:Y}}function V(aa,Y,ka,qa,ra){function pa(){F(ya);
ca.addReply(Ba,function(Oa){Ba.id=Oa;ca.replies.push(Ba);R(ya);ka&&ka()},function(Oa){wa();K(ya);b.handleError(Oa,null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))},qa,ra)}function wa(){M(Ba,ya,function(Oa){pa()},!0)}var Ca=P().pdiv,Ba=b.newComment(aa,b.getCurrentUser());Ba.pCommentId=ca.id;null==ca.replies&&(ca.replies=[]);var ya=W(Ba,ca.replies,Ca,ba+1);Y?wa():pa()}if(S||!ca.isResolved){H.style.display="none";var l=document.createElement("div");l.className="geCommentContainer";