Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"geCommentActionLnk";mxUtils.write(Y,W);X.appendChild(Y);mxEvent.addListener(Y,"click",function(Z){P(Z,q);Z.preventDefault();mxEvent.consume(Z)});U.appendChild(X);V&&(X.style.display="none")}function K(){function W(X){P.push(V);if(null!=X.replies)for(var Y=0;Y<X.replies.length;Y++)V=V.nextSibling,W(X.replies[Y])}var P=[],V=m;W(q);return{pdiv:V,replies:P}}function R(W,P,V,X,Y){function Z(){D(ea);q.addReply(ma,function(za){ma.id=za;q.replies.push(ma);N(ea);V&&V()},function(za){da();z(ea);b.handleError(za,
null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))},X,Y)}function da(){y(ma,ea,function(za){Z()},!0)}var ba=K().pdiv,ma=b.newComment(W,b.getCurrentUser());ma.pCommentId=q.id;null==q.replies&&(q.replies=[]);var ea=I(ma,q.replies,ba,F+1);P?da():Z()}if(O||!q.isResolved){B.style.display="none";var m=document.createElement("div");m.className="geCommentContainer";m.setAttribute("data-commentId",q.id);m.style.marginLeft=20*F+5+"px";q.isResolved&&!Editor.isDarkMode()&&(m.style.backgroundColor=