Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxUtils.htmlEntities(mxResources.get("error")+(ma&&ma.message?": "+ma.message:""));this.hasError=!0})):C.innerHTML=mxUtils.htmlEntities(mxResources.get("error"))});fa();this.refreshComments=fa;K=mxUtils.bind(this,function(){function ca(da){var P=ma[da.id];if(null!=P)for(T(da,P),P=0;null!=da.replies&&P<da.replies.length;P++)ca(da.replies[P])}if(this.window.isVisible()){for(var ja=C.querySelectorAll(".geCommentDate"),ma={},aa=0;aa<ja.length;aa++){var S=ja[aa];ma[S.getAttribute("data-commentId")]=S}for(aa=