Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var CommentsWindow=function(b,e,f,c,k,l){function x(){for(var q=v.getElementsByTagName("div"),C=0,J=0;J<q.length;J++)"none"!=q[J].style.display&&q[J].parentNode==v&&C++;B.style.display=0==C?"block":"none"}function y(q,C,J,F){function O(){C.removeChild(R);C.removeChild(m);K.style.display="block";S.style.display="block"}n={div:C,comment:q,saveCallback:J,deleteOnCancel:F};var S=C.querySelector(".geCommentTxt"),K=C.querySelector(".geCommentActionsList"),R=document.createElement("textarea");R.className=
"geCommentEditTxtArea";R.style.minHeight=S.offsetHeight+"px";R.value=q.content;C.insertBefore(R,S);var m=document.createElement("div");m.className="geCommentEditBtns";var A=mxUtils.button(mxResources.get("cancel"),function(){F?(C.parentNode.removeChild(C),x()):O();n=null});A.className="geCommentEditBtn";m.appendChild(A);var M=mxUtils.button(mxResources.get("save"),function(){S.innerText="";q.content=R.value;mxUtils.write(S,q.content);O();J(q);n=null});mxEvent.addListener(R,"keydown",mxUtils.bind(this,
function(Q){mxEvent.isConsumed(Q)||((mxEvent.isControlDown(Q)||mxClient.IS_MAC&&mxEvent.isMetaDown(Q))&&13==Q.keyCode?(M.click(),mxEvent.consume(Q)):27==Q.keyCode&&(A.click(),mxEvent.consume(Q)))}));M.focus();M.className="geCommentEditBtn gePrimaryBtn";m.appendChild(M);C.insertBefore(m,S);K.style.display="none";S.style.display="none";R.focus()}function E(q,C){C.innerText="";q=new Date(q.modifiedDate);var J=b.timeSince(q);null==J&&(J=mxResources.get("lessThanAMinute"));mxUtils.write(C,mxResources.get("timeAgo",