Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
[J],"{1} ago"));C.setAttribute("title",q.toLocaleDateString()+" "+q.toLocaleTimeString())}function D(q){var C=document.createElement("img");C.className="geCommentBusyImg";C.src=IMAGE_PATH+"/spin.gif";q.appendChild(C);q.busyImg=C}function z(q){q.style.border="1px solid red";q.removeChild(q.busyImg)}function M(q){q.style.border="";q.removeChild(q.busyImg)}function I(q,C,J,G,P){function O(W,Q,V){var X=document.createElement("li");X.className="geCommentAction";var Y=document.createElement("a");Y.className=
"geCommentActionLnk";mxUtils.write(Y,W);X.appendChild(Y);mxEvent.addListener(Y,"click",function(Z){Q(Z,q);Z.preventDefault();mxEvent.consume(Z)});U.appendChild(X);V&&(X.style.display="none")}function N(){function W(X){Q.push(V);if(null!=X.replies)for(var Y=0;Y<X.replies.length;Y++)V=V.nextSibling,W(X.replies[Y])}var Q=[],V=m;W(q);return{pdiv:V,replies:Q}}function T(W,Q,V,X,Y){function Z(){D(ea);q.addReply(ma,function(za){ma.id=za;q.replies.push(ma);M(ea);V&&V()},function(za){ca();z(ea);b.handleError(za,