Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
l();this.refreshComments=l;B=mxUtils.bind(this,function(){function n(K){var O=C[K.id];if(null!=O)for(L(K,O),O=0;null!=K.replies&&O<K.replies.length;O++)n(K.replies[O])}if(this.window.isVisible()){for(var z=t.querySelectorAll(".geCommentDate"),C={},D=0;D<z.length;D++){var M=z[D];C[M.getAttribute("data-commentId")]=M}for(D=0;D<S.length;D++)n(S[D])}});setInterval(B,6E4);this.refreshCommentsTime=B;this.window=new mxWindow(mxResources.get("comments"),q,f,m,d,u,!0,!0);this.window.minimumSize=new mxRectangle(0,