Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
[C],"{1} ago"));z.setAttribute("title",n.toLocaleDateString()+" "+n.toLocaleTimeString())}function N(n){var z=document.createElement("img");z.className="geCommentBusyImg";z.src=IMAGE_PATH+"/spin.gif";n.appendChild(z);n.busyImg=z}function H(n){n.style.border="1px solid red";n.removeChild(n.busyImg)}function R(n){n.style.border="";n.removeChild(n.busyImg)}function J(n,z,C,D,M){function K(U,T,W){var X=document.createElement("li");X.className="geCommentAction";var Y=document.createElement("a");Y.className=
"geCommentActionLnk";mxUtils.write(Y,U);X.appendChild(Y);mxEvent.addListener(Y,"click",function(Z){T(Z,n);Z.preventDefault();mxEvent.consume(Z)});Q.appendChild(X);W&&(X.style.display="none")}function O(){function U(X){T.push(W);if(null!=X.replies)for(var Y=0;Y<X.replies.length;Y++)W=W.nextSibling,U(X.replies[Y])}var T=[],W=k;U(n);return{pdiv:W,replies:T}}function V(U,T,W,X,Y){function Z(){N(ea);n.addReply(na,function(za){na.id=za;n.replies.push(na);R(ea);W&&W()},function(za){ca();H(ea);b.handleError(za,