Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!f||X(mxResources.get("reply"),function(){U("",!0)},ca.isResolved);J=b.getCurrentUser();null==J||J.id!=ca.user.id||d||ca.isLocked||(X(mxResources.get("edit"),function(){function Z(){K(ca,k,function(){G(k);ca.editComment(ca.content,function(){R(k)},function(ba){L(k);Z();b.handleError(ba,null,null,null,mxUtils.htmlEntities(mxResources.get("objectNotFound")))})})}Z()},ca.isResolved),X(mxResources.get("delete"),function(){b.confirm(mxResources.get("areYouSure"),function(){G(k);ca.deleteComment(function(Z){if(!0===