Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
U();this.refreshComments=U;F=mxUtils.bind(this,function(){function N(y){var C=R[y.id];if(null!=C)for(E(y,C),C=0;null!=y.replies&&C<y.replies.length;C++)N(y.replies[C])}if(this.window.isVisible()){for(var P=v.querySelectorAll(".geCommentDate"),R={},M=0;M<P.length;M++){var p=P[M];R[p.getAttribute("data-commentId")]=p}for(M=0;M<S.length;M++)N(S[M])}});setInterval(F,6E4);this.refreshCommentsTime=F;this.window=new mxWindow(mxResources.get("comments"),q,e,f,c,k,!0,!0);this.window.minimumSize=new mxRectangle(0,