Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ea&&1==Va.length){L.view.validate();var wa=new mxHierarchicalLayout(L,"horizontalflow"==ea?mxConstants.DIRECTION_WEST:mxConstants.DIRECTION_NORTH);wa.intraCellSpacing=Q;wa.parallelEdgeSpacing=W;wa.interRankCellSpacing=V;wa.disableEdgeStyle=!1;this.executeLayout(function(){wa.execute(L.getDefaultParent(),Ua);L.moveCells(Ua,ca,da)},!0,Y);Y=null}else if("orgchart"==ea){L.view.validate();var Ma=new mxOrgChartLayout(L,2,V,Q),Ia=Ma.isVertexIgnored;Ma.isVertexIgnored=function(Na){return Ia.apply(this,arguments)||
0>mxUtils.indexOf(v,Na)};this.executeLayout(function(){Ma.execute(L.getDefaultParent());na()},!0,Y);Y=null}else if("organic"==ea||"auto"==ea&&Ua.length>v.length){L.view.validate();var Aa=new mxFastOrganicLayout(L);Aa.forceConstant=3*Q;Aa.disableEdgeStyle=!1;Aa.resetEdges=!1;var Ja=Aa.isVertexIgnored;Aa.isVertexIgnored=function(Na){return Ja.apply(this,arguments)||0>mxUtils.indexOf(v,Na)};this.executeLayout(function(){Aa.execute(L.getDefaultParent());na()},!0,Y);Y=null}}this.hideDialog()}finally{L.model.endUpdate()}null!=