Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"change",function(){G=O.value});I=document.createElement("div");I.style.marginTop="6px";I.style.display="inline-block";I.style.width="140px";mxUtils.write(I,mxResources.get("siblingSpacing")+": ");z.appendChild(I);var W=document.createElement("input");W.type="number";W.value=P;W.style.width="200px";W.style.boxSizing="border-box";z.appendChild(W);mxEvent.addListener(W,"change",function(){P=W.value});I=mxUtils.button(mxResources.get("custom")+"...",function(){var X=[{layout:"mxOrgChartLayout",config:{branchOptimizer:parseInt(Q.value),
parentChildSpacing:parseInt(O.value),siblingSpacing:parseInt(W.value)}}];c.hideDialog();c.showCustomLayoutDialog(JSON.stringify(X,null,2))});I.className="geBtn";z=new CustomDialog(c,z,function(){null==J&&(J=2);c.loadOrgChartLayouts(p)},null,null,null,I);c.showDialog(z.container,355,140,!0,!0)},y,null,m());l.addSeparator(y);l.addItem(mxResources.get("parallels"),null,mxUtils.bind(this,function(){c.tryAndHandle(mxUtils.bind(this,function(){var J=new mxParallelEdgeLayout(k);J.checkOverlap=!0;c.prompt(mxResources.get("spacing"),
J.spacing,mxUtils.bind(this,function(G){c.tryAndHandle(mxUtils.bind(this,function(){J.spacing=G;c.executeLayout(function(){J.execute(k.getDefaultParent(),k.isSelectionEmpty()?null:k.getSelectionCells())},!1)}))}))}))}),y);l.addSeparator(y);c.menus.addMenuItem(l,"runLayout",y,null,null,mxResources.get("custom")+"...")};this.put("help",new Menu(mxUtils.bind(this,function(l,y){if(!mxClient.IS_CHROMEAPP&&c.isOffline())this.addMenuItems(l,["about"],y);else{var J=l.addItem("Search:",null,null,y,null,null,