Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ea&&1==Va.length){I.view.validate();var ta=new mxHierarchicalLayout(I,"horizontalflow"==ea?mxConstants.DIRECTION_WEST:mxConstants.DIRECTION_NORTH);ta.intraCellSpacing=T;ta.parallelEdgeSpacing=U;ta.interRankCellSpacing=W;ta.disableEdgeStyle=!1;this.executeLayout(function(){ta.execute(I.getDefaultParent(),Ua);I.moveCells(Ua,ca,ha)},!0,Y);Y=null}else if("orgchart"==ea){I.view.validate();var La=new mxOrgChartLayout(I,2,W,T),Ga=La.isVertexIgnored;La.isVertexIgnored=function(Ma){return Ga.apply(this,arguments)||
0>mxUtils.indexOf(t,Ma)};this.executeLayout(function(){La.execute(I.getDefaultParent());ma()},!0,Y);Y=null}else if("organic"==ea||"auto"==ea&&Ua.length>t.length){I.view.validate();var ya=new mxFastOrganicLayout(I);ya.forceConstant=3*T;ya.disableEdgeStyle=!1;ya.resetEdges=!1;var Ja=ya.isVertexIgnored;ya.isVertexIgnored=function(Ma){return Ja.apply(this,arguments)||0>mxUtils.indexOf(t,Ma)};this.executeLayout(function(){ya.execute(I.getDefaultParent());ma()},!0,Y);Y=null}}this.hideDialog()}finally{I.model.endUpdate()}null!=