Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"change",function(){E=R.value});F=document.createElement("div");F.style.marginTop="6px";F.style.display="inline-block";F.style.width="140px";mxUtils.write(F,mxResources.get("siblingSpacing")+": ");x.appendChild(F);var W=document.createElement("input");W.type="number";W.value=M;W.style.width="200px";W.style.boxSizing="border-box";x.appendChild(W);mxEvent.addListener(W,"change",function(){M=W.value});F=mxUtils.button(mxResources.get("custom")+"...",function(){var X=[{layout:"mxOrgChartLayout",config:{branchOptimizer:parseInt(Q.value),
parentChildSpacing:parseInt(R.value),siblingSpacing:parseInt(W.value)}}];d.hideDialog();d.showCustomLayoutDialog(JSON.stringify(X,null,2))});F.className="geBtn";x=new CustomDialog(d,x,function(){null==D&&(D=2);d.loadOrgChartLayouts(k)},null,null,null,F);d.showDialog(x.container,355,140,!0,!0)},u,null,v());f.addSeparator(u);f.addItem(mxResources.get("parallels"),null,mxUtils.bind(this,function(){d.tryAndHandle(mxUtils.bind(this,function(){var D=new mxParallelEdgeLayout(q);D.checkOverlap=!0;d.prompt(mxResources.get("spacing"),
D.spacing,mxUtils.bind(this,function(E){d.tryAndHandle(mxUtils.bind(this,function(){D.spacing=E;d.executeLayout(function(){D.execute(q.getDefaultParent(),q.isSelectionEmpty()?null:q.getSelectionCells())},!1)}))}))}))}),u);f.addSeparator(u);d.menus.addMenuItem(f,"runLayout",u,null,null,mxResources.get("custom")+"...")};this.put("help",new Menu(mxUtils.bind(this,function(f,u){if(!mxClient.IS_CHROMEAPP&&d.isOffline())this.addMenuItems(f,["about"],u);else{var D=f.addItem("Search:",null,null,u,null,null,