Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O=document.createElement("div");O.style.marginTop="6px";O.style.display="inline-block";O.style.width="140px";mxUtils.write(O,mxResources.get("siblingSpacing")+": ");K.appendChild(O);var P=document.createElement("input");P.type="number";P.value=D;P.style.width="200px";P.style.boxSizing="border-box";K.appendChild(P);mxEvent.addListener(P,"change",function(){D=P.value});O=mxUtils.button(mxResources.get("custom")+"...",function(){var Q=[{layout:"mxOrgChartLayout",config:{branchOptimizer:parseInt(V.value),
parentChildSpacing:parseInt(G.value),siblingSpacing:parseInt(P.value)}}];d.hideDialog();d.showCustomLayoutDialog(JSON.stringify(Q,null,2))});O.className="geBtn";K=new CustomDialog(d,K,function(){null==z&&(z=2);d.loadOrgChartLayouts(M)},null,null,null,O);d.showDialog(K.container,355,140,!0,!0)},n,null,v());l.addSeparator(n);l.addItem(mxResources.get("parallels"),null,mxUtils.bind(this,function(){d.tryAndHandle(mxUtils.bind(this,function(){var z=new mxParallelEdgeLayout(u);z.checkOverlap=!0;d.prompt(mxResources.get("spacing"),
z.spacing,mxUtils.bind(this,function(C){d.tryAndHandle(mxUtils.bind(this,function(){z.spacing=C;d.executeLayout(function(){z.execute(u.getDefaultParent(),u.isSelectionEmpty()?null:u.getSelectionCells())},!1)}))}))}))}),n);l.addSeparator(n);d.menus.addMenuItem(l,"runLayout",n,null,null,mxResources.get("custom")+"...")};this.put("help",new Menu(mxUtils.bind(this,function(l,n){if(!mxClient.IS_CHROMEAPP&&d.isOffline())this.addMenuItems(l,["about"],n);else{var z=l.addItem("Search:",null,null,n,null,null,