Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
W.type="number";W.value=P;W.style.width="200px";W.style.boxSizing="border-box";z.appendChild(W);mxEvent.addListener(W,"change",function(){P=W.value});I=mxUtils.button(mxResources.get("custom")+"...",function(){var X=[{layout:"mxOrgChartLayout",config:{branchOptimizer:parseInt(Q.value),parentChildSpacing:parseInt(O.value),siblingSpacing:parseInt(W.value)}}];c.hideDialog();c.showCustomLayoutDialog(JSON.stringify(X,null,2))});I.className="geBtn";z=new CustomDialog(c,z,function(){null==J&&(J=2);c.loadOrgChartLayouts(p)},