Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.addMenuItems(l,["-","close"])})));f.prototype.execute=function(){var l=this.ui.editor.graph;this.customFonts=this.prevCustomFonts;this.prevCustomFonts=this.ui.menus.customFonts;this.ui.fireEvent(new mxEventObject("customFontsChanged","customFonts",this.customFonts));this.extFonts=this.previousExtFonts;for(var y=l.extFonts,J=0;null!=y&&J<y.length;J++){var G=document.getElementById("extFont_"+y[J].name);null!=G&&G.parentNode.removeChild(G)}l.extFonts=[];for(J=0;null!=this.previousExtFonts&&J<this.previousExtFonts.length;J++)this.ui.editor.graph.addExtFont(this.previousExtFonts[J].name,
this.previousExtFonts[J].url);this.previousExtFonts=y};this.put("fontFamily",new Menu(mxUtils.bind(this,function(l,y){for(var J=mxUtils.bind(this,function(O,W,X,Z,Y){var ba=c.editor.graph;Z=this.styleChange(l,Z||O,"1"!=urlParams["ext-fonts"]?[mxConstants.STYLE_FONTFAMILY,"fontSource","FType"]:[mxConstants.STYLE_FONTFAMILY],"1"!=urlParams["ext-fonts"]?[O,null!=W?encodeURIComponent(W):null,null]:[O],null,y,function(){"1"!=urlParams["ext-fonts"]?ba.setFont(O,W):(document.execCommand("fontname",!1,O),