Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.addMenuItems(l,["-","close"])})));m.prototype.execute=function(){var l=this.ui.editor.graph;this.customFonts=this.prevCustomFonts;this.prevCustomFonts=this.ui.menus.customFonts;this.ui.fireEvent(new mxEventObject("customFontsChanged","customFonts",this.customFonts));this.extFonts=this.previousExtFonts;for(var n=l.extFonts,z=0;null!=n&&z<n.length;z++){var E=document.getElementById("extFont_"+n[z].name);null!=E&&E.parentNode.removeChild(E)}l.extFonts=[];for(z=0;null!=this.previousExtFonts&&z<this.previousExtFonts.length;z++)this.ui.editor.graph.addExtFont(this.previousExtFonts[z].name,
this.previousExtFonts[z].url);this.previousExtFonts=n};this.put("fontFamily",new Menu(mxUtils.bind(this,function(l,n){for(var z=mxUtils.bind(this,function(H,O,P,V,R){var W=d.editor.graph;V=this.styleChange(l,V||H,"1"!=urlParams["ext-fonts"]?[mxConstants.STYLE_FONTFAMILY,"fontSource","FType"]:[mxConstants.STYLE_FONTFAMILY],"1"!=urlParams["ext-fonts"]?[H,null!=O?encodeURIComponent(O):null,null]:[H],null,n,function(){"1"!=urlParams["ext-fonts"]?W.setFont(H,O):(document.execCommand("fontname",!1,H),W.addExtFont(H,