Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
E={},M=0;M<this.defaultFonts.length;M++){var k=this.defaultFonts[M];"string"===typeof k?D(k):null!=k.fontFamily&&null!=k.fontUrl&&(E[encodeURIComponent(k.fontFamily)+"@"+encodeURIComponent(k.fontUrl)]=!0,D(k.fontFamily,k.fontUrl))}f.addSeparator(u);if("1"!=urlParams["ext-fonts"]){k=function(R){var W=encodeURIComponent(R.name)+(null==R.url?"":"@"+encodeURIComponent(R.url));if(!E[W]){for(var X=R.name,Z=0;null!=F[X.toLowerCase()];)X=R.name+" ("+ ++Z+")";null==x[W]&&(Q.push({name:R.name,url:R.url,label:X,
title:R.url}),F[X.toLowerCase()]=R,x[W]=R)}};var x={},F={},Q=[];for(M=0;M<this.customFonts.length;M++)k(this.customFonts[M]);for(var N in Graph.recentCustomFonts)k(Graph.recentCustomFonts[N]);Q.sort(function(R,W){return R.label<W.label?-1:R.label>W.label?1:0});if(0<Q.length){for(M=0;M<Q.length;M++)D(Q[M].name,Q[M].url,!0,Q[M].label,Q[M].url);f.addSeparator(u)}f.addItem(mxResources.get("reset"),null,mxUtils.bind(this,function(){Graph.recentCustomFonts={};this.customFonts=[];d.fireEvent(new mxEventObject("customFontsChanged"))}),