Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.graph.setShadowVisible("1"==l.getAttribute("shadow"),!1);if(B=l.getAttribute("extFonts"))try{for(B=B.split("|").map(function(U){U=U.split("^");return{name:U[0],url:U[1]}}),N=0;N<B.length;N++)this.graph.addExtFont(B[N].name,B[N].url)}catch(U){console.log("ExtFonts format error: "+U.message)}else null!=this.graph.extFonts&&0<this.graph.extFonts.length&&(this.graph.extFonts=[])}b.apply(this,arguments)}else throw{message:mxResources.get("notADiagramFile")||"Invalid data",toString:function(){return this.message}};