Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
var V=null;null!=ba&&0<ba.length&&(V=ba[0].getAttribute("href"));for(var Z=1;Z<M.length;Z++)if(ba=M[Z].indexOf(")"),0<ba){var aa=Editor.trimCssUrl(M[Z].substring(0,ba));this.graph.isRelativeUrl(aa)&&(aa=null!=V?V+aa:window.location.protocol+"//"+window.location.hostname+("/"==aa.charAt(0)?"":m)+aa);C.push('url("'+aa+'"'+M[Z].substring(ba))}else C.push(M[Z])}else C=[m]}return null!=C?C.join(""):null};Editor.prototype.mapFontUrl=function(m,C,M){/^https?:\/\//.test(C)&&!this.isCorsEnabledForUrl(C)&&
(C=PROXY_URL+"?url="+encodeURIComponent(C));M(m,C)};Editor.prototype.embedCssFonts=function(m,C){var M=m.split("url("),ba=0;null==this.cachedFonts&&(this.cachedFonts={});var V=mxUtils.bind(this,function(){if(0==ba){for(var qa=[M[0]],ra=1;ra<M.length;ra++){var pa=M[ra].indexOf(")");qa.push('url("');qa.push(this.cachedFonts[Editor.trimCssUrl(M[ra].substring(0,pa))]);qa.push('"'+M[ra].substring(pa))}C(qa.join(""))}});if(0<M.length){for(m=1;m<M.length;m++){var Z=M[m].indexOf(")"),aa=null,ka=M[m].indexOf("format(",