Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var P=null;null!=M&&0<M.length&&(P=M[0].getAttribute("href"));for(var T=1;T<F.length;T++)if(M=F[T].indexOf(")"),0<M){var W=Editor.trimCssUrl(F[T].substring(0,M));this.graph.isRelativeUrl(W)&&(W=null!=P?P+W:window.location.protocol+"//"+window.location.hostname+("/"==W.charAt(0)?"":g)+W);x.push('url("'+W+'"'+F[T].substring(M))}else x.push(F[T])}else x=[g]}return null!=x?x.join(""):null};Editor.prototype.mapFontUrl=function(g,x,F){/^https?:\/\//.test(x)&&!this.isCorsEnabledForUrl(x)&&(x=PROXY_URL+"?url="+
encodeURIComponent(x));F(g,x)};Editor.prototype.embedCssFonts=function(g,x){var F=g.split("url("),M=0;null==this.cachedFonts&&(this.cachedFonts={});var P=mxUtils.bind(this,function(){if(0==M){for(var X=[F[0]],Z=1;Z<F.length;Z++){var Y=F[Z].indexOf(")");X.push('url("');X.push(this.cachedFonts[Editor.trimCssUrl(F[Z].substring(0,Y))]);X.push('"'+F[Z].substring(Y))}x(X.join(""))}});if(0<F.length){for(g=1;g<F.length;g++){var T=F[g].indexOf(")"),W=null,U=F[g].indexOf("format(",T);0<U&&(W=Editor.trimCssUrl(F[g].substring(U+