Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null==this.cachedGoogleFonts[ka]?(Z++,this.loadUrl(ka,mxUtils.bind(this,function(qa){this.cachedGoogleFonts[ka]=qa;N.push(qa+"\n");Z--;U()}),mxUtils.bind(this,function(qa){Z--;N.push("@import url("+ka+");\n");U()}))):N.push(this.cachedGoogleFonts[ka]+"\n"):N.push('@font-face {font-family: "'+Y+'";src: url("'+ka+'")}\n')})(B[aa].name,B[aa].url);U()}else l()};Editor.prototype.addMathCss=function(l){l=l.getElementsByTagName("defs");if(null!=l&&0<l.length)for(var B=document.getElementsByTagName("style"),
N=0;N<B.length;N++){var Z=mxUtils.getTextContent(B[N]);0>Z.indexOf("mxPageSelector")&&0<Z.indexOf("MathJax")&&l[0].appendChild(B[N].cloneNode(!0))}};Editor.prototype.addFontCss=function(l,B){B=null!=B?B:this.absoluteCssFonts(this.fontCss);if(null!=B){var N=l.getElementsByTagName("defs"),Z=l.ownerDocument;0==N.length?(N=null!=Z.createElementNS?Z.createElementNS(mxConstants.NS_SVG,"defs"):Z.createElement("defs"),null!=l.firstChild?l.insertBefore(N,l.firstChild):l.appendChild(N)):N=N[0];l=null!=Z.createElementNS?