Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
!this.isCorsEnabledForUrl(A)&&(A=PROXY_URL+"?url="+encodeURIComponent(A));N(l,A)};Editor.prototype.embedCssFonts=function(l,A){var N=l.split("url("),X=0;null==this.cachedFonts&&(this.cachedFonts={});var U=mxUtils.bind(this,function(){if(0==X){for(var qa=[N[0]],ra=1;ra<N.length;ra++){var pa=N[ra].indexOf(")");qa.push('url("');qa.push(this.cachedFonts[Editor.trimCssUrl(N[ra].substring(0,pa))]);qa.push('"'+N[ra].substring(pa))}A(qa.join(""))}});if(0<N.length){for(l=1;l<N.length;l++){var Z=N[l].indexOf(")"),
ba=null,ia=N[l].indexOf("format(",Z);0<ia&&(ba=Editor.trimCssUrl(N[l].substring(ia+7,N[l].indexOf(")",ia))));mxUtils.bind(this,function(qa){if(null==this.cachedFonts[qa]){this.cachedFonts[qa]=qa;X++;var ra="application/x-font-ttf";if("svg"==ba||/(\.svg)($|\?)/i.test(qa))ra="image/svg+xml";else if("otf"==ba||"embedded-opentype"==ba||/(\.otf)($|\?)/i.test(qa))ra="application/x-font-opentype";else if("woff"==ba||/(\.woff)($|\?)/i.test(qa))ra="application/font-woff";else if("woff2"==ba||/(\.woff2)($|\?)/i.test(qa))ra=
"application/font-woff2";else if("eot"==ba||/(\.eot)($|\?)/i.test(qa))ra="application/vnd.ms-fontobject";else if("sfnt"==ba||/(\.sfnt)($|\?)/i.test(qa))ra="application/font-sfnt";this.mapFontUrl(ra,qa,mxUtils.bind(this,function(pa,xa){this.loadUrl(xa,mxUtils.bind(this,function(Ca){this.cachedFonts[qa]=Ca;X--;U()}),mxUtils.bind(this,function(Ca){X--;U()}),!0,null,"data:"+pa+";charset=utf-8;base64,")}))}})(Editor.trimCssUrl(N[l].substring(0,Z)),ba)}U()}else A(l)};Editor.prototype.loadFonts=function(l){null!=