Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.defaultFonts[D];"string"===typeof M?z(M):null!=M.fontFamily&&null!=M.fontUrl&&(C[encodeURIComponent(M.fontFamily)+"@"+encodeURIComponent(M.fontUrl)]=!0,z(M.fontFamily,M.fontUrl))}l.addSeparator(n);if("1"!=urlParams["ext-fonts"]){M=function(G){var P=encodeURIComponent(G.name)+(null==G.url?"":"@"+encodeURIComponent(G.url));if(!C[P]){for(var Q=G.name,U=0;null!=O[Q.toLowerCase()];)Q=G.name+" ("+ ++U+")";null==K[P]&&(V.push({name:G.name,url:G.url,label:Q,title:G.url}),O[Q.toLowerCase()]=G,K[P]=G)}};