Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.defaultFonts[G];"string"===typeof P?C(P):null!=P.fontFamily&&null!=P.fontUrl&&(J[encodeURIComponent(P.fontFamily)+"@"+encodeURIComponent(P.fontUrl)]=!0,C(P.fontFamily,P.fontUrl))}p.addSeparator(q);if("1"!=urlParams["ext-fonts"]){P=function(K){var R=encodeURIComponent(K.name)+(null==K.url?"":"@"+encodeURIComponent(K.url));if(!J[R]){for(var U=K.name,W=0;null!=N[U.toLowerCase()];)U=K.name+" ("+ ++W+")";null==O[R]&&(T.push({name:K.name,url:K.url,label:U,title:K.url}),N[U.toLowerCase()]=K,O[R]=K)}};