Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.addMenuItems(l,["-","close"])})));m.prototype.execute=function(){var l=this.ui.editor.graph;this.customFonts=this.prevCustomFonts;this.prevCustomFonts=this.ui.menus.customFonts;this.ui.fireEvent(new mxEventObject("customFontsChanged","customFonts",this.customFonts));this.extFonts=this.previousExtFonts;for(var n=l.extFonts,z=0;null!=n&&z<n.length;z++){var C=document.getElementById("extFont_"+n[z].name);null!=C&&C.parentNode.removeChild(C)}l.extFonts=[];for(z=0;null!=this.previousExtFonts&&z<this.previousExtFonts.length;z++)this.ui.editor.graph.addExtFont(this.previousExtFonts[z].name,
this.previousExtFonts[z].url);this.previousExtFonts=n};this.put("fontFamily",new Menu(mxUtils.bind(this,function(l,n){for(var z=mxUtils.bind(this,function(G,P,Q,U,T){var W=d.editor.graph;U=this.styleChange(l,U||G,"1"!=urlParams["ext-fonts"]?[mxConstants.STYLE_FONTFAMILY,"fontSource","FType"]:[mxConstants.STYLE_FONTFAMILY],"1"!=urlParams["ext-fonts"]?[G,null!=P?encodeURIComponent(P):null,null]:[G],null,n,function(){"1"!=urlParams["ext-fonts"]?W.setFont(G,P):(document.execCommand("fontname",!1,G),W.addExtFont(G,