Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.prototype.addFontCss=function(g,y){y=null!=y?y:this.absoluteCssFonts(this.fontCss);if(null!=y){var H=g.getElementsByTagName("defs"),O=g.ownerDocument;0==H.length?(H=null!=O.createElementNS?O.createElementNS(mxConstants.NS_SVG,"defs"):O.createElement("defs"),null!=g.firstChild?g.insertBefore(H,g.firstChild):g.appendChild(H)):H=H[0];g=null!=O.createElementNS?O.createElementNS(mxConstants.NS_SVG,"style"):O.createElement("style");g.setAttribute("type","text/css");mxUtils.setTextContent(g,y);H.appendChild(g)}};