Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
" "+Z.getStatus()})},X,this.timeout,function(){Q&&null!=G&&G({code:App.ERROR_TIMEOUT,retry:Y})},W)});Y()}catch(Z){null!=G&&G(Z)}};Editor.prototype.absoluteCssFonts=function(k){var y=null;if(null!=k){var G=k.split("url(");if(0<G.length){y=[G[0]];k=window.location.pathname;var P=null!=k?k.lastIndexOf("/"):-1;0<=P&&(k=k.substring(0,P+1));P=document.getElementsByTagName("base");var Q=null;null!=P&&0<P.length&&(Q=P[0].getAttribute("href"));for(var U=1;U<G.length;U++)if(P=G[U].indexOf(")"),0<P){var T=Editor.trimCssUrl(G[U].substring(0,
P));this.graph.isRelativeUrl(T)&&(T=null!=Q?Q+T:window.location.protocol+"//"+window.location.hostname+("/"==T.charAt(0)?"":k)+T);y.push('url("'+T+'"'+G[U].substring(P))}else y.push(G[U])}else y=[k]}return null!=y?y.join(""):null};Editor.prototype.mapFontUrl=function(k,y,G){/^https?:\/\//.test(y)&&!this.isCorsEnabledForUrl(y)&&(y=PROXY_URL+"?url="+encodeURIComponent(y));G(k,y)};Editor.prototype.embedCssFonts=function(k,y){var G=k.split("url("),P=0;null==this.cachedFonts&&(this.cachedFonts={});var Q=