Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
" "+Z.getStatus()})},X,this.timeout,function(){U&&null!=K&&K({code:App.ERROR_TIMEOUT,retry:Y})},V)});Y()}catch(Z){null!=K&&K(Z)}};Editor.prototype.absoluteCssFonts=function(m){var B=null;if(null!=m){var K=m.split("url(");if(0<K.length){B=[K[0]];m=window.location.pathname;var R=null!=m?m.lastIndexOf("/"):-1;0<=R&&(m=m.substring(0,R+1));R=document.getElementsByTagName("base");var U=null;null!=R&&0<R.length&&(U=R[0].getAttribute("href"));for(var W=1;W<K.length;W++)if(R=K[W].indexOf(")"),0<R){var Q=Editor.trimCssUrl(K[W].substring(0,
R));this.graph.isRelativeUrl(Q)&&(Q=null!=U?U+Q:window.location.protocol+"//"+window.location.hostname+("/"==Q.charAt(0)?"":m)+Q);B.push('url("'+Q+'"'+K[W].substring(R))}else B.push(K[W])}else B=[m]}return null!=B?B.join(""):null};Editor.prototype.mapFontUrl=function(m,B,K){/^https?:\/\//.test(B)&&!this.isCorsEnabledForUrl(B)&&(B=PROXY_URL+"?url="+encodeURIComponent(B));K(m,B)};Editor.prototype.embedCssFonts=function(m,B){var K=m.split("url("),R=0;null==this.cachedFonts&&(this.cachedFonts={});var U=