Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(g){if(null!=g){Editor.prototype.fontCss=g;var x=document.getElementsByTagName("script")[0];if(null!=x&&null!=x.parentNode){var F=document.createElement("style");F.setAttribute("type","text/css");F.appendChild(document.createTextNode(g));x.parentNode.insertBefore(F,x);g=g.split("url(");for(F=1;F<g.length;F++){var M=g[F].indexOf(")");M=Editor.trimCssUrl(g[F].substring(0,M));var P=document.createElement("link");P.setAttribute("rel","preload");P.setAttribute("href",M);P.setAttribute("as","font");
P.setAttribute("crossorigin","");x.parentNode.insertBefore(P,x)}}}};Editor.trimCssUrl=function(g){return g.replace(RegExp("^[\\s\"']+","g"),"").replace(RegExp("[\\s\"']+$","g"),"")};Editor.GOOGLE_FONTS="https://fonts.googleapis.com/css?family=";Editor.GUID_ALPHABET="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_";Editor.GUID_LENGTH=20;Editor.guid=function(g){g=null!=g?g:Editor.GUID_LENGTH;for(var x=[],F=0;F<g;F++)x.push(Editor.GUID_ALPHABET.charAt(Math.floor(Math.random()*Editor.GUID_ALPHABET.length)));