Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
G={},P=0;P<this.defaultFonts.length;P++){var p=this.defaultFonts[P];"string"===typeof p?J(p):null!=p.fontFamily&&null!=p.fontUrl&&(G[encodeURIComponent(p.fontFamily)+"@"+encodeURIComponent(p.fontUrl)]=!0,J(p.fontFamily,p.fontUrl))}l.addSeparator(y);if("1"!=urlParams["ext-fonts"]){p=function(O){var W=encodeURIComponent(O.name)+(null==O.url?"":"@"+encodeURIComponent(O.url));if(!G[W]){for(var X=O.name,Z=0;null!=I[X.toLowerCase()];)X=O.name+" ("+ ++Z+")";null==z[W]&&(Q.push({name:O.name,url:O.url,label:X,
title:O.url}),I[X.toLowerCase()]=O,z[W]=O)}};var z={},I={},Q=[];for(P=0;P<this.customFonts.length;P++)p(this.customFonts[P]);for(var N in Graph.recentCustomFonts)p(Graph.recentCustomFonts[N]);Q.sort(function(O,W){return O.label<W.label?-1:O.label>W.label?1:0});if(0<Q.length){for(P=0;P<Q.length;P++)J(Q[P].name,Q[P].url,!0,Q[P].label,Q[P].url);l.addSeparator(y)}l.addItem(mxResources.get("reset"),null,mxUtils.bind(this,function(){Graph.recentCustomFonts={};this.customFonts=[];c.fireEvent(new mxEventObject("customFontsChanged"))}),