Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(null!=B&&null!=B.parentNode){var N=document.createElement("style");N.setAttribute("type","text/css");N.appendChild(document.createTextNode(l));B.parentNode.insertBefore(N,B);l=l.split("url(");for(N=1;N<l.length;N++){var Z=l[N].indexOf(")");Z=Editor.trimCssUrl(l[N].substring(0,Z));var U=document.createElement("link");U.setAttribute("rel","preload");U.setAttribute("href",Z);U.setAttribute("as","font");U.setAttribute("crossorigin","");B.parentNode.insertBefore(U,B)}}}};Editor.trimCssUrl=function(l){return l.replace(RegExp("^[\\s\"']+",
"g"),"").replace(RegExp("[\\s\"']+$","g"),"")};Editor.GOOGLE_FONTS="https://fonts.googleapis.com/css?family=";Editor.GUID_ALPHABET="0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ-_";Editor.GUID_LENGTH=20;Editor.guid=function(l){l=null!=l?l:Editor.GUID_LENGTH;for(var B=[],N=0;N<l;N++)B.push(Editor.GUID_ALPHABET.charAt(Math.floor(Math.random()*Editor.GUID_ALPHABET.length)));return B.join("")};Editor.updateStatusInterval=1E4;Editor.prototype.appName="diagrams.net";Editor.prototype.diagramFileTypes=