Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(C=PROXY_URL+"?url="+encodeURIComponent(C));M(m,C)};Editor.prototype.embedCssFonts=function(m,C){var M=m.split("url("),ba=0;null==this.cachedFonts&&(this.cachedFonts={});var V=mxUtils.bind(this,function(){if(0==ba){for(var qa=[M[0]],ra=1;ra<M.length;ra++){var pa=M[ra].indexOf(")");qa.push('url("');qa.push(this.cachedFonts[Editor.trimCssUrl(M[ra].substring(0,pa))]);qa.push('"'+M[ra].substring(pa))}C(qa.join(""))}});if(0<M.length){for(m=1;m<M.length;m++){var Z=M[m].indexOf(")"),aa=null,ka=M[m].indexOf("format(",
Z);0<ka&&(aa=Editor.trimCssUrl(M[m].substring(ka+7,M[m].indexOf(")",ka))));mxUtils.bind(this,function(qa){if(null==this.cachedFonts[qa]){this.cachedFonts[qa]=qa;ba++;var ra="application/x-font-ttf";if("svg"==aa||/(\.svg)($|\?)/i.test(qa))ra="image/svg+xml";else if("otf"==aa||"embedded-opentype"==aa||/(\.otf)($|\?)/i.test(qa))ra="application/x-font-opentype";else if("woff"==aa||/(\.woff)($|\?)/i.test(qa))ra="application/font-woff";else if("woff2"==aa||/(\.woff2)($|\?)/i.test(qa))ra="application/font-woff2";
else if("eot"==aa||/(\.eot)($|\?)/i.test(qa))ra="application/vnd.ms-fontobject";else if("sfnt"==aa||/(\.sfnt)($|\?)/i.test(qa))ra="application/font-sfnt";this.mapFontUrl(ra,qa,mxUtils.bind(this,function(pa,wa){this.loadUrl(wa,mxUtils.bind(this,function(Da){this.cachedFonts[qa]=Da;ba--;V()}),mxUtils.bind(this,function(Da){ba--;V()}),!0,null,"data:"+pa+";charset=utf-8;base64,")}))}})(Editor.trimCssUrl(M[m].substring(0,Z)),aa)}V()}else C(m)};Editor.prototype.loadFonts=function(m){null!=this.fontCss&&