Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M({code:pa.getStatus()},pa):M({message:mxResources.get("error")+" "+pa.getStatus()},pa))}),function(pa){null!=M&&M({message:mxResources.get("error")+" "+pa.getStatus()})},qa,this.timeout,function(){V&&null!=M&&M({code:App.ERROR_TIMEOUT,retry:ra})},ka)});ra()}catch(pa){null!=M&&M(pa)}};Editor.prototype.absoluteCssFonts=function(m){var C=null;if(null!=m){var M=m.split("url(");if(0<M.length){C=[M[0]];m=window.location.pathname;var ba=null!=m?m.lastIndexOf("/"):-1;0<=ba&&(m=m.substring(0,ba+1));ba=document.getElementsByTagName("base");