Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.defaultFonts[F];"string"===typeof O?C(O):null!=O.fontFamily&&null!=O.fontUrl&&(J[encodeURIComponent(O.fontFamily)+"@"+encodeURIComponent(O.fontUrl)]=!0,C(O.fontFamily,O.fontUrl))}p.addSeparator(q);if("1"!=urlParams["ext-fonts"]){O=function(M){var Q=encodeURIComponent(M.name)+(null==M.url?"":"@"+encodeURIComponent(M.url));if(!J[Q]){for(var U=M.name,W=0;null!=K[U.toLowerCase()];)U=M.name+" ("+ ++W+")";null==S[Q]&&(R.push({name:M.name,url:M.url,label:U,title:M.url}),K[U.toLowerCase()]=M,S[Q]=M)}};