Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.addExtFont=function(b,e,g){if(b&&e){"1"!=urlParams["ext-fonts"]&&(Graph.recentCustomFonts[b.toLowerCase()]={name:b,url:e});var p="extFont_"+b;if(null==document.getElementById(p))if(0==e.indexOf(Editor.GOOGLE_FONTS))mxClient.link("stylesheet",e,null,p);else{document.getElementsByTagName("head");var y=document.createElement("style");y.appendChild(document.createTextNode('@font-face {\n\tfont-family: "'+b+'";\n\tsrc: url("'+e+'");\n}'));y.setAttribute("id",p);document.getElementsByTagName("head")[0].appendChild(y)}if(!g){null==
this.extFonts&&(this.extFonts=[]);g=this.extFonts;p=!0;for(y=0;y<g.length;y++)if(g[y].name==b){p=!1;break}p&&this.extFonts.push({name:b,url:e})}}};