Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.addMenuItems(p,["-","close"])})));f.prototype.execute=function(){var p=this.ui.editor.graph;this.customFonts=this.prevCustomFonts;this.prevCustomFonts=this.ui.menus.customFonts;this.ui.fireEvent(new mxEventObject("customFontsChanged","customFonts",this.customFonts));this.extFonts=this.previousExtFonts;for(var q=p.extFonts,C=0;null!=q&&C<q.length;C++){var J=document.getElementById("extFont_"+q[C].name);null!=J&&J.parentNode.removeChild(J)}p.extFonts=[];for(C=0;null!=this.previousExtFonts&&C<this.previousExtFonts.length;C++)this.ui.editor.graph.addExtFont(this.previousExtFonts[C].name,
this.previousExtFonts[C].url);this.previousExtFonts=q};this.put("fontFamily",new Menu(mxUtils.bind(this,function(p,q){for(var C=mxUtils.bind(this,function(K,R,U,W,Q){var V=c.editor.graph;W=this.styleChange(p,W||K,"1"!=urlParams["ext-fonts"]?[mxConstants.STYLE_FONTFAMILY,"fontSource","FType"]:[mxConstants.STYLE_FONTFAMILY],"1"!=urlParams["ext-fonts"]?[K,null!=R?encodeURIComponent(R):null,null]:[K],null,q,function(){"1"!=urlParams["ext-fonts"]?V.setFont(K,R):(document.execCommand("fontname",!1,K),V.addExtFont(K,