Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.prototype.addFontCss=function(m,B){B=null!=B?B:this.absoluteCssFonts(this.fontCss);if(null!=B){var K=m.getElementsByTagName("defs"),R=m.ownerDocument;0==K.length?(K=null!=R.createElementNS?R.createElementNS(mxConstants.NS_SVG,"defs"):R.createElement("defs"),null!=m.firstChild?m.insertBefore(K,m.firstChild):m.appendChild(K)):K=K[0];m=null!=R.createElementNS?R.createElementNS(mxConstants.NS_SVG,"style"):R.createElement("style");m.setAttribute("type","text/css");mxUtils.setTextContent(m,B);K.appendChild(m)}};