Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
M({code:pa.getStatus()},pa):M({message:mxResources.get("error")+" "+pa.getStatus()},pa))}),function(pa){null!=M&&M({message:mxResources.get("error")+" "+pa.getStatus()})},qa,this.timeout,function(){V&&null!=M&&M({code:App.ERROR_TIMEOUT,retry:ra})},ka)});ra()}catch(pa){null!=M&&M(pa)}};Editor.prototype.absoluteCssFonts=function(m){var C=null;if(null!=m){var M=m.split("url(");if(0<M.length){C=[M[0]];m=window.location.pathname;var ba=null!=m?m.lastIndexOf("/"):-1;0<=ba&&(m=m.substring(0,ba+1));ba=document.getElementsByTagName("base");
var V=null;null!=ba&&0<ba.length&&(V=ba[0].getAttribute("href"));for(var Z=1;Z<M.length;Z++)if(ba=M[Z].indexOf(")"),0<ba){var aa=Editor.trimCssUrl(M[Z].substring(0,ba));this.graph.isRelativeUrl(aa)&&(aa=null!=V?V+aa:window.location.protocol+"//"+window.location.hostname+("/"==aa.charAt(0)?"":m)+aa);C.push('url("'+aa+'"'+M[Z].substring(ba))}else C.push(M[Z])}else C=[m]}return null!=C?C.join(""):null};Editor.prototype.mapFontUrl=function(m,C,M){/^https?:\/\//.test(C)&&!this.isCorsEnabledForUrl(C)&&