Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.defaultFonts[A];"string"===typeof N?z(N):null!=N.fontFamily&&null!=N.fontUrl&&(E[encodeURIComponent(N.fontFamily)+"@"+encodeURIComponent(N.fontUrl)]=!0,z(N.fontFamily,N.fontUrl))}l.addSeparator(n);if("1"!=urlParams["ext-fonts"]){N=function(H){var O=encodeURIComponent(H.name)+(null==H.url?"":"@"+encodeURIComponent(H.url));if(!E[O]){for(var P=H.name,V=0;null!=L[P.toLowerCase()];)P=H.name+" ("+ ++V+")";null==Q[O]&&(U.push({name:H.name,url:H.url,label:P,title:H.url}),L[P.toLowerCase()]=H,Q[O]=H)}};