Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.addExtFont=function(b,e,g){if(b&&e){"1"!=urlParams["ext-fonts"]&&(Graph.recentCustomFonts[b.toLowerCase()]={name:b,url:e});var p="extFont_"+b;if(null==document.getElementById(p))if(0==e.indexOf(Editor.GOOGLE_FONTS))mxClient.link("stylesheet",e,null,p);else{document.getElementsByTagName("head");var y=document.createElement("style");y.appendChild(document.createTextNode('@font-face {\n\tfont-family: "'+b+'";\n\tsrc: url("'+e+'");\n}'));y.setAttribute("id",p);document.getElementsByTagName("head")[0].appendChild(y)}if(!g){null==
this.extFonts&&(this.extFonts=[]);g=this.extFonts;p=!0;for(y=0;y<g.length;y++)if(g[y].name==b){p=!1;break}p&&this.extFonts.push({name:b,url:e})}}};