Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
g+'";\nsrc: url("'+x+'");\n}'),g=document.createElement("style"),mxUtils.write(g,F));return g};Graph.addFont=function(g,x,F){if(null!=g&&0<g.length&&null!=x&&0<x.length){var M=g.toLowerCase();if("helvetica"!=M&&"arial"!=g&&"sans-serif"!=M){var Q=Graph.customFontElements[M];null!=Q&&Q.url!=x&&(Q.elt.parentNode.removeChild(Q.elt),Q=null);null==Q?(Q=x,"http:"==x.substring(0,5)&&(Q=PROXY_URL+"?url="+encodeURIComponent(x)),Q={name:g,url:x,elt:Graph.createFontElement(g,Q)},Graph.customFontElements[M]=Q,
Graph.recentCustomFonts[M]=Q,x=document.getElementsByTagName("head")[0],null!=F&&("link"==Q.elt.nodeName.toLowerCase()?(Q.elt.onload=F,Q.elt.onerror=F):F()),null!=x&&x.appendChild(Q.elt)):null!=F&&F()}else null!=F&&F()}else null!=F&&F();return g};Graph.getFontUrl=function(g,x){g=Graph.customFontElements[g.toLowerCase()];null!=g&&(x=g.url);return x};Graph.processFontAttributes=function(g){g=g.getElementsByTagName("*");for(var x=0;x<g.length;x++){var F=g[x].getAttribute("data-font-src");if(null!=F){var M=