<fim-prefix>ld be parsed directly by adding it to JS.
										if (libs[j].toLowerCase()
												.endsWith(".js"))
										{
											js.append(tmp);
										}
										else
										{
											if (result.length() > 1)
											{
												result.append(",");
											}

											result.append("'" + tmp + "'");
										}
									}
								}
							}
						}
						else
						{
							String tmp = stencils.get(names[i]);

							if (tmp == null)
							{
								try
								{
									tmp = readXmlFile(
											"/stencils/" + names[i] + ".xml",
											true);

									// Cache for later use
									if (tmp != null)
									{
										stencils.put(names[i], tmp);
									}
								}
								catch (NullPointerException e)
								{
									// This seems possible according to access log so ignore stencil
								}
							}

							if (tmp != null)
							{
								if (result.length() > 1)
								{
									result.append(",");
								}

								result.append("'" + tmp + "'");
							}
						}
					}

					done.add(names[i]);
				}
			}
		}

		result.append("]");

		// LATER: Detect protocol of request in dev
		// mode to avoid security errors
		String proto = "https://";

		String setCachedUrls = "";
		String[] urls = request.getParameterValues("fetch");

		if (urls != null)
		{
			HashSet<String> completed = new HashSet<String>();

			for (int i = 0; i < urls.length; i++)
			{
				try
				{
					// Checks if URL already fetched to avoid duplicates
					// BUG: CWE-918 Server-Side Request Forgery (SSRF)
					// if (!completed.contains(urls[i]))
					// FIXED: 
<fim-middle>					if (!completed.contains(urls[i]) && Utils.sanitizeUrl(urls[i]))
					{
						completed.add(urls[i]);
						URL url = new URL(urls[i]);
						URLConnection connection = url.openConnection();
						<fix-suffix>ByteArrayOutputStream stream = new ByteArrayOutputStream();
						Utils.copy(connection.getInputStream(), stream);
						setCachedUrls += "GraphViewer.cachedUrls['"
								+ StringEscapeUtils.escapeEcmaScript(urls[i])
								+ "'] = decodeURIComponent('"
								+ StringEscapeUtils.escapeEcmaScript(
										Utils.encodeURIComponent(
												stream.toString("UTF-8"),
												Utils.CHARSET_FOR_URL_ENCODING))
								+ "');";
					}
				}
				catch (Exception e)
				{
					// ignore
				}
			}
		}

		// Installs a callback to load the stencils after the viewer was injected
		return "window.onDrawioViewerLoad = function() {" + setCachedUrls
				+ "mxStencilRegistry.parseStencilSets(" + result.toString()
				+ ");" + js + "GraphViewer.processElements(); };"
				+ "var t = document.getElementsByTagName('script');"
				+ "if (t != null && t.length > 0) {"
				+ "var script = document.createElement('script');"
				+ "script.type = 'text/javascript';" + "script.src = '" + proto
				<|endoftext|>