Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.createRoughCanvas=function(m){var C=rough.canvas({getContext:function(){return m}});C.draw=function(M){var ba=M.sets||[];M=M.options||this.getDefaultOptions();for(var V=0;V<ba.length;V++){var Z=ba[V];switch(Z.type){case "path":null!=M.stroke&&this._drawToContext(m,Z,M);break;case "fillPath":this._drawToContext(m,Z,M);break;case "fillSketch":this.fillSketch(m,Z,M)}}};C.fillSketch=function(M,ba,V){var Z=m.state.strokeColor,aa=m.state.strokeWidth,ka=m.state.strokeAlpha,qa=m.state.dashed,ra=V.fillWeight;