Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
    calculateDiscount: function(amount, discount=null) {

        if(discount === "" || discount === null || discount === 'null' || discount === 0) {
        
            return parseFloat(Number(amount));

        } else if( typeof discount === 'string' && discount.indexOf("%") > 0 ) {
        
            // For parcantage discount  
            return parseFloat(Number(amount) - (Number(discount.replace("%",""))/100) * Number(amount)); 

        } else {

            // For Fixed Discount
            return parseFloat(Number(amount) - Number(discount));

        }

    },