Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.createRoughCanvas=function(m){var C=rough.canvas({getContext:function(){return m}});C.draw=function(M){var ba=M.sets||[];M=M.options||this.getDefaultOptions();for(var V=0;V<ba.length;V++){var Z=ba[V];switch(Z.type){case "path":null!=M.stroke&&this._drawToContext(m,Z,M);break;case "fillPath":this._drawToContext(m,Z,M);break;case "fillSketch":this.fillSketch(m,Z,M)}}};C.fillSketch=function(M,ba,V){var Z=m.state.strokeColor,aa=m.state.strokeWidth,ka=m.state.strokeAlpha,qa=m.state.dashed,ra=V.fillWeight;
0>ra&&(ra=V.strokeWidth/2);m.setStrokeAlpha(m.state.fillAlpha);m.setStrokeColor(V.fill||"");m.setStrokeWidth(ra);m.setDashed(!1);this._drawToContext(M,ba,V);m.setDashed(qa);m.setStrokeWidth(aa);m.setStrokeColor(Z);m.setStrokeAlpha(ka)};C._drawToContext=function(M,ba,V){M.begin();for(var Z=0;Z<ba.ops.length;Z++){var aa=ba.ops[Z],ka=aa.data;switch(aa.op){case "move":M.moveTo(ka[0],ka[1]);break;case "bcurveTo":M.curveTo(ka[0],ka[1],ka[2],ka[3],ka[4],ka[5]);break;case "lineTo":M.lineTo(ka[0],ka[1])}}M.end();
"fillPath"===ba.type&&V.filled?M.fill():M.stroke()};return C};(function(){function m(Z,aa,ka){this.canvas=Z;this.rc=aa;this.shape=ka;this.canvas.setLineJoin("round");this.canvas.setLineCap("round");this.originalBegin=this.canvas.begin;this.canvas.begin=mxUtils.bind(this,m.prototype.begin);this.originalEnd=this.canvas.end;this.canvas.end=mxUtils.bind(this,m.prototype.end);this.originalRect=this.canvas.rect;this.canvas.rect=mxUtils.bind(this,m.prototype.rect);this.originalRoundrect=this.canvas.roundrect;