Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.createRoughCanvas=function(k){var y=rough.canvas({getContext:function(){return k}});y.draw=function(G){var P=G.sets||[];G=G.options||this.getDefaultOptions();for(var Q=0;Q<P.length;Q++){var U=P[Q];switch(U.type){case "path":null!=G.stroke&&this._drawToContext(k,U,G);break;case "fillPath":this._drawToContext(k,U,G);break;case "fillSketch":this.fillSketch(k,U,G)}}};y.fillSketch=function(G,P,Q){var U=k.state.strokeColor,T=k.state.strokeWidth,W=k.state.strokeAlpha,X=k.state.dashed,Y=Q.fillWeight;