Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.createRoughCanvas=function(k){var y=rough.canvas({getContext:function(){return k}});y.draw=function(G){var P=G.sets||[];G=G.options||this.getDefaultOptions();for(var Q=0;Q<P.length;Q++){var U=P[Q];switch(U.type){case "path":null!=G.stroke&&this._drawToContext(k,U,G);break;case "fillPath":this._drawToContext(k,U,G);break;case "fillSketch":this.fillSketch(k,U,G)}}};y.fillSketch=function(G,P,Q){var U=k.state.strokeColor,T=k.state.strokeWidth,W=k.state.strokeAlpha,X=k.state.dashed,Y=Q.fillWeight;
0>Y&&(Y=Q.strokeWidth/2);k.setStrokeAlpha(k.state.fillAlpha);k.setStrokeColor(Q.fill||"");k.setStrokeWidth(Y);k.setDashed(!1);this._drawToContext(G,P,Q);k.setDashed(X);k.setStrokeWidth(T);k.setStrokeColor(U);k.setStrokeAlpha(W)};y._drawToContext=function(G,P,Q){G.begin();for(var U=0;U<P.ops.length;U++){var T=P.ops[U],W=T.data;switch(T.op){case "move":G.moveTo(W[0],W[1]);break;case "bcurveTo":G.curveTo(W[0],W[1],W[2],W[3],W[4],W[5]);break;case "lineTo":G.lineTo(W[0],W[1])}}G.end();"fillPath"===P.type&&