Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.createRoughCanvas=function(l){var B=rough.canvas({getContext:function(){return l}});B.draw=function(N){var Z=N.sets||[];N=N.options||this.getDefaultOptions();for(var U=0;U<Z.length;U++){var aa=Z[U];switch(aa.type){case "path":null!=N.stroke&&this._drawToContext(l,aa,N);break;case "fillPath":this._drawToContext(l,aa,N);break;case "fillSketch":this.fillSketch(l,aa,N)}}};B.fillSketch=function(N,Z,U){var aa=l.state.strokeColor,Y=l.state.strokeWidth,ka=l.state.strokeAlpha,qa=l.state.dashed,ra=U.fillWeight;
0>ra&&(ra=U.strokeWidth/2);l.setStrokeAlpha(l.state.fillAlpha);l.setStrokeColor(U.fill||"");l.setStrokeWidth(ra);l.setDashed(!1);this._drawToContext(N,Z,U);l.setDashed(qa);l.setStrokeWidth(Y);l.setStrokeColor(aa);l.setStrokeAlpha(ka)};B._drawToContext=function(N,Z,U){N.begin();for(var aa=0;aa<Z.ops.length;aa++){var Y=Z.ops[aa],ka=Y.data;switch(Y.op){case "move":N.moveTo(ka[0],ka[1]);break;case "bcurveTo":N.curveTo(ka[0],ka[1],ka[2],ka[3],ka[4],ka[5]);break;case "lineTo":N.lineTo(ka[0],ka[1])}}N.end();