Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.createRoughCanvas=function(l){var A=rough.canvas({getContext:function(){return l}});A.draw=function(O){var X=O.sets||[];O=O.options||this.getDefaultOptions();for(var U=0;U<X.length;U++){var aa=X[U];switch(aa.type){case "path":null!=O.stroke&&this._drawToContext(l,aa,O);break;case "fillPath":this._drawToContext(l,aa,O);break;case "fillSketch":this.fillSketch(l,aa,O)}}};A.fillSketch=function(O,X,U){var aa=l.state.strokeColor,ba=l.state.strokeWidth,ia=l.state.strokeAlpha,qa=l.state.dashed,ra=
U.fillWeight;0>ra&&(ra=U.strokeWidth/2);l.setStrokeAlpha(l.state.fillAlpha);l.setStrokeColor(U.fill||"");l.setStrokeWidth(ra);l.setDashed(!1);this._drawToContext(O,X,U);l.setDashed(qa);l.setStrokeWidth(ba);l.setStrokeColor(aa);l.setStrokeAlpha(ia)};A._drawToContext=function(O,X,U){O.begin();for(var aa=0;aa<X.ops.length;aa++){var ba=X.ops[aa],ia=ba.data;switch(ba.op){case "move":O.moveTo(ia[0],ia[1]);break;case "bcurveTo":O.curveTo(ia[0],ia[1],ia[2],ia[3],ia[4],ia[5]);break;case "lineTo":O.lineTo(ia[0],