Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
        return setInterval(function() {

            var distance = new Date().getTime() - startTime;

            var totalSeconds = distance / 1000;

            var seconds = Math.floor( totalSeconds % 60 ).toString().padStart(2,0);

            var minutes = Math.floor( ( totalSeconds % 3600 ) / 60 ).toString().padStart(2,0);

            var hours = Math.floor( totalSeconds / 3600 ).toString().padStart(2,0);
            
            $(container).html(`${hours}:${minutes}:${seconds}`);

        }, 1000);