Language: JavaScript
Label: safe
CWE: CWE-829 \u2014 Inclusion of Functionality from Untrusted Control Sphere
The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.

Code:
function format_number(
    number, 
    decimalPlaces = null,
    decimalSeparator = "",
	thousandSeparator = ""
    ) {

        var number = Number(number);
        var decimalPlaces = empty(decimalPlaces) ? get_options("decimalPlaces") : decimalPlaces;
        var decimalSeparator = empty(decimalSeparator) ? get_options("decimalSeparator") : decimalSeparator;
        var thousandSeparator = empty(thousandSeparator) ? get_options("thousandSeparator") : thousandSeparator;

        /** Regex taken from VisioN: https://stackoverflow.com/a/14428340 */
        var re = '\\d(?=(\\d{' + (3) + '})+' + (decimalPlaces > 0 ? '\\D' : '$') + ')',
        num = number.toFixed(Math.max(0, ~~decimalPlaces));
        var formatedNumber = (decimalSeparator ? num.replace('.', decimalSeparator) : num).replace(new RegExp(re, 'g'), '$&' + (thousandSeparator || ','));

        return formatedNumber;

}