Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.createRoughCanvas=function(l){var A=rough.canvas({getContext:function(){return l}});A.draw=function(N){var X=N.sets||[];N=N.options||this.getDefaultOptions();for(var U=0;U<X.length;U++){var Z=X[U];switch(Z.type){case "path":null!=N.stroke&&this._drawToContext(l,Z,N);break;case "fillPath":this._drawToContext(l,Z,N);break;case "fillSketch":this.fillSketch(l,Z,N)}}};A.fillSketch=function(N,X,U){var Z=l.state.strokeColor,ba=l.state.strokeWidth,ia=l.state.strokeAlpha,qa=l.state.dashed,ra=U.fillWeight;