Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Editor.createRoughCanvas=function(g){var y=rough.canvas({getContext:function(){return g}});y.draw=function(H){var O=H.sets||[];H=H.options||this.getDefaultOptions();for(var P=0;P<O.length;P++){var V=O[P];switch(V.type){case "path":null!=H.stroke&&this._drawToContext(g,V,H);break;case "fillPath":this._drawToContext(g,V,H);break;case "fillSketch":this.fillSketch(g,V,H)}}};y.fillSketch=function(H,O,P){var V=g.state.strokeColor,R=g.state.strokeWidth,W=g.state.strokeAlpha,X=g.state.dashed,Z=P.fillWeight;
0>Z&&(Z=P.strokeWidth/2);g.setStrokeAlpha(g.state.fillAlpha);g.setStrokeColor(P.fill||"");g.setStrokeWidth(Z);g.setDashed(!1);this._drawToContext(H,O,P);g.setDashed(X);g.setStrokeWidth(R);g.setStrokeColor(V);g.setStrokeAlpha(W)};y._drawToContext=function(H,O,P){H.begin();for(var V=0;V<O.ops.length;V++){var R=O.ops[V],W=R.data;switch(R.op){case "move":H.moveTo(W[0],W[1]);break;case "bcurveTo":H.curveTo(W[0],W[1],W[2],W[3],W[4],W[5]);break;case "lineTo":H.lineTo(W[0],W[1])}}H.end();"fillPath"===O.type&&