Language: JavaScript
Label: safe
CWE: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

Code:
function format_number(
    number, 
    decimalPlaces = null,
    decimalSeparator = "",
	thousandSeparator = ""
    ) {

        var number = Number(number);
        var decimalPlaces = empty(decimalPlaces) ? get_options("decimalPlaces") : decimalPlaces;
        var decimalSeparator = empty(decimalSeparator) ? get_options("decimalSeparator") : decimalSeparator;
        var thousandSeparator = empty(thousandSeparator) ? get_options("thousandSeparator") : thousandSeparator;

        /** Regex taken from VisioN: https://stackoverflow.com/a/14428340 */
        var re = '\\d(?=(\\d{' + (3) + '})+' + (decimalPlaces > 0 ? '\\D' : '$') + ')',
        num = number.toFixed(Math.max(0, ~~decimalPlaces));
        var formatedNumber = (decimalSeparator ? num.replace('.', decimalSeparator) : num).replace(new RegExp(re, 'g'), '$&' + (thousandSeparator || ','));

        return formatedNumber;

}