Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.createRoughCanvas=function(l){var A=rough.canvas({getContext:function(){return l}});A.draw=function(O){var X=O.sets||[];O=O.options||this.getDefaultOptions();for(var U=0;U<X.length;U++){var aa=X[U];switch(aa.type){case "path":null!=O.stroke&&this._drawToContext(l,aa,O);break;case "fillPath":this._drawToContext(l,aa,O);break;case "fillSketch":this.fillSketch(l,aa,O)}}};A.fillSketch=function(O,X,U){var aa=l.state.strokeColor,ba=l.state.strokeWidth,ia=l.state.strokeAlpha,qa=l.state.dashed,ra=