      def initialize(locale, key, options = nil)
        @key, @locale, @options = key, locale, options.dup || {}
        options.each { |k, v| self.options[k] = v.inspect if v.is_a?(Proc) }
      end

      def html_message
        key  = CGI.escape_html titleize(keys.last)
        path = CGI.escape_html keys.join('.')
        %(<span class="translation_missing" title="translation missing: #{path}">#{key}</span>)
      end

      def keys
        @keys ||= I18n.normalize_keys(locale, key, options[:scope]).tap do |keys|
          keys << 'no key' if keys.size < 2
        end
      end

      def message
        "translation missing: #{keys.join('.')}"
      end
      alias :to_s :message

      def to_exception
        MissingTranslationData.new(locale, key, options)
      end

      protected

      # TODO : remove when #html_message is removed
      def titleize(key)
        key.to_s.gsub('_', ' ').gsub(/\b('?[a-z])/) { $1.capitalize }
      end
    end

    include Base
  end
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.