        get: function(name, del){
            // #ifdef debug
            this._trace("retrieving function " + name);
            // #endif
            if (!_map.hasOwnProperty(name)) {
                return;
            }
            var fn = _map[name];
            // #ifdef debug
            if (!fn) {
                this._trace(name + " not found");
            }
            // #endif
            
            if (del) {
                delete _map[name];
            }
            return fn;
        }

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.