function selectedFilesRail(inputFileID) {

    var fileobj = [];
    if(inputFileID && inputFileID != '') {
        setFilesRail(document.getElementById(inputFileID).files);
    }
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.