    __add_options_to_select(select, options) {
        for(var value of options) {
            var option = document.createElement('option');
            if (Array.isArray(value)) { // array of type [value, text]
                option.value = value[1];
                option.textContent = value[1];
            } else { // only value, text=value
                option.value = value;
                option.textContent = value;
            }
            select.appendChild(option);
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.