export function html(m, keyPath, ...args) {
  const html = str(m, keyPath, ...args);

  return html ? React.createElement('span', { dangerouslySetInnerHTML: { __html: html } }) : null;
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.