    public static String getResponseMimeType(String pRequestMimeType, String defaultMimeType, String pCallback) {

        // For a valid given callback, return "text/javascript" for proper inclusion
        if (pCallback != null && isValidCallback(pCallback)) {
            return "text/javascript";
        }

        // Pick up mime time from request, but sanitize
        if (pRequestMimeType != null) {
            return sanitize(pRequestMimeType);
        }

        // Use the given default mime type (possibly picked up from a configuration)
        return sanitize(defaultMimeType);
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.