	sanitizeHtml(html) {
		const walkHtmlNodes = (nodes) => {
			if (!nodes || !nodes.length) return;

			for (const node of nodes) {
				for (const attr in node.attributes) {
					if (!node.attributes.hasOwnProperty(attr)) continue;
					if (JS_EVENT_NAMES.includes(attr)) node.setAttribute(attr, '');
				}
				walkHtmlNodes(node.childNodes);
			}
		};

		// Need to wrap in div, otherwise elements at the root will be skipped
		// The DIV tags are removed below
		const dom = NodeHtmlParser.parse(`<div>${html}</div>`, {
			script: false,
			style: true,
			pre: true,
			comment: false,
		});

		walkHtmlNodes([dom]);
		const output = dom.toString();
		return output.substr(5, output.length - 11);
	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.