                            summary[tagId] = {'textValue': _.escape(tag.textValue),
                                              'id': tag.id,
                                              'canRemove': false,
                                              'canRemoveCount': 0,
                                              'links': [],
                                              'addedBy': []
                                             };
                        }
                        // Add link to list...
                        var l = tag.link;
                        // slice parent class 'ProjectI' > 'Project'
                        l.parent.class = l.parent.class.slice(0, -1);
                        summary[tagId].links.push(l);

                        // ...and summarise other properties on the tag
                        if (l.permissions.canDelete) {
                            summary[tagId].canRemoveCount += 1;
                        }
                        summary[tagId].canRemove = summary[tagId].canRemove || l.permissions.canDelete;
                        if (summary[tagId].addedBy.indexOf(linkOwner) === -1) {
                            summary[tagId].addedBy.push(linkOwner);
                        }
                    });
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.