    render: function(relations) {
        if ((! relations) || (relations.length == 0)) {
            return '';
        }
        
        if (! this.recordClass) {
            if (! Tine[this.foreignApp]) {
                Tine.log.warn('Tine.widgets.relation.GridRenderer::render - ForeignApp not found: ' + this.foreignApp);
                return '';
            }
            
            this.recordClass = Tine[this.foreignApp].Model[this.foreignModel];
        }
        
        for (var index = 0; index < relations.length; index++) {
            var el = relations[index];
            if (el.type == this.type && el.related_model == this.relModel) {
                var record = new this.recordClass(el.related_record);
                return Ext.util.Format.htmlEncode(record.getTitle());
            }
        }
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.