def pref_get(key):
    if get_user() is None:
        return "Authentication required", 401

    if key in get_preferences():
        return Response(json.dumps({'key': key, 'value': get_preferences()[key]}))
    else:
        return Response(json.dumps({'key': key, 'error': 'novalue'}))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.