  md(str, opt = {}) {
    this._state = {};
    str = this._xmlEscape(str);
    str = this._nbsp(str);
    if (!opt.raw) str = this._mdLink(str);
    if (!opt.raw) str = this._plainUrlToLink(str);
    if (!opt.raw) str = this._extendedFormatting(str);
    if (!opt.raw) str = this._mdCode(str);
    if (!opt.raw) str = this._mdEmStrong(str);
    if (!opt.raw) str = this.emojis.markup(str);
    if (!opt.raw) str = this._mdBlockQuote(str);
    if (!opt.raw) str = this._mdChannelsAndNicks(str);
    return str;
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.