    protected function doSetupTrusted($config) {
        $this->info['position'] = new HTMLPurifier_AttrDef_Enum(array(
            'static', 'relative', 'absolute', 'fixed'
        ));
        $this->info['top'] =
        $this->info['left'] =
        $this->info['right'] =
        $this->info['bottom'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
            new HTMLPurifier_AttrDef_CSS_Length(),
            new HTMLPurifier_AttrDef_CSS_Percentage(),
            new HTMLPurifier_AttrDef_Enum(array('auto')),
        ));
        $this->info['z-index'] = new HTMLPurifier_AttrDef_CSS_Composite(array(
            new HTMLPurifier_AttrDef_Integer(),
            new HTMLPurifier_AttrDef_Enum(array('auto')),
        ));
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.