        getCreateHtml: function (address) {
            address = this.getHelper().escapeString(address);

            var html = '<span class="dropdown email-address-create-dropdown pull-right">' +
                '<button class="dropdown-toggle btn btn-link btn-sm" data-toggle="dropdown">' +
                    '<span class="caret text-muted"></span>' +
                '</button>' +
                '<ul class="dropdown-menu" role="menu">' +
            '';

            if (this.getAcl().check('Contact', 'create')) {
                html += '<li><a href="javascript:" data-action="createContact" data-address="'+address+'">'+this.translate('Create Contact', 'labels', 'Email')+'</a></li>';
            }
            if (this.getAcl().check('Lead', 'create')) {
                html += '<li><a href="javascript:" data-action="createLead" data-address="'+address+'">'+this.translate('Create Lead', 'labels', 'Email')+'</a></li>';
            }
            if (this.getAcl().check('Contact', 'edit')) {
                html += '<li><a href="javascript:" data-action="addToContact" data-address="'+address+'">'+this.translate('Add to Contact', 'labels', 'Email')+'</a></li>';
            }
            if (this.getAcl().check('Lead', 'edit')) {
                html += '<li><a href="javascript:" data-action="addToLead" data-address="'+address+'">'+this.translate('Add to Lead', 'labels', 'Email')+'</a></li>';
            }

            html += '</ul>' +
            '</span>';

            return html;
        },
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.