  _mdChannelsAndNicks(str) {
    // TODO: Make nicks clickable
    return str.replace(/(^|\s)(#[a-zA-Z][\w.-]+)/g, (all, pre, channel) => {
      const suffix = channel.match(/\.$/) ? '.' : '';
      if (suffix) channel = channel.replace(/\.$/, '');
      return pre + '<a href="./' + route.urlFor(encodeURIComponent(channel)) + '">' + channel + '</a>' + suffix;
    });
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.