  _mdIrcTextFormatting(tag) {
    const end = tag.after.indexOf(tag.captured);
    if (end == -1) return;

    tag.content = tag.after.substring(0, end);
    tag.after = tag.after.substring(end + tag.captured.length);
    tag.tag = tag.captured == '\x02' ? tagPair(['strong'])
              : tag.captured == '\x1d' ? tagPair(['em'])
              : tag.captured == '\x1f' ? tagPair(['u'])
              : tag.captured == '\x11' ? tagPair(['code'])
              : tagPair(['span']);
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.