  def nofollowify_links(string)
    if this_blog.dofollowify
      string
    else
      string.gsub(/<a(.*?)>/i, '<a\1 rel="nofollow">')
    end
  end
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.