  md(str, opt = {}) {
    return !str.length ? '&nbsp;'
         : opt.raw ? nbsp(escape(str))
         : this.emojis.markup(nbsp(this._tagToHTML(this._makeTag(str))));
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.