  def test_full_sanitize_allows_turning_off_encoding_special_chars
    assert_equal '&amp;', full_sanitize('&')
    assert_equal '&', full_sanitize('&', encode_special_chars: false)
  end
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.