					parser.validateLink = function(url) {
						var BAD_PROTOCOLS    = [ 'vbscript', 'javascript', 'file', 'data' ];
						var str = url.trim().toLowerCase();

						if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) {
							return false;
						}
						return true;
					}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.