    setEntries(entries) {
        if (entries.length === 0) {
            this.emptyList();
            return;
        }

        let htmlToInsert = '';

        for (let timesheet of entries) {
            let label = this.attributes['template']
                .replace('%customer%', timesheet.project.customer.name)
                .replace('%project%', timesheet.project.name)
                .replace('%activity%', timesheet.activity.name);

            htmlToInsert +=
                `<li>` +
                    `<a href="${ this.attributes['href'].replace('000', timesheet.id) }" data-event="kimai.timesheetStart kimai.timesheetUpdate" class="api-link" data-method="PATCH" data-msg-error="timesheet.start.error" data-msg-success="timesheet.start.success">` +
                        `<i class="${ this.attributes['icon'] }"></i> ${ label }` +
                    `</a>` +
                `</li>`;
        }

        this.itemList.innerHTML = htmlToInsert;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.