    public function __construct(Iterator $iterator, $filter = null) {
        parent::__construct($iterator);
        $this->l = strlen($filter);
        $this->filter = $filter;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.