        setup: function () {
            var data = this.model.get('data') || {};

            this.userId = data.userId;

            this.messageData['entityType'] = this.getHelper().escapeString(Espo.Utils.upperCaseFirst((this.translate(data.entityType, 'scopeNames') || '').toLowerCase()));
            if (data.personEntityId) {
                this.messageData['from'] = '<a href="#' + this.getHelper().escapeString(data.personEntityType) + '/view/' + this.getHelper().escapeString(data.personEntityId) + '">' + this.getHelper().escapeString(data.personEntityName) + '</a>';
            } else {
                this.messageData['from'] = this.getHelper().escapeString(data.fromString || this.translate('empty address'));
            }

            this.emailId = this.getHelper().escapeString(data.emailId);
            this.emailName = this.getHelper().escapeString(data.emailName);

            this.createMessage();
        }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.