  _mdURL(tag) {
    tag.captured = tag.captured.replace(/[,.:;!"\']$/, (after) => {
      tag.after = after[0] + tag.after;
      return '';
    });

    tag.content = tag.captured.replace(/^(https|mailto):(\/\/)?/, '');
    tag.attrs.href = escape(tag.captured);
    tag.attrs.target = '_blank';
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.