    public function filter(&$uri, $config, $context) {
        // check if filter not applicable
        if (!$config->get('HTML.SafeIframe')) return true;
        // check if the filter should actually trigger
        if (!$context->get('EmbeddedURI', true)) return true;
        $token = $context->get('CurrentToken', true);
        if (!($token && $token->name == 'iframe')) return true;
        // check if we actually have some whitelists enabled
        if ($this->regexp === null) return false;
        // actually check the whitelists
        return preg_match($this->regexp, $uri->toString());
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.