            foreach($item->attributes as $name => $value)
                if ($name !== 'id' && $name !== 'listId') {
                    $copy->$name = $value;
                }
            $lineItems[] = $copy;
        }
        return $lineItems;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.