    public function clean($html) {



        $xssClean = new XSSClean();
        $html = $xssClean->clean($html);

        $config = \HTMLPurifier_Config::createDefault();

        if ($this->purifierPath) {
            $config->set('Cache.SerializerPath', $this->purifierPath);
        }


        if ($this->purifierPath) {
            $config->set('Cache.SerializerPath', $this->purifierPath);
        }
        $config->set('URI.DisableExternal', true);
        $config->set('URI.DisableExternalResources', true);
    //    $config->set('URI.DisableResources', true);
        $config->set('URI.Host', site_hostname());

        $purifier = new \HTMLPurifier($config);
        $html = $purifier->purify($html);

        return $html;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.