        before: str.substring(0, match.index),
        captured: match[0],
        index: match.index,
        match,
        tag: rule.tag,
      };

      this[rule.handler](tag);
      if (typeof tag.content !== 'string') {
        str = tag.before + tag.captured + tag.after;
        continue;
      }

      if (tag.before.length) children.push(this._makeTag(tag.before, rules, depth + 1));
      children.push([tag.tag, tag.attrs, [this._makeTag(tag.content, rule.rules, depth + 1)]]);
      if (tag.after.length) children.push(this._makeTag(tag.after, rules, depth + 1));
      break;
    }

    return [null, {}, children.length ? children : [escape(str)]];
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.