def whitelist(allow_guest=False, xss_safe=False, methods=None):
	"""
	Decorator for whitelisting a function and making it accessible via HTTP.
	Standard request will be `/api/method/[path.to.method]`

	:param allow_guest: Allow non logged-in user to access this method.
	:param methods: Allowed http method to access the method.

	Use as:

		@frappe.whitelist()
		def myfunc(param1, param2):
			pass
	"""

	if not methods:
		methods = ['GET', 'POST', 'PUT', 'DELETE']

	def innerfn(fn):
		global whitelisted, guest_methods, xss_safe_methods, allowed_http_methods_for_whitelisted_func
		whitelisted.append(fn)

		allowed_http_methods_for_whitelisted_func[fn] = methods

		if allow_guest:
			guest_methods.append(fn)

			if xss_safe:
				xss_safe_methods.append(fn)

		return fn

	return innerfn
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.