  def comment_link(uniqueid, data)
    comment = comment_for_type(data)
    i18n_key = data[:cutoff] ? 'truncated' : 'full'
    notification = t(
      "notifications.comment.#{i18n_key}",
      name: data[:user],
      comment: strip_tags(data[:comment]),
      typename: data[:typename]
    )
    notification_link(uniqueid, comment[:path], notification)
  end
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.