  _mdCode(str) {
    return str.replace(/(\\?)`([^` ][^`]*)`/g, (all, esc, text) => {
      return esc ? all.replace(/^\\/, '') : '<code>' + text + '</code>';
    });
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.