    def handle(self, command, kwargs=None):
        """
        Dispatch and handle processing of the given command.

        :param command: Name of command to run.
        :type command: unicode
        :param kwargs: Arguments to pass to the command handler. If empty, `request.POST` is used.
        :type kwargs: dict
        :return: response.
        :rtype: HttpResponse
        """

        kwargs = kwargs or dict(six.iteritems(self.request.POST))
        try:
            handler = self.get_command_handler(command)
            if not handler or not callable(handler):
                raise Problem(_("Error! Invalid command `%s`.") % command)
            kwargs.pop("csrfmiddlewaretoken", None)  # The CSRF token should never be passed as a kwarg
            kwargs.pop("command", None)  # Nor the command
            kwargs.update(request=self.request, basket=self.basket)
            kwargs = self.preprocess_kwargs(command, kwargs)

            response = handler(**kwargs) or {}

        except (Problem, ValidationError) as exc:
            if not self.ajax:
                raise
            msg = exc.message if hasattr(exc, "message") else exc
            response = {
                "error": force_text(msg, errors="ignore"),
                "code": force_text(getattr(exc, "code", None) or "", errors="ignore"),
            }

        response = self.postprocess_response(command, kwargs, response)

        if self.ajax:
            return JsonResponse(response)

        return_url = response.get("return") or kwargs.get("return")
        if return_url and return_url.startswith("/"):
            return HttpResponseRedirect(return_url)
        return redirect("shuup:basket")
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.