    constructor()
    {
        // All construction occurs here
        this.setup_palettes();
        this._use_classes = false;
        this._escape_for_html = true;

        this.bold = false;
        this.fg = this.bg = null;

        this._buffer = '';

        this._url_whitelist = { 'http':1, 'https':1 };
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.