        me.setAttachment = function(attachmentData, fileName)
        {
            // data URI format: data:[<mediaType>][;base64],<data>

            // position in data URI string of where data begins
            const base64Start = attachmentData.indexOf(',') + 1;
            // position in data URI string of where mediaType ends
            const mediaTypeEnd = attachmentData.indexOf(';');

            // extract mediaType
            const mediaType = attachmentData.substring(5, mediaTypeEnd);
            // extract data and convert to binary
            const rawData = attachmentData.substring(base64Start);
            const decodedData = rawData.length > 0 ? atob(rawData) : '';

            // Transform into a Blob
            const buf = new Uint8Array(decodedData.length);
            for (let i = 0; i < decodedData.length; ++i) {
                buf[i] = decodedData.charCodeAt(i);
            }
            const blob = new window.Blob([ buf ], { type: mediaType });

            // Get Blob URL
            const blobUrl = window.URL.createObjectURL(blob);

            // IE does not support setting a data URI on an a element
            // Using msSaveBlob to download
            if (window.Blob && navigator.msSaveBlob) {
                $attachmentLink.off('click').on('click', function () {
                    navigator.msSaveBlob(blob, fileName);
                });
            } else {
                $attachmentLink.attr('href', blobUrl);
            }

            if (typeof fileName !== 'undefined') {
                $attachmentLink.attr('download', fileName);
            }

            me.handleBlobAttachmentPreview($attachmentPreview, blobUrl, mediaType);
        };
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.