        updateState: function(rfb, state, oldstate) {
            var msg;

            document.documentElement.classList.remove("noVNC_connecting");
            document.documentElement.classList.remove("noVNC_connected");
            document.documentElement.classList.remove("noVNC_disconnecting");

            switch (state) {
                case 'connecting':
                    document.getElementById("noVNC_transition_text").innerHTML = _("Connecting...");
                    document.documentElement.classList.add("noVNC_connecting");
                    break;
                case 'connected':
                    UI.connected = true;
                    document.documentElement.classList.add("noVNC_connected");
                    if (rfb && rfb.get_encrypt()) {
                        msg = _("Connected (encrypted) to ") + UI.desktopName;
                    } else {
                        msg = _("Connected (unencrypted) to ") + UI.desktopName;
                    }
                    UI.showStatus(msg);
                    break;
                case 'disconnecting':
                    UI.connected = false;
                    document.getElementById("noVNC_transition_text").innerHTML = _("Disconnecting...");
                    document.documentElement.classList.add("noVNC_disconnecting");
                    break;
                case 'disconnected':
                    UI.showStatus(_("Disconnected"));
                    break;
                default:
                    msg = "Invalid UI state";
                    Util.Error(msg);
                    UI.showStatus(msg, 'error');
                    break;
            }

            UI.updateVisualState();
        },
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.