  _mdLink(str) {
    const re = RE.mdLink || (RE.mdLink = XRegExp('\\[ ([a-zA-Z][^\\]]+) \\] \\( ([^)]+) \\)', 'gx'));
    return XRegExp.replace(str, re, (all, text, href) => {
      const scheme = href.match(/^\s*(\w+):/) || ['', ''];
      if (scheme[1] && ['http', 'https', 'mailto'].indexOf(scheme[1]) == -1) return all; // Avoid XSS links
      this._state.md = true;
      const first = href.substring(0, 1);
      const target = ['/', '#'].indexOf(first) != -1 ? '' : ' target="_blank"';
      return '<a href="' + route.urlFor(href) + '"' + target + '>' + text + '</a>';
    });
  }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.