    public function validateChildren($tokens_of_children, $config, $context) {
        $result = parent::validateChildren($tokens_of_children, $config, $context);
        // we assume that $tokens_of_children is not modified
        if ($result === false) {
            if (empty($tokens_of_children)) return true;
            elseif ($this->whitespace) return $tokens_of_children;
            else return array();
        }
        return $result;
    }
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.