  show_status: function() {
    return '<span style="' + this.get('status_style') + '">'
      + htmlEncode(this.get('status')) + (this.get("is_unmanaged") ? " (unmanaged)" : "")
      + '</span>';
  }.property("status_style", "disabled"),
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.