def _is_javascript_scheme(s):
    is_image_url = False
    for image_type in _find_image_dataurls(s):
        is_image_url = True
        if _is_unsafe_image_type(image_type):
            return True
    if is_image_url:
        return False
    return bool(_is_possibly_malicious_scheme(s))
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.