system: You are an expert security code reviewer. You will be shown a source code file. Your task is to name the single function or class that contains the specified CWE vulnerability.

OUTPUT FORMAT: Respond with the exact function or class name (no parentheses, no qualifiers, no module prefixes), wrapped in \boxed{...}. Example: `\boxed{salted_hmac}`. Output the boxed name ONLY -- no explanation, no other text.

user: ```python
"""
Core functionality for roast.vim plugin. This module is inteded to be testable outside vim, so MUST NOT import the `vim`
module.
"""

import shlex
from itertools import takewhile
from typing import List, Dict, Optional
import json
from pathlib import Path
from xml.dom import minidom
from xml.parsers.expat import ExpatError
import re

import requests

try:
    from jinja2 import Template
except ImportError:
    Template = None


class Request:
    def __init__(self, method, url, headers, params=None, data=None, auth=None, verify_ssl=True):
        self.method = method
        self.url = url
        self.headers = headers
        self.params = params
        self.data = data
        self.auth = auth
        self.verify_ssl = verify_ssl

    def send(self, session: requests.Session = None) -> requests.Response:
        session.auth = self.auth
        return session.send(requests.Request(
            self.method,
            self.url,
            self.headers,
            params=self.params,
            data=self.data,
        ).prepare(), verify=self.verify_ssl)


def render_body(body: str, heredoc: str, variables: Dict[str, str]):
    if heredoc is None:
        return body.format(**variables)
    heredoc = heredoc.lower()

    if heredoc in {'raw', 'json'}:
        return body

    if heredoc == 'jinja2':
        if Template is None:
            raise ValueError('Jinja2 is not available. Please `pip install jinja2` before using.')
        return Template(body).render(**variables)

    return body.format(**variables)


def build_request(lines, line_num, *, use_overrides=None) -> Request:
    config = {}
    headers = {}
    variables = {}
    aliases = {}
    templates = {}
    current_template = None
    heredoc = None

    for line in lines[:line_num]:
        if heredoc:
            if line == heredoc:
                heredoc = None
            continue

        heredoc = pop_heredoc(tokenize(line))
        if heredoc:
            continue

        stripped_line = line.strip()
        if not stripped_line or stripped_line.startswith('#'):
            continue

        is_indented = line.startswith(' ' * 4)
        if not is_indented:
            current_template = None
        elif current_template:
            current_template.append(line)
            continue

        parts = tokenize(line)
        if len(parts) < 1:
            continue

        head, *rest = parts

        if head == 'set':
            # Interpolations in variables are applied when the variable is defined.
            variables[rest[0]] = ' '.join(rest[1:]).format(**variables)

        elif head == 'alias':
            # Interpolations in aliases are applied when the alias is used.
            aliases[rest[0]] = ' '.join(rest[1:])

        elif head == 'use':
            if len(rest) > 1:
                config[rest[0]] = ' '.join(rest[1:])
            else:
                del config[rest[0]]

        elif head.endswith(':'):
            key = head[:-1].lower()
            if rest:
                headers[key] = ' '.join(rest).format(**variables)
            else:
                del headers[key]

        elif head == 'template':
            templates[rest[0]] = current_template = []

    line = lines[line_num]
    for alias, replacement in aliases.items():
        if line.startswith(alias + ' '):
            line = line.replace(alias + ' ', replacement, 1)
            break

    method, loc, *tokens = tokenize(line)

    heredoc = pop_heredoc(tokens)
    if heredoc:
        body = '\n'.join(takewhile(lambda l: l != heredoc, lines[line_num + 1:]))
    else:
        file_path = pop_file_body(tokens)
        body = file_path.read_text() if file_path else None

    if body:
        body = render_body(body, heredoc, variables)

    if use_overrides:
        config.update(use_overrides)

    url_prefix = None
    if 'url_prefix' in config:
        url_prefix = config['url_prefix']
    elif 'host' in headers:
        url_prefix = headers['host']
        # TODO: Using host header this way is against the HTTP spec and should be removed. See issue #14.
        if '/' in url_prefix or url_prefix.startswith('http:') or url_prefix.startswith('https:'):
            del headers['host']

    url = loc.format(**variables)
    if url_prefix and not re.match(r'https?://', url):
        url = url_prefix.rstrip('/') + '/' + url.lstrip('/')

    params = build_params_dict(tokens, variables)

    # TODO: Use syntax like `use http_auth basic user password` instead.
    auth = None
    if 'http_auth_username' in config and 'http_auth_password' in config:
        auth = config['http_auth_username'], config['http_auth_password']

    return Request(method, url, headers, params=params, data=body, auth=auth)


def pop_heredoc(tokens: List[str]) -> Optional[str]:
    heredoc = None
    if len(tokens) >= 2 and tokens[-2] == '<<':
        heredoc = tokens.pop()
        tokens.pop()
    return heredoc


def pop_file_body(tokens: List[str]) -> Optional[Path]:
    loc = None
    if tokens and tokens[-1].startswith('<'):
        loc = tokens.pop()[1:]
    elif len(tokens) >= 2 and tokens[-2] == '<':
        loc = tokens.pop()
        tokens.pop()
    return loc and Path(loc)


def build_params_dict(tokens: List[str], variables: Dict[str, str] = None) -> Dict[str, str]:
    if variables is None:
        variables = {}

    params = {}
    for var in tokens:
        if '=' in var:
            name, value = var.split('=', 1)
            value = value.format(**variables)
        else:
            name, value = var, variables[var]
        params[name] = variables['@' + name] = value

    return params


def tokenize(text: str) -> List[str]:
    sl = shlex.shlex(text, posix=True, punctuation_chars='<')
    sl.whitespace_split = True
    return list(sl)


def render_pretty(buf, response):
    blueprint = {'commands': ['call clearmatches()']}
    content_type = response.headers['content-type'].split(';')[0] if 'content-type' in response.headers else 'text/html'
    if content_type.endswith('/json'):
        try:
            blueprint['lines'] = json.dumps(response.json(), ensure_ascii=False, indent=2).splitlines()
        except json.JSONDecodeError:
            blueprint['commands'].append('set filetype=txt')
            blueprint['commands'].append('call matchaddpos("Error", range(1, line("$")))')
        else:
            blueprint['commands'].append('set filetype=json')

    elif content_type.endswith('/xml'):
        try:
            blueprint['lines'] = minidom.parseString(response.text).toprettyxml().splitlines()
        except ExpatError:
            blueprint['commands'].append('set filetype=txt')
            blueprint['commands'].append('call matchaddpos("Error", range(1, line("$")))')
        else:
            blueprint['commands'].append('set filetype=xml')

    elif content_type.endswith('/html'):
        blueprint['commands'].append('set filetype=html')

    if not blueprint.get('lines'):
        blueprint['lines'] = response.text.splitlines()

    return blueprint


def render_headers(buf, response):
    lines = ['=== Response Headers ===']
    for key, value in response.headers.items():
        lines.append(f'{key}: {value}')

    lines.append('')
    lines.append('')
    lines.append('=== Request Headers ===')
    for key, value in response.request.headers.items():
        lines.append(f'{key.title()}: {value}')

    return {'lines': lines}

```

Name the function or class in this code that contains a `CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')` vulnerability.
Answer: render_body