system: You are an expert security code reviewer. You will be shown a source code file along with a multiple-choice question listing several function or class names from that file. Your task is to identify which one contains the specified CWE vulnerability.

OUTPUT FORMAT: Respond with the single letter of the correct option, wrapped in \boxed{...}. Example: `\boxed{B}`. Output the boxed letter ONLY -- no explanation, no other text.

user: ```python
# -*- coding: utf-8 -*-
from flask import Flask
from flask import request
from flask import render_template
from flask_cors import CORS
import threading
import logging
import logging.config
import os
import sys
import traceback
import toml


log_config_file = "./fdsns_log.conf"
if os.path.exists(log_config_file):
    logging.config.fileConfig(log_config_file)
else:
    logging.basicConfig(stream=sys.stdout,
                        format='[%(asctime)s - %(name)s - %(levelname)s]: %(message)s',
                        level=logging.INFO)


logger = logging.getLogger(__name__)
logger.setLevel(logging.INFO)

app = Flask(__name__)
CORS(app)
app_thr = None

toml_config_file = '/opt/fdsns/fdsns.toml'
toml_config_demo = '''
title = "Demo"
port = 5699
[[table]]
    name = "Demo table1"
    [[table.list]]
        name = "Google"
        url = "http://www.google.com"
    [[table.list]]
        name = "Baidu"
        url = "http://www.baidu.com"
[[table]]
    name = "Demo table2"
    [[table.list]]
        name = "GitHub"
        url = "http://www.github.com"
[[table.list]]
        name = "TestSameServerDifferentPort"
        url = "$localhost:12345"
'''
g_toml_config = None


def run_app(main_thr=False):
    def _body():
        global g_toml_config
        try:
            g_toml_config = toml.load(toml_config_file)
        except:
            err = traceback.format_exc()
            logger.error("--- web_site --- toml file load traceback: %s" % err)
            logger.warning("--- web_site --- parse toml file error, just demo it")
            g_toml_config = toml.loads(toml_config_demo)

        app.run(host="0.0.0.0", port=g_toml_config.get("port", 5699), threaded=True)

    logger.info("--- web_site --- start web server")
    if main_thr:
        _body()
    else:
        global app_thr
        app_thr = threading.Thread(target=_body)
        app_thr.daemon = True
        app_thr.start()


@app.route('/hello/')
@app.route('/hello/<name>')
def hello_world(name=None):
    return 'Hello World! Welcome ' + str(name)


@app.route('/')
def main_web_serv():
    global g_toml_config
    if g_toml_config:
        url_parts = request.url_root.split(':')
        if len(url_parts) >= 2:
            local_url = url_parts[0] + ":" + url_parts[1].rstrip('/')
        else:
            local_url = ""

        return render_template('main_web_serv.html',
                               title=g_toml_config.get("title", "Empty title"),
                               table=g_toml_config.get("table", {}),
                               localhost_url=local_url)
    else:
        return 400


if __name__ == "__main__":
    run_app(True)

```

Which of the following functions or classes contains a `CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')` vulnerability?

  A) hello_world
  B) run_app
  C) _body
  D) main_web_serv
Answer: A