system: You are an expert security code reviewer. You will be shown a source code file along with a multiple-choice question listing several function or class names from that file. Your task is to identify which one contains the specified CWE vulnerability.

OUTPUT FORMAT: Respond with the single letter of the correct option, wrapped in \boxed{...}. Example: `\boxed{B}`. Output the boxed letter ONLY -- no explanation, no other text.

user: ```python
import json
from datetime import datetime, date

from flask import Blueprint, request
from flask import current_app as app

from db.wikishield_connection import DBConnection as WS
from db.wikishield_db import WikishieldDB
from lang.langs import Lang, LangsManager
from db.connection_info import read_sql_user_name
from clf.classifier_manager import reload_classifier
from sklearn.exceptions import NotFittedError

api = Blueprint('api', __name__)

# default number of revisions to fetch
_DEF_NUM_OF_REVS = 50
# maximum number of revisions to fetch
_MAX_NUM_OF_REVS = 500


# TODO: close wikishield_db at all routes

# TODO: define HTTP status codes here

# ----------------------------------------------------------------------------------------------------
class WikishieldApiResult:
    """
    this class generate JSON results for Wikishield API
    """

    @staticmethod
    def build_good_res(data=None):
        """
        build good result JSON of API

        param data: data to send at response. data must be serializable value (i.e. can converted to dictionary).
                    if your data it numpy value. use `data = my_numpy_obj.item()` function for converting to pure Python object

        return JSON result
        """
        return json.dumps(obj={'status': 'ok', 'data': data}, default=WikishieldApiResult._encode_object)

    @staticmethod
    def build_err_res(err_msg: str = None):
        """
        build error result JSON of API

        param err_msg: error message

        return JSON result
        """

        return json.dumps(obj={'status': 'error', 'errInfo': {'errMsg': err_msg}},
                          default=WikishieldApiResult._encode_object)

    @staticmethod
    def _encode_object(obj):
        if isinstance(obj, (datetime, date)):
            return obj.strftime('%Y-%m-%d %H:%M:%S')
        elif isinstance(obj, ValueError):
            return obj.__str__()  # return error message
        else:
            return obj.__dict__()


# ----------------------------------------------------------------------------------------------------
def _get_lang(lang_name: str):
    """
    get language from query parameters

    param lang_name: name of the language

    return language
    """

    lang_manager = LangsManager()
    if not lang_manager.is_support_lang(lang_name):
        raise ValueError("API not support `lang`={}".format(lang_name))
    return lang_manager.get_lang(lang_name)


# ----------------------------------------------------------------------------------------------------
def _try_parse_int(value: str):
    """
    try parse integer from string

    param value: string to parse

    return int
    """

    try:
        return int(value)
    except ValueError:
        raise ValueError("Cannot parse int from string")


# ----------------------------------------------------------------------------------------------------
def _try_parse_bool(value: str):
    """
    try parse boolean from string

    param value: string to parse

    return boolean
    """

    try:
        return bool(value)
    except ValueError:
        raise ValueError("Cannot parse boolean from string")


# ----------------------------------------------------------------------------------------------------
def _get_wikishield_db(lang: Lang):
    """
    get Wikishield database

    param lang: language

    return Wikishield database
    """

    sql_user_name = read_sql_user_name()
    wikishield_conn = WS(sql_user_name)
    wikishield_conn.start()
    return WikishieldDB(wikishield_conn.ctx, lang, sql_user_name)


# ----------------------------------------------------------------------------------------------------
@api.route('/score_rev', methods=['GET'])  # TODO: change to POST
def score_rev():
    """
    score revision route

    request parameters:
                `rev_text` - revision text
                `lang` = language
    response:
                JSON with `scoreResult`
    """

    try:
        rev_text = request.args.get("rev_text")
        rev_text = rev_text.strip() if rev_text else False
        if not rev_text:
            return WikishieldApiResult.build_err_res("Missing `rev_text` parameter"), 400
        lang_name = request.args.get("lang")
        _get_lang(lang_name)  # check language
        wiki_classifier = reload_classifier(lang_name)
        score_result = wiki_classifier.score_rev(rev_text)
        return WikishieldApiResult.build_good_res({'scoreResult': score_result})
    except Exception as ex:
        err_msg = str(ex)
        return WikishieldApiResult.build_err_res(err_msg), 400


# ----------------------------------------------------------------------------------------------------
@api.route('/manage_rev', methods=['POST'])
def manage_rev():
    """
    manage a revision at Wikipedia and update revision good editing in Wikishield table

    request parameters:
                `rev_id` - revision id to verify or restore
                `lang` = language
    response: /
    """

    try:
        req_data = request.get_json()
        rev_id = _try_parse_int(req_data['rev_id'])
        if rev_id < 1:
            raise ValueError("Parameter out of range `rev_id`={}".format(rev_id))
        lang_name = req_data['lang']
        lang = _get_lang(lang_name)
        good_editing = _try_parse_bool(req_data['good_editing'])
        wikishield_db = _get_wikishield_db(lang)
        wikishield_db.update_rev_good_editing(rev_id, good_editing)
        wikishield_db.commit()
        return WikishieldApiResult.build_good_res({})
    except Exception as ex:
        err_msg = str(ex)
        return WikishieldApiResult.build_err_res(err_msg), 400


# ----------------------------------------------------------------------------------------------------
@api.route('/get_revs', methods=['GET'])
def get_revs():
    """
    get last unverified revisions

    request parameters:
                `num_revs` - number of revisions to fetch
                 `lang` = language
    response:
                JSON with list of revisions
    """
    try:
        num_revs = _try_parse_int(request.args.get("num_revs", default=_DEF_NUM_OF_REVS))
        if num_revs < 0 or num_revs > _MAX_NUM_OF_REVS:
            raise ValueError("Illegal parameter range `num_revs`")
        lang_name = request.args.get("lang")
        lang = _get_lang(lang_name)
        wikishield_db = _get_wikishield_db(lang)
        revs = wikishield_db.fetch_recent_unverified_revs(num_revs)
        return WikishieldApiResult.build_good_res({'revs': revs})
    except Exception as ex:
        err_msg = str(ex)
        return WikishieldApiResult.build_err_res(err_msg), 400


# ----------------------------------------------------------------------------------------------------
@api.route('/<path:path>')
def unknown_request(path: str):
    """
    route for all unknown requests in API

    this return an error JSON response
    """

    err_msg = "Unknown request at path '{}'".format(path)
    return WikishieldApiResult.build_err_res(err_msg), 404

```

Which of the following functions or classes contains a `CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')` vulnerability?

  A) get_revs
  B) _get_lang
  C) build_good_res
  D) unknown_request
Answer: D