Language: Python
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    def test_render_markdown_security(self):
        self.assertEqual(helpers.render_markdown('<script>alert("XSS")</script>'), "")
        self.assertHTMLEqual(
            helpers.render_markdown('[link](javascript:alert("XSS"))'),
            '<p><a title="XSS" rel="noopener noreferrer">link</a>)</p>',  # the trailing ) seems weird to me, but...
        )
        self.assertHTMLEqual(
            helpers.render_markdown(
                "[link\nJS]"
                "(&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A"  # '(javascript:'
                "&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29)"  # 'alert("XSS"))'
            ),
            '<p><a rel="noopener noreferrer">link JS</a></p>',
        )