Language: Python
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    def successful_post(self, request, obj, created, logger):
        """Callback after the form is successfully saved but before redirecting the user."""
        verb = "Created" if created else "Modified"
        msg = f"{verb} {self.queryset.model._meta.verbose_name}"
        logger.info(f"{msg} {obj} (PK: {obj.pk})")
        if hasattr(obj, "get_absolute_url"):
            msg = f'{msg} <a href="{obj.get_absolute_url()}">{escape(obj)}</a>'
        else:
            msg = f"{msg} {escape(obj)}"
        messages.success(request, mark_safe(msg))