Language: Python
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
def render_boolean(value):
    """Render HTML from a computed boolean value.

    Args:
        value (any): Input value, can be any variable.
            A truthy value (for example non-empty string / True / non-zero number) is considered True.
            A falsey value other than None (for example "" or 0 or False) is considered False.
            A value of None is considered neither True nor False.

    Returns:
        (str): HTML
            '<span class="text-success"><i class="mdi mdi-check-bold" title="Yes"></i></span>' if True value
            - or -
            '<span class="text-muted">&mdash;</span>' if None value
            - or -
            '<span class="text-danger"><i class="mdi mdi-close-thick" title="No"></i></span>' if False value

    Examples:
        >>> render_boolean(None)
        '<span class="text-muted">&mdash;</span>'
        >>> render_boolean(True or "arbitrary string" or 1)
        '<span class="text-success"><i class="mdi mdi-check-bold" title="Yes"></i></span>'
        >>> render_boolean(False or "" or 0)
        '<span class="text-danger"><i class="mdi mdi-close-thick" title="No"></i></span>'
    """
    if value is None:
        return mark_safe(HTML_NONE)
    if bool(value):
        return mark_safe(HTML_TRUE)
    return mark_safe(HTML_FALSE)