Language: Python
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
def render_markdown(value):
    """
    Render text as Markdown

    Example:
        {{ text | render_markdown }}
    """
    # Strip HTML tags
    value = strip_tags(value)

    # Sanitize Markdown links
    schemes = "|".join(settings.ALLOWED_URL_SCHEMES)
    pattern = rf"\[(.+)\]\((?!({schemes})).*:(.+)\)"
    value = re.sub(pattern, "[\\1](\\3)", value, flags=re.IGNORECASE)

    # Render Markdown
    html = markdown(value, extensions=["fenced_code", "tables"])

    return mark_safe(html)