Language: Python
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
def computed_fields(context, obj, advanced_ui=None):
    """
    Render all applicable links for the given object.
    This can also check whether the advanced_ui attribute is True or False for UI display purposes.
    """
    fields = obj.get_computed_fields(label_as_key=True, advanced_ui=advanced_ui)
    if not computed_fields:
        return ""

    template_code = ""

    for label, value in fields.items():
        escaped_label = escape(label)
        template_code += f"""
            <tr>
                <td><span title="{escaped_label}">{escaped_label}</span></td>
                <td>{escape(value)}</td>
            <tr>
            """
    return mark_safe(template_code)