Language: Python
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    def test_support_message(self):
        """Test the `support_message` tag with config and settings."""
        with override_settings():
            del settings.SUPPORT_MESSAGE
            with override_config():
                self.assertHTMLEqual(
                    helpers.support_message(),
                    "<p>If further assistance is required, please join the <code>#nautobot</code> channel "
                    'on <a href="https://slack.networktocode.com/">Network to Code\'s Slack community</a> '
                    "and post your question.</p>",
                )

            with override_config(SUPPORT_MESSAGE="Reach out to your support team for assistance."):
                self.assertHTMLEqual(
                    helpers.support_message(),
                    "<p>Reach out to your support team for assistance.</p>",
                )

        with override_settings(SUPPORT_MESSAGE="Settings **support** message:\n\n- Item 1\n- Item 2"):
            with override_config(SUPPORT_MESSAGE="Config support message"):
                self.assertHTMLEqual(
                    helpers.support_message(),
                    "<p>Settings <strong>support</strong> message:</p><ul><li>Item 1</li><li>Item 2</li></ul>",
                )