Language: Python
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    def post(self, request, pk):
        post_data = request.POST
        job_button = JobButton.objects.get(pk=pk)
        job_model = job_button.job
        result = JobResult.enqueue_job(
            job_model=job_model,
            user=request.user,
            object_pk=post_data["object_pk"],
            object_model_name=post_data["object_model_name"],
        )
        msg = f'Job enqueued. <a href="{result.get_absolute_url()}">Click here for the results.</a>'
        messages.info(request=request, message=mark_safe(msg))
        return redirect(post_data["redirect_path"])