Language: Python
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    def successful_post(self, request, obj, created, logger):
        """Callback after the form is successfully saved but before redirecting the user."""
        verb = "Created" if created else "Modified"
        msg = f"{verb} {self.queryset.model._meta.verbose_name}"
        logger.info(f"{msg} {obj} (PK: {obj.pk})")
        if hasattr(obj, "get_absolute_url"):
            msg = format_html('{} <a href="{}">{}</a>', msg, obj.get_absolute_url(), obj)
        else:
            msg = format_html("{} {}", msg, obj)
        messages.success(request, msg)