v8::Local<v8::Value> PrivateScriptRunner::runDOMAttributeGetter(
    ScriptState* scriptState,
    ScriptState* scriptStateInUserScript,
    const char* className,
    const char* attributeName,
    v8::Local<v8::Value> holder) {
  v8::Isolate* isolate = scriptState->isolate();
  v8::Local<v8::Object> classObject =
      classObjectOfPrivateScript(scriptState, className);
  v8::Local<v8::Value> descriptor;
  if (!classObject
           ->GetOwnPropertyDescriptor(scriptState->context(),
                                      v8String(isolate, attributeName))
           .ToLocal(&descriptor) ||
      !descriptor->IsObject()) {
    LOG(FATAL)
        << "Private script error: Target DOM attribute getter was not found. "
           "(Class name = "
        << className << ", Attribute name = " << attributeName << ")";
  }
  v8::Local<v8::Value> getter;
  if (!v8::Local<v8::Object>::Cast(descriptor)
           ->Get(scriptState->context(), v8String(isolate, "get"))
           .ToLocal(&getter) ||
      !getter->IsFunction()) {
    LOG(FATAL)
        << "Private script error: Target DOM attribute getter was not found. "
           "(Class name = "
        << className << ", Attribute name = " << attributeName << ")";
  }
  initializeHolderIfNeeded(scriptState, classObject, holder);
  v8::TryCatch block(isolate);
  v8::Local<v8::Value> result;
  if (!V8ScriptRunner::callInternalFunction(
           v8::Local<v8::Function>::Cast(getter), holder, 0, 0, isolate)
           .ToLocal(&result)) {
    rethrowExceptionInPrivateScript(isolate, block, scriptStateInUserScript,
                                    ExceptionState::GetterContext,
                                    attributeName, className);
    block.ReThrow();
    return v8::Local<v8::Value>();
  }
  return result;
}

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.