static bool IsNameOfInlineEventHandler(const Vector<UChar, 32>& name) {
  const size_t kLengthOfShortestInlineEventHandlerName = 5;  // To wit: oncut.
  if (name.size() < kLengthOfShortestInlineEventHandlerName)
    return false;
  return name[0] == 'o' && name[1] == 'n';
}

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.