=== Message

"xxx" is provided externally to the method an is not sanitized before use.