CVE-2020-13928: Cross-site scripting in Apache Atlas

The vulnerability manifests in two phases: 1) Unsanitized input storage during search saving, and 2) Unsafe output generation during rendering. The identified controller method aligns with the first phase by handling search persistence, while the renderer method corresponds to the second phase. Both would appear in exploitation call stacks - the controller when malicious input is submitted, and the renderer when stored XSS payloads are displayed. Confidence is medium due to lack of direct patch evidence, but grounded in the advisory's description of vulnerable operations.