Potential reflected XSS in the WebSub intent verification

[randomstuff]

I believe the WebSub intent verification of enginebai/PyMessager might be vulnerable to XSS because it reflects the hub.challenge parameter with a HTML content type:

@app.route(API_ROOT + FB_WEBHOOK, methods=["GET"])
def fb_webhook():
 verification_code = 'I_AM_VERIFICIATION_CODE'
 verify_token = request.args.get('hub.verify_token')
 if verification_code == verify_token:
 return request.args.get('hub.challenge')

Reference: https://www.w3.org/TR/websub/