Input is always cast as `(int)$objectId` (no changes for malicious XSS) which comes directly from `$this->getRequest()->getVal( 'objectId' )`