Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
            static function (?NodeInterface $node, string $name) use ($nodes, $names) {
                return $node === null && !in_array($name, $names, true)
                    || $node !== null && !in_array($node, $nodes, true);
            },