Language: PHP
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
    public function __construct(
        string $projectDir,
        string $legacyDir,
        string $legacySessionName,
        string $defaultSessionName,
        LegacyScopeState $legacyScopeState,
        SessionInterface $session,
        ModuleNameMapperInterface $moduleNameMapper,
        BaseActionDefinitionProviderInterface $baseActionDefinitionProvider,
        LegacyActionResolverInterface $legacyActionResolver,
        AclManagerInterface $acl
    ) {
        parent::__construct(
            $projectDir,
            $legacyDir,
            $legacySessionName,
            $defaultSessionName,
            $legacyScopeState,
            $session
        );
        $this->moduleNameMapper = $moduleNameMapper;
        $this->baseActionDefinitionProvider = $baseActionDefinitionProvider;
        $this->legacyActionResolver = $legacyActionResolver;
        $this->acl = $acl;
    }