Language: PHP
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
                $slug = htmlspecialchars($item->getSlug());
                $foundSlug = true;

                if (strlen($slug) > 0) {
                    $slugToCompare = preg_replace('/[#\?\*\:\\\\<\>\|"%&@=;]/', '-', $item->getSlug());
                    if($item->getSlug() !== $slugToCompare){
                        throw new Model\Element\ValidationException('Slug contains forbidden characters!');
                    }

                    $document = Model\Document::getByPath($slug);
                    if ($document) {
                        throw new Model\Element\ValidationException('Slug must be unique. Found conflict with document path "' . $slug . '"');
                    }

                    if (strlen($slug) < 2 || $slug[0] !== '/') {
                        throw new Model\Element\ValidationException('Slug must be at least 2 characters long and start with slash');
                    }

                    if (strpos($slug, '//') !== false || !filter_var('https://example.com' . $slug, FILTER_VALIDATE_URL)) {
                        throw new Model\Element\ValidationException('Slug "' . $slug . '" is not valid');
                    }
                }
            }
        }