                    pathParams: match.slice(1),
                    req,
                    res
                });
            }
            catch (e) {
                log.error(`Custom handler ${note.noteId} failed with ${e.message}`);

                res.status(500).send(e.message);
            }
        }
        else if (attr.name === 'customResourceProvider') {
            fileUploadService.downloadNoteFile(attr.noteId, res);
        }
        else {
            throw new Error("Unrecognized attribute name " + attr.name);
        }

        return; // only first handler is executed
    }

    const message = `No handler matched for custom ${path} request.`;

    log.info(message);
    res.status(404).send(message);
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.