function route(method, path, middleware, routeHandler, resultHandler, transactional = true) {
    router[method](path, ...middleware, (req, res, next) => {
        const start = Date.now();

        try {
            cls.namespace.bindEmitter(req);
            cls.namespace.bindEmitter(res);

            const result = cls.init(() => {
                cls.set('componentId', req.headers['trilium-component-id']);
                cls.set('localNowDateTime', req.headers['trilium-local-now-datetime']);
                cls.set('hoistedNoteId', req.headers['trilium-hoisted-note-id'] || 'root');

                const cb = () => routeHandler(req, res, next);

                return transactional ? sql.transactional(cb) : cb();
            });

            if (resultHandler) {
                if (result && result.then) {
                    result
                        .then(actualResult => {
                            const responseLength = resultHandler(req, res, actualResult);

                            log.request(req, res, Date.now() - start, responseLength);
                        })
                        .catch(e => {
                            log.error(`${method} ${path} threw exception: ` + e.stack);

                            res.status(500).send(e.message);
                        });
                }
                else {
                    const responseLength = resultHandler(req, res, result);

                    log.request(req, res, Date.now() - start, responseLength);
                }
            }
        }
        catch (e) {
            log.error(`${method} ${path} threw exception: ` + e.stack);

            res.status(500).send(e.message);
        }
    });
}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.