From 6ac1a72c6100b6bc309754448c2f234b5be6ad77 Mon Sep 17 00:00:00 2001 From: Nicolas Will Date: Tue, 28 Jul 2026 21:03:58 +0200 Subject: [PATCH] Address Micronaut modeling review feedback --- .../io.micronaut.context.annotation.model.yml | 7 + .../ext/io.micronaut.http.client.model.yml | 44 +- java/ql/lib/ext/io.micronaut.http.model.yml | 59 +- .../lib/ext/io.micronaut.http.uri.model.yml | 28 + .../semmle/code/java/dataflow/FlowSources.qll | 11 - .../frameworks/micronaut/MicronautConfig.qll | 41 - .../micronaut/MicronautController.qll | 56 +- .../micronaut/MicronautWebSocket.qll | 6 +- .../micronaut/MicronautConfigTest.java | 30 - .../micronaut/MicronautControllerTest.java | 33 +- .../micronaut/MicronautHttpClientTest.java | 78 + .../micronaut/MicronautHttpRequestTest.java | 22 +- .../micronaut/MicronautWebSocketTest.java | 8 + .../tests/MicronautResponseSplitting.java | 7 + .../semmle/tests/ResponseSplitting.expected | 34 +- .../semmle/tests/MicronautUrlRedirect.java | 15 + .../CWE-601/semmle/tests/UrlRedirect.expected | 43 +- .../security/CWE-918/MicronautSSRF.java | 16 + .../security/CWE-918/RequestForgery.expected | 1727 +++++++++-------- .../convert/value/ConvertibleMultiValues.java | 10 + .../core/convert/value/ConvertibleValues.java | 15 + .../io/micronaut/core/type/Argument.java | 4 + .../io/micronaut/http/HttpHeaders.java | 9 +- .../io/micronaut/http/HttpParameters.java | 8 +- .../io/micronaut/http/HttpRequest.java | 9 + .../io/micronaut/http/HttpResponse.java | 3 + .../http/client/BlockingHttpClient.java | 9 + .../io/micronaut/http/client/HttpClient.java | 14 + .../io/micronaut/http/uri/UriBuilder.java | 6 + .../io/micronaut/websocket/CloseReason.java | 4 + 30 files changed, 1303 insertions(+), 1053 deletions(-) create mode 100644 java/ql/lib/ext/io.micronaut.context.annotation.model.yml create mode 100644 java/ql/lib/ext/io.micronaut.http.uri.model.yml delete mode 100644 java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautConfig.qll delete mode 100644 java/ql/test/library-tests/frameworks/micronaut/MicronautConfigTest.java create mode 100644 java/ql/test/stubs/micronaut-4.x/io/micronaut/core/convert/value/ConvertibleMultiValues.java create mode 100644 java/ql/test/stubs/micronaut-4.x/io/micronaut/core/convert/value/ConvertibleValues.java create mode 100644 java/ql/test/stubs/micronaut-4.x/io/micronaut/core/type/Argument.java create mode 100644 java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/CloseReason.java diff --git a/java/ql/lib/ext/io.micronaut.context.annotation.model.yml b/java/ql/lib/ext/io.micronaut.context.annotation.model.yml new file mode 100644 index 00000000000..816b47eaf5d --- /dev/null +++ b/java/ql/lib/ext/io.micronaut.context.annotation.model.yml @@ -0,0 +1,7 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: sourceModel + data: + - ["io.micronaut.context.annotation", "Property", True, "", "", "Annotated", "", "environment", "manual"] + - ["io.micronaut.context.annotation", "Value", True, "", "", "Annotated", "", "environment", "manual"] diff --git a/java/ql/lib/ext/io.micronaut.http.client.model.yml b/java/ql/lib/ext/io.micronaut.http.client.model.yml index 05741c4902d..1ecbe3c2b86 100644 --- a/java/ql/lib/ext/io.micronaut.http.client.model.yml +++ b/java/ql/lib/ext/io.micronaut.http.client.model.yml @@ -3,31 +3,33 @@ extensions: pack: codeql/java-all extensible: sinkModel data: - # HttpClient.toBlocking() returns BlockingHttpClient; retrieve/exchange with String URL are SSRF sinks - - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(String)", "", "Argument[0]", "request-forgery", "manual"] - - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(String,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(HttpRequest)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(HttpRequest,Argument)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(HttpRequest,Argument,Argument)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(HttpRequest,Class)", "", "Argument[0]", "request-forgery", "manual"] - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(String)", "", "Argument[0]", "request-forgery", "manual"] - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(String,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "exchange", "(String,Class,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(HttpRequest)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(HttpRequest,Argument)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(HttpRequest,Argument,Argument)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(HttpRequest,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(String)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(String,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "BlockingHttpClient", True, "retrieve", "(String,Class,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "exchange", "(HttpRequest)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "exchange", "(HttpRequest,Argument)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "exchange", "(HttpRequest,Argument,Argument)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "exchange", "(HttpRequest,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "exchange", "(String)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "exchange", "(String,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "retrieve", "(HttpRequest)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "retrieve", "(HttpRequest,Argument)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "retrieve", "(HttpRequest,Argument,Argument)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "retrieve", "(HttpRequest,Class)", "", "Argument[0]", "request-forgery", "manual"] + - ["io.micronaut.http.client", "HttpClient", True, "retrieve", "(String)", "", "Argument[0]", "request-forgery", "manual"] - addsTo: pack: codeql/java-all extensible: summaryModel data: - # HttpClient.toBlocking() taint propagation - ["io.micronaut.http.client", "HttpClient", True, "toBlocking", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"] - # HttpRequest.GET/POST/PUT/DELETE/PATCH factory methods propagate URI taint - - ["io.micronaut.http", "HttpRequest", True, "GET", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "POST", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "PUT", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "DELETE", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "PATCH", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "HEAD", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "OPTIONS", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - # UriBuilder taint propagation - - ["io.micronaut.http.uri", "UriBuilder", True, "of", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.uri", "UriBuilder", True, "of", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.uri", "UriBuilder", True, "host", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.uri", "UriBuilder", True, "path", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.uri", "UriBuilder", True, "queryParam", "(String,Object[])", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.uri", "UriBuilder", True, "queryParam", "(String,Object[])", "", "Argument[1].ArrayElement", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.uri", "UriBuilder", True, "fragment", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.uri", "UriBuilder", True, "build", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"] diff --git a/java/ql/lib/ext/io.micronaut.http.model.yml b/java/ql/lib/ext/io.micronaut.http.model.yml index 5fd2053e4e2..6e6d30ff268 100644 --- a/java/ql/lib/ext/io.micronaut.http.model.yml +++ b/java/ql/lib/ext/io.micronaut.http.model.yml @@ -4,35 +4,56 @@ extensions: extensible: sourceModel data: - ["io.micronaut.http", "HttpRequest", True, "getBody", "", "", "ReturnValue", "remote", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "getHeaders", "", "", "ReturnValue.Element.MapValue.Element", "remote", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "getParameters", "", "", "ReturnValue.Element.MapValue.Element.Element.MapValue", "remote", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "getCookies", "", "", "ReturnValue", "remote", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "getUri", "", "", "ReturnValue", "remote", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "getPath", "", "", "ReturnValue", "remote", "manual"] - - ["io.micronaut.http", "HttpRequest", True, "getContentType", "", "", "ReturnValue", "remote", "manual"] - ["io.micronaut.http", "HttpRequest", True, "getContentLength", "", "", "ReturnValue", "remote", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "getContentType", "", "", "ReturnValue", "remote", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "getCookies", "", "", "ReturnValue", "remote", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "getHeaders", "", "", "ReturnValue", "remote", "manual"] - ["io.micronaut.http", "HttpRequest", True, "getMethodName", "", "", "ReturnValue", "remote", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "getParameters", "", "", "ReturnValue", "remote", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "getPath", "", "", "ReturnValue", "remote", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "getUri", "", "", "ReturnValue", "remote", "manual"] - addsTo: pack: codeql/java-all extensible: summaryModel data: - - ["io.micronaut.http", "HttpHeaders", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpHeaders", True, "getAll", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpHeaders", True, "getFirst", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpHeaders", True, "values", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpParameters", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpParameters", True, "getAll", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http", "HttpParameters", True, "getFirst", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "get", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] + - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "getAll", "", "", "Argument[this].Element.MapValue", "ReturnValue", "value", "manual"] + - ["io.micronaut.core.convert.value", "ConvertibleMultiValues", True, "getFirst", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] + - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "asMap", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] + - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "asProperties", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] + - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "getValue", "", "", "Argument[this].Element.MapValue", "ReturnValue", "taint", "manual"] + - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "subMap", "", "", "Argument[this].Element.MapValue", "ReturnValue.MapValue", "taint", "manual"] + - ["io.micronaut.core.convert.value", "ConvertibleValues", True, "values", "", "", "Argument[this].Element.MapValue", "ReturnValue.Element", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "DELETE", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "DELETE", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "DELETE", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "DELETE", "(URI,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "GET", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "GET", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "HEAD", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "HEAD", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "OPTIONS", "(String)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "OPTIONS", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "PATCH", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "PATCH", "(URI,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "POST", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "POST", "(URI,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "PUT", "(String,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http", "HttpRequest", True, "PUT", "(URI,Object)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.cookie", "Cookie", True, "getDomain", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.cookie", "Cookie", True, "getName", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.cookie", "Cookie", True, "getPath", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.cookie", "Cookie", True, "getValue", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.cookie", "Cookies", True, "findCookie", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - ["io.micronaut.http.cookie", "Cookies", True, "get", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - ["io.micronaut.http.cookie", "Cookies", True, "getAll", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.cookie", "Cookies", True, "findCookie", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.cookie", "Cookie", True, "getValue", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.cookie", "Cookie", True, "getName", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.cookie", "Cookie", True, "getDomain", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - - ["io.micronaut.http.cookie", "Cookie", True, "getPath", "", "", "Argument[this]", "ReturnValue", "taint", "manual"] - addsTo: pack: codeql/java-all extensible: sinkModel data: - - ["io.micronaut.http", "MutableHttpResponse", True, "header", "(CharSequence,CharSequence)", "", "Argument[1]", "response-splitting", "manual"] + - ["io.micronaut.http", "HttpResponse", True, "permanentRedirect", "(URI)", "", "Argument[0]", "url-redirection", "manual"] - ["io.micronaut.http", "HttpResponse", True, "redirect", "(URI)", "", "Argument[0]", "url-redirection", "manual"] + - ["io.micronaut.http", "HttpResponse", True, "seeOther", "(URI)", "", "Argument[0]", "url-redirection", "manual"] + - ["io.micronaut.http", "HttpResponse", True, "temporaryRedirect", "(URI)", "", "Argument[0]", "url-redirection", "manual"] + - ["io.micronaut.http", "MutableHttpResponse", True, "header", "(CharSequence,CharSequence)", "", "Argument[1]", "response-splitting", "manual"] + - ["io.micronaut.http", "MutableHttpResponse", True, "headers", "(Map)", "", "Argument[0]", "response-splitting", "manual"] diff --git a/java/ql/lib/ext/io.micronaut.http.uri.model.yml b/java/ql/lib/ext/io.micronaut.http.uri.model.yml new file mode 100644 index 00000000000..61ce1391b93 --- /dev/null +++ b/java/ql/lib/ext/io.micronaut.http.uri.model.yml @@ -0,0 +1,28 @@ +extensions: + - addsTo: + pack: codeql/java-all + extensible: summaryModel + data: + - ["io.micronaut.http.uri", "UriBuilder", True, "build", "()", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "expand", "(Map)", "", "Argument[0].MapValue", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "expand", "(Map)", "", "Argument[this]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "fragment", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "fragment", "(String)", "", "Argument[this]", "ReturnValue", "value", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "host", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "host", "(String)", "", "Argument[this]", "ReturnValue", "value", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "of", "(CharSequence)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "of", "(URI)", "", "Argument[0]", "ReturnValue", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "path", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "path", "(String)", "", "Argument[this]", "ReturnValue", "value", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "queryParam", "(String,Object[])", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "queryParam", "(String,Object[])", "", "Argument[1].ArrayElement", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "queryParam", "(String,Object[])", "", "Argument[this]", "ReturnValue", "value", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "replacePath", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "replacePath", "(String)", "", "Argument[this]", "ReturnValue", "value", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "replaceQueryParam", "(String,Object[])", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "replaceQueryParam", "(String,Object[])", "", "Argument[1].ArrayElement", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "replaceQueryParam", "(String,Object[])", "", "Argument[this]", "ReturnValue", "value", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "scheme", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "scheme", "(String)", "", "Argument[this]", "ReturnValue", "value", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "userInfo", "(String)", "", "Argument[0]", "Argument[this]", "taint", "manual"] + - ["io.micronaut.http.uri", "UriBuilder", True, "userInfo", "(String)", "", "Argument[this]", "ReturnValue", "value", "manual"] diff --git a/java/ql/lib/semmle/code/java/dataflow/FlowSources.qll b/java/ql/lib/semmle/code/java/dataflow/FlowSources.qll index 41aca7a05c4..565ceb01a7b 100644 --- a/java/ql/lib/semmle/code/java/dataflow/FlowSources.qll +++ b/java/ql/lib/semmle/code/java/dataflow/FlowSources.qll @@ -32,7 +32,6 @@ import semmle.code.java.frameworks.Thrift import semmle.code.java.frameworks.javaee.jsf.JSFRenderer import semmle.code.java.frameworks.micronaut.MicronautController import semmle.code.java.frameworks.micronaut.MicronautWebSocket -import semmle.code.java.frameworks.micronaut.MicronautConfig private import semmle.code.java.dataflow.ExternalFlow private import codeql.threatmodels.ThreatModels @@ -204,16 +203,6 @@ private class MicronautWebSocketParameterSource extends RemoteFlowSource { override string getSourceType() { result = "Micronaut WebSocket parameter" } } -private class MicronautConfigSource extends LocalUserInput { - MicronautConfigSource() { - this.asExpr() = any(MicronautConfigField f).getAnAccess() - or - this.asParameter() instanceof MicronautConfigParameter - } - - override string getThreatModel() { result = "environment" } -} - private class MicronautErrorHandlerSource extends RemoteFlowSource { MicronautErrorHandlerSource() { this.asParameter() = any(MicronautErrorHandler h).getARemoteParameter() diff --git a/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautConfig.qll b/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautConfig.qll deleted file mode 100644 index 3d1b3c5126b..00000000000 --- a/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautConfig.qll +++ /dev/null @@ -1,41 +0,0 @@ -/** Provides classes for identifying Micronaut configuration injection sources. */ -overlay[local?] -module; - -import java - -/** The annotation type `@Value` from `io.micronaut.context.annotation`. */ -class MicronautValueAnnotation extends AnnotationType { - MicronautValueAnnotation() { this.hasQualifiedName("io.micronaut.context.annotation", "Value") } -} - -/** The annotation type `@Property` from `io.micronaut.context.annotation`. */ -class MicronautPropertyAnnotation extends AnnotationType { - MicronautPropertyAnnotation() { - this.hasQualifiedName("io.micronaut.context.annotation", "Property") - } -} - -/** - * A field annotated with Micronaut's `@Value` or `@Property` annotation, - * representing an injected configuration value. - */ -class MicronautConfigField extends Field { - MicronautConfigField() { - this.getAnAnnotation().getType() instanceof MicronautValueAnnotation - or - this.getAnAnnotation().getType() instanceof MicronautPropertyAnnotation - } -} - -/** - * A parameter annotated with Micronaut's `@Value` or `@Property` annotation, - * representing an injected configuration value. - */ -class MicronautConfigParameter extends Parameter { - MicronautConfigParameter() { - this.getAnAnnotation().getType() instanceof MicronautValueAnnotation - or - this.getAnAnnotation().getType() instanceof MicronautPropertyAnnotation - } -} diff --git a/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautController.qll b/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautController.qll index 5be5308b366..c0ca30d9799 100644 --- a/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautController.qll +++ b/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautController.qll @@ -59,6 +59,25 @@ class MicronautHttpInputAnnotation extends Annotation { } } +/** Holds if `parameter` is explicitly bound to remote HTTP request data. */ +private predicate isExplicitlyTaintedInput(Parameter parameter) { + parameter.getAnAnnotation() instanceof MicronautHttpInputAnnotation + or + parameter.getAnAnnotation().getType() instanceof MicronautRequestBeanAnnotation + or + parameter + .getType() + .(RefType) + .getASourceSupertype*() + .hasQualifiedName("io.micronaut.http", ["HttpRequest", "HttpHeaders", "HttpParameters"]) + or + parameter + .getType() + .(RefType) + .getASourceSupertype*() + .hasQualifiedName("io.micronaut.http.cookie", "Cookies") +} + /** A parameter of a `MicronautRequestMappingMethod`. */ class MicronautRequestMappingParameter extends Parameter { MicronautRequestMappingParameter() { this.getCallable() instanceof MicronautRequestMappingMethod } @@ -67,11 +86,6 @@ class MicronautRequestMappingParameter extends Parameter { predicate isNotDirectlyTaintedInput() { this.getType().(RefType).getAnAncestor().hasQualifiedName("io.micronaut.http", "HttpResponse") or - this.getType() - .(RefType) - .getAnAncestor() - .hasQualifiedName("io.micronaut.http", "MutableHttpResponse") - or this.getType().(RefType).getAnAncestor().hasQualifiedName("java.security", "Principal") or this.getType().(RefType).getAnAncestor().hasQualifiedName("java.util", "Locale") @@ -80,35 +94,19 @@ class MicronautRequestMappingParameter extends Parameter { or this.getType().(RefType).getAnAncestor().hasQualifiedName("java.time", "ZoneId") or + this.getType().(RefType).getAnAncestor() instanceof TypeInputStream + or + this.getType().(RefType).getAnAncestor().hasQualifiedName("java.io", "Reader") + or // @Value/@Property parameters are configuration injection, not HTTP input this.getAnAnnotation() .getType() .hasQualifiedName("io.micronaut.context.annotation", ["Value", "Property"]) } - private predicate isExplicitlyTaintedInput() { - // The MicronautHttpInputAnnotation allows access to the URI path, - // request parameters, cookie values, headers, and the body of the request. - this.getAnAnnotation() instanceof MicronautHttpInputAnnotation - or - // A @RequestBean parameter binds multiple request attributes into a POJO - this.getAnAnnotation().getType() instanceof MicronautRequestBeanAnnotation - or - // An HttpRequest parameter provides access to request data - this.getType() - .(RefType) - .getASourceSupertype*() - .hasQualifiedName("io.micronaut.http", "HttpRequest") - or - // InputStream or Reader parameters allow access to the body of a request - this.getType().(RefType).getAnAncestor() instanceof TypeInputStream - or - this.getType().(RefType).getAnAncestor().hasQualifiedName("java.io", "Reader") - } - /** Holds if the input is tainted (i.e. comes from user-controlled input). */ predicate isTaintedInput() { - this.isExplicitlyTaintedInput() + isExplicitlyTaintedInput(this) or not this.isNotDirectlyTaintedInput() } @@ -126,11 +124,7 @@ class MicronautErrorHandler extends Method { /** Gets a parameter that carries user-controlled request data. */ Parameter getARemoteParameter() { result = this.getAParameter() and - result - .getType() - .(RefType) - .getASourceSupertype*() - .hasQualifiedName("io.micronaut.http", "HttpRequest") + isExplicitlyTaintedInput(result) } } diff --git a/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautWebSocket.qll b/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautWebSocket.qll index eafbca58e69..8f4fdfb58f3 100644 --- a/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautWebSocket.qll +++ b/java/ql/lib/semmle/code/java/frameworks/micronaut/MicronautWebSocket.qll @@ -26,7 +26,7 @@ class MicronautServerWebSocketClass extends Class { class MicronautWebSocketHandlerAnnotation extends AnnotationType { MicronautWebSocketHandlerAnnotation() { this.getPackage().hasName("io.micronaut.websocket.annotation") and - this.hasName(["OnMessage", "OnOpen"]) + this.hasName(["OnClose", "OnMessage", "OnOpen"]) } } @@ -44,10 +44,10 @@ class MicronautWebSocketMessageHandler extends Method { class MicronautWebSocketParameter extends Parameter { MicronautWebSocketParameter() { this.getCallable() instanceof MicronautWebSocketMessageHandler and - // Exclude WebSocketSession parameters + // Exclude framework-provided WebSocket lifecycle parameters not this.getType() .(RefType) .getAnAncestor() - .hasQualifiedName("io.micronaut.websocket", "WebSocketSession") + .hasQualifiedName("io.micronaut.websocket", ["CloseReason", "WebSocketSession"]) } } diff --git a/java/ql/test/library-tests/frameworks/micronaut/MicronautConfigTest.java b/java/ql/test/library-tests/frameworks/micronaut/MicronautConfigTest.java deleted file mode 100644 index f8cd7a44669..00000000000 --- a/java/ql/test/library-tests/frameworks/micronaut/MicronautConfigTest.java +++ /dev/null @@ -1,30 +0,0 @@ -import io.micronaut.context.annotation.Value; -import io.micronaut.context.annotation.Property; -import io.micronaut.http.annotation.*; - -@Controller("/config") -class MicronautConfigTest { - - void sink(Object o) {} - - @Value("${app.secret}") - String secretValue; - - @Property(name = "app.api-key") - String apiKey; - - @Get("/secret") - void testValueField() { - sink(secretValue); // $hasTaintFlow - } - - @Get("/key") - void testPropertyField() { - sink(apiKey); // $hasTaintFlow - } - - @Get("/param") - void testValueParam(@Value("${app.name}") String appName) { - sink(appName); // $hasTaintFlow - } -} diff --git a/java/ql/test/library-tests/frameworks/micronaut/MicronautControllerTest.java b/java/ql/test/library-tests/frameworks/micronaut/MicronautControllerTest.java index 3a1b2caaf6a..4bc38d949b1 100644 --- a/java/ql/test/library-tests/frameworks/micronaut/MicronautControllerTest.java +++ b/java/ql/test/library-tests/frameworks/micronaut/MicronautControllerTest.java @@ -1,5 +1,6 @@ import io.micronaut.http.annotation.*; import io.micronaut.http.*; +import io.micronaut.http.cookie.Cookies; import java.io.InputStream; import java.io.Reader; @@ -58,14 +59,29 @@ class MicronautControllerTest { sink(request); // $hasTaintFlow } + @Get("/headers") + void testHttpHeaders(HttpHeaders headers) { + sink(headers); // $hasTaintFlow + } + + @Get("/parameters") + void testHttpParameters(HttpParameters parameters) { + sink(parameters); // $hasTaintFlow + } + + @Get("/cookies") + void testCookies(Cookies cookies) { + sink(cookies); // $hasTaintFlow + } + @Post("/stream") - void testInputStream(InputStream stream) { + void testInputStream(@Body InputStream stream) { sink(stream); // $hasTaintFlow } @Post("/reader") void testReader(Reader reader) { - sink(reader); // $hasTaintFlow + sink(reader); } @Post("/post") @@ -92,4 +108,17 @@ class MicronautControllerTest { void testErrorHandler(HttpRequest request) { sink(request); // $hasTaintFlow } + + @io.micronaut.http.annotation.Error + void testAnnotatedErrorHandler(@Header String header, @RequestBean Object bean) { + sink(header); // $hasTaintFlow + sink(bean); // $hasTaintFlow + } + + @io.micronaut.http.annotation.Error + void testErrorHandlerCarriers(HttpHeaders headers, HttpParameters parameters, Cookies cookies) { + sink(headers); // $hasTaintFlow + sink(parameters); // $hasTaintFlow + sink(cookies); // $hasTaintFlow + } } diff --git a/java/ql/test/library-tests/frameworks/micronaut/MicronautHttpClientTest.java b/java/ql/test/library-tests/frameworks/micronaut/MicronautHttpClientTest.java index 86e045f6f8d..b073266a501 100644 --- a/java/ql/test/library-tests/frameworks/micronaut/MicronautHttpClientTest.java +++ b/java/ql/test/library-tests/frameworks/micronaut/MicronautHttpClientTest.java @@ -2,7 +2,9 @@ import io.micronaut.http.*; import io.micronaut.http.client.HttpClient; import io.micronaut.http.client.BlockingHttpClient; import io.micronaut.http.uri.UriBuilder; +import io.micronaut.core.type.Argument; import java.net.URI; +import java.util.Collections; class MicronautHttpClientTest { @@ -34,6 +36,39 @@ class MicronautHttpClientTest { client.toBlocking().exchange(url, String.class); // $hasTaintFlow } + void testRetrieveStringClassClass() { + client.toBlocking().retrieve(taint(), String.class, Object.class); // $hasTaintFlow + } + + void testExchangeStringClassClass() { + client.toBlocking().exchange(taint(), String.class, Object.class); // $hasTaintFlow + } + + void testBlockingRequest() { + client.toBlocking().retrieve(HttpRequest.GET(taint())); // $hasTaintFlow + client.toBlocking().retrieve(HttpRequest.GET(taint()), String.class); // $hasTaintFlow + client.toBlocking().retrieve(HttpRequest.GET(taint()), new Argument()); // $hasTaintFlow + client.toBlocking().retrieve(HttpRequest.GET(taint()), new Argument(), new Argument()); // $hasTaintFlow + client.toBlocking().exchange(HttpRequest.GET(taint())); // $hasTaintFlow + client.toBlocking().exchange(HttpRequest.GET(taint()), String.class); // $hasTaintFlow + client.toBlocking().exchange(HttpRequest.GET(taint()), new Argument()); // $hasTaintFlow + client.toBlocking().exchange(HttpRequest.GET(taint()), new Argument(), new Argument()); // $hasTaintFlow + } + + void testNonBlockingClient() { + client.retrieve(taint()); // $hasTaintFlow + client.exchange(taint()); // $hasTaintFlow + client.exchange(taint(), String.class); // $hasTaintFlow + client.retrieve(HttpRequest.GET(taint())); // $hasTaintFlow + client.retrieve(HttpRequest.GET(taint()), String.class); // $hasTaintFlow + client.retrieve(HttpRequest.GET(taint()), new Argument()); // $hasTaintFlow + client.retrieve(HttpRequest.GET(taint()), new Argument(), new Argument()); // $hasTaintFlow + client.exchange(HttpRequest.GET(taint())); // $hasTaintFlow + client.exchange(HttpRequest.GET(taint()), String.class); // $hasTaintFlow + client.exchange(HttpRequest.GET(taint()), new Argument()); // $hasTaintFlow + client.exchange(HttpRequest.GET(taint()), new Argument(), new Argument()); // $hasTaintFlow + } + void testGetFactory() { HttpRequest req = HttpRequest.GET(taint()); sink(req); // $hasTaintFlow @@ -69,6 +104,21 @@ class MicronautHttpClientTest { sink(req); // $hasTaintFlow } + void testUriFactories() { + sink(HttpRequest.GET(URI.create(taint()))); // $hasTaintFlow + sink(HttpRequest.POST(URI.create(taint()), "body")); // $hasTaintFlow + sink(HttpRequest.PUT(URI.create(taint()), "body")); // $hasTaintFlow + sink(HttpRequest.DELETE(URI.create(taint()))); // $hasTaintFlow + sink(HttpRequest.DELETE(URI.create(taint()), "body")); // $hasTaintFlow + sink(HttpRequest.PATCH(URI.create(taint()), "body")); // $hasTaintFlow + sink(HttpRequest.HEAD(URI.create(taint()))); // $hasTaintFlow + sink(HttpRequest.OPTIONS(URI.create(taint()))); // $hasTaintFlow + } + + void testDeleteFactoryWithBody() { + sink(HttpRequest.DELETE(taint(), "body")); // $hasTaintFlow + } + void testUriBuilderOfCharSequence() { URI uri = UriBuilder.of(taint()).build(); sink(uri); // $hasTaintFlow @@ -103,4 +153,32 @@ class MicronautHttpClientTest { URI uri = UriBuilder.of("http://example.com").fragment(taint()).build(); sink(uri); // $hasTaintFlow } + + void testUriBuilderMutation() { + UriBuilder builder = UriBuilder.of("http://example.com"); + builder.host(taint()); + sink(builder.build()); // $hasTaintFlow + } + + void testUriBuilderReplaceQueryParam() { + URI uri = UriBuilder.of("http://example.com").replaceQueryParam("key", taint()).build(); + sink(uri); // $hasTaintFlow + } + + void testUriBuilderAdditionalFluentMethods() { + sink(UriBuilder.of("http://example.com").scheme(taint()).build()); // $hasTaintFlow + sink(UriBuilder.of("http://example.com").userInfo(taint()).build()); // $hasTaintFlow + sink(UriBuilder.of("http://example.com").replacePath(taint()).build()); // $hasTaintFlow + } + + void testUriBuilderExpandBuilder() { + URI uri = UriBuilder.of(taint()).expand(Collections.singletonMap("id", "value")); + sink(uri); // $hasTaintFlow + } + + void testUriBuilderExpandValue() { + URI uri = UriBuilder.of("http://example.com/{id}") + .expand(Collections.singletonMap("id", taint())); + sink(uri); // $hasTaintFlow + } } diff --git a/java/ql/test/library-tests/frameworks/micronaut/MicronautHttpRequestTest.java b/java/ql/test/library-tests/frameworks/micronaut/MicronautHttpRequestTest.java index 0fc55343122..b3340b6c6cb 100644 --- a/java/ql/test/library-tests/frameworks/micronaut/MicronautHttpRequestTest.java +++ b/java/ql/test/library-tests/frameworks/micronaut/MicronautHttpRequestTest.java @@ -1,6 +1,8 @@ import io.micronaut.http.annotation.*; import io.micronaut.http.*; import io.micronaut.http.cookie.*; +import java.util.List; +import java.util.Map; @Controller("/http") class MicronautHttpRequestTest { @@ -11,17 +13,27 @@ class MicronautHttpRequestTest { void testHeaders(HttpRequest request) { sink(request.getHeaders()); // $hasTaintFlow sink(request.getHeaders().get("X-Custom")); // $hasTaintFlow - sink(request.getHeaders().getAll("X-Custom")); // $hasTaintFlow - sink(request.getHeaders().getFirst("X-Custom")); // $hasTaintFlow - sink(request.getHeaders().values()); // $hasTaintFlow + sink(request.getHeaders().getAll("X-Custom").get(0)); // $hasTaintFlow + sink(request.getHeaders().getFirst("X-Custom").get()); // $hasTaintFlow + sink(request.getHeaders().getValue("X-Custom").get(0)); // $hasTaintFlow + sink(request.getHeaders().values().iterator().next().get(0)); // $hasTaintFlow + sink(request.getHeaders().asMap().get("X-Custom").get(0)); // $hasTaintFlow + sink(request.getHeaders().asProperties().get("X-Custom")); // $hasTaintFlow + sink(request.getHeaders().subMap("X", List.class).get("Custom").get(0)); // $hasTaintFlow + for (Map.Entry> header : request.getHeaders()) { + sink(header.getValue().get(0)); // $hasTaintFlow + } } @Get("/params") void testParameters(HttpRequest request) { sink(request.getParameters()); // $hasTaintFlow sink(request.getParameters().get("q")); // $hasTaintFlow - sink(request.getParameters().getAll("q")); // $hasTaintFlow - sink(request.getParameters().getFirst("q")); // $hasTaintFlow + sink(request.getParameters().getAll("q").get(0)); // $hasTaintFlow + sink(request.getParameters().getFirst("q").get()); // $hasTaintFlow + sink(request.getParameters().getValue("q").get(0)); // $hasTaintFlow + sink(request.getParameters().values().iterator().next().get(0)); // $hasTaintFlow + sink(request.getParameters().asMap().get("q").get(0)); // $hasTaintFlow } @Get("/cookies") diff --git a/java/ql/test/library-tests/frameworks/micronaut/MicronautWebSocketTest.java b/java/ql/test/library-tests/frameworks/micronaut/MicronautWebSocketTest.java index 0c46a311b2b..99f7a575a22 100644 --- a/java/ql/test/library-tests/frameworks/micronaut/MicronautWebSocketTest.java +++ b/java/ql/test/library-tests/frameworks/micronaut/MicronautWebSocketTest.java @@ -1,4 +1,5 @@ import io.micronaut.websocket.annotation.*; +import io.micronaut.websocket.CloseReason; import io.micronaut.websocket.WebSocketSession; @ServerWebSocket("/chat/{room}") @@ -15,4 +16,11 @@ class MicronautWebSocketTest { void onOpen(String room, WebSocketSession session) { sink(room); // $hasTaintFlow } + + @OnClose + void onClose(String room, CloseReason reason, WebSocketSession session) { + sink(room); // $hasTaintFlow + sink(reason); + sink(session); + } } diff --git a/java/ql/test/query-tests/security/CWE-113/semmle/tests/MicronautResponseSplitting.java b/java/ql/test/query-tests/security/CWE-113/semmle/tests/MicronautResponseSplitting.java index 405bb66fcd4..4ba35f86959 100644 --- a/java/ql/test/query-tests/security/CWE-113/semmle/tests/MicronautResponseSplitting.java +++ b/java/ql/test/query-tests/security/CWE-113/semmle/tests/MicronautResponseSplitting.java @@ -3,6 +3,7 @@ import io.micronaut.http.annotation.Get; import io.micronaut.http.annotation.QueryValue; import io.micronaut.http.HttpResponse; import io.micronaut.http.MutableHttpResponse; +import java.util.Collections; @Controller("/headers") public class MicronautResponseSplitting { @@ -19,4 +20,10 @@ public class MicronautResponseSplitting { String sanitized = headerValue.replace('\n', ' ').replace('\r', ' '); return HttpResponse.ok().header("X-Custom", sanitized); } + + @Get("/bad-map") + public MutableHttpResponse badMap(@QueryValue String headerValue) { + // BAD: user-controlled header value + return HttpResponse.ok().headers(Collections.singletonMap("X-Custom", headerValue)); + } } diff --git a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected index ce0916a0323..5be15214151 100644 --- a/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected +++ b/java/ql/test/query-tests/security/CWE-113/semmle/tests/ResponseSplitting.expected @@ -1,25 +1,33 @@ #select -| MicronautResponseSplitting.java:13:53:13:63 | headerValue | MicronautResponseSplitting.java:11:39:11:68 | headerValue : String | MicronautResponseSplitting.java:13:53:13:63 | headerValue | This header depends on a $@, which may cause a response-splitting vulnerability. | MicronautResponseSplitting.java:11:39:11:68 | headerValue | user-provided value | +| MicronautResponseSplitting.java:14:53:14:63 | headerValue | MicronautResponseSplitting.java:12:39:12:68 | headerValue : String | MicronautResponseSplitting.java:14:53:14:63 | headerValue | This header depends on a $@, which may cause a response-splitting vulnerability. | MicronautResponseSplitting.java:12:39:12:68 | headerValue | user-provided value | +| MicronautResponseSplitting.java:27:42:27:90 | singletonMap(...) | MicronautResponseSplitting.java:25:42:25:71 | headerValue : String | MicronautResponseSplitting.java:27:42:27:90 | singletonMap(...) | This header depends on a $@, which may cause a response-splitting vulnerability. | MicronautResponseSplitting.java:25:42:25:71 | headerValue | user-provided value | | ResponseSplitting.java:23:23:23:28 | cookie | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:23:23:23:28 | cookie | This header depends on a $@, which may cause a response-splitting vulnerability. | ResponseSplitting.java:22:39:22:66 | getParameter(...) | user-provided value | | ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | ResponseSplitting.java:28:38:28:72 | getParameter(...) | This header depends on a $@, which may cause a response-splitting vulnerability. | ResponseSplitting.java:28:38:28:72 | getParameter(...) | user-provided value | | ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | ResponseSplitting.java:29:38:29:72 | getParameter(...) | This header depends on a $@, which may cause a response-splitting vulnerability. | ResponseSplitting.java:29:38:29:72 | getParameter(...) | user-provided value | | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | This header depends on a $@, which may cause a response-splitting vulnerability. | ResponseSplitting.java:53:14:53:48 | getParameter(...) | user-provided value | edges -| MicronautResponseSplitting.java:11:39:11:68 | headerValue : String | MicronautResponseSplitting.java:13:53:13:63 | headerValue | provenance | Sink:MaD:1 | -| ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | ResponseSplitting.java:23:23:23:28 | cookie | provenance | Sink:MaD:2 | -| ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | provenance | Src:MaD:4 MaD:6 | -| ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:27 | t : String | provenance | Src:MaD:4 | -| ResponseSplitting.java:59:27:59:27 | t : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | provenance | MaD:5 Sink:MaD:3 | +| MicronautResponseSplitting.java:12:39:12:68 | headerValue : String | MicronautResponseSplitting.java:14:53:14:63 | headerValue | provenance | Sink:MaD:1 | +| MicronautResponseSplitting.java:25:42:25:71 | headerValue : String | MicronautResponseSplitting.java:27:79:27:89 | headerValue : String | provenance | | +| MicronautResponseSplitting.java:27:79:27:89 | headerValue : String | MicronautResponseSplitting.java:27:42:27:90 | singletonMap(...) | provenance | MaD:7 Sink:MaD:2 | +| ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | ResponseSplitting.java:23:23:23:28 | cookie | provenance | Sink:MaD:3 | +| ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | provenance | Src:MaD:5 MaD:8 | +| ResponseSplitting.java:53:14:53:48 | getParameter(...) : String | ResponseSplitting.java:59:27:59:27 | t : String | provenance | Src:MaD:5 | +| ResponseSplitting.java:59:27:59:27 | t : String | ResponseSplitting.java:59:27:59:57 | replaceFirst(...) | provenance | MaD:6 Sink:MaD:4 | models | 1 | Sink: io.micronaut.http; MutableHttpResponse; true; header; (CharSequence,CharSequence); ; Argument[1]; response-splitting; manual | -| 2 | Sink: javax.servlet.http; HttpServletResponse; false; addCookie; ; ; Argument[0]; response-splitting; manual | -| 3 | Sink: javax.servlet.http; HttpServletResponse; false; setHeader; ; ; Argument[0..1]; response-splitting; manual | -| 4 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | -| 5 | Summary: java.lang; String; false; replaceFirst; ; ; Argument[this]; ReturnValue; taint; manual | -| 6 | Summary: javax.servlet.http; Cookie; false; Cookie; ; ; Argument[1]; Argument[this]; taint; manual | +| 2 | Sink: io.micronaut.http; MutableHttpResponse; true; headers; (Map); ; Argument[0]; response-splitting; manual | +| 3 | Sink: javax.servlet.http; HttpServletResponse; false; addCookie; ; ; Argument[0]; response-splitting; manual | +| 4 | Sink: javax.servlet.http; HttpServletResponse; false; setHeader; ; ; Argument[0..1]; response-splitting; manual | +| 5 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | +| 6 | Summary: java.lang; String; false; replaceFirst; ; ; Argument[this]; ReturnValue; taint; manual | +| 7 | Summary: java.util; Collections; false; singletonMap; (Object,Object); ; Argument[1]; ReturnValue.MapValue; value; manual | +| 8 | Summary: javax.servlet.http; Cookie; false; Cookie; ; ; Argument[1]; Argument[this]; taint; manual | nodes -| MicronautResponseSplitting.java:11:39:11:68 | headerValue : String | semmle.label | headerValue : String | -| MicronautResponseSplitting.java:13:53:13:63 | headerValue | semmle.label | headerValue | +| MicronautResponseSplitting.java:12:39:12:68 | headerValue : String | semmle.label | headerValue : String | +| MicronautResponseSplitting.java:14:53:14:63 | headerValue | semmle.label | headerValue | +| MicronautResponseSplitting.java:25:42:25:71 | headerValue : String | semmle.label | headerValue : String | +| MicronautResponseSplitting.java:27:42:27:90 | singletonMap(...) | semmle.label | singletonMap(...) | +| MicronautResponseSplitting.java:27:79:27:89 | headerValue : String | semmle.label | headerValue : String | | ResponseSplitting.java:22:20:22:67 | new Cookie(...) : Cookie | semmle.label | new Cookie(...) : Cookie | | ResponseSplitting.java:22:39:22:66 | getParameter(...) : String | semmle.label | getParameter(...) : String | | ResponseSplitting.java:23:23:23:28 | cookie | semmle.label | cookie | diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/MicronautUrlRedirect.java b/java/ql/test/query-tests/security/CWE-601/semmle/tests/MicronautUrlRedirect.java index 2eeb3b50a11..6b3b5331a02 100644 --- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/MicronautUrlRedirect.java +++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/MicronautUrlRedirect.java @@ -22,4 +22,19 @@ public class MicronautUrlRedirect { } return HttpResponse.ok(); } + + @Get("/permanent") + public MutableHttpResponse permanent(@QueryValue String target) { + return HttpResponse.permanentRedirect(URI.create(target)); + } + + @Get("/see-other") + public MutableHttpResponse seeOther(@QueryValue String target) { + return HttpResponse.seeOther(URI.create(target)); + } + + @Get("/temporary") + public MutableHttpResponse temporary(@QueryValue String target) { + return HttpResponse.temporaryRedirect(URI.create(target)); + } } diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected index 79c8258c7ba..4e311cdd560 100644 --- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected +++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected @@ -1,5 +1,8 @@ #select | MicronautUrlRedirect.java:14:38:14:55 | create(...) | MicronautUrlRedirect.java:12:39:12:63 | target : String | MicronautUrlRedirect.java:14:38:14:55 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:12:39:12:63 | target | user-provided value | +| MicronautUrlRedirect.java:28:47:28:64 | create(...) | MicronautUrlRedirect.java:27:45:27:69 | target : String | MicronautUrlRedirect.java:28:47:28:64 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:27:45:27:69 | target | user-provided value | +| MicronautUrlRedirect.java:33:38:33:55 | create(...) | MicronautUrlRedirect.java:32:44:32:68 | target : String | MicronautUrlRedirect.java:33:38:33:55 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:32:44:32:68 | target | user-provided value | +| MicronautUrlRedirect.java:38:47:38:64 | create(...) | MicronautUrlRedirect.java:37:45:37:69 | target : String | MicronautUrlRedirect.java:38:47:38:64 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:37:45:37:69 | target | user-provided value | | UrlRedirect2.java:27:25:27:54 | getParameter(...) | UrlRedirect2.java:27:25:27:54 | getParameter(...) | UrlRedirect2.java:27:25:27:54 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect2.java:27:25:27:54 | getParameter(...) | user-provided value | | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:23:25:23:54 | getParameter(...) | user-provided value | | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:32:37:32:66 | getParameter(...) | user-provided value | @@ -8,23 +11,41 @@ | mad/Test.java:14:22:14:38 | (...)... | mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:22:14:38 | (...)... | Untrusted URL redirection depends on a $@. | mad/Test.java:9:16:9:41 | getParameter(...) | user-provided value | edges | MicronautUrlRedirect.java:12:39:12:63 | target : String | MicronautUrlRedirect.java:14:49:14:54 | target : String | provenance | | -| MicronautUrlRedirect.java:14:49:14:54 | target : String | MicronautUrlRedirect.java:14:38:14:55 | create(...) | provenance | MaD:5 Sink:MaD:1 | -| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | provenance | Src:MaD:3 MaD:4 | -| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | provenance | Src:MaD:3 | +| MicronautUrlRedirect.java:14:49:14:54 | target : String | MicronautUrlRedirect.java:14:38:14:55 | create(...) | provenance | MaD:8 Sink:MaD:2 | +| MicronautUrlRedirect.java:27:45:27:69 | target : String | MicronautUrlRedirect.java:28:58:28:63 | target : String | provenance | | +| MicronautUrlRedirect.java:28:58:28:63 | target : String | MicronautUrlRedirect.java:28:47:28:64 | create(...) | provenance | MaD:8 Sink:MaD:1 | +| MicronautUrlRedirect.java:32:44:32:68 | target : String | MicronautUrlRedirect.java:33:49:33:54 | target : String | provenance | | +| MicronautUrlRedirect.java:33:49:33:54 | target : String | MicronautUrlRedirect.java:33:38:33:55 | create(...) | provenance | MaD:8 Sink:MaD:3 | +| MicronautUrlRedirect.java:37:45:37:69 | target : String | MicronautUrlRedirect.java:38:58:38:63 | target : String | provenance | | +| MicronautUrlRedirect.java:38:58:38:63 | target : String | MicronautUrlRedirect.java:38:47:38:64 | create(...) | provenance | MaD:8 Sink:MaD:4 | +| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | provenance | Src:MaD:6 MaD:7 | +| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | provenance | Src:MaD:6 | | UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:14 | input : String | provenance | | -| UrlRedirect.java:46:10:46:14 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | provenance | MaD:4 | -| mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:31:14:38 | source(...) : String | provenance | Src:MaD:3 | -| mad/Test.java:14:31:14:38 | source(...) : String | mad/Test.java:14:22:14:38 | (...)... | provenance | Sink:MaD:2 | +| UrlRedirect.java:46:10:46:14 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | provenance | MaD:7 | +| mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:31:14:38 | source(...) : String | provenance | Src:MaD:6 | +| mad/Test.java:14:31:14:38 | source(...) : String | mad/Test.java:14:22:14:38 | (...)... | provenance | Sink:MaD:5 | models -| 1 | Sink: io.micronaut.http; HttpResponse; true; redirect; (URI); ; Argument[0]; url-redirection; manual | -| 2 | Sink: org.kohsuke.stapler; HttpResponses; true; redirectTo; (String); ; Argument[0]; url-redirection; ai-manual | -| 3 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | -| 4 | Summary: java.lang; String; false; replaceAll; ; ; Argument[this]; ReturnValue; taint; manual | -| 5 | Summary: java.net; URI; false; create; ; ; Argument[0]; ReturnValue; taint; manual | +| 1 | Sink: io.micronaut.http; HttpResponse; true; permanentRedirect; (URI); ; Argument[0]; url-redirection; manual | +| 2 | Sink: io.micronaut.http; HttpResponse; true; redirect; (URI); ; Argument[0]; url-redirection; manual | +| 3 | Sink: io.micronaut.http; HttpResponse; true; seeOther; (URI); ; Argument[0]; url-redirection; manual | +| 4 | Sink: io.micronaut.http; HttpResponse; true; temporaryRedirect; (URI); ; Argument[0]; url-redirection; manual | +| 5 | Sink: org.kohsuke.stapler; HttpResponses; true; redirectTo; (String); ; Argument[0]; url-redirection; ai-manual | +| 6 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | +| 7 | Summary: java.lang; String; false; replaceAll; ; ; Argument[this]; ReturnValue; taint; manual | +| 8 | Summary: java.net; URI; false; create; ; ; Argument[0]; ReturnValue; taint; manual | nodes | MicronautUrlRedirect.java:12:39:12:63 | target : String | semmle.label | target : String | | MicronautUrlRedirect.java:14:38:14:55 | create(...) | semmle.label | create(...) | | MicronautUrlRedirect.java:14:49:14:54 | target : String | semmle.label | target : String | +| MicronautUrlRedirect.java:27:45:27:69 | target : String | semmle.label | target : String | +| MicronautUrlRedirect.java:28:47:28:64 | create(...) | semmle.label | create(...) | +| MicronautUrlRedirect.java:28:58:28:63 | target : String | semmle.label | target : String | +| MicronautUrlRedirect.java:32:44:32:68 | target : String | semmle.label | target : String | +| MicronautUrlRedirect.java:33:38:33:55 | create(...) | semmle.label | create(...) | +| MicronautUrlRedirect.java:33:49:33:54 | target : String | semmle.label | target : String | +| MicronautUrlRedirect.java:37:45:37:69 | target : String | semmle.label | target : String | +| MicronautUrlRedirect.java:38:47:38:64 | create(...) | semmle.label | create(...) | +| MicronautUrlRedirect.java:38:58:38:63 | target : String | semmle.label | target : String | | UrlRedirect2.java:27:25:27:54 | getParameter(...) | semmle.label | getParameter(...) | | UrlRedirect.java:23:25:23:54 | getParameter(...) | semmle.label | getParameter(...) | | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | semmle.label | weakCleanup(...) | diff --git a/java/ql/test/query-tests/security/CWE-918/MicronautSSRF.java b/java/ql/test/query-tests/security/CWE-918/MicronautSSRF.java index 128a0cfa710..8426390a35f 100644 --- a/java/ql/test/query-tests/security/CWE-918/MicronautSSRF.java +++ b/java/ql/test/query-tests/security/CWE-918/MicronautSSRF.java @@ -2,6 +2,7 @@ import io.micronaut.http.annotation.Controller; import io.micronaut.http.annotation.Get; import io.micronaut.http.annotation.QueryValue; import io.micronaut.http.client.HttpClient; +import io.micronaut.http.HttpRequest; import io.micronaut.http.uri.UriBuilder; import java.net.URI; @@ -30,4 +31,19 @@ public class MicronautSSRF { URI uri = UriBuilder.of("http://example.com").host(host).build(); return client.toBlocking().retrieve(uri.toString()); // $ Alert } + + @Get("/blocking-request") + public Object testBlockingRequest(@QueryValue String url) { // $ Source + return client.toBlocking().exchange(HttpRequest.GET(url)); // $ Alert + } + + @Get("/non-blocking") + public Object testNonBlocking(@QueryValue String url) { // $ Source + return client.exchange(url); // $ Alert + } + + @Get("/non-blocking-request") + public Object testNonBlockingRequest(@QueryValue String url) { // $ Source + return client.exchange(HttpRequest.GET(url)); // $ Alert + } } diff --git a/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected b/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected index 9c44be4a386..6974c8f5cf5 100644 --- a/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected +++ b/java/ql/test/query-tests/security/CWE-918/RequestForgery.expected @@ -226,10 +226,13 @@ | JdbcUrlSSRF.java:86:19:86:25 | jdbcUrl | JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:86:19:86:25 | jdbcUrl | Potential server-side request forgery due to a $@. | JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) | user-provided value | | JdbcUrlSSRF.java:87:19:87:25 | jdbcUrl | JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:87:19:87:25 | jdbcUrl | Potential server-side request forgery due to a $@. | JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) | user-provided value | | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | Potential server-side request forgery due to a $@. | JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) | user-provided value | -| MicronautSSRF.java:15:45:15:47 | url | MicronautSSRF.java:14:32:14:53 | url : String | MicronautSSRF.java:15:45:15:47 | url | Potential server-side request forgery due to a $@. | MicronautSSRF.java:14:32:14:53 | url | user-provided value | -| MicronautSSRF.java:20:45:20:47 | url | MicronautSSRF.java:19:42:19:63 | url : String | MicronautSSRF.java:20:45:20:47 | url | Potential server-side request forgery due to a $@. | MicronautSSRF.java:19:42:19:63 | url | user-provided value | -| MicronautSSRF.java:25:45:25:47 | url | MicronautSSRF.java:24:37:24:58 | url : String | MicronautSSRF.java:25:45:25:47 | url | Potential server-side request forgery due to a $@. | MicronautSSRF.java:24:37:24:58 | url | user-provided value | -| MicronautSSRF.java:31:45:31:58 | toString(...) | MicronautSSRF.java:29:34:29:56 | host : String | MicronautSSRF.java:31:45:31:58 | toString(...) | Potential server-side request forgery due to a $@. | MicronautSSRF.java:29:34:29:56 | host | user-provided value | +| MicronautSSRF.java:16:45:16:47 | url | MicronautSSRF.java:15:32:15:53 | url : String | MicronautSSRF.java:16:45:16:47 | url | Potential server-side request forgery due to a $@. | MicronautSSRF.java:15:32:15:53 | url | user-provided value | +| MicronautSSRF.java:21:45:21:47 | url | MicronautSSRF.java:20:42:20:63 | url : String | MicronautSSRF.java:21:45:21:47 | url | Potential server-side request forgery due to a $@. | MicronautSSRF.java:20:42:20:63 | url | user-provided value | +| MicronautSSRF.java:26:45:26:47 | url | MicronautSSRF.java:25:37:25:58 | url : String | MicronautSSRF.java:26:45:26:47 | url | Potential server-side request forgery due to a $@. | MicronautSSRF.java:25:37:25:58 | url | user-provided value | +| MicronautSSRF.java:32:45:32:58 | toString(...) | MicronautSSRF.java:30:34:30:56 | host : String | MicronautSSRF.java:32:45:32:58 | toString(...) | Potential server-side request forgery due to a $@. | MicronautSSRF.java:30:34:30:56 | host | user-provided value | +| MicronautSSRF.java:37:45:37:64 | GET(...) | MicronautSSRF.java:36:39:36:60 | url : String | MicronautSSRF.java:37:45:37:64 | GET(...) | Potential server-side request forgery due to a $@. | MicronautSSRF.java:36:39:36:60 | url | user-provided value | +| MicronautSSRF.java:42:32:42:34 | url | MicronautSSRF.java:41:35:41:56 | url : String | MicronautSSRF.java:42:32:42:34 | url | Potential server-side request forgery due to a $@. | MicronautSSRF.java:41:35:41:56 | url | user-provided value | +| MicronautSSRF.java:47:32:47:51 | GET(...) | MicronautSSRF.java:46:42:46:63 | url : String | MicronautSSRF.java:47:32:47:51 | GET(...) | Potential server-side request forgery due to a $@. | MicronautSSRF.java:46:42:46:63 | url | user-provided value | | ReactiveWebClientSSRF.java:16:52:16:54 | url | ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:16:52:16:54 | url | Potential server-side request forgery due to a $@. | ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) | user-provided value | | ReactiveWebClientSSRF.java:35:30:35:32 | url | ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:35:30:35:32 | url | Potential server-side request forgery due to a $@. | ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) | user-provided value | | SanitizationTests.java:25:52:25:54 | uri | SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:25:52:25:54 | uri | Potential server-side request forgery due to a $@. | SanitizationTests.java:22:31:22:57 | getParameter(...) | user-provided value | @@ -381,1015 +384,1025 @@ | mad/Test.java:107:15:107:31 | (...)... | mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:107:15:107:31 | (...)... | Potential server-side request forgery due to a $@. | mad/Test.java:26:16:26:41 | getParameter(...) | user-provided value | | mad/Test.java:112:15:112:31 | (...)... | mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:112:15:112:31 | (...)... | Potential server-side request forgery due to a $@. | mad/Test.java:26:16:26:41 | getParameter(...) | user-provided value | edges -| ApacheHttpSSRF.java:27:27:27:53 | getParameter(...) : String | ApacheHttpSSRF.java:28:31:28:34 | sink : String | provenance | Src:MaD:280 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:30:43:30:45 | uri | provenance | Sink:MaD:214 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:32:29:32:31 | uri | provenance | Sink:MaD:220 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:34:26:34:28 | uri | provenance | Sink:MaD:215 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:35:26:35:28 | uri | provenance | Sink:MaD:218 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:36:25:36:27 | uri | provenance | Sink:MaD:219 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:37:28:37:30 | uri | provenance | Sink:MaD:213 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:38:29:38:31 | uri | provenance | Sink:MaD:216 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:39:27:39:29 | uri | provenance | Sink:MaD:221 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:40:27:40:29 | uri | provenance | Sink:MaD:217 | +| ApacheHttpSSRF.java:27:27:27:53 | getParameter(...) : String | ApacheHttpSSRF.java:28:31:28:34 | sink : String | provenance | Src:MaD:283 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:30:43:30:45 | uri | provenance | Sink:MaD:217 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:32:29:32:31 | uri | provenance | Sink:MaD:223 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:34:26:34:28 | uri | provenance | Sink:MaD:218 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:35:26:35:28 | uri | provenance | Sink:MaD:221 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:36:25:36:27 | uri | provenance | Sink:MaD:222 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:37:28:37:30 | uri | provenance | Sink:MaD:216 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:38:29:38:31 | uri | provenance | Sink:MaD:219 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:39:27:39:29 | uri | provenance | Sink:MaD:224 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:40:27:40:29 | uri | provenance | Sink:MaD:220 | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:42:62:42:64 | uri : URI | provenance | | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:43:41:43:43 | uri : URI | provenance | | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:44:41:44:43 | uri : URI | provenance | | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:46:77:46:79 | uri : URI | provenance | | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:47:56:47:58 | uri : URI | provenance | | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:48:56:48:58 | uri : URI | provenance | | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:50:32:50:34 | uri | provenance | Sink:MaD:223 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:51:33:51:35 | uri | provenance | Sink:MaD:227 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:52:32:52:34 | uri | provenance | Sink:MaD:228 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:53:35:53:37 | uri | provenance | Sink:MaD:222 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:54:36:54:38 | uri | provenance | Sink:MaD:225 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:55:33:55:35 | uri | provenance | Sink:MaD:224 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:56:34:56:36 | uri | provenance | Sink:MaD:230 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:57:34:57:36 | uri | provenance | Sink:MaD:226 | -| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:58:43:58:45 | uri | provenance | Sink:MaD:229 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:50:32:50:34 | uri | provenance | Sink:MaD:226 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:51:33:51:35 | uri | provenance | Sink:MaD:230 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:52:32:52:34 | uri | provenance | Sink:MaD:231 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:53:35:53:37 | uri | provenance | Sink:MaD:225 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:54:36:54:38 | uri | provenance | Sink:MaD:228 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:55:33:55:35 | uri | provenance | Sink:MaD:227 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:56:34:56:36 | uri | provenance | Sink:MaD:233 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:57:34:57:36 | uri | provenance | Sink:MaD:229 | +| ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | ApacheHttpSSRF.java:58:43:58:45 | uri | provenance | Sink:MaD:232 | | ApacheHttpSSRF.java:28:31:28:34 | sink : String | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRF.java:28:31:28:34 | sink : String | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | provenance | MaD:290 | -| ApacheHttpSSRF.java:42:62:42:64 | uri : URI | ApacheHttpSSRF.java:42:62:42:75 | toString(...) : String | provenance | MaD:291 | -| ApacheHttpSSRF.java:42:62:42:75 | toString(...) : String | ApacheHttpSSRF.java:42:34:42:82 | new BasicRequestLine(...) | provenance | MaD:300 Sink:MaD:234 | -| ApacheHttpSSRF.java:43:41:43:43 | uri : URI | ApacheHttpSSRF.java:43:41:43:54 | toString(...) | provenance | MaD:291 Sink:MaD:235 | -| ApacheHttpSSRF.java:44:41:44:43 | uri : URI | ApacheHttpSSRF.java:44:41:44:54 | toString(...) | provenance | MaD:291 Sink:MaD:236 | -| ApacheHttpSSRF.java:46:77:46:79 | uri : URI | ApacheHttpSSRF.java:46:77:46:90 | toString(...) : String | provenance | MaD:291 | -| ApacheHttpSSRF.java:46:77:46:90 | toString(...) : String | ApacheHttpSSRF.java:46:49:46:97 | new BasicRequestLine(...) | provenance | MaD:300 Sink:MaD:231 | -| ApacheHttpSSRF.java:47:56:47:58 | uri : URI | ApacheHttpSSRF.java:47:56:47:69 | toString(...) | provenance | MaD:291 Sink:MaD:232 | -| ApacheHttpSSRF.java:48:56:48:58 | uri : URI | ApacheHttpSSRF.java:48:56:48:69 | toString(...) | provenance | MaD:291 Sink:MaD:233 | -| ApacheHttpSSRFVersion5.java:41:30:41:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | provenance | Src:MaD:280 | +| ApacheHttpSSRF.java:28:31:28:34 | sink : String | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | provenance | MaD:295 | +| ApacheHttpSSRF.java:42:62:42:64 | uri : URI | ApacheHttpSSRF.java:42:62:42:75 | toString(...) : String | provenance | MaD:296 | +| ApacheHttpSSRF.java:42:62:42:75 | toString(...) : String | ApacheHttpSSRF.java:42:34:42:82 | new BasicRequestLine(...) | provenance | MaD:305 Sink:MaD:237 | +| ApacheHttpSSRF.java:43:41:43:43 | uri : URI | ApacheHttpSSRF.java:43:41:43:54 | toString(...) | provenance | MaD:296 Sink:MaD:238 | +| ApacheHttpSSRF.java:44:41:44:43 | uri : URI | ApacheHttpSSRF.java:44:41:44:54 | toString(...) | provenance | MaD:296 Sink:MaD:239 | +| ApacheHttpSSRF.java:46:77:46:79 | uri : URI | ApacheHttpSSRF.java:46:77:46:90 | toString(...) : String | provenance | MaD:296 | +| ApacheHttpSSRF.java:46:77:46:90 | toString(...) : String | ApacheHttpSSRF.java:46:49:46:97 | new BasicRequestLine(...) | provenance | MaD:305 Sink:MaD:234 | +| ApacheHttpSSRF.java:47:56:47:58 | uri : URI | ApacheHttpSSRF.java:47:56:47:69 | toString(...) | provenance | MaD:296 Sink:MaD:235 | +| ApacheHttpSSRF.java:48:56:48:58 | uri : URI | ApacheHttpSSRF.java:48:56:48:69 | toString(...) | provenance | MaD:296 Sink:MaD:236 | +| ApacheHttpSSRFVersion5.java:41:30:41:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | provenance | Src:MaD:283 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:49:54:49:56 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:50:54:50:56 | uri | provenance | Sink:MaD:43 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:50:54:50:56 | uri | provenance | Sink:MaD:46 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:51:48:51:50 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:52:48:52:50 | uri | provenance | Sink:MaD:45 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:52:48:52:50 | uri | provenance | Sink:MaD:48 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:55:38:55:40 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:56:38:56:40 | uri | provenance | Sink:MaD:48 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:56:38:56:40 | uri | provenance | Sink:MaD:51 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:59:35:59:37 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:60:35:60:37 | uri | provenance | Sink:MaD:51 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:60:35:60:37 | uri | provenance | Sink:MaD:54 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:63:36:63:38 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:64:36:64:38 | uri | provenance | Sink:MaD:54 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:64:36:64:38 | uri | provenance | Sink:MaD:57 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:67:39:67:41 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:68:39:68:41 | uri | provenance | Sink:MaD:57 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:68:39:68:41 | uri | provenance | Sink:MaD:60 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:71:37:71:39 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:72:37:72:39 | uri | provenance | Sink:MaD:60 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:72:37:72:39 | uri | provenance | Sink:MaD:63 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:75:36:75:38 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:76:36:76:38 | uri | provenance | Sink:MaD:63 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:76:36:76:38 | uri | provenance | Sink:MaD:66 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:79:35:79:37 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:80:35:80:37 | uri | provenance | Sink:MaD:66 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:80:35:80:37 | uri | provenance | Sink:MaD:69 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:83:37:83:39 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:84:37:84:39 | uri | provenance | Sink:MaD:69 | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:88:51:88:53 | uri | provenance | Sink:MaD:71 | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:92:51:92:53 | uri | provenance | Sink:MaD:73 | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:94:45:94:47 | uri | provenance | Sink:MaD:75 | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:97:54:97:56 | uri | provenance | Sink:MaD:77 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:84:37:84:39 | uri | provenance | Sink:MaD:72 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:88:51:88:53 | uri | provenance | Sink:MaD:74 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:92:51:92:53 | uri | provenance | Sink:MaD:76 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:94:45:94:47 | uri | provenance | Sink:MaD:78 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:97:54:97:56 | uri | provenance | Sink:MaD:80 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:98:48:98:50 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:99:48:99:50 | uri | provenance | Sink:MaD:79 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:99:48:99:50 | uri | provenance | Sink:MaD:82 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:103:55:103:57 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:104:55:104:57 | uri | provenance | Sink:MaD:82 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:104:55:104:57 | uri | provenance | Sink:MaD:85 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:105:49:105:51 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:106:49:106:51 | uri | provenance | Sink:MaD:84 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:106:49:106:51 | uri | provenance | Sink:MaD:87 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:109:39:109:41 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:110:39:110:41 | uri | provenance | Sink:MaD:87 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:110:39:110:41 | uri | provenance | Sink:MaD:90 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:113:36:113:38 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:114:36:114:38 | uri | provenance | Sink:MaD:90 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:114:36:114:38 | uri | provenance | Sink:MaD:93 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:117:37:117:39 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:118:37:118:39 | uri | provenance | Sink:MaD:93 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:118:37:118:39 | uri | provenance | Sink:MaD:96 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:121:40:121:42 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:122:40:122:42 | uri | provenance | Sink:MaD:96 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:122:40:122:42 | uri | provenance | Sink:MaD:99 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:125:38:125:40 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:126:38:126:40 | uri | provenance | Sink:MaD:99 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:126:38:126:40 | uri | provenance | Sink:MaD:102 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:129:37:129:39 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:130:37:130:39 | uri | provenance | Sink:MaD:102 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:130:37:130:39 | uri | provenance | Sink:MaD:105 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:133:36:133:38 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:134:36:134:38 | uri | provenance | Sink:MaD:105 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:134:36:134:38 | uri | provenance | Sink:MaD:108 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:137:38:137:40 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:138:38:138:40 | uri | provenance | Sink:MaD:108 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:138:38:138:40 | uri | provenance | Sink:MaD:111 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:141:41:141:43 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:142:41:142:43 | uri | provenance | Sink:MaD:110 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:142:41:142:43 | uri | provenance | Sink:MaD:113 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:144:38:144:40 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:145:38:145:40 | uri | provenance | Sink:MaD:112 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:145:38:145:40 | uri | provenance | Sink:MaD:115 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:147:39:147:41 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:148:39:148:41 | uri | provenance | Sink:MaD:114 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:148:39:148:41 | uri | provenance | Sink:MaD:117 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:150:42:150:44 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:151:42:151:44 | uri | provenance | Sink:MaD:116 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:151:42:151:44 | uri | provenance | Sink:MaD:119 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:153:40:153:42 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:154:40:154:42 | uri | provenance | Sink:MaD:118 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:154:40:154:42 | uri | provenance | Sink:MaD:121 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:156:39:156:41 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:157:39:157:41 | uri | provenance | Sink:MaD:120 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:157:39:157:41 | uri | provenance | Sink:MaD:123 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:159:38:159:40 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:160:38:160:40 | uri | provenance | Sink:MaD:122 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:160:38:160:40 | uri | provenance | Sink:MaD:125 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:164:47:164:49 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:165:47:165:49 | uri | provenance | Sink:MaD:209 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:165:47:165:49 | uri | provenance | Sink:MaD:212 | | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:167:40:167:42 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:168:40:168:42 | uri | provenance | Sink:MaD:124 | +| ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:168:40:168:42 | uri | provenance | Sink:MaD:127 | | ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | provenance | MaD:290 | -| ApacheHttpSSRFVersion5.java:44:31:44:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:45:42:45:49 | hostSink : String | provenance | Src:MaD:280 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:48:54:48:57 | host | provenance | Sink:MaD:41 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:54:38:54:41 | host | provenance | Sink:MaD:46 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:58:35:58:38 | host | provenance | Sink:MaD:49 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:62:36:62:39 | host | provenance | Sink:MaD:52 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:66:39:66:42 | host | provenance | Sink:MaD:55 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:70:37:70:40 | host | provenance | Sink:MaD:58 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:74:36:74:39 | host | provenance | Sink:MaD:61 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:78:35:78:38 | host | provenance | Sink:MaD:64 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:82:37:82:40 | host | provenance | Sink:MaD:67 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:87:51:87:54 | host | provenance | Sink:MaD:70 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:91:51:91:54 | host | provenance | Sink:MaD:72 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:93:45:93:48 | host | provenance | Sink:MaD:74 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:96:54:96:57 | host | provenance | Sink:MaD:76 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:102:55:102:58 | host | provenance | Sink:MaD:80 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:108:39:108:42 | host | provenance | Sink:MaD:85 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:112:36:112:39 | host | provenance | Sink:MaD:88 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:116:37:116:40 | host | provenance | Sink:MaD:91 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:120:40:120:43 | host | provenance | Sink:MaD:94 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:124:38:124:41 | host | provenance | Sink:MaD:97 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:128:37:128:40 | host | provenance | Sink:MaD:100 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:132:36:132:39 | host | provenance | Sink:MaD:103 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:136:38:136:41 | host | provenance | Sink:MaD:106 | -| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:162:52:162:55 | host | provenance | Sink:MaD:207 | -| ApacheHttpSSRFVersion5.java:45:42:45:49 | hostSink : String | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | provenance | MaD:299 | -| ApacheHttpSSRFVersion5.java:49:54:49:56 | uri : URI | ApacheHttpSSRFVersion5.java:49:54:49:67 | toString(...) | provenance | MaD:291 Sink:MaD:42 | -| ApacheHttpSSRFVersion5.java:51:48:51:50 | uri : URI | ApacheHttpSSRFVersion5.java:51:48:51:61 | toString(...) | provenance | MaD:291 Sink:MaD:44 | -| ApacheHttpSSRFVersion5.java:55:38:55:40 | uri : URI | ApacheHttpSSRFVersion5.java:55:38:55:51 | toString(...) | provenance | MaD:291 Sink:MaD:47 | -| ApacheHttpSSRFVersion5.java:59:35:59:37 | uri : URI | ApacheHttpSSRFVersion5.java:59:35:59:48 | toString(...) | provenance | MaD:291 Sink:MaD:50 | -| ApacheHttpSSRFVersion5.java:63:36:63:38 | uri : URI | ApacheHttpSSRFVersion5.java:63:36:63:49 | toString(...) | provenance | MaD:291 Sink:MaD:53 | -| ApacheHttpSSRFVersion5.java:67:39:67:41 | uri : URI | ApacheHttpSSRFVersion5.java:67:39:67:52 | toString(...) | provenance | MaD:291 Sink:MaD:56 | -| ApacheHttpSSRFVersion5.java:71:37:71:39 | uri : URI | ApacheHttpSSRFVersion5.java:71:37:71:50 | toString(...) | provenance | MaD:291 Sink:MaD:59 | -| ApacheHttpSSRFVersion5.java:75:36:75:38 | uri : URI | ApacheHttpSSRFVersion5.java:75:36:75:49 | toString(...) | provenance | MaD:291 Sink:MaD:62 | -| ApacheHttpSSRFVersion5.java:79:35:79:37 | uri : URI | ApacheHttpSSRFVersion5.java:79:35:79:48 | toString(...) | provenance | MaD:291 Sink:MaD:65 | -| ApacheHttpSSRFVersion5.java:83:37:83:39 | uri : URI | ApacheHttpSSRFVersion5.java:83:37:83:50 | toString(...) | provenance | MaD:291 Sink:MaD:68 | -| ApacheHttpSSRFVersion5.java:98:48:98:50 | uri : URI | ApacheHttpSSRFVersion5.java:98:48:98:61 | toString(...) | provenance | MaD:291 Sink:MaD:78 | -| ApacheHttpSSRFVersion5.java:103:55:103:57 | uri : URI | ApacheHttpSSRFVersion5.java:103:55:103:68 | toString(...) | provenance | MaD:291 Sink:MaD:81 | -| ApacheHttpSSRFVersion5.java:105:49:105:51 | uri : URI | ApacheHttpSSRFVersion5.java:105:49:105:62 | toString(...) | provenance | MaD:291 Sink:MaD:83 | -| ApacheHttpSSRFVersion5.java:109:39:109:41 | uri : URI | ApacheHttpSSRFVersion5.java:109:39:109:52 | toString(...) | provenance | MaD:291 Sink:MaD:86 | -| ApacheHttpSSRFVersion5.java:113:36:113:38 | uri : URI | ApacheHttpSSRFVersion5.java:113:36:113:49 | toString(...) | provenance | MaD:291 Sink:MaD:89 | -| ApacheHttpSSRFVersion5.java:117:37:117:39 | uri : URI | ApacheHttpSSRFVersion5.java:117:37:117:50 | toString(...) | provenance | MaD:291 Sink:MaD:92 | -| ApacheHttpSSRFVersion5.java:121:40:121:42 | uri : URI | ApacheHttpSSRFVersion5.java:121:40:121:53 | toString(...) | provenance | MaD:291 Sink:MaD:95 | -| ApacheHttpSSRFVersion5.java:125:38:125:40 | uri : URI | ApacheHttpSSRFVersion5.java:125:38:125:51 | toString(...) | provenance | MaD:291 Sink:MaD:98 | -| ApacheHttpSSRFVersion5.java:129:37:129:39 | uri : URI | ApacheHttpSSRFVersion5.java:129:37:129:50 | toString(...) | provenance | MaD:291 Sink:MaD:101 | -| ApacheHttpSSRFVersion5.java:133:36:133:38 | uri : URI | ApacheHttpSSRFVersion5.java:133:36:133:49 | toString(...) | provenance | MaD:291 Sink:MaD:104 | -| ApacheHttpSSRFVersion5.java:137:38:137:40 | uri : URI | ApacheHttpSSRFVersion5.java:137:38:137:51 | toString(...) | provenance | MaD:291 Sink:MaD:107 | -| ApacheHttpSSRFVersion5.java:141:41:141:43 | uri : URI | ApacheHttpSSRFVersion5.java:141:41:141:54 | toString(...) | provenance | MaD:291 Sink:MaD:109 | -| ApacheHttpSSRFVersion5.java:144:38:144:40 | uri : URI | ApacheHttpSSRFVersion5.java:144:38:144:51 | toString(...) | provenance | MaD:291 Sink:MaD:111 | -| ApacheHttpSSRFVersion5.java:147:39:147:41 | uri : URI | ApacheHttpSSRFVersion5.java:147:39:147:52 | toString(...) | provenance | MaD:291 Sink:MaD:113 | -| ApacheHttpSSRFVersion5.java:150:42:150:44 | uri : URI | ApacheHttpSSRFVersion5.java:150:42:150:55 | toString(...) | provenance | MaD:291 Sink:MaD:115 | -| ApacheHttpSSRFVersion5.java:153:40:153:42 | uri : URI | ApacheHttpSSRFVersion5.java:153:40:153:53 | toString(...) | provenance | MaD:291 Sink:MaD:117 | -| ApacheHttpSSRFVersion5.java:156:39:156:41 | uri : URI | ApacheHttpSSRFVersion5.java:156:39:156:52 | toString(...) | provenance | MaD:291 Sink:MaD:119 | -| ApacheHttpSSRFVersion5.java:159:38:159:40 | uri : URI | ApacheHttpSSRFVersion5.java:159:38:159:51 | toString(...) | provenance | MaD:291 Sink:MaD:121 | -| ApacheHttpSSRFVersion5.java:164:47:164:49 | uri : URI | ApacheHttpSSRFVersion5.java:164:47:164:60 | toString(...) | provenance | MaD:291 Sink:MaD:208 | -| ApacheHttpSSRFVersion5.java:167:40:167:42 | uri : URI | ApacheHttpSSRFVersion5.java:167:40:167:53 | toString(...) | provenance | MaD:291 Sink:MaD:123 | -| ApacheHttpSSRFVersion5.java:180:30:180:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | provenance | Src:MaD:280 | +| ApacheHttpSSRFVersion5.java:42:31:42:37 | uriSink : String | ApacheHttpSSRFVersion5.java:42:23:42:38 | new URI(...) : URI | provenance | MaD:295 | +| ApacheHttpSSRFVersion5.java:44:31:44:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:45:42:45:49 | hostSink : String | provenance | Src:MaD:283 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:48:54:48:57 | host | provenance | Sink:MaD:44 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:54:38:54:41 | host | provenance | Sink:MaD:49 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:58:35:58:38 | host | provenance | Sink:MaD:52 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:62:36:62:39 | host | provenance | Sink:MaD:55 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:66:39:66:42 | host | provenance | Sink:MaD:58 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:70:37:70:40 | host | provenance | Sink:MaD:61 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:74:36:74:39 | host | provenance | Sink:MaD:64 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:78:35:78:38 | host | provenance | Sink:MaD:67 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:82:37:82:40 | host | provenance | Sink:MaD:70 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:87:51:87:54 | host | provenance | Sink:MaD:73 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:91:51:91:54 | host | provenance | Sink:MaD:75 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:93:45:93:48 | host | provenance | Sink:MaD:77 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:96:54:96:57 | host | provenance | Sink:MaD:79 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:102:55:102:58 | host | provenance | Sink:MaD:83 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:108:39:108:42 | host | provenance | Sink:MaD:88 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:112:36:112:39 | host | provenance | Sink:MaD:91 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:116:37:116:40 | host | provenance | Sink:MaD:94 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:120:40:120:43 | host | provenance | Sink:MaD:97 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:124:38:124:41 | host | provenance | Sink:MaD:100 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:128:37:128:40 | host | provenance | Sink:MaD:103 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:132:36:132:39 | host | provenance | Sink:MaD:106 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:136:38:136:41 | host | provenance | Sink:MaD:109 | +| ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:162:52:162:55 | host | provenance | Sink:MaD:210 | +| ApacheHttpSSRFVersion5.java:45:42:45:49 | hostSink : String | ApacheHttpSSRFVersion5.java:45:29:45:50 | new HttpHost(...) : HttpHost | provenance | MaD:304 | +| ApacheHttpSSRFVersion5.java:49:54:49:56 | uri : URI | ApacheHttpSSRFVersion5.java:49:54:49:67 | toString(...) | provenance | MaD:296 Sink:MaD:45 | +| ApacheHttpSSRFVersion5.java:51:48:51:50 | uri : URI | ApacheHttpSSRFVersion5.java:51:48:51:61 | toString(...) | provenance | MaD:296 Sink:MaD:47 | +| ApacheHttpSSRFVersion5.java:55:38:55:40 | uri : URI | ApacheHttpSSRFVersion5.java:55:38:55:51 | toString(...) | provenance | MaD:296 Sink:MaD:50 | +| ApacheHttpSSRFVersion5.java:59:35:59:37 | uri : URI | ApacheHttpSSRFVersion5.java:59:35:59:48 | toString(...) | provenance | MaD:296 Sink:MaD:53 | +| ApacheHttpSSRFVersion5.java:63:36:63:38 | uri : URI | ApacheHttpSSRFVersion5.java:63:36:63:49 | toString(...) | provenance | MaD:296 Sink:MaD:56 | +| ApacheHttpSSRFVersion5.java:67:39:67:41 | uri : URI | ApacheHttpSSRFVersion5.java:67:39:67:52 | toString(...) | provenance | MaD:296 Sink:MaD:59 | +| ApacheHttpSSRFVersion5.java:71:37:71:39 | uri : URI | ApacheHttpSSRFVersion5.java:71:37:71:50 | toString(...) | provenance | MaD:296 Sink:MaD:62 | +| ApacheHttpSSRFVersion5.java:75:36:75:38 | uri : URI | ApacheHttpSSRFVersion5.java:75:36:75:49 | toString(...) | provenance | MaD:296 Sink:MaD:65 | +| ApacheHttpSSRFVersion5.java:79:35:79:37 | uri : URI | ApacheHttpSSRFVersion5.java:79:35:79:48 | toString(...) | provenance | MaD:296 Sink:MaD:68 | +| ApacheHttpSSRFVersion5.java:83:37:83:39 | uri : URI | ApacheHttpSSRFVersion5.java:83:37:83:50 | toString(...) | provenance | MaD:296 Sink:MaD:71 | +| ApacheHttpSSRFVersion5.java:98:48:98:50 | uri : URI | ApacheHttpSSRFVersion5.java:98:48:98:61 | toString(...) | provenance | MaD:296 Sink:MaD:81 | +| ApacheHttpSSRFVersion5.java:103:55:103:57 | uri : URI | ApacheHttpSSRFVersion5.java:103:55:103:68 | toString(...) | provenance | MaD:296 Sink:MaD:84 | +| ApacheHttpSSRFVersion5.java:105:49:105:51 | uri : URI | ApacheHttpSSRFVersion5.java:105:49:105:62 | toString(...) | provenance | MaD:296 Sink:MaD:86 | +| ApacheHttpSSRFVersion5.java:109:39:109:41 | uri : URI | ApacheHttpSSRFVersion5.java:109:39:109:52 | toString(...) | provenance | MaD:296 Sink:MaD:89 | +| ApacheHttpSSRFVersion5.java:113:36:113:38 | uri : URI | ApacheHttpSSRFVersion5.java:113:36:113:49 | toString(...) | provenance | MaD:296 Sink:MaD:92 | +| ApacheHttpSSRFVersion5.java:117:37:117:39 | uri : URI | ApacheHttpSSRFVersion5.java:117:37:117:50 | toString(...) | provenance | MaD:296 Sink:MaD:95 | +| ApacheHttpSSRFVersion5.java:121:40:121:42 | uri : URI | ApacheHttpSSRFVersion5.java:121:40:121:53 | toString(...) | provenance | MaD:296 Sink:MaD:98 | +| ApacheHttpSSRFVersion5.java:125:38:125:40 | uri : URI | ApacheHttpSSRFVersion5.java:125:38:125:51 | toString(...) | provenance | MaD:296 Sink:MaD:101 | +| ApacheHttpSSRFVersion5.java:129:37:129:39 | uri : URI | ApacheHttpSSRFVersion5.java:129:37:129:50 | toString(...) | provenance | MaD:296 Sink:MaD:104 | +| ApacheHttpSSRFVersion5.java:133:36:133:38 | uri : URI | ApacheHttpSSRFVersion5.java:133:36:133:49 | toString(...) | provenance | MaD:296 Sink:MaD:107 | +| ApacheHttpSSRFVersion5.java:137:38:137:40 | uri : URI | ApacheHttpSSRFVersion5.java:137:38:137:51 | toString(...) | provenance | MaD:296 Sink:MaD:110 | +| ApacheHttpSSRFVersion5.java:141:41:141:43 | uri : URI | ApacheHttpSSRFVersion5.java:141:41:141:54 | toString(...) | provenance | MaD:296 Sink:MaD:112 | +| ApacheHttpSSRFVersion5.java:144:38:144:40 | uri : URI | ApacheHttpSSRFVersion5.java:144:38:144:51 | toString(...) | provenance | MaD:296 Sink:MaD:114 | +| ApacheHttpSSRFVersion5.java:147:39:147:41 | uri : URI | ApacheHttpSSRFVersion5.java:147:39:147:52 | toString(...) | provenance | MaD:296 Sink:MaD:116 | +| ApacheHttpSSRFVersion5.java:150:42:150:44 | uri : URI | ApacheHttpSSRFVersion5.java:150:42:150:55 | toString(...) | provenance | MaD:296 Sink:MaD:118 | +| ApacheHttpSSRFVersion5.java:153:40:153:42 | uri : URI | ApacheHttpSSRFVersion5.java:153:40:153:53 | toString(...) | provenance | MaD:296 Sink:MaD:120 | +| ApacheHttpSSRFVersion5.java:156:39:156:41 | uri : URI | ApacheHttpSSRFVersion5.java:156:39:156:52 | toString(...) | provenance | MaD:296 Sink:MaD:122 | +| ApacheHttpSSRFVersion5.java:159:38:159:40 | uri : URI | ApacheHttpSSRFVersion5.java:159:38:159:51 | toString(...) | provenance | MaD:296 Sink:MaD:124 | +| ApacheHttpSSRFVersion5.java:164:47:164:49 | uri : URI | ApacheHttpSSRFVersion5.java:164:47:164:60 | toString(...) | provenance | MaD:296 Sink:MaD:211 | +| ApacheHttpSSRFVersion5.java:167:40:167:42 | uri : URI | ApacheHttpSSRFVersion5.java:167:40:167:53 | toString(...) | provenance | MaD:296 Sink:MaD:126 | +| ApacheHttpSSRFVersion5.java:180:30:180:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | provenance | Src:MaD:283 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:184:56:184:58 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:185:56:185:58 | uri | provenance | Sink:MaD:126 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:185:56:185:58 | uri | provenance | Sink:MaD:129 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:186:50:186:52 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:187:50:187:52 | uri | provenance | Sink:MaD:128 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:187:50:187:52 | uri | provenance | Sink:MaD:131 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:189:40:189:42 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:190:40:190:42 | uri | provenance | Sink:MaD:130 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:190:40:190:42 | uri | provenance | Sink:MaD:133 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:192:37:192:39 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:193:37:193:39 | uri | provenance | Sink:MaD:132 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:193:37:193:39 | uri | provenance | Sink:MaD:135 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:195:38:195:40 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:196:38:196:40 | uri | provenance | Sink:MaD:134 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:196:38:196:40 | uri | provenance | Sink:MaD:137 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:198:41:198:43 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:199:41:199:43 | uri | provenance | Sink:MaD:136 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:199:41:199:43 | uri | provenance | Sink:MaD:139 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:201:39:201:41 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:202:39:202:41 | uri | provenance | Sink:MaD:138 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:202:39:202:41 | uri | provenance | Sink:MaD:141 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:204:38:204:40 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:205:38:205:40 | uri | provenance | Sink:MaD:140 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:205:38:205:40 | uri | provenance | Sink:MaD:143 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:207:37:207:39 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:208:37:208:39 | uri | provenance | Sink:MaD:142 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:208:37:208:39 | uri | provenance | Sink:MaD:145 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:210:39:210:41 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:211:39:211:41 | uri | provenance | Sink:MaD:144 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:211:39:211:41 | uri | provenance | Sink:MaD:147 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:214:28:214:30 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:215:28:215:30 | uri | provenance | Sink:MaD:146 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:215:28:215:30 | uri | provenance | Sink:MaD:149 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:217:25:217:27 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:218:25:218:27 | uri | provenance | Sink:MaD:148 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:218:25:218:27 | uri | provenance | Sink:MaD:151 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:220:26:220:28 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:221:26:221:28 | uri | provenance | Sink:MaD:150 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:221:26:221:28 | uri | provenance | Sink:MaD:153 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:223:29:223:31 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:224:29:224:31 | uri | provenance | Sink:MaD:152 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:224:29:224:31 | uri | provenance | Sink:MaD:155 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:226:27:226:29 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:227:27:227:29 | uri | provenance | Sink:MaD:154 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:227:27:227:29 | uri | provenance | Sink:MaD:157 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:229:26:229:28 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:230:26:230:28 | uri | provenance | Sink:MaD:156 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:230:26:230:28 | uri | provenance | Sink:MaD:159 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:232:25:232:27 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:233:25:233:27 | uri | provenance | Sink:MaD:158 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:233:25:233:27 | uri | provenance | Sink:MaD:161 | | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:235:27:235:29 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:236:27:236:29 | uri | provenance | Sink:MaD:160 | -| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:239:46:239:48 | uri | provenance | Sink:MaD:161 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:236:27:236:29 | uri | provenance | Sink:MaD:163 | +| ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:239:46:239:48 | uri | provenance | Sink:MaD:164 | | ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | provenance | MaD:290 | -| ApacheHttpSSRFVersion5.java:184:56:184:58 | uri : URI | ApacheHttpSSRFVersion5.java:184:56:184:69 | toString(...) | provenance | MaD:291 Sink:MaD:125 | -| ApacheHttpSSRFVersion5.java:186:50:186:52 | uri : URI | ApacheHttpSSRFVersion5.java:186:50:186:63 | toString(...) | provenance | MaD:291 Sink:MaD:127 | -| ApacheHttpSSRFVersion5.java:189:40:189:42 | uri : URI | ApacheHttpSSRFVersion5.java:189:40:189:53 | toString(...) | provenance | MaD:291 Sink:MaD:129 | -| ApacheHttpSSRFVersion5.java:192:37:192:39 | uri : URI | ApacheHttpSSRFVersion5.java:192:37:192:50 | toString(...) | provenance | MaD:291 Sink:MaD:131 | -| ApacheHttpSSRFVersion5.java:195:38:195:40 | uri : URI | ApacheHttpSSRFVersion5.java:195:38:195:51 | toString(...) | provenance | MaD:291 Sink:MaD:133 | -| ApacheHttpSSRFVersion5.java:198:41:198:43 | uri : URI | ApacheHttpSSRFVersion5.java:198:41:198:54 | toString(...) | provenance | MaD:291 Sink:MaD:135 | -| ApacheHttpSSRFVersion5.java:201:39:201:41 | uri : URI | ApacheHttpSSRFVersion5.java:201:39:201:52 | toString(...) | provenance | MaD:291 Sink:MaD:137 | -| ApacheHttpSSRFVersion5.java:204:38:204:40 | uri : URI | ApacheHttpSSRFVersion5.java:204:38:204:51 | toString(...) | provenance | MaD:291 Sink:MaD:139 | -| ApacheHttpSSRFVersion5.java:207:37:207:39 | uri : URI | ApacheHttpSSRFVersion5.java:207:37:207:50 | toString(...) | provenance | MaD:291 Sink:MaD:141 | -| ApacheHttpSSRFVersion5.java:210:39:210:41 | uri : URI | ApacheHttpSSRFVersion5.java:210:39:210:52 | toString(...) | provenance | MaD:291 Sink:MaD:143 | -| ApacheHttpSSRFVersion5.java:214:28:214:30 | uri : URI | ApacheHttpSSRFVersion5.java:214:28:214:41 | toString(...) | provenance | MaD:291 Sink:MaD:145 | -| ApacheHttpSSRFVersion5.java:217:25:217:27 | uri : URI | ApacheHttpSSRFVersion5.java:217:25:217:38 | toString(...) | provenance | MaD:291 Sink:MaD:147 | -| ApacheHttpSSRFVersion5.java:220:26:220:28 | uri : URI | ApacheHttpSSRFVersion5.java:220:26:220:39 | toString(...) | provenance | MaD:291 Sink:MaD:149 | -| ApacheHttpSSRFVersion5.java:223:29:223:31 | uri : URI | ApacheHttpSSRFVersion5.java:223:29:223:42 | toString(...) | provenance | MaD:291 Sink:MaD:151 | -| ApacheHttpSSRFVersion5.java:226:27:226:29 | uri : URI | ApacheHttpSSRFVersion5.java:226:27:226:40 | toString(...) | provenance | MaD:291 Sink:MaD:153 | -| ApacheHttpSSRFVersion5.java:229:26:229:28 | uri : URI | ApacheHttpSSRFVersion5.java:229:26:229:39 | toString(...) | provenance | MaD:291 Sink:MaD:155 | -| ApacheHttpSSRFVersion5.java:232:25:232:27 | uri : URI | ApacheHttpSSRFVersion5.java:232:25:232:38 | toString(...) | provenance | MaD:291 Sink:MaD:157 | -| ApacheHttpSSRFVersion5.java:235:27:235:29 | uri : URI | ApacheHttpSSRFVersion5.java:235:27:235:40 | toString(...) | provenance | MaD:291 Sink:MaD:159 | -| ApacheHttpSSRFVersion5.java:251:30:251:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | provenance | Src:MaD:280 | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:255:44:255:46 | uri | provenance | Sink:MaD:162 | +| ApacheHttpSSRFVersion5.java:181:31:181:37 | uriSink : String | ApacheHttpSSRFVersion5.java:181:23:181:38 | new URI(...) : URI | provenance | MaD:295 | +| ApacheHttpSSRFVersion5.java:184:56:184:58 | uri : URI | ApacheHttpSSRFVersion5.java:184:56:184:69 | toString(...) | provenance | MaD:296 Sink:MaD:128 | +| ApacheHttpSSRFVersion5.java:186:50:186:52 | uri : URI | ApacheHttpSSRFVersion5.java:186:50:186:63 | toString(...) | provenance | MaD:296 Sink:MaD:130 | +| ApacheHttpSSRFVersion5.java:189:40:189:42 | uri : URI | ApacheHttpSSRFVersion5.java:189:40:189:53 | toString(...) | provenance | MaD:296 Sink:MaD:132 | +| ApacheHttpSSRFVersion5.java:192:37:192:39 | uri : URI | ApacheHttpSSRFVersion5.java:192:37:192:50 | toString(...) | provenance | MaD:296 Sink:MaD:134 | +| ApacheHttpSSRFVersion5.java:195:38:195:40 | uri : URI | ApacheHttpSSRFVersion5.java:195:38:195:51 | toString(...) | provenance | MaD:296 Sink:MaD:136 | +| ApacheHttpSSRFVersion5.java:198:41:198:43 | uri : URI | ApacheHttpSSRFVersion5.java:198:41:198:54 | toString(...) | provenance | MaD:296 Sink:MaD:138 | +| ApacheHttpSSRFVersion5.java:201:39:201:41 | uri : URI | ApacheHttpSSRFVersion5.java:201:39:201:52 | toString(...) | provenance | MaD:296 Sink:MaD:140 | +| ApacheHttpSSRFVersion5.java:204:38:204:40 | uri : URI | ApacheHttpSSRFVersion5.java:204:38:204:51 | toString(...) | provenance | MaD:296 Sink:MaD:142 | +| ApacheHttpSSRFVersion5.java:207:37:207:39 | uri : URI | ApacheHttpSSRFVersion5.java:207:37:207:50 | toString(...) | provenance | MaD:296 Sink:MaD:144 | +| ApacheHttpSSRFVersion5.java:210:39:210:41 | uri : URI | ApacheHttpSSRFVersion5.java:210:39:210:52 | toString(...) | provenance | MaD:296 Sink:MaD:146 | +| ApacheHttpSSRFVersion5.java:214:28:214:30 | uri : URI | ApacheHttpSSRFVersion5.java:214:28:214:41 | toString(...) | provenance | MaD:296 Sink:MaD:148 | +| ApacheHttpSSRFVersion5.java:217:25:217:27 | uri : URI | ApacheHttpSSRFVersion5.java:217:25:217:38 | toString(...) | provenance | MaD:296 Sink:MaD:150 | +| ApacheHttpSSRFVersion5.java:220:26:220:28 | uri : URI | ApacheHttpSSRFVersion5.java:220:26:220:39 | toString(...) | provenance | MaD:296 Sink:MaD:152 | +| ApacheHttpSSRFVersion5.java:223:29:223:31 | uri : URI | ApacheHttpSSRFVersion5.java:223:29:223:42 | toString(...) | provenance | MaD:296 Sink:MaD:154 | +| ApacheHttpSSRFVersion5.java:226:27:226:29 | uri : URI | ApacheHttpSSRFVersion5.java:226:27:226:40 | toString(...) | provenance | MaD:296 Sink:MaD:156 | +| ApacheHttpSSRFVersion5.java:229:26:229:28 | uri : URI | ApacheHttpSSRFVersion5.java:229:26:229:39 | toString(...) | provenance | MaD:296 Sink:MaD:158 | +| ApacheHttpSSRFVersion5.java:232:25:232:27 | uri : URI | ApacheHttpSSRFVersion5.java:232:25:232:38 | toString(...) | provenance | MaD:296 Sink:MaD:160 | +| ApacheHttpSSRFVersion5.java:235:27:235:29 | uri : URI | ApacheHttpSSRFVersion5.java:235:27:235:40 | toString(...) | provenance | MaD:296 Sink:MaD:162 | +| ApacheHttpSSRFVersion5.java:251:30:251:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | provenance | Src:MaD:283 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:255:44:255:46 | uri | provenance | Sink:MaD:165 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:256:38:256:40 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:257:38:257:40 | uri | provenance | Sink:MaD:164 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:257:38:257:40 | uri | provenance | Sink:MaD:167 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:259:28:259:30 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:260:28:260:30 | uri | provenance | Sink:MaD:166 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:260:28:260:30 | uri | provenance | Sink:MaD:169 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:262:25:262:27 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:263:25:263:27 | uri | provenance | Sink:MaD:168 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:263:25:263:27 | uri | provenance | Sink:MaD:171 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:265:26:265:28 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:266:26:266:28 | uri | provenance | Sink:MaD:170 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:266:26:266:28 | uri | provenance | Sink:MaD:173 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:268:29:268:31 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:269:29:269:31 | uri | provenance | Sink:MaD:172 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:269:29:269:31 | uri | provenance | Sink:MaD:175 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:271:27:271:29 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:272:27:272:29 | uri | provenance | Sink:MaD:174 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:272:27:272:29 | uri | provenance | Sink:MaD:177 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:274:26:274:28 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:275:26:275:28 | uri | provenance | Sink:MaD:176 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:275:26:275:28 | uri | provenance | Sink:MaD:179 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:277:25:277:27 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:278:25:278:27 | uri | provenance | Sink:MaD:178 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:278:25:278:27 | uri | provenance | Sink:MaD:181 | | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:280:27:280:29 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:281:27:281:29 | uri | provenance | Sink:MaD:180 | +| ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:281:27:281:29 | uri | provenance | Sink:MaD:183 | | ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | provenance | MaD:290 | -| ApacheHttpSSRFVersion5.java:256:38:256:40 | uri : URI | ApacheHttpSSRFVersion5.java:256:38:256:51 | toString(...) | provenance | MaD:291 Sink:MaD:163 | -| ApacheHttpSSRFVersion5.java:259:28:259:30 | uri : URI | ApacheHttpSSRFVersion5.java:259:28:259:41 | toString(...) | provenance | MaD:291 Sink:MaD:165 | -| ApacheHttpSSRFVersion5.java:262:25:262:27 | uri : URI | ApacheHttpSSRFVersion5.java:262:25:262:38 | toString(...) | provenance | MaD:291 Sink:MaD:167 | -| ApacheHttpSSRFVersion5.java:265:26:265:28 | uri : URI | ApacheHttpSSRFVersion5.java:265:26:265:39 | toString(...) | provenance | MaD:291 Sink:MaD:169 | -| ApacheHttpSSRFVersion5.java:268:29:268:31 | uri : URI | ApacheHttpSSRFVersion5.java:268:29:268:42 | toString(...) | provenance | MaD:291 Sink:MaD:171 | -| ApacheHttpSSRFVersion5.java:271:27:271:29 | uri : URI | ApacheHttpSSRFVersion5.java:271:27:271:40 | toString(...) | provenance | MaD:291 Sink:MaD:173 | -| ApacheHttpSSRFVersion5.java:274:26:274:28 | uri : URI | ApacheHttpSSRFVersion5.java:274:26:274:39 | toString(...) | provenance | MaD:291 Sink:MaD:175 | -| ApacheHttpSSRFVersion5.java:277:25:277:27 | uri : URI | ApacheHttpSSRFVersion5.java:277:25:277:38 | toString(...) | provenance | MaD:291 Sink:MaD:177 | -| ApacheHttpSSRFVersion5.java:280:27:280:29 | uri : URI | ApacheHttpSSRFVersion5.java:280:27:280:40 | toString(...) | provenance | MaD:291 Sink:MaD:179 | -| ApacheHttpSSRFVersion5.java:295:30:295:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | provenance | Src:MaD:280 | +| ApacheHttpSSRFVersion5.java:252:31:252:37 | uriSink : String | ApacheHttpSSRFVersion5.java:252:23:252:38 | new URI(...) : URI | provenance | MaD:295 | +| ApacheHttpSSRFVersion5.java:256:38:256:40 | uri : URI | ApacheHttpSSRFVersion5.java:256:38:256:51 | toString(...) | provenance | MaD:296 Sink:MaD:166 | +| ApacheHttpSSRFVersion5.java:259:28:259:30 | uri : URI | ApacheHttpSSRFVersion5.java:259:28:259:41 | toString(...) | provenance | MaD:296 Sink:MaD:168 | +| ApacheHttpSSRFVersion5.java:262:25:262:27 | uri : URI | ApacheHttpSSRFVersion5.java:262:25:262:38 | toString(...) | provenance | MaD:296 Sink:MaD:170 | +| ApacheHttpSSRFVersion5.java:265:26:265:28 | uri : URI | ApacheHttpSSRFVersion5.java:265:26:265:39 | toString(...) | provenance | MaD:296 Sink:MaD:172 | +| ApacheHttpSSRFVersion5.java:268:29:268:31 | uri : URI | ApacheHttpSSRFVersion5.java:268:29:268:42 | toString(...) | provenance | MaD:296 Sink:MaD:174 | +| ApacheHttpSSRFVersion5.java:271:27:271:29 | uri : URI | ApacheHttpSSRFVersion5.java:271:27:271:40 | toString(...) | provenance | MaD:296 Sink:MaD:176 | +| ApacheHttpSSRFVersion5.java:274:26:274:28 | uri : URI | ApacheHttpSSRFVersion5.java:274:26:274:39 | toString(...) | provenance | MaD:296 Sink:MaD:178 | +| ApacheHttpSSRFVersion5.java:277:25:277:27 | uri : URI | ApacheHttpSSRFVersion5.java:277:25:277:38 | toString(...) | provenance | MaD:296 Sink:MaD:180 | +| ApacheHttpSSRFVersion5.java:280:27:280:29 | uri : URI | ApacheHttpSSRFVersion5.java:280:27:280:40 | toString(...) | provenance | MaD:296 Sink:MaD:182 | +| ApacheHttpSSRFVersion5.java:295:30:295:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | provenance | Src:MaD:283 | | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:308:60:308:62 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:309:60:309:62 | uri | provenance | Sink:MaD:212 | +| ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:309:60:309:62 | uri | provenance | Sink:MaD:215 | | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:313:53:313:55 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:314:53:314:55 | uri | provenance | Sink:MaD:212 | +| ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:314:53:314:55 | uri | provenance | Sink:MaD:215 | | ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | provenance | MaD:290 | -| ApacheHttpSSRFVersion5.java:298:31:298:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:299:42:299:49 | hostSink : String | provenance | Src:MaD:280 | -| ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:303:34:303:37 | host | provenance | Sink:MaD:181 | -| ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:304:34:304:37 | host | provenance | Sink:MaD:182 | -| ApacheHttpSSRFVersion5.java:299:42:299:49 | hostSink : String | ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | provenance | MaD:299 | -| ApacheHttpSSRFVersion5.java:308:60:308:62 | uri : URI | ApacheHttpSSRFVersion5.java:308:60:308:73 | toString(...) | provenance | MaD:291 Sink:MaD:211 | -| ApacheHttpSSRFVersion5.java:313:53:313:55 | uri : URI | ApacheHttpSSRFVersion5.java:313:53:313:66 | toString(...) | provenance | MaD:291 Sink:MaD:211 | -| ApacheHttpSSRFVersion5.java:326:30:326:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | provenance | Src:MaD:280 | +| ApacheHttpSSRFVersion5.java:296:31:296:37 | uriSink : String | ApacheHttpSSRFVersion5.java:296:23:296:38 | new URI(...) : URI | provenance | MaD:295 | +| ApacheHttpSSRFVersion5.java:298:31:298:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:299:42:299:49 | hostSink : String | provenance | Src:MaD:283 | +| ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:303:34:303:37 | host | provenance | Sink:MaD:184 | +| ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:304:34:304:37 | host | provenance | Sink:MaD:185 | +| ApacheHttpSSRFVersion5.java:299:42:299:49 | hostSink : String | ApacheHttpSSRFVersion5.java:299:29:299:50 | new HttpHost(...) : HttpHost | provenance | MaD:304 | +| ApacheHttpSSRFVersion5.java:308:60:308:62 | uri : URI | ApacheHttpSSRFVersion5.java:308:60:308:73 | toString(...) | provenance | MaD:296 Sink:MaD:214 | +| ApacheHttpSSRFVersion5.java:313:53:313:55 | uri : URI | ApacheHttpSSRFVersion5.java:313:53:313:66 | toString(...) | provenance | MaD:296 Sink:MaD:214 | +| ApacheHttpSSRFVersion5.java:326:30:326:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | provenance | Src:MaD:283 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:333:42:333:44 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:334:42:334:44 | uri | provenance | Sink:MaD:184 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:334:42:334:44 | uri | provenance | Sink:MaD:187 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:336:39:336:41 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:337:39:337:41 | uri | provenance | Sink:MaD:186 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:337:39:337:41 | uri | provenance | Sink:MaD:189 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:339:40:339:42 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:340:40:340:42 | uri | provenance | Sink:MaD:188 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:340:40:340:42 | uri | provenance | Sink:MaD:191 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:342:43:342:45 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:343:43:343:45 | uri | provenance | Sink:MaD:190 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:343:43:343:45 | uri | provenance | Sink:MaD:193 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:345:41:345:43 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:346:41:346:43 | uri | provenance | Sink:MaD:192 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:346:41:346:43 | uri | provenance | Sink:MaD:195 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:348:40:348:42 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:349:40:349:42 | uri | provenance | Sink:MaD:194 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:349:40:349:42 | uri | provenance | Sink:MaD:197 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:351:39:351:41 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:352:39:352:41 | uri | provenance | Sink:MaD:196 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:352:39:352:41 | uri | provenance | Sink:MaD:199 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:356:48:356:50 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:357:48:357:50 | uri | provenance | Sink:MaD:209 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:357:48:357:50 | uri | provenance | Sink:MaD:212 | | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:359:41:359:43 | uri : URI | provenance | | -| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:360:41:360:43 | uri | provenance | Sink:MaD:198 | +| ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:360:41:360:43 | uri | provenance | Sink:MaD:201 | | ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | provenance | MaD:290 | -| ApacheHttpSSRFVersion5.java:329:31:329:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:330:42:330:49 | hostSink : String | provenance | Src:MaD:280 | -| ApacheHttpSSRFVersion5.java:330:29:330:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:354:53:354:56 | host | provenance | Sink:MaD:207 | -| ApacheHttpSSRFVersion5.java:330:42:330:49 | hostSink : String | ApacheHttpSSRFVersion5.java:330:29:330:50 | new HttpHost(...) : HttpHost | provenance | MaD:299 | -| ApacheHttpSSRFVersion5.java:333:42:333:44 | uri : URI | ApacheHttpSSRFVersion5.java:333:42:333:55 | toString(...) | provenance | MaD:291 Sink:MaD:183 | -| ApacheHttpSSRFVersion5.java:336:39:336:41 | uri : URI | ApacheHttpSSRFVersion5.java:336:39:336:52 | toString(...) | provenance | MaD:291 Sink:MaD:185 | -| ApacheHttpSSRFVersion5.java:339:40:339:42 | uri : URI | ApacheHttpSSRFVersion5.java:339:40:339:53 | toString(...) | provenance | MaD:291 Sink:MaD:187 | -| ApacheHttpSSRFVersion5.java:342:43:342:45 | uri : URI | ApacheHttpSSRFVersion5.java:342:43:342:56 | toString(...) | provenance | MaD:291 Sink:MaD:189 | -| ApacheHttpSSRFVersion5.java:345:41:345:43 | uri : URI | ApacheHttpSSRFVersion5.java:345:41:345:54 | toString(...) | provenance | MaD:291 Sink:MaD:191 | -| ApacheHttpSSRFVersion5.java:348:40:348:42 | uri : URI | ApacheHttpSSRFVersion5.java:348:40:348:53 | toString(...) | provenance | MaD:291 Sink:MaD:193 | -| ApacheHttpSSRFVersion5.java:351:39:351:41 | uri : URI | ApacheHttpSSRFVersion5.java:351:39:351:52 | toString(...) | provenance | MaD:291 Sink:MaD:195 | -| ApacheHttpSSRFVersion5.java:356:48:356:50 | uri : URI | ApacheHttpSSRFVersion5.java:356:48:356:61 | toString(...) | provenance | MaD:291 Sink:MaD:208 | -| ApacheHttpSSRFVersion5.java:359:41:359:43 | uri : URI | ApacheHttpSSRFVersion5.java:359:41:359:54 | toString(...) | provenance | MaD:291 Sink:MaD:197 | -| ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | provenance | Src:MaD:280 | -| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:380:57:380:59 | uri | provenance | Sink:MaD:200 | -| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:382:51:382:53 | uri | provenance | Sink:MaD:202 | -| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:386:50:386:52 | uri | provenance | Sink:MaD:204 | -| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:388:44:388:46 | uri | provenance | Sink:MaD:206 | -| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:390:24:390:26 | uri | provenance | Sink:MaD:210 | -| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:394:24:394:26 | uri | provenance | Sink:MaD:210 | +| ApacheHttpSSRFVersion5.java:327:31:327:37 | uriSink : String | ApacheHttpSSRFVersion5.java:327:23:327:38 | new URI(...) : URI | provenance | MaD:295 | +| ApacheHttpSSRFVersion5.java:329:31:329:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:330:42:330:49 | hostSink : String | provenance | Src:MaD:283 | +| ApacheHttpSSRFVersion5.java:330:29:330:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:354:53:354:56 | host | provenance | Sink:MaD:210 | +| ApacheHttpSSRFVersion5.java:330:42:330:49 | hostSink : String | ApacheHttpSSRFVersion5.java:330:29:330:50 | new HttpHost(...) : HttpHost | provenance | MaD:304 | +| ApacheHttpSSRFVersion5.java:333:42:333:44 | uri : URI | ApacheHttpSSRFVersion5.java:333:42:333:55 | toString(...) | provenance | MaD:296 Sink:MaD:186 | +| ApacheHttpSSRFVersion5.java:336:39:336:41 | uri : URI | ApacheHttpSSRFVersion5.java:336:39:336:52 | toString(...) | provenance | MaD:296 Sink:MaD:188 | +| ApacheHttpSSRFVersion5.java:339:40:339:42 | uri : URI | ApacheHttpSSRFVersion5.java:339:40:339:53 | toString(...) | provenance | MaD:296 Sink:MaD:190 | +| ApacheHttpSSRFVersion5.java:342:43:342:45 | uri : URI | ApacheHttpSSRFVersion5.java:342:43:342:56 | toString(...) | provenance | MaD:296 Sink:MaD:192 | +| ApacheHttpSSRFVersion5.java:345:41:345:43 | uri : URI | ApacheHttpSSRFVersion5.java:345:41:345:54 | toString(...) | provenance | MaD:296 Sink:MaD:194 | +| ApacheHttpSSRFVersion5.java:348:40:348:42 | uri : URI | ApacheHttpSSRFVersion5.java:348:40:348:53 | toString(...) | provenance | MaD:296 Sink:MaD:196 | +| ApacheHttpSSRFVersion5.java:351:39:351:41 | uri : URI | ApacheHttpSSRFVersion5.java:351:39:351:52 | toString(...) | provenance | MaD:296 Sink:MaD:198 | +| ApacheHttpSSRFVersion5.java:356:48:356:50 | uri : URI | ApacheHttpSSRFVersion5.java:356:48:356:61 | toString(...) | provenance | MaD:296 Sink:MaD:211 | +| ApacheHttpSSRFVersion5.java:359:41:359:43 | uri : URI | ApacheHttpSSRFVersion5.java:359:41:359:54 | toString(...) | provenance | MaD:296 Sink:MaD:200 | +| ApacheHttpSSRFVersion5.java:372:30:372:56 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | provenance | Src:MaD:283 | +| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:380:57:380:59 | uri | provenance | Sink:MaD:203 | +| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:382:51:382:53 | uri | provenance | Sink:MaD:205 | +| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:386:50:386:52 | uri | provenance | Sink:MaD:207 | +| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:388:44:388:46 | uri | provenance | Sink:MaD:209 | +| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:390:24:390:26 | uri | provenance | Sink:MaD:213 | +| ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | ApacheHttpSSRFVersion5.java:394:24:394:26 | uri | provenance | Sink:MaD:213 | | ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | provenance | Config | -| ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | provenance | MaD:290 | -| ApacheHttpSSRFVersion5.java:375:31:375:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | provenance | Src:MaD:280 | -| ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:379:57:379:60 | host | provenance | Sink:MaD:199 | -| ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:381:51:381:54 | host | provenance | Sink:MaD:201 | -| ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:385:50:385:53 | host | provenance | Sink:MaD:203 | -| ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:387:44:387:47 | host | provenance | Sink:MaD:205 | -| ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | provenance | MaD:299 | -| JakartaWsSSRF.java:14:22:14:48 | getParameter(...) : String | JakartaWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:280 Sink:MaD:6 | -| JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) : String | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | provenance | Src:MaD:280 | -| JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | JavaNetHttpSSRF.java:39:59:39:61 | uri | provenance | Sink:MaD:9 | +| ApacheHttpSSRFVersion5.java:373:31:373:37 | uriSink : String | ApacheHttpSSRFVersion5.java:373:23:373:38 | new URI(...) : URI | provenance | MaD:295 | +| ApacheHttpSSRFVersion5.java:375:31:375:58 | getParameter(...) : String | ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | provenance | Src:MaD:283 | +| ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:379:57:379:60 | host | provenance | Sink:MaD:202 | +| ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:381:51:381:54 | host | provenance | Sink:MaD:204 | +| ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:385:50:385:53 | host | provenance | Sink:MaD:206 | +| ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | ApacheHttpSSRFVersion5.java:387:44:387:47 | host | provenance | Sink:MaD:208 | +| ApacheHttpSSRFVersion5.java:376:42:376:49 | hostSink : String | ApacheHttpSSRFVersion5.java:376:29:376:50 | new HttpHost(...) : HttpHost | provenance | MaD:304 | +| JakartaWsSSRF.java:14:22:14:48 | getParameter(...) : String | JakartaWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:283 Sink:MaD:9 | +| JavaNetHttpSSRF.java:25:27:25:53 | getParameter(...) : String | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | provenance | Src:MaD:283 | +| JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | JavaNetHttpSSRF.java:39:59:39:61 | uri | provenance | Sink:MaD:12 | | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | provenance | Config | -| JavaNetHttpSSRF.java:26:31:26:34 | sink : String | JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | provenance | MaD:290 | +| JavaNetHttpSSRF.java:26:31:26:34 | sink : String | JavaNetHttpSSRF.java:26:23:26:35 | new URI(...) : URI | provenance | MaD:295 | | JavaNetHttpSSRF.java:26:31:26:34 | sink : String | JavaNetHttpSSRF.java:27:40:27:43 | sink : String | provenance | | -| JavaNetHttpSSRF.java:27:24:27:57 | new URI(...) : URI | JavaNetHttpSSRF.java:38:65:38:68 | uri2 | provenance | Sink:MaD:8 | +| JavaNetHttpSSRF.java:27:24:27:57 | new URI(...) : URI | JavaNetHttpSSRF.java:38:65:38:68 | uri2 | provenance | Sink:MaD:11 | | JavaNetHttpSSRF.java:27:40:27:43 | sink : String | JavaNetHttpSSRF.java:27:24:27:57 | new URI(...) : URI | provenance | Config | | JavaNetHttpSSRF.java:27:40:27:43 | sink : String | JavaNetHttpSSRF.java:28:32:28:35 | sink : String | provenance | | -| JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:30:32:30:35 | url1 | provenance | Sink:MaD:12 | -| JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:33:32:33:35 | url1 | provenance | Sink:MaD:12 | -| JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:34:30:34:33 | url1 | provenance | Sink:MaD:13 | +| JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:30:32:30:35 | url1 | provenance | Sink:MaD:15 | +| JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:33:32:33:35 | url1 | provenance | Sink:MaD:15 | +| JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | JavaNetHttpSSRF.java:34:30:34:33 | url1 | provenance | Sink:MaD:16 | | JavaNetHttpSSRF.java:28:32:28:35 | sink : String | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | provenance | Config | -| JavaNetHttpSSRF.java:28:32:28:35 | sink : String | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | provenance | MaD:293 | -| JaxWsSSRF.java:14:22:14:48 | getParameter(...) : String | JaxWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:280 Sink:MaD:26 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:26:28:26:34 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:20 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:28:41:28:47 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:21 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:29:41:29:47 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:23 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:30:41:30:47 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:22 | -| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:32:27:32:33 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:245 | -| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:43:27:43:33 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:2 | -| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:48:23:48:29 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:2 | -| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | provenance | Src:MaD:280 | +| JavaNetHttpSSRF.java:28:32:28:35 | sink : String | JavaNetHttpSSRF.java:28:24:28:36 | new URL(...) : URL | provenance | MaD:298 | +| JaxWsSSRF.java:14:22:14:48 | getParameter(...) : String | JaxWsSSRF.java:15:23:15:25 | url | provenance | Src:MaD:283 Sink:MaD:29 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:26:28:26:34 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:23 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:28:41:28:47 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:24 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:29:41:29:47 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:26 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:30:41:30:47 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:25 | +| JdbcUrlSSRF.java:21:26:21:56 | getParameter(...) : String | JdbcUrlSSRF.java:32:27:32:33 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:248 | +| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:43:27:43:33 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:2 | +| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:48:23:48:29 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:2 | +| JdbcUrlSSRF.java:40:26:40:56 | getParameter(...) : String | JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | provenance | Src:MaD:283 | | JdbcUrlSSRF.java:52:9:52:13 | props : Properties | JdbcUrlSSRF.java:54:49:54:53 | props | provenance | Sink:MaD:1 | | JdbcUrlSSRF.java:52:9:52:13 | props [post update] : Properties [] : String | JdbcUrlSSRF.java:54:49:54:53 | props | provenance | Sink:MaD:1 | | JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | JdbcUrlSSRF.java:52:9:52:13 | props : Properties | provenance | Config | -| JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | JdbcUrlSSRF.java:52:9:52:13 | props [post update] : Properties [] : String | provenance | MaD:298 | -| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:65:27:65:33 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:260 | -| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:67:75:67:81 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:261 | -| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:70:75:70:81 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:263 | -| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:73:75:73:81 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:262 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:82:21:82:27 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:238 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:83:21:83:27 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:239 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:84:21:84:27 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:240 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:86:19:86:25 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:241 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:87:19:87:25 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:242 | -| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | provenance | Src:MaD:280 Sink:MaD:243 | -| MicronautSSRF.java:14:32:14:53 | url : String | MicronautSSRF.java:15:45:15:47 | url | provenance | Sink:MaD:4 | -| MicronautSSRF.java:19:42:19:63 | url : String | MicronautSSRF.java:20:45:20:47 | url | provenance | Sink:MaD:3 | -| MicronautSSRF.java:24:37:24:58 | url : String | MicronautSSRF.java:25:45:25:47 | url | provenance | Sink:MaD:5 | -| MicronautSSRF.java:29:34:29:56 | host : String | MicronautSSRF.java:30:60:30:63 | host : String | provenance | | -| MicronautSSRF.java:30:19:30:64 | host(...) : UriBuilder | MicronautSSRF.java:30:19:30:72 | build(...) : URI | provenance | MaD:281 | -| MicronautSSRF.java:30:19:30:72 | build(...) : URI | MicronautSSRF.java:31:45:31:47 | uri : URI | provenance | | -| MicronautSSRF.java:30:60:30:63 | host : String | MicronautSSRF.java:30:19:30:64 | host(...) : UriBuilder | provenance | MaD:282 | -| MicronautSSRF.java:31:45:31:47 | uri : URI | MicronautSSRF.java:31:45:31:58 | toString(...) | provenance | MaD:291 Sink:MaD:4 | -| ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:16:52:16:54 | url | provenance | Src:MaD:280 Sink:MaD:277 | -| ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:35:30:35:32 | url | provenance | Src:MaD:280 Sink:MaD:276 | -| SanitizationTests.java:22:23:22:58 | new URI(...) : URI | SanitizationTests.java:25:52:25:54 | uri | provenance | Sink:MaD:9 | +| JdbcUrlSSRF.java:52:38:52:44 | jdbcUrl : String | JdbcUrlSSRF.java:52:9:52:13 | props [post update] : Properties [] : String | provenance | MaD:303 | +| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:65:27:65:33 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:263 | +| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:67:75:67:81 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:264 | +| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:70:75:70:81 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:266 | +| JdbcUrlSSRF.java:60:26:60:56 | getParameter(...) : String | JdbcUrlSSRF.java:73:75:73:81 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:265 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:82:21:82:27 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:241 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:83:21:83:27 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:242 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:84:21:84:27 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:243 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:86:19:86:25 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:244 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:87:19:87:25 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:245 | +| JdbcUrlSSRF.java:80:26:80:56 | getParameter(...) : String | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | provenance | Src:MaD:283 Sink:MaD:246 | +| MicronautSSRF.java:15:32:15:53 | url : String | MicronautSSRF.java:16:45:16:47 | url | provenance | Sink:MaD:5 | +| MicronautSSRF.java:20:42:20:63 | url : String | MicronautSSRF.java:21:45:21:47 | url | provenance | Sink:MaD:4 | +| MicronautSSRF.java:25:37:25:58 | url : String | MicronautSSRF.java:26:45:26:47 | url | provenance | Sink:MaD:6 | +| MicronautSSRF.java:30:34:30:56 | host : String | MicronautSSRF.java:31:60:31:63 | host : String | provenance | | +| MicronautSSRF.java:31:19:31:64 | host(...) : UriBuilder | MicronautSSRF.java:31:19:31:72 | build(...) : URI | provenance | MaD:284 | +| MicronautSSRF.java:31:19:31:72 | build(...) : URI | MicronautSSRF.java:32:45:32:47 | uri : URI | provenance | | +| MicronautSSRF.java:31:60:31:63 | host : String | MicronautSSRF.java:31:19:31:64 | host(...) : UriBuilder | provenance | MaD:285+MaD:286 | +| MicronautSSRF.java:32:45:32:47 | uri : URI | MicronautSSRF.java:32:45:32:58 | toString(...) | provenance | MaD:296 Sink:MaD:5 | +| MicronautSSRF.java:36:39:36:60 | url : String | MicronautSSRF.java:37:61:37:63 | url : String | provenance | | +| MicronautSSRF.java:37:61:37:63 | url : String | MicronautSSRF.java:37:45:37:64 | GET(...) | provenance | MaD:287 Sink:MaD:3 | +| MicronautSSRF.java:41:35:41:56 | url : String | MicronautSSRF.java:42:32:42:34 | url | provenance | Sink:MaD:8 | +| MicronautSSRF.java:46:42:46:63 | url : String | MicronautSSRF.java:47:48:47:50 | url : String | provenance | | +| MicronautSSRF.java:47:48:47:50 | url : String | MicronautSSRF.java:47:32:47:51 | GET(...) | provenance | MaD:287 Sink:MaD:7 | +| ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:16:52:16:54 | url | provenance | Src:MaD:283 Sink:MaD:280 | +| ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) : String | ReactiveWebClientSSRF.java:35:30:35:32 | url | provenance | Src:MaD:283 Sink:MaD:279 | +| SanitizationTests.java:22:23:22:58 | new URI(...) : URI | SanitizationTests.java:25:52:25:54 | uri | provenance | Sink:MaD:12 | | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | SanitizationTests.java:25:52:25:54 | uri : URI | provenance | | -| SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | provenance | Src:MaD:280 Config | -| SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | provenance | Src:MaD:280 MaD:290 | -| SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | SanitizationTests.java:25:29:25:63 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:25:29:25:63 | build(...) : HttpRequest | SanitizationTests.java:26:25:26:25 | r | provenance | Sink:MaD:7 | -| SanitizationTests.java:25:52:25:54 | uri : URI | SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:78:33:78:63 | getParameter(...) : String | SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | provenance | Src:MaD:280 | -| SanitizationTests.java:79:36:79:78 | newBuilder(...) : Builder | SanitizationTests.java:79:36:79:86 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:79:36:79:86 | build(...) : HttpRequest | SanitizationTests.java:80:25:80:32 | unsafer3 | provenance | Sink:MaD:7 | -| SanitizationTests.java:79:59:79:77 | new URI(...) : URI | SanitizationTests.java:79:36:79:78 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | provenance | Src:MaD:283 Config | +| SanitizationTests.java:22:31:22:57 | getParameter(...) : String | SanitizationTests.java:22:23:22:58 | new URI(...) : URI | provenance | Src:MaD:283 MaD:295 | +| SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | SanitizationTests.java:25:29:25:63 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:25:29:25:63 | build(...) : HttpRequest | SanitizationTests.java:26:25:26:25 | r | provenance | Sink:MaD:10 | +| SanitizationTests.java:25:52:25:54 | uri : URI | SanitizationTests.java:25:29:25:55 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:78:33:78:63 | getParameter(...) : String | SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | provenance | Src:MaD:283 | +| SanitizationTests.java:79:36:79:78 | newBuilder(...) : Builder | SanitizationTests.java:79:36:79:86 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:79:36:79:86 | build(...) : HttpRequest | SanitizationTests.java:80:25:80:32 | unsafer3 | provenance | Sink:MaD:10 | +| SanitizationTests.java:79:59:79:77 | new URI(...) : URI | SanitizationTests.java:79:36:79:78 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) : URI | provenance | MaD:290 | -| SanitizationTests.java:82:49:82:79 | getParameter(...) : String | SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | provenance | Src:MaD:280 | -| SanitizationTests.java:83:36:83:78 | newBuilder(...) : Builder | SanitizationTests.java:83:36:83:86 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:83:36:83:86 | build(...) : HttpRequest | SanitizationTests.java:84:25:84:32 | unsafer4 | provenance | Sink:MaD:7 | -| SanitizationTests.java:83:59:83:77 | new URI(...) : URI | SanitizationTests.java:83:36:83:78 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:79:67:79:76 | unsafeUri3 : String | SanitizationTests.java:79:59:79:77 | new URI(...) : URI | provenance | MaD:295 | +| SanitizationTests.java:82:49:82:79 | getParameter(...) : String | SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | provenance | Src:MaD:283 | +| SanitizationTests.java:83:36:83:78 | newBuilder(...) : Builder | SanitizationTests.java:83:36:83:86 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:83:36:83:86 | build(...) : HttpRequest | SanitizationTests.java:84:25:84:32 | unsafer4 | provenance | Sink:MaD:10 | +| SanitizationTests.java:83:59:83:77 | new URI(...) : URI | SanitizationTests.java:83:36:83:78 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) : URI | provenance | MaD:290 | +| SanitizationTests.java:83:67:83:76 | unsafeUri4 : String | SanitizationTests.java:83:59:83:77 | new URI(...) : URI | provenance | MaD:295 | | SanitizationTests.java:87:13:87:22 | unsafeUri5 [post update] : StringBuilder | SanitizationTests.java:88:67:88:76 | unsafeUri5 : StringBuilder | provenance | | -| SanitizationTests.java:87:31:87:61 | getParameter(...) : String | SanitizationTests.java:87:13:87:22 | unsafeUri5 [post update] : StringBuilder | provenance | Src:MaD:280 MaD:283 | -| SanitizationTests.java:88:36:88:89 | newBuilder(...) : Builder | SanitizationTests.java:88:36:88:97 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:88:36:88:97 | build(...) : HttpRequest | SanitizationTests.java:89:25:89:32 | unsafer5 | provenance | Sink:MaD:7 | -| SanitizationTests.java:88:59:88:88 | new URI(...) : URI | SanitizationTests.java:88:36:88:89 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:88:67:88:76 | unsafeUri5 : StringBuilder | SanitizationTests.java:88:67:88:87 | toString(...) : String | provenance | MaD:285 | -| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:87:31:87:61 | getParameter(...) : String | SanitizationTests.java:87:13:87:22 | unsafeUri5 [post update] : StringBuilder | provenance | Src:MaD:283 MaD:288 | +| SanitizationTests.java:88:36:88:89 | newBuilder(...) : Builder | SanitizationTests.java:88:36:88:97 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:88:36:88:97 | build(...) : HttpRequest | SanitizationTests.java:89:25:89:32 | unsafer5 | provenance | Sink:MaD:10 | +| SanitizationTests.java:88:59:88:88 | new URI(...) : URI | SanitizationTests.java:88:36:88:89 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:88:67:88:76 | unsafeUri5 : StringBuilder | SanitizationTests.java:88:67:88:87 | toString(...) : String | provenance | MaD:290 | +| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) : URI | provenance | MaD:290 | +| SanitizationTests.java:88:67:88:87 | toString(...) : String | SanitizationTests.java:88:59:88:88 | new URI(...) : URI | provenance | MaD:295 | | SanitizationTests.java:91:40:91:87 | new StringBuilder(...) : StringBuilder | SanitizationTests.java:93:68:93:77 | unafeUri5a : StringBuilder | provenance | | -| SanitizationTests.java:91:58:91:86 | getParameter(...) : String | SanitizationTests.java:91:40:91:87 | new StringBuilder(...) : StringBuilder | provenance | Src:MaD:280 MaD:287 | -| SanitizationTests.java:93:37:93:90 | newBuilder(...) : Builder | SanitizationTests.java:93:37:93:98 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:93:37:93:98 | build(...) : HttpRequest | SanitizationTests.java:94:25:94:33 | unsafer5a | provenance | Sink:MaD:7 | -| SanitizationTests.java:93:60:93:89 | new URI(...) : URI | SanitizationTests.java:93:37:93:90 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:93:68:93:77 | unafeUri5a : StringBuilder | SanitizationTests.java:93:68:93:88 | toString(...) : String | provenance | MaD:285 | -| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:91:58:91:86 | getParameter(...) : String | SanitizationTests.java:91:40:91:87 | new StringBuilder(...) : StringBuilder | provenance | Src:MaD:283 MaD:292 | +| SanitizationTests.java:93:37:93:90 | newBuilder(...) : Builder | SanitizationTests.java:93:37:93:98 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:93:37:93:98 | build(...) : HttpRequest | SanitizationTests.java:94:25:94:33 | unsafer5a | provenance | Sink:MaD:10 | +| SanitizationTests.java:93:60:93:89 | new URI(...) : URI | SanitizationTests.java:93:37:93:90 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:93:68:93:77 | unafeUri5a : StringBuilder | SanitizationTests.java:93:68:93:88 | toString(...) : String | provenance | MaD:290 | +| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) : URI | provenance | MaD:290 | +| SanitizationTests.java:93:68:93:88 | toString(...) : String | SanitizationTests.java:93:60:93:89 | new URI(...) : URI | provenance | MaD:295 | | SanitizationTests.java:96:41:96:105 | append(...) : StringBuilder | SanitizationTests.java:98:68:98:78 | unsafeUri5b : StringBuilder | provenance | | -| SanitizationTests.java:96:42:96:89 | new StringBuilder(...) : StringBuilder | SanitizationTests.java:96:41:96:105 | append(...) : StringBuilder | provenance | MaD:284 | -| SanitizationTests.java:96:60:96:88 | getParameter(...) : String | SanitizationTests.java:96:42:96:89 | new StringBuilder(...) : StringBuilder | provenance | Src:MaD:280 MaD:287 | -| SanitizationTests.java:98:37:98:91 | newBuilder(...) : Builder | SanitizationTests.java:98:37:98:99 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:98:37:98:99 | build(...) : HttpRequest | SanitizationTests.java:99:25:99:33 | unsafer5b | provenance | Sink:MaD:7 | -| SanitizationTests.java:98:60:98:90 | new URI(...) : URI | SanitizationTests.java:98:37:98:91 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:98:68:98:78 | unsafeUri5b : StringBuilder | SanitizationTests.java:98:68:98:89 | toString(...) : String | provenance | MaD:285 | -| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:96:42:96:89 | new StringBuilder(...) : StringBuilder | SanitizationTests.java:96:41:96:105 | append(...) : StringBuilder | provenance | MaD:289 | +| SanitizationTests.java:96:60:96:88 | getParameter(...) : String | SanitizationTests.java:96:42:96:89 | new StringBuilder(...) : StringBuilder | provenance | Src:MaD:283 MaD:292 | +| SanitizationTests.java:98:37:98:91 | newBuilder(...) : Builder | SanitizationTests.java:98:37:98:99 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:98:37:98:99 | build(...) : HttpRequest | SanitizationTests.java:99:25:99:33 | unsafer5b | provenance | Sink:MaD:10 | +| SanitizationTests.java:98:60:98:90 | new URI(...) : URI | SanitizationTests.java:98:37:98:91 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:98:68:98:78 | unsafeUri5b : StringBuilder | SanitizationTests.java:98:68:98:89 | toString(...) : String | provenance | MaD:290 | +| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) : URI | provenance | MaD:290 | +| SanitizationTests.java:98:68:98:89 | toString(...) : String | SanitizationTests.java:98:60:98:90 | new URI(...) : URI | provenance | MaD:295 | | SanitizationTests.java:101:41:101:106 | append(...) : StringBuilder | SanitizationTests.java:103:68:103:78 | unsafeUri5c : StringBuilder | provenance | | -| SanitizationTests.java:101:77:101:105 | getParameter(...) : String | SanitizationTests.java:101:41:101:106 | append(...) : StringBuilder | provenance | Src:MaD:280 MaD:283+MaD:284 | -| SanitizationTests.java:103:37:103:91 | newBuilder(...) : Builder | SanitizationTests.java:103:37:103:99 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:103:37:103:99 | build(...) : HttpRequest | SanitizationTests.java:104:25:104:33 | unsafer5c | provenance | Sink:MaD:7 | -| SanitizationTests.java:103:60:103:90 | new URI(...) : URI | SanitizationTests.java:103:37:103:91 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:103:68:103:78 | unsafeUri5c : StringBuilder | SanitizationTests.java:103:68:103:89 | toString(...) : String | provenance | MaD:285 | -| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:101:77:101:105 | getParameter(...) : String | SanitizationTests.java:101:41:101:106 | append(...) : StringBuilder | provenance | Src:MaD:283 MaD:288+MaD:289 | +| SanitizationTests.java:103:37:103:91 | newBuilder(...) : Builder | SanitizationTests.java:103:37:103:99 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:103:37:103:99 | build(...) : HttpRequest | SanitizationTests.java:104:25:104:33 | unsafer5c | provenance | Sink:MaD:10 | +| SanitizationTests.java:103:60:103:90 | new URI(...) : URI | SanitizationTests.java:103:37:103:91 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:103:68:103:78 | unsafeUri5c : StringBuilder | SanitizationTests.java:103:68:103:89 | toString(...) : String | provenance | MaD:290 | +| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) : URI | provenance | MaD:290 | +| SanitizationTests.java:103:68:103:89 | toString(...) : String | SanitizationTests.java:103:60:103:90 | new URI(...) : URI | provenance | MaD:295 | | SanitizationTests.java:106:33:106:104 | format(...) : String | SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | provenance | | -| SanitizationTests.java:106:33:106:104 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:106:33:106:104 | format(...) : String | provenance | MaD:286 | -| SanitizationTests.java:106:73:106:103 | getParameter(...) : String | SanitizationTests.java:106:33:106:104 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:280 | -| SanitizationTests.java:107:36:107:78 | newBuilder(...) : Builder | SanitizationTests.java:107:36:107:86 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:107:36:107:86 | build(...) : HttpRequest | SanitizationTests.java:108:25:108:32 | unsafer6 | provenance | Sink:MaD:7 | -| SanitizationTests.java:107:59:107:77 | new URI(...) : URI | SanitizationTests.java:107:36:107:78 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:106:33:106:104 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:106:33:106:104 | format(...) : String | provenance | MaD:291 | +| SanitizationTests.java:106:73:106:103 | getParameter(...) : String | SanitizationTests.java:106:33:106:104 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:283 | +| SanitizationTests.java:107:36:107:78 | newBuilder(...) : Builder | SanitizationTests.java:107:36:107:86 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:107:36:107:86 | build(...) : HttpRequest | SanitizationTests.java:108:25:108:32 | unsafer6 | provenance | Sink:MaD:10 | +| SanitizationTests.java:107:59:107:77 | new URI(...) : URI | SanitizationTests.java:107:36:107:78 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) : URI | provenance | MaD:290 | +| SanitizationTests.java:107:67:107:76 | unsafeUri6 : String | SanitizationTests.java:107:59:107:77 | new URI(...) : URI | provenance | MaD:295 | | SanitizationTests.java:110:33:110:110 | format(...) : String | SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | provenance | | -| SanitizationTests.java:110:33:110:110 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:110:33:110:110 | format(...) : String | provenance | MaD:286 | -| SanitizationTests.java:110:56:110:86 | getParameter(...) : String | SanitizationTests.java:110:33:110:110 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:280 | -| SanitizationTests.java:111:36:111:78 | newBuilder(...) : Builder | SanitizationTests.java:111:36:111:86 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:111:36:111:86 | build(...) : HttpRequest | SanitizationTests.java:112:25:112:32 | unsafer7 | provenance | Sink:MaD:7 | -| SanitizationTests.java:111:59:111:77 | new URI(...) : URI | SanitizationTests.java:111:36:111:78 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:110:33:110:110 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:110:33:110:110 | format(...) : String | provenance | MaD:291 | +| SanitizationTests.java:110:56:110:86 | getParameter(...) : String | SanitizationTests.java:110:33:110:110 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:283 | +| SanitizationTests.java:111:36:111:78 | newBuilder(...) : Builder | SanitizationTests.java:111:36:111:86 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:111:36:111:86 | build(...) : HttpRequest | SanitizationTests.java:112:25:112:32 | unsafer7 | provenance | Sink:MaD:10 | +| SanitizationTests.java:111:59:111:77 | new URI(...) : URI | SanitizationTests.java:111:36:111:78 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) : URI | provenance | MaD:290 | +| SanitizationTests.java:111:67:111:76 | unsafeUri7 : String | SanitizationTests.java:111:59:111:77 | new URI(...) : URI | provenance | MaD:295 | | SanitizationTests.java:114:33:114:110 | format(...) : String | SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | provenance | | -| SanitizationTests.java:114:33:114:110 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:114:33:114:110 | format(...) : String | provenance | MaD:286 | -| SanitizationTests.java:114:55:114:85 | getParameter(...) : String | SanitizationTests.java:114:33:114:110 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:280 | -| SanitizationTests.java:115:36:115:78 | newBuilder(...) : Builder | SanitizationTests.java:115:36:115:86 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:115:36:115:86 | build(...) : HttpRequest | SanitizationTests.java:116:25:116:32 | unsafer8 | provenance | Sink:MaD:7 | -| SanitizationTests.java:115:59:115:77 | new URI(...) : URI | SanitizationTests.java:115:36:115:78 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:114:33:114:110 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:114:33:114:110 | format(...) : String | provenance | MaD:291 | +| SanitizationTests.java:114:55:114:85 | getParameter(...) : String | SanitizationTests.java:114:33:114:110 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:283 | +| SanitizationTests.java:115:36:115:78 | newBuilder(...) : Builder | SanitizationTests.java:115:36:115:86 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:115:36:115:86 | build(...) : HttpRequest | SanitizationTests.java:116:25:116:32 | unsafer8 | provenance | Sink:MaD:10 | +| SanitizationTests.java:115:59:115:77 | new URI(...) : URI | SanitizationTests.java:115:36:115:78 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) : URI | provenance | MaD:290 | -| SanitizationTests.java:118:33:118:63 | getParameter(...) : String | SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | provenance | Src:MaD:280 | -| SanitizationTests.java:119:36:119:78 | newBuilder(...) : Builder | SanitizationTests.java:119:36:119:86 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:119:36:119:86 | build(...) : HttpRequest | SanitizationTests.java:120:25:120:32 | unsafer9 | provenance | Sink:MaD:7 | -| SanitizationTests.java:119:59:119:77 | new URI(...) : URI | SanitizationTests.java:119:36:119:78 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:115:67:115:76 | unsafeUri8 : String | SanitizationTests.java:115:59:115:77 | new URI(...) : URI | provenance | MaD:295 | +| SanitizationTests.java:118:33:118:63 | getParameter(...) : String | SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | provenance | Src:MaD:283 | +| SanitizationTests.java:119:36:119:78 | newBuilder(...) : Builder | SanitizationTests.java:119:36:119:86 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:119:36:119:86 | build(...) : HttpRequest | SanitizationTests.java:120:25:120:32 | unsafer9 | provenance | Sink:MaD:10 | +| SanitizationTests.java:119:59:119:77 | new URI(...) : URI | SanitizationTests.java:119:36:119:78 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) : URI | provenance | MaD:290 | +| SanitizationTests.java:119:67:119:76 | unsafeUri9 : String | SanitizationTests.java:119:59:119:77 | new URI(...) : URI | provenance | MaD:295 | | SanitizationTests.java:122:34:122:126 | format(...) : String | SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | provenance | | -| SanitizationTests.java:122:34:122:126 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:122:34:122:126 | format(...) : String | provenance | MaD:286 | -| SanitizationTests.java:122:94:122:125 | getParameter(...) : String | SanitizationTests.java:122:34:122:126 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:280 | -| SanitizationTests.java:123:37:123:80 | newBuilder(...) : Builder | SanitizationTests.java:123:37:123:88 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:123:37:123:88 | build(...) : HttpRequest | SanitizationTests.java:124:25:124:33 | unsafer10 | provenance | Sink:MaD:7 | -| SanitizationTests.java:123:60:123:79 | new URI(...) : URI | SanitizationTests.java:123:37:123:80 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:122:34:122:126 | new ..[] { .. } : Object[] [[]] : String | SanitizationTests.java:122:34:122:126 | format(...) : String | provenance | MaD:291 | +| SanitizationTests.java:122:94:122:125 | getParameter(...) : String | SanitizationTests.java:122:34:122:126 | new ..[] { .. } : Object[] [[]] : String | provenance | Src:MaD:283 | +| SanitizationTests.java:123:37:123:80 | newBuilder(...) : Builder | SanitizationTests.java:123:37:123:88 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:123:37:123:88 | build(...) : HttpRequest | SanitizationTests.java:124:25:124:33 | unsafer10 | provenance | Sink:MaD:10 | +| SanitizationTests.java:123:60:123:79 | new URI(...) : URI | SanitizationTests.java:123:37:123:80 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) : URI | provenance | MaD:290 | -| SanitizationTests.java:177:31:177:114 | newBuilder(...) : Builder | SanitizationTests.java:177:31:177:122 | build(...) : HttpRequest | provenance | MaD:288 | -| SanitizationTests.java:177:31:177:122 | build(...) : HttpRequest | SanitizationTests.java:178:25:178:27 | r18 | provenance | Sink:MaD:7 | -| SanitizationTests.java:177:54:177:113 | new URI(...) : URI | SanitizationTests.java:177:31:177:114 | newBuilder(...) : Builder | provenance | MaD:289 | -| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) | provenance | Config Sink:MaD:9 | -| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) | provenance | MaD:290 Sink:MaD:9 | +| SanitizationTests.java:123:68:123:78 | unsafeUri10 : String | SanitizationTests.java:123:60:123:79 | new URI(...) : URI | provenance | MaD:295 | +| SanitizationTests.java:177:31:177:114 | newBuilder(...) : Builder | SanitizationTests.java:177:31:177:122 | build(...) : HttpRequest | provenance | MaD:293 | +| SanitizationTests.java:177:31:177:122 | build(...) : HttpRequest | SanitizationTests.java:178:25:178:27 | r18 | provenance | Sink:MaD:10 | +| SanitizationTests.java:177:54:177:113 | new URI(...) : URI | SanitizationTests.java:177:31:177:114 | newBuilder(...) : Builder | provenance | MaD:294 | +| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) | provenance | Config Sink:MaD:12 | +| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) | provenance | MaD:295 Sink:MaD:12 | | SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) : URI | provenance | Config | -| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) : URI | provenance | MaD:290 | -| SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | SanitizationTests.java:177:62:177:112 | getFromList(...) : String | provenance | MaD:295 | +| SanitizationTests.java:177:62:177:112 | getFromList(...) : String | SanitizationTests.java:177:54:177:113 | new URI(...) : URI | provenance | MaD:295 | +| SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | SanitizationTests.java:177:62:177:112 | getFromList(...) : String | provenance | MaD:300 | | SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | SanitizationTests.java:199:31:199:112 | list : List [] : String | provenance | | -| SanitizationTests.java:177:82:177:110 | getParameter(...) : String | SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | provenance | Src:MaD:280 MaD:294 | +| SanitizationTests.java:177:82:177:110 | getParameter(...) : String | SanitizationTests.java:177:74:177:111 | of(...) : List [] : String | provenance | Src:MaD:283 MaD:299 | | SanitizationTests.java:199:31:199:112 | list : List [] : String | SanitizationTests.java:200:16:200:19 | list : List [] : String | provenance | | -| SanitizationTests.java:200:16:200:19 | list : List [] : String | SanitizationTests.java:200:16:200:26 | get(...) : String | provenance | MaD:295 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:32:39:32:59 | ... + ... | provenance | Src:MaD:280 Sink:MaD:267 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:33:69:33:82 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:34:73:34:86 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:35:87:35:100 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:38:83:38:96 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:40:105:40:118 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:43:35:43:48 | fooResourceUrl | provenance | Src:MaD:280 Sink:MaD:265 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:44:91:44:104 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:45:95:45:108 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:46:109:46:122 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:49:105:49:118 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:51:127:51:140 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:54:34:54:47 | fooResourceUrl | provenance | Src:MaD:280 Sink:MaD:266 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:55:79:55:92 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:56:83:56:96 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:57:97:57:110 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:60:93:60:106 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:62:115:62:128 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:65:39:65:52 | fooResourceUrl | provenance | Src:MaD:280 Sink:MaD:268 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:66:69:66:82 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:67:73:67:86 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:68:87:68:100 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:71:83:71:96 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:73:105:73:118 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:76:41:76:54 | fooResourceUrl | provenance | Src:MaD:280 Sink:MaD:271 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:77:93:77:106 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:78:97:78:110 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:79:111:79:124 | fooResourceUrl | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:82:107:82:120 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:84:129:84:142 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | provenance | Src:MaD:280 | -| SpringSSRF.java:38:83:38:96 | fooResourceUrl : String | SpringSSRF.java:38:69:38:97 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:40:105:40:118 | fooResourceUrl : String | SpringSSRF.java:40:69:40:119 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:49:105:49:118 | fooResourceUrl : String | SpringSSRF.java:49:91:49:119 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:51:127:51:140 | fooResourceUrl : String | SpringSSRF.java:51:91:51:141 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:60:93:60:106 | fooResourceUrl : String | SpringSSRF.java:60:79:60:107 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:62:115:62:128 | fooResourceUrl : String | SpringSSRF.java:62:79:62:129 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:71:83:71:96 | fooResourceUrl : String | SpringSSRF.java:71:69:71:97 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:73:105:73:118 | fooResourceUrl : String | SpringSSRF.java:73:69:73:119 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:82:107:82:120 | fooResourceUrl : String | SpringSSRF.java:82:93:82:121 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:84:129:84:142 | fooResourceUrl : String | SpringSSRF.java:84:93:84:143 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:87:40:87:62 | new URI(...) | provenance | Config Sink:MaD:272 | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:87:40:87:62 | new URI(...) | provenance | MaD:290 Sink:MaD:272 | +| SanitizationTests.java:200:16:200:19 | list : List [] : String | SanitizationTests.java:200:16:200:26 | get(...) : String | provenance | MaD:300 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:32:39:32:59 | ... + ... | provenance | Src:MaD:283 Sink:MaD:270 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:33:69:33:82 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:34:73:34:86 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:35:87:35:100 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:38:83:38:96 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:40:105:40:118 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:43:35:43:48 | fooResourceUrl | provenance | Src:MaD:283 Sink:MaD:268 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:44:91:44:104 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:45:95:45:108 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:46:109:46:122 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:49:105:49:118 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:51:127:51:140 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:54:34:54:47 | fooResourceUrl | provenance | Src:MaD:283 Sink:MaD:269 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:55:79:55:92 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:56:83:56:96 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:57:97:57:110 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:60:93:60:106 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:62:115:62:128 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:65:39:65:52 | fooResourceUrl | provenance | Src:MaD:283 Sink:MaD:271 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:66:69:66:82 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:67:73:67:86 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:68:87:68:100 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:71:83:71:96 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:73:105:73:118 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:76:41:76:54 | fooResourceUrl | provenance | Src:MaD:283 Sink:MaD:274 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:77:93:77:106 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:78:97:78:110 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:79:111:79:124 | fooResourceUrl | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:82:107:82:120 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:84:129:84:142 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:28:33:28:60 | getParameter(...) : String | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | provenance | Src:MaD:283 | +| SpringSSRF.java:38:83:38:96 | fooResourceUrl : String | SpringSSRF.java:38:69:38:97 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:40:105:40:118 | fooResourceUrl : String | SpringSSRF.java:40:69:40:119 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:49:105:49:118 | fooResourceUrl : String | SpringSSRF.java:49:91:49:119 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:51:127:51:140 | fooResourceUrl : String | SpringSSRF.java:51:91:51:141 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:60:93:60:106 | fooResourceUrl : String | SpringSSRF.java:60:79:60:107 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:62:115:62:128 | fooResourceUrl : String | SpringSSRF.java:62:79:62:129 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:71:83:71:96 | fooResourceUrl : String | SpringSSRF.java:71:69:71:97 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:73:105:73:118 | fooResourceUrl : String | SpringSSRF.java:73:69:73:119 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:82:107:82:120 | fooResourceUrl : String | SpringSSRF.java:82:93:82:121 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:84:129:84:142 | fooResourceUrl : String | SpringSSRF.java:84:93:84:143 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:87:40:87:62 | new URI(...) | provenance | Config Sink:MaD:275 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:87:40:87:62 | new URI(...) | provenance | MaD:295 Sink:MaD:275 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:88:92:88:105 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:89:96:89:109 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:90:110:90:123 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:93:106:93:119 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:95:128:95:141 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:98:42:98:55 | fooResourceUrl | provenance | Sink:MaD:273 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:98:42:98:55 | fooResourceUrl | provenance | Sink:MaD:276 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:99:80:99:93 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:100:84:100:97 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:101:98:101:111 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:104:94:104:107 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:106:116:106:129 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:109:40:109:53 | fooResourceUrl | provenance | Sink:MaD:274 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:109:40:109:53 | fooResourceUrl | provenance | Sink:MaD:277 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:110:92:110:105 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:111:96:111:109 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:112:110:112:123 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:115:106:115:119 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:117:128:117:141 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:120:30:120:43 | fooResourceUrl | provenance | Sink:MaD:275 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:120:30:120:43 | fooResourceUrl | provenance | Sink:MaD:278 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:121:68:121:81 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:122:72:122:85 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:123:86:123:99 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:126:82:126:95 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:128:104:128:117 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:131:33:131:46 | fooResourceUrl | provenance | Sink:MaD:264 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:131:33:131:46 | fooResourceUrl | provenance | Sink:MaD:267 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:132:49:132:62 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:133:53:133:66 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:134:67:134:80 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:137:63:137:76 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:139:85:139:98 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:142:41:142:54 | fooResourceUrl | provenance | Sink:MaD:269 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:142:41:142:54 | fooResourceUrl | provenance | Sink:MaD:272 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:143:57:143:70 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:144:61:144:74 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:145:75:145:88 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:148:71:148:84 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:150:93:150:106 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:153:42:153:55 | fooResourceUrl | provenance | Sink:MaD:270 | +| SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:153:42:153:55 | fooResourceUrl | provenance | Sink:MaD:273 | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:154:58:154:71 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:155:62:155:75 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:156:76:156:89 | fooResourceUrl | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:159:72:159:85 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:161:94:161:107 | fooResourceUrl : String | provenance | | | SpringSSRF.java:87:48:87:61 | fooResourceUrl : String | SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:93:106:93:119 | fooResourceUrl : String | SpringSSRF.java:93:92:93:120 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:95:128:95:141 | fooResourceUrl : String | SpringSSRF.java:95:92:95:142 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:104:94:104:107 | fooResourceUrl : String | SpringSSRF.java:104:80:104:108 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:106:116:106:129 | fooResourceUrl : String | SpringSSRF.java:106:80:106:130 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:115:106:115:119 | fooResourceUrl : String | SpringSSRF.java:115:92:115:120 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:117:128:117:141 | fooResourceUrl : String | SpringSSRF.java:117:92:117:142 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:126:82:126:95 | fooResourceUrl : String | SpringSSRF.java:126:68:126:96 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:128:104:128:117 | fooResourceUrl : String | SpringSSRF.java:128:68:128:118 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:137:63:137:76 | fooResourceUrl : String | SpringSSRF.java:137:49:137:77 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:139:85:139:98 | fooResourceUrl : String | SpringSSRF.java:139:49:139:99 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:148:71:148:84 | fooResourceUrl : String | SpringSSRF.java:148:57:148:85 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:150:93:150:106 | fooResourceUrl : String | SpringSSRF.java:150:57:150:107 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:159:72:159:85 | fooResourceUrl : String | SpringSSRF.java:159:58:159:86 | of(...) | provenance | MaD:296 | -| SpringSSRF.java:161:94:161:107 | fooResourceUrl : String | SpringSSRF.java:161:58:161:108 | of(...) | provenance | MaD:297 | -| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:168:44:168:46 | uri | provenance | Sink:MaD:258 | -| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:170:35:170:37 | uri | provenance | Sink:MaD:253 | -| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:171:35:171:37 | uri | provenance | Sink:MaD:259 | -| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:172:38:172:40 | uri | provenance | Sink:MaD:252 | -| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:173:39:173:41 | uri | provenance | Sink:MaD:256 | -| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:174:37:174:39 | uri | provenance | Sink:MaD:257 | -| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:175:36:175:38 | uri | provenance | Sink:MaD:254 | -| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:176:44:176:46 | uri | provenance | Sink:MaD:255 | +| SpringSSRF.java:93:106:93:119 | fooResourceUrl : String | SpringSSRF.java:93:92:93:120 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:95:128:95:141 | fooResourceUrl : String | SpringSSRF.java:95:92:95:142 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:104:94:104:107 | fooResourceUrl : String | SpringSSRF.java:104:80:104:108 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:106:116:106:129 | fooResourceUrl : String | SpringSSRF.java:106:80:106:130 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:115:106:115:119 | fooResourceUrl : String | SpringSSRF.java:115:92:115:120 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:117:128:117:141 | fooResourceUrl : String | SpringSSRF.java:117:92:117:142 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:126:82:126:95 | fooResourceUrl : String | SpringSSRF.java:126:68:126:96 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:128:104:128:117 | fooResourceUrl : String | SpringSSRF.java:128:68:128:118 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:137:63:137:76 | fooResourceUrl : String | SpringSSRF.java:137:49:137:77 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:139:85:139:98 | fooResourceUrl : String | SpringSSRF.java:139:49:139:99 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:148:71:148:84 | fooResourceUrl : String | SpringSSRF.java:148:57:148:85 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:150:93:150:106 | fooResourceUrl : String | SpringSSRF.java:150:57:150:107 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:159:72:159:85 | fooResourceUrl : String | SpringSSRF.java:159:58:159:86 | of(...) | provenance | MaD:301 | +| SpringSSRF.java:161:94:161:107 | fooResourceUrl : String | SpringSSRF.java:161:58:161:108 | of(...) | provenance | MaD:302 | +| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:168:44:168:46 | uri | provenance | Sink:MaD:261 | +| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:170:35:170:37 | uri | provenance | Sink:MaD:256 | +| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:171:35:171:37 | uri | provenance | Sink:MaD:262 | +| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:172:38:172:40 | uri | provenance | Sink:MaD:255 | +| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:173:39:173:41 | uri | provenance | Sink:MaD:259 | +| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:174:37:174:39 | uri | provenance | Sink:MaD:260 | +| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:175:36:175:38 | uri | provenance | Sink:MaD:257 | +| SpringSSRF.java:166:27:166:49 | new URI(...) : URI | SpringSSRF.java:176:44:176:46 | uri | provenance | Sink:MaD:258 | | SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | provenance | Config | -| SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | provenance | MaD:290 | +| SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | SpringSSRF.java:166:27:166:49 | new URI(...) : URI | provenance | MaD:295 | | SpringSSRF.java:166:35:166:48 | fooResourceUrl : String | SpringSSRF.java:179:35:179:48 | fooResourceUrl : String | provenance | | -| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:182:49:182:51 | uri | provenance | Sink:MaD:246 | -| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:183:58:183:60 | uri | provenance | Sink:MaD:247 | -| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:184:57:184:59 | uri | provenance | Sink:MaD:248 | -| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:185:66:185:68 | uri | provenance | Sink:MaD:250 | -| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:186:57:186:59 | uri | provenance | Sink:MaD:249 | -| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:187:66:187:68 | uri | provenance | Sink:MaD:251 | +| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:182:49:182:51 | uri | provenance | Sink:MaD:249 | +| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:183:58:183:60 | uri | provenance | Sink:MaD:250 | +| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:184:57:184:59 | uri | provenance | Sink:MaD:251 | +| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:185:66:185:68 | uri | provenance | Sink:MaD:253 | +| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:186:57:186:59 | uri | provenance | Sink:MaD:252 | +| SpringSSRF.java:179:27:179:49 | new URI(...) : URI | SpringSSRF.java:187:66:187:68 | uri | provenance | Sink:MaD:254 | | SpringSSRF.java:179:35:179:48 | fooResourceUrl : String | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | provenance | Config | -| SpringSSRF.java:179:35:179:48 | fooResourceUrl : String | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | provenance | MaD:290 | -| URLClassLoaderSSRF.java:16:26:16:52 | getParameter(...) : String | URLClassLoaderSSRF.java:17:31:17:33 | url : String | provenance | Src:MaD:280 | +| SpringSSRF.java:179:35:179:48 | fooResourceUrl : String | SpringSSRF.java:179:27:179:49 | new URI(...) : URI | provenance | MaD:295 | +| URLClassLoaderSSRF.java:16:26:16:52 | getParameter(...) : String | URLClassLoaderSSRF.java:17:31:17:33 | url : String | provenance | Src:MaD:283 | | URLClassLoaderSSRF.java:17:23:17:34 | new URI(...) : URI | URLClassLoaderSSRF.java:18:74:18:76 | uri : URI | provenance | | | URLClassLoaderSSRF.java:17:31:17:33 | url : String | URLClassLoaderSSRF.java:17:23:17:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:17:31:17:33 | url : String | URLClassLoaderSSRF.java:17:23:17:34 | new URI(...) : URI | provenance | MaD:290 | -| URLClassLoaderSSRF.java:18:64:18:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:18:64:18:85 | new URL[] | provenance | Sink:MaD:16 | -| URLClassLoaderSSRF.java:18:64:18:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:18:64:18:85 | new URL[] | provenance | Sink:MaD:16 | -| URLClassLoaderSSRF.java:18:74:18:76 | uri : URI | URLClassLoaderSSRF.java:18:74:18:84 | toURL(...) : URL | provenance | MaD:292 | +| URLClassLoaderSSRF.java:17:31:17:33 | url : String | URLClassLoaderSSRF.java:17:23:17:34 | new URI(...) : URI | provenance | MaD:295 | +| URLClassLoaderSSRF.java:18:64:18:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:18:64:18:85 | new URL[] | provenance | Sink:MaD:19 | +| URLClassLoaderSSRF.java:18:64:18:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:18:64:18:85 | new URL[] | provenance | Sink:MaD:19 | +| URLClassLoaderSSRF.java:18:74:18:76 | uri : URI | URLClassLoaderSSRF.java:18:74:18:84 | toURL(...) : URL | provenance | MaD:297 | | URLClassLoaderSSRF.java:18:74:18:84 | toURL(...) : URL | URLClassLoaderSSRF.java:18:64:18:85 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:28:26:28:52 | getParameter(...) : String | URLClassLoaderSSRF.java:29:31:29:33 | url : String | provenance | Src:MaD:280 | +| URLClassLoaderSSRF.java:28:26:28:52 | getParameter(...) : String | URLClassLoaderSSRF.java:29:31:29:33 | url : String | provenance | Src:MaD:283 | | URLClassLoaderSSRF.java:29:23:29:34 | new URI(...) : URI | URLClassLoaderSSRF.java:30:74:30:76 | uri : URI | provenance | | | URLClassLoaderSSRF.java:29:31:29:33 | url : String | URLClassLoaderSSRF.java:29:23:29:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:29:31:29:33 | url : String | URLClassLoaderSSRF.java:29:23:29:34 | new URI(...) : URI | provenance | MaD:290 | -| URLClassLoaderSSRF.java:30:64:30:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:30:64:30:85 | new URL[] | provenance | Sink:MaD:17 | -| URLClassLoaderSSRF.java:30:64:30:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:30:64:30:85 | new URL[] | provenance | Sink:MaD:17 | -| URLClassLoaderSSRF.java:30:74:30:76 | uri : URI | URLClassLoaderSSRF.java:30:74:30:84 | toURL(...) : URL | provenance | MaD:292 | +| URLClassLoaderSSRF.java:29:31:29:33 | url : String | URLClassLoaderSSRF.java:29:23:29:34 | new URI(...) : URI | provenance | MaD:295 | +| URLClassLoaderSSRF.java:30:64:30:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:30:64:30:85 | new URL[] | provenance | Sink:MaD:20 | +| URLClassLoaderSSRF.java:30:64:30:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:30:64:30:85 | new URL[] | provenance | Sink:MaD:20 | +| URLClassLoaderSSRF.java:30:74:30:76 | uri : URI | URLClassLoaderSSRF.java:30:74:30:84 | toURL(...) : URL | provenance | MaD:297 | | URLClassLoaderSSRF.java:30:74:30:84 | toURL(...) : URL | URLClassLoaderSSRF.java:30:64:30:85 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:40:26:40:52 | getParameter(...) : String | URLClassLoaderSSRF.java:41:31:41:33 | url : String | provenance | Src:MaD:280 | +| URLClassLoaderSSRF.java:40:26:40:52 | getParameter(...) : String | URLClassLoaderSSRF.java:41:31:41:33 | url : String | provenance | Src:MaD:283 | | URLClassLoaderSSRF.java:41:23:41:34 | new URI(...) : URI | URLClassLoaderSSRF.java:44:74:44:76 | uri : URI | provenance | | | URLClassLoaderSSRF.java:41:31:41:33 | url : String | URLClassLoaderSSRF.java:41:23:41:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:41:31:41:33 | url : String | URLClassLoaderSSRF.java:41:23:41:34 | new URI(...) : URI | provenance | MaD:290 | -| URLClassLoaderSSRF.java:44:64:44:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:44:64:44:85 | new URL[] | provenance | Sink:MaD:18 | -| URLClassLoaderSSRF.java:44:64:44:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:44:64:44:85 | new URL[] | provenance | Sink:MaD:18 | -| URLClassLoaderSSRF.java:44:74:44:76 | uri : URI | URLClassLoaderSSRF.java:44:74:44:84 | toURL(...) : URL | provenance | MaD:292 | +| URLClassLoaderSSRF.java:41:31:41:33 | url : String | URLClassLoaderSSRF.java:41:23:41:34 | new URI(...) : URI | provenance | MaD:295 | +| URLClassLoaderSSRF.java:44:64:44:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:44:64:44:85 | new URL[] | provenance | Sink:MaD:21 | +| URLClassLoaderSSRF.java:44:64:44:85 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:44:64:44:85 | new URL[] | provenance | Sink:MaD:21 | +| URLClassLoaderSSRF.java:44:74:44:76 | uri : URI | URLClassLoaderSSRF.java:44:74:44:84 | toURL(...) : URL | provenance | MaD:297 | | URLClassLoaderSSRF.java:44:74:44:84 | toURL(...) : URL | URLClassLoaderSSRF.java:44:64:44:85 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:54:26:54:52 | getParameter(...) : String | URLClassLoaderSSRF.java:55:31:55:33 | url : String | provenance | Src:MaD:280 | +| URLClassLoaderSSRF.java:54:26:54:52 | getParameter(...) : String | URLClassLoaderSSRF.java:55:31:55:33 | url : String | provenance | Src:MaD:283 | | URLClassLoaderSSRF.java:55:23:55:34 | new URI(...) : URI | URLClassLoaderSSRF.java:56:82:56:84 | uri : URI | provenance | | | URLClassLoaderSSRF.java:55:31:55:33 | url : String | URLClassLoaderSSRF.java:55:23:55:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:55:31:55:33 | url : String | URLClassLoaderSSRF.java:55:23:55:34 | new URI(...) : URI | provenance | MaD:290 | -| URLClassLoaderSSRF.java:56:72:56:93 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:56:72:56:93 | new URL[] | provenance | Sink:MaD:19 | -| URLClassLoaderSSRF.java:56:82:56:84 | uri : URI | URLClassLoaderSSRF.java:56:82:56:92 | toURL(...) : URL | provenance | MaD:292 | +| URLClassLoaderSSRF.java:55:31:55:33 | url : String | URLClassLoaderSSRF.java:55:23:55:34 | new URI(...) : URI | provenance | MaD:295 | +| URLClassLoaderSSRF.java:56:72:56:93 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:56:72:56:93 | new URL[] | provenance | Sink:MaD:22 | +| URLClassLoaderSSRF.java:56:82:56:84 | uri : URI | URLClassLoaderSSRF.java:56:82:56:92 | toURL(...) : URL | provenance | MaD:297 | | URLClassLoaderSSRF.java:56:82:56:92 | toURL(...) : URL | URLClassLoaderSSRF.java:56:72:56:93 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:66:26:66:52 | getParameter(...) : String | URLClassLoaderSSRF.java:67:31:67:33 | url : String | provenance | Src:MaD:280 | +| URLClassLoaderSSRF.java:66:26:66:52 | getParameter(...) : String | URLClassLoaderSSRF.java:67:31:67:33 | url : String | provenance | Src:MaD:283 | | URLClassLoaderSSRF.java:67:23:67:34 | new URI(...) : URI | URLClassLoaderSSRF.java:70:31:70:33 | uri : URI | provenance | | | URLClassLoaderSSRF.java:67:31:67:33 | url : String | URLClassLoaderSSRF.java:67:23:67:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:67:31:67:33 | url : String | URLClassLoaderSSRF.java:67:23:67:34 | new URI(...) : URI | provenance | MaD:290 | -| URLClassLoaderSSRF.java:70:21:70:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:70:21:70:42 | new URL[] | provenance | Sink:MaD:14 | -| URLClassLoaderSSRF.java:70:21:70:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:70:21:70:42 | new URL[] | provenance | Sink:MaD:14 | -| URLClassLoaderSSRF.java:70:31:70:33 | uri : URI | URLClassLoaderSSRF.java:70:31:70:41 | toURL(...) : URL | provenance | MaD:292 | +| URLClassLoaderSSRF.java:67:31:67:33 | url : String | URLClassLoaderSSRF.java:67:23:67:34 | new URI(...) : URI | provenance | MaD:295 | +| URLClassLoaderSSRF.java:70:21:70:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:70:21:70:42 | new URL[] | provenance | Sink:MaD:17 | +| URLClassLoaderSSRF.java:70:21:70:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:70:21:70:42 | new URL[] | provenance | Sink:MaD:17 | +| URLClassLoaderSSRF.java:70:31:70:33 | uri : URI | URLClassLoaderSSRF.java:70:31:70:41 | toURL(...) : URL | provenance | MaD:297 | | URLClassLoaderSSRF.java:70:31:70:41 | toURL(...) : URL | URLClassLoaderSSRF.java:70:21:70:42 | {...} : URL[] [[]] : URL | provenance | | -| URLClassLoaderSSRF.java:83:26:83:52 | getParameter(...) : String | URLClassLoaderSSRF.java:84:31:84:33 | url : String | provenance | Src:MaD:280 | +| URLClassLoaderSSRF.java:83:26:83:52 | getParameter(...) : String | URLClassLoaderSSRF.java:84:31:84:33 | url : String | provenance | Src:MaD:283 | | URLClassLoaderSSRF.java:84:23:84:34 | new URI(...) : URI | URLClassLoaderSSRF.java:89:31:89:33 | uri : URI | provenance | | | URLClassLoaderSSRF.java:84:31:84:33 | url : String | URLClassLoaderSSRF.java:84:23:84:34 | new URI(...) : URI | provenance | Config | -| URLClassLoaderSSRF.java:84:31:84:33 | url : String | URLClassLoaderSSRF.java:84:23:84:34 | new URI(...) : URI | provenance | MaD:290 | -| URLClassLoaderSSRF.java:89:21:89:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:89:21:89:42 | new URL[] | provenance | Sink:MaD:15 | -| URLClassLoaderSSRF.java:89:21:89:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:89:21:89:42 | new URL[] | provenance | Sink:MaD:15 | -| URLClassLoaderSSRF.java:89:31:89:33 | uri : URI | URLClassLoaderSSRF.java:89:31:89:41 | toURL(...) : URL | provenance | MaD:292 | +| URLClassLoaderSSRF.java:84:31:84:33 | url : String | URLClassLoaderSSRF.java:84:23:84:34 | new URI(...) : URI | provenance | MaD:295 | +| URLClassLoaderSSRF.java:89:21:89:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:89:21:89:42 | new URL[] | provenance | Sink:MaD:18 | +| URLClassLoaderSSRF.java:89:21:89:42 | {...} : URL[] [[]] : URL | URLClassLoaderSSRF.java:89:21:89:42 | new URL[] | provenance | Sink:MaD:18 | +| URLClassLoaderSSRF.java:89:31:89:33 | uri : URI | URLClassLoaderSSRF.java:89:31:89:41 | toURL(...) : URL | provenance | MaD:297 | | URLClassLoaderSSRF.java:89:31:89:41 | toURL(...) : URL | URLClassLoaderSSRF.java:89:21:89:42 | {...} : URL[] [[]] : URL | provenance | | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:31:40:31:47 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:36:16:36:23 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:38:36:38:43 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:40:16:40:23 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:45:40:45:47 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:47:40:47:47 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:49:36:49:43 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:51:36:51:43 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:53:36:53:43 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:55:44:55:51 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:57:38:57:45 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:59:44:59:51 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:61:53:61:60 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:63:32:63:39 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:65:44:65:51 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:67:32:67:39 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:69:33:69:40 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:71:53:71:60 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:74:58:74:65 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:76:62:76:69 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:78:52:78:59 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:80:34:80:41 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:82:40:82:47 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:84:40:84:47 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:86:50:86:57 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:92:33:92:40 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:97:35:97:42 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:102:32:102:39 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:107:24:107:31 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:112:24:112:31 | source(...) : String | provenance | Src:MaD:280 | -| mad/Test.java:31:40:31:47 | source(...) : String | mad/Test.java:31:24:31:47 | (...)... | provenance | Sink:MaD:10 | -| mad/Test.java:36:16:36:23 | source(...) : String | mad/Test.java:36:10:36:23 | (...)... | provenance | Sink:MaD:12 | -| mad/Test.java:38:36:38:43 | source(...) : String | mad/Test.java:38:28:38:43 | (...)... | provenance | Sink:MaD:11 | -| mad/Test.java:40:16:40:23 | source(...) : String | mad/Test.java:40:10:40:23 | (...)... | provenance | Sink:MaD:13 | -| mad/Test.java:45:40:45:47 | source(...) : String | mad/Test.java:45:32:45:47 | (...)... | provenance | Sink:MaD:14 | -| mad/Test.java:45:40:45:47 | source(...) : String | mad/Test.java:45:32:45:47 | (...)... | provenance | Sink:MaD:14 | -| mad/Test.java:47:40:47:47 | source(...) : String | mad/Test.java:47:32:47:47 | (...)... | provenance | Sink:MaD:15 | -| mad/Test.java:47:40:47:47 | source(...) : String | mad/Test.java:47:32:47:47 | (...)... | provenance | Sink:MaD:15 | -| mad/Test.java:49:36:49:43 | source(...) : String | mad/Test.java:49:28:49:43 | (...)... | provenance | Sink:MaD:16 | -| mad/Test.java:49:36:49:43 | source(...) : String | mad/Test.java:49:28:49:43 | (...)... | provenance | Sink:MaD:16 | -| mad/Test.java:51:36:51:43 | source(...) : String | mad/Test.java:51:28:51:43 | (...)... | provenance | Sink:MaD:17 | -| mad/Test.java:51:36:51:43 | source(...) : String | mad/Test.java:51:28:51:43 | (...)... | provenance | Sink:MaD:17 | -| mad/Test.java:53:36:53:43 | source(...) : String | mad/Test.java:53:28:53:43 | (...)... | provenance | Sink:MaD:18 | -| mad/Test.java:53:36:53:43 | source(...) : String | mad/Test.java:53:28:53:43 | (...)... | provenance | Sink:MaD:18 | -| mad/Test.java:55:44:55:51 | source(...) : String | mad/Test.java:55:36:55:51 | (...)... | provenance | Sink:MaD:19 | -| mad/Test.java:57:38:57:45 | source(...) : String | mad/Test.java:57:32:57:45 | (...)... | provenance | Sink:MaD:28 | -| mad/Test.java:59:44:59:51 | source(...) : String | mad/Test.java:59:38:59:51 | (...)... | provenance | Sink:MaD:29 | -| mad/Test.java:61:53:61:60 | source(...) : String | mad/Test.java:61:47:61:60 | (...)... | provenance | Sink:MaD:27 | -| mad/Test.java:63:32:63:39 | source(...) : String | mad/Test.java:63:26:63:39 | (...)... | provenance | Sink:MaD:31 | -| mad/Test.java:65:44:65:51 | source(...) : String | mad/Test.java:65:38:65:51 | (...)... | provenance | Sink:MaD:32 | -| mad/Test.java:67:32:67:39 | source(...) : String | mad/Test.java:67:26:67:39 | (...)... | provenance | Sink:MaD:30 | -| mad/Test.java:69:33:69:40 | source(...) : String | mad/Test.java:69:27:69:40 | (...)... | provenance | Sink:MaD:25 | -| mad/Test.java:71:53:71:60 | source(...) : String | mad/Test.java:71:47:71:60 | (...)... | provenance | Sink:MaD:33 | -| mad/Test.java:74:58:74:65 | source(...) : String | mad/Test.java:74:50:74:65 | (...)... | provenance | Sink:MaD:35 | -| mad/Test.java:76:62:76:69 | source(...) : String | mad/Test.java:76:50:76:69 | (...)... | provenance | Sink:MaD:34 | -| mad/Test.java:78:52:78:59 | source(...) : String | mad/Test.java:78:43:78:59 | (...)... | provenance | Sink:MaD:36 | -| mad/Test.java:80:34:80:41 | source(...) : String | mad/Test.java:80:25:80:41 | (...)... | provenance | Sink:MaD:37 | -| mad/Test.java:82:40:82:47 | source(...) : String | mad/Test.java:82:31:82:47 | (...)... | provenance | Sink:MaD:38 | -| mad/Test.java:84:40:84:47 | source(...) : String | mad/Test.java:84:31:84:47 | (...)... | provenance | Sink:MaD:39 | -| mad/Test.java:86:50:86:57 | source(...) : String | mad/Test.java:86:41:86:57 | (...)... | provenance | Sink:MaD:40 | -| mad/Test.java:92:33:92:40 | source(...) : String | mad/Test.java:92:24:92:40 | (...)... | provenance | Sink:MaD:24 | -| mad/Test.java:97:35:97:42 | source(...) : String | mad/Test.java:97:29:97:42 | (...)... | provenance | Sink:MaD:237 | -| mad/Test.java:102:32:102:39 | source(...) : String | mad/Test.java:102:26:102:39 | (...)... | provenance | Sink:MaD:244 | -| mad/Test.java:107:24:107:31 | source(...) : String | mad/Test.java:107:15:107:31 | (...)... | provenance | Sink:MaD:279 | -| mad/Test.java:112:24:112:31 | source(...) : String | mad/Test.java:112:15:112:31 | (...)... | provenance | Sink:MaD:278 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:31:40:31:47 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:36:16:36:23 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:38:36:38:43 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:40:16:40:23 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:45:40:45:47 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:47:40:47:47 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:49:36:49:43 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:51:36:51:43 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:53:36:53:43 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:55:44:55:51 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:57:38:57:45 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:59:44:59:51 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:61:53:61:60 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:63:32:63:39 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:65:44:65:51 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:67:32:67:39 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:69:33:69:40 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:71:53:71:60 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:74:58:74:65 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:76:62:76:69 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:78:52:78:59 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:80:34:80:41 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:82:40:82:47 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:84:40:84:47 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:86:50:86:57 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:92:33:92:40 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:97:35:97:42 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:102:32:102:39 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:107:24:107:31 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:26:16:26:41 | getParameter(...) : String | mad/Test.java:112:24:112:31 | source(...) : String | provenance | Src:MaD:283 | +| mad/Test.java:31:40:31:47 | source(...) : String | mad/Test.java:31:24:31:47 | (...)... | provenance | Sink:MaD:13 | +| mad/Test.java:36:16:36:23 | source(...) : String | mad/Test.java:36:10:36:23 | (...)... | provenance | Sink:MaD:15 | +| mad/Test.java:38:36:38:43 | source(...) : String | mad/Test.java:38:28:38:43 | (...)... | provenance | Sink:MaD:14 | +| mad/Test.java:40:16:40:23 | source(...) : String | mad/Test.java:40:10:40:23 | (...)... | provenance | Sink:MaD:16 | +| mad/Test.java:45:40:45:47 | source(...) : String | mad/Test.java:45:32:45:47 | (...)... | provenance | Sink:MaD:17 | +| mad/Test.java:45:40:45:47 | source(...) : String | mad/Test.java:45:32:45:47 | (...)... | provenance | Sink:MaD:17 | +| mad/Test.java:47:40:47:47 | source(...) : String | mad/Test.java:47:32:47:47 | (...)... | provenance | Sink:MaD:18 | +| mad/Test.java:47:40:47:47 | source(...) : String | mad/Test.java:47:32:47:47 | (...)... | provenance | Sink:MaD:18 | +| mad/Test.java:49:36:49:43 | source(...) : String | mad/Test.java:49:28:49:43 | (...)... | provenance | Sink:MaD:19 | +| mad/Test.java:49:36:49:43 | source(...) : String | mad/Test.java:49:28:49:43 | (...)... | provenance | Sink:MaD:19 | +| mad/Test.java:51:36:51:43 | source(...) : String | mad/Test.java:51:28:51:43 | (...)... | provenance | Sink:MaD:20 | +| mad/Test.java:51:36:51:43 | source(...) : String | mad/Test.java:51:28:51:43 | (...)... | provenance | Sink:MaD:20 | +| mad/Test.java:53:36:53:43 | source(...) : String | mad/Test.java:53:28:53:43 | (...)... | provenance | Sink:MaD:21 | +| mad/Test.java:53:36:53:43 | source(...) : String | mad/Test.java:53:28:53:43 | (...)... | provenance | Sink:MaD:21 | +| mad/Test.java:55:44:55:51 | source(...) : String | mad/Test.java:55:36:55:51 | (...)... | provenance | Sink:MaD:22 | +| mad/Test.java:57:38:57:45 | source(...) : String | mad/Test.java:57:32:57:45 | (...)... | provenance | Sink:MaD:31 | +| mad/Test.java:59:44:59:51 | source(...) : String | mad/Test.java:59:38:59:51 | (...)... | provenance | Sink:MaD:32 | +| mad/Test.java:61:53:61:60 | source(...) : String | mad/Test.java:61:47:61:60 | (...)... | provenance | Sink:MaD:30 | +| mad/Test.java:63:32:63:39 | source(...) : String | mad/Test.java:63:26:63:39 | (...)... | provenance | Sink:MaD:34 | +| mad/Test.java:65:44:65:51 | source(...) : String | mad/Test.java:65:38:65:51 | (...)... | provenance | Sink:MaD:35 | +| mad/Test.java:67:32:67:39 | source(...) : String | mad/Test.java:67:26:67:39 | (...)... | provenance | Sink:MaD:33 | +| mad/Test.java:69:33:69:40 | source(...) : String | mad/Test.java:69:27:69:40 | (...)... | provenance | Sink:MaD:28 | +| mad/Test.java:71:53:71:60 | source(...) : String | mad/Test.java:71:47:71:60 | (...)... | provenance | Sink:MaD:36 | +| mad/Test.java:74:58:74:65 | source(...) : String | mad/Test.java:74:50:74:65 | (...)... | provenance | Sink:MaD:38 | +| mad/Test.java:76:62:76:69 | source(...) : String | mad/Test.java:76:50:76:69 | (...)... | provenance | Sink:MaD:37 | +| mad/Test.java:78:52:78:59 | source(...) : String | mad/Test.java:78:43:78:59 | (...)... | provenance | Sink:MaD:39 | +| mad/Test.java:80:34:80:41 | source(...) : String | mad/Test.java:80:25:80:41 | (...)... | provenance | Sink:MaD:40 | +| mad/Test.java:82:40:82:47 | source(...) : String | mad/Test.java:82:31:82:47 | (...)... | provenance | Sink:MaD:41 | +| mad/Test.java:84:40:84:47 | source(...) : String | mad/Test.java:84:31:84:47 | (...)... | provenance | Sink:MaD:42 | +| mad/Test.java:86:50:86:57 | source(...) : String | mad/Test.java:86:41:86:57 | (...)... | provenance | Sink:MaD:43 | +| mad/Test.java:92:33:92:40 | source(...) : String | mad/Test.java:92:24:92:40 | (...)... | provenance | Sink:MaD:27 | +| mad/Test.java:97:35:97:42 | source(...) : String | mad/Test.java:97:29:97:42 | (...)... | provenance | Sink:MaD:240 | +| mad/Test.java:102:32:102:39 | source(...) : String | mad/Test.java:102:26:102:39 | (...)... | provenance | Sink:MaD:247 | +| mad/Test.java:107:24:107:31 | source(...) : String | mad/Test.java:107:15:107:31 | (...)... | provenance | Sink:MaD:282 | +| mad/Test.java:112:24:112:31 | source(...) : String | mad/Test.java:112:15:112:31 | (...)... | provenance | Sink:MaD:281 | models | 1 | Sink: com.zaxxer.hikari; HikariConfig; false; HikariConfig; (Properties); ; Argument[0]; request-forgery; manual | | 2 | Sink: com.zaxxer.hikari; HikariConfig; false; setJdbcUrl; (String); ; Argument[0]; request-forgery; manual | -| 3 | Sink: io.micronaut.http.client; BlockingHttpClient; true; exchange; (String); ; Argument[0]; request-forgery; manual | -| 4 | Sink: io.micronaut.http.client; BlockingHttpClient; true; retrieve; (String); ; Argument[0]; request-forgery; manual | -| 5 | Sink: io.micronaut.http.client; BlockingHttpClient; true; retrieve; (String,Class); ; Argument[0]; request-forgery; manual | -| 6 | Sink: jakarta.ws.rs.client; Client; true; target; ; ; Argument[0]; request-forgery; manual | -| 7 | Sink: java.net.http; HttpClient; true; send; (HttpRequest,HttpResponse$BodyHandler); ; Argument[0]; request-forgery; ai-manual | -| 8 | Sink: java.net.http; HttpRequest$Builder; false; uri; ; ; Argument[0]; request-forgery; manual | -| 9 | Sink: java.net.http; HttpRequest; false; newBuilder; ; ; Argument[0]; request-forgery; manual | -| 10 | Sink: java.net; DatagramSocket; true; connect; (SocketAddress); ; Argument[0]; request-forgery; ai-manual | -| 11 | Sink: java.net; URL; false; openConnection; (Proxy); ; Argument[0]; request-forgery; ai-manual | -| 12 | Sink: java.net; URL; false; openConnection; ; ; Argument[this]; request-forgery; manual | -| 13 | Sink: java.net; URL; false; openStream; ; ; Argument[this]; request-forgery; manual | -| 14 | Sink: java.net; URLClassLoader; false; URLClassLoader; (String,URL[],ClassLoader); ; Argument[1]; request-forgery; manual | -| 15 | Sink: java.net; URLClassLoader; false; URLClassLoader; (String,URL[],ClassLoader,URLStreamHandlerFactory); ; Argument[1]; request-forgery; manual | -| 16 | Sink: java.net; URLClassLoader; false; URLClassLoader; (URL[]); ; Argument[0]; request-forgery; manual | -| 17 | Sink: java.net; URLClassLoader; false; URLClassLoader; (URL[],ClassLoader); ; Argument[0]; request-forgery; manual | -| 18 | Sink: java.net; URLClassLoader; false; URLClassLoader; (URL[],ClassLoader,URLStreamHandlerFactory); ; Argument[0]; request-forgery; manual | -| 19 | Sink: java.net; URLClassLoader; false; newInstance; ; ; Argument[0]; request-forgery; manual | -| 20 | Sink: java.sql; Driver; false; connect; (String,Properties); ; Argument[0]; request-forgery; manual | -| 21 | Sink: java.sql; DriverManager; false; getConnection; (String); ; Argument[0]; request-forgery; manual | -| 22 | Sink: java.sql; DriverManager; false; getConnection; (String,Properties); ; Argument[0]; request-forgery; manual | -| 23 | Sink: java.sql; DriverManager; false; getConnection; (String,String,String); ; Argument[0]; request-forgery; manual | -| 24 | Sink: javafx.scene.web; WebEngine; false; load; (String); ; Argument[0]; request-forgery; ai-manual | -| 25 | Sink: javax.activation; URLDataSource; true; URLDataSource; ; ; Argument[0]; request-forgery; manual | -| 26 | Sink: javax.ws.rs.client; Client; true; target; ; ; Argument[0]; request-forgery; manual | -| 27 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (JellyContext,URL); ; Argument[1]; request-forgery; ai-manual | -| 28 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (JellyContext,URL,URL); ; Argument[1]; request-forgery; ai-manual | -| 29 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (JellyContext,URL,URL); ; Argument[2]; request-forgery; ai-manual | -| 30 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (URL); ; Argument[0]; request-forgery; ai-manual | -| 31 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (URL,URL); ; Argument[0]; request-forgery; ai-manual | -| 32 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (URL,URL); ; Argument[1]; request-forgery; ai-manual | -| 33 | Sink: org.apache.cxf.catalog; OASISCatalogManager; true; loadCatalog; (URL); ; Argument[0]; request-forgery; manual | -| 34 | Sink: org.apache.cxf.common.classloader; ClassLoaderUtils; true; getURLClassLoader; (List,ClassLoader); ; Argument[0]; request-forgery; manual | -| 35 | Sink: org.apache.cxf.common.classloader; ClassLoaderUtils; true; getURLClassLoader; (URL[],ClassLoader); ; Argument[0]; request-forgery; manual | -| 36 | Sink: org.apache.cxf.resource; ExtendedURIResolver; true; resolve; (String,String); ; Argument[0]; request-forgery; manual | -| 37 | Sink: org.apache.cxf.resource; URIResolver; true; URIResolver; (String); ; Argument[0]; request-forgery; manual | -| 38 | Sink: org.apache.cxf.resource; URIResolver; true; URIResolver; (String,String); ; Argument[1]; request-forgery; manual | -| 39 | Sink: org.apache.cxf.resource; URIResolver; true; URIResolver; (String,String,Class); ; Argument[1]; request-forgery; manual | -| 40 | Sink: org.apache.cxf.resource; URIResolver; true; resolve; (String,String,Class); ; Argument[1]; request-forgery; manual | -| 41 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 42 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (Method,String); ; Argument[1]; request-forgery; hq-manual | -| 43 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | -| 44 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | -| 45 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 46 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; delete; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 47 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | -| 48 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | -| 49 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; get; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 50 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; get; (String); ; Argument[0]; request-forgery; hq-manual | -| 51 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | -| 52 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; head; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 53 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; head; (String); ; Argument[0]; request-forgery; hq-manual | -| 54 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | -| 55 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; options; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 56 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; options; (String); ; Argument[0]; request-forgery; hq-manual | -| 57 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | -| 58 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; patch; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 59 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | -| 60 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | -| 61 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; post; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 62 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; post; (String); ; Argument[0]; request-forgery; hq-manual | -| 63 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | -| 64 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; put; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 65 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; put; (String); ; Argument[0]; request-forgery; hq-manual | -| 66 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | -| 67 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; trace; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 68 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | -| 69 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | -| 70 | Sink: org.apache.hc.client5.http.async.methods; ConfigurableHttpRequest; true; ConfigurableHttpRequest; (String,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 71 | Sink: org.apache.hc.client5.http.async.methods; ConfigurableHttpRequest; true; ConfigurableHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 72 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; SimpleHttpRequest; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 73 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; SimpleHttpRequest; (Method,URI); ; Argument[1]; request-forgery; hq-manual | -| 74 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; SimpleHttpRequest; (String,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 75 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; SimpleHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 76 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; create; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 77 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | -| 78 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | -| 79 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 80 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 81 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (Method,String); ; Argument[1]; request-forgery; hq-manual | -| 82 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | -| 83 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | -| 84 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 85 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; delete; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 86 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | -| 87 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | -| 88 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; get; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 89 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; get; (String); ; Argument[0]; request-forgery; hq-manual | -| 90 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | -| 91 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; head; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 92 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; head; (String); ; Argument[0]; request-forgery; hq-manual | -| 93 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | -| 94 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; options; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 95 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; options; (String); ; Argument[0]; request-forgery; hq-manual | -| 96 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | -| 97 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; patch; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 98 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | -| 99 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | -| 100 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; post; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 101 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; post; (String); ; Argument[0]; request-forgery; hq-manual | -| 102 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | -| 103 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; put; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 104 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; put; (String); ; Argument[0]; request-forgery; hq-manual | -| 105 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | -| 106 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; trace; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | -| 107 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | -| 108 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | -| 109 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | -| 110 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | -| 111 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; get; (String); ; Argument[0]; request-forgery; hq-manual | -| 112 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | -| 113 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; head; (String); ; Argument[0]; request-forgery; hq-manual | -| 114 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | -| 115 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; options; (String); ; Argument[0]; request-forgery; hq-manual | -| 116 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | -| 117 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | -| 118 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | -| 119 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; post; (String); ; Argument[0]; request-forgery; hq-manual | -| 120 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | -| 121 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; put; (String); ; Argument[0]; request-forgery; hq-manual | -| 122 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | -| 123 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | -| 124 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | -| 125 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; create; (Method,String); ; Argument[1]; request-forgery; hq-manual | -| 126 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | -| 127 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | -| 128 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 129 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | -| 130 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | -| 131 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; get; (String); ; Argument[0]; request-forgery; hq-manual | -| 132 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | -| 133 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; head; (String); ; Argument[0]; request-forgery; hq-manual | -| 134 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | -| 135 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; options; (String); ; Argument[0]; request-forgery; hq-manual | -| 136 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | -| 137 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | -| 138 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | -| 139 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; post; (String); ; Argument[0]; request-forgery; hq-manual | -| 140 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | -| 141 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; put; (String); ; Argument[0]; request-forgery; hq-manual | -| 142 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | -| 143 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | -| 144 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | -| 145 | Sink: org.apache.hc.client5.http.classic.methods; HttpDelete; true; HttpDelete; (String); ; Argument[0]; request-forgery; hq-manual | -| 146 | Sink: org.apache.hc.client5.http.classic.methods; HttpDelete; true; HttpDelete; (URI); ; Argument[0]; request-forgery; hq-manual | -| 147 | Sink: org.apache.hc.client5.http.classic.methods; HttpGet; true; HttpGet; (String); ; Argument[0]; request-forgery; hq-manual | -| 148 | Sink: org.apache.hc.client5.http.classic.methods; HttpGet; true; HttpGet; (URI); ; Argument[0]; request-forgery; hq-manual | -| 149 | Sink: org.apache.hc.client5.http.classic.methods; HttpHead; true; HttpHead; (String); ; Argument[0]; request-forgery; hq-manual | -| 150 | Sink: org.apache.hc.client5.http.classic.methods; HttpHead; true; HttpHead; (URI); ; Argument[0]; request-forgery; hq-manual | -| 151 | Sink: org.apache.hc.client5.http.classic.methods; HttpOptions; true; HttpOptions; (String); ; Argument[0]; request-forgery; hq-manual | -| 152 | Sink: org.apache.hc.client5.http.classic.methods; HttpOptions; true; HttpOptions; (URI); ; Argument[0]; request-forgery; hq-manual | -| 153 | Sink: org.apache.hc.client5.http.classic.methods; HttpPatch; true; HttpPatch; (String); ; Argument[0]; request-forgery; hq-manual | -| 154 | Sink: org.apache.hc.client5.http.classic.methods; HttpPatch; true; HttpPatch; (URI); ; Argument[0]; request-forgery; hq-manual | -| 155 | Sink: org.apache.hc.client5.http.classic.methods; HttpPost; true; HttpPost; (String); ; Argument[0]; request-forgery; hq-manual | -| 156 | Sink: org.apache.hc.client5.http.classic.methods; HttpPost; true; HttpPost; (URI); ; Argument[0]; request-forgery; hq-manual | -| 157 | Sink: org.apache.hc.client5.http.classic.methods; HttpPut; true; HttpPut; (String); ; Argument[0]; request-forgery; hq-manual | -| 158 | Sink: org.apache.hc.client5.http.classic.methods; HttpPut; true; HttpPut; (URI); ; Argument[0]; request-forgery; hq-manual | -| 159 | Sink: org.apache.hc.client5.http.classic.methods; HttpTrace; true; HttpTrace; (String); ; Argument[0]; request-forgery; hq-manual | -| 160 | Sink: org.apache.hc.client5.http.classic.methods; HttpTrace; true; HttpTrace; (URI); ; Argument[0]; request-forgery; hq-manual | -| 161 | Sink: org.apache.hc.client5.http.classic.methods; HttpUriRequestBase; true; HttpUriRequestBase; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 162 | Sink: org.apache.hc.client5.http.fluent; Request; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | -| 163 | Sink: org.apache.hc.client5.http.fluent; Request; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | -| 164 | Sink: org.apache.hc.client5.http.fluent; Request; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 165 | Sink: org.apache.hc.client5.http.fluent; Request; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | -| 166 | Sink: org.apache.hc.client5.http.fluent; Request; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | -| 167 | Sink: org.apache.hc.client5.http.fluent; Request; true; get; (String); ; Argument[0]; request-forgery; hq-manual | -| 168 | Sink: org.apache.hc.client5.http.fluent; Request; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | -| 169 | Sink: org.apache.hc.client5.http.fluent; Request; true; head; (String); ; Argument[0]; request-forgery; hq-manual | -| 170 | Sink: org.apache.hc.client5.http.fluent; Request; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | -| 171 | Sink: org.apache.hc.client5.http.fluent; Request; true; options; (String); ; Argument[0]; request-forgery; hq-manual | -| 172 | Sink: org.apache.hc.client5.http.fluent; Request; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | -| 173 | Sink: org.apache.hc.client5.http.fluent; Request; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | -| 174 | Sink: org.apache.hc.client5.http.fluent; Request; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | -| 175 | Sink: org.apache.hc.client5.http.fluent; Request; true; post; (String); ; Argument[0]; request-forgery; hq-manual | -| 176 | Sink: org.apache.hc.client5.http.fluent; Request; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | -| 177 | Sink: org.apache.hc.client5.http.fluent; Request; true; put; (String); ; Argument[0]; request-forgery; hq-manual | -| 178 | Sink: org.apache.hc.client5.http.fluent; Request; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | -| 179 | Sink: org.apache.hc.client5.http.fluent; Request; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | -| 180 | Sink: org.apache.hc.client5.http.fluent; Request; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | -| 181 | Sink: org.apache.hc.core5.http.impl.bootstrap; HttpAsyncRequester; true; connect; (HttpHost,Timeout); ; Argument[0]; request-forgery; hq-manual | -| 182 | Sink: org.apache.hc.core5.http.impl.bootstrap; HttpAsyncRequester; true; connect; (HttpHost,Timeout,Object,FutureCallback); ; Argument[0]; request-forgery; hq-manual | -| 183 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | -| 184 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | -| 185 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; get; (String); ; Argument[0]; request-forgery; hq-manual | -| 186 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | -| 187 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; head; (String); ; Argument[0]; request-forgery; hq-manual | -| 188 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | -| 189 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; options; (String); ; Argument[0]; request-forgery; hq-manual | -| 190 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | -| 191 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | -| 192 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | -| 193 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; post; (String); ; Argument[0]; request-forgery; hq-manual | -| 194 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | -| 195 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; put; (String); ; Argument[0]; request-forgery; hq-manual | -| 196 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | -| 197 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | -| 198 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | -| 199 | Sink: org.apache.hc.core5.http.message; BasicClassicHttpRequest; true; BasicClassicHttpRequest; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 200 | Sink: org.apache.hc.core5.http.message; BasicClassicHttpRequest; true; BasicClassicHttpRequest; (Method,URI); ; Argument[1]; request-forgery; hq-manual | -| 201 | Sink: org.apache.hc.core5.http.message; BasicClassicHttpRequest; true; BasicClassicHttpRequest; (String,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 202 | Sink: org.apache.hc.core5.http.message; BasicClassicHttpRequest; true; BasicClassicHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 203 | Sink: org.apache.hc.core5.http.message; BasicHttpRequest; true; BasicHttpRequest; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 204 | Sink: org.apache.hc.core5.http.message; BasicHttpRequest; true; BasicHttpRequest; (Method,URI); ; Argument[1]; request-forgery; hq-manual | -| 205 | Sink: org.apache.hc.core5.http.message; BasicHttpRequest; true; BasicHttpRequest; (String,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | -| 206 | Sink: org.apache.hc.core5.http.message; BasicHttpRequest; true; BasicHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 207 | Sink: org.apache.hc.core5.http.support; AbstractRequestBuilder; true; setHttpHost; (HttpHost); ; Argument[0]; request-forgery; hq-manual | -| 208 | Sink: org.apache.hc.core5.http.support; AbstractRequestBuilder; true; setUri; (String); ; Argument[0]; request-forgery; hq-manual | -| 209 | Sink: org.apache.hc.core5.http.support; AbstractRequestBuilder; true; setUri; (URI); ; Argument[0]; request-forgery; hq-manual | -| 210 | Sink: org.apache.hc.core5.http; HttpRequest; true; setUri; (URI); ; Argument[0]; request-forgery; hq-manual | -| 211 | Sink: org.apache.hc.core5.http; HttpRequestFactory; true; newHttpRequest; (String,String); ; Argument[1]; request-forgery; hq-manual | -| 212 | Sink: org.apache.hc.core5.http; HttpRequestFactory; true; newHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | -| 213 | Sink: org.apache.http.client.methods; HttpDelete; false; HttpDelete; ; ; Argument[0]; request-forgery; manual | -| 214 | Sink: org.apache.http.client.methods; HttpGet; false; HttpGet; ; ; Argument[0]; request-forgery; manual | -| 215 | Sink: org.apache.http.client.methods; HttpHead; false; HttpHead; ; ; Argument[0]; request-forgery; manual | -| 216 | Sink: org.apache.http.client.methods; HttpOptions; false; HttpOptions; ; ; Argument[0]; request-forgery; manual | -| 217 | Sink: org.apache.http.client.methods; HttpPatch; false; HttpPatch; ; ; Argument[0]; request-forgery; manual | -| 218 | Sink: org.apache.http.client.methods; HttpPost; false; HttpPost; ; ; Argument[0]; request-forgery; manual | -| 219 | Sink: org.apache.http.client.methods; HttpPut; false; HttpPut; ; ; Argument[0]; request-forgery; manual | -| 220 | Sink: org.apache.http.client.methods; HttpRequestBase; true; setURI; ; ; Argument[0]; request-forgery; manual | -| 221 | Sink: org.apache.http.client.methods; HttpTrace; false; HttpTrace; ; ; Argument[0]; request-forgery; manual | -| 222 | Sink: org.apache.http.client.methods; RequestBuilder; false; delete; ; ; Argument[0]; request-forgery; manual | -| 223 | Sink: org.apache.http.client.methods; RequestBuilder; false; get; ; ; Argument[0]; request-forgery; manual | -| 224 | Sink: org.apache.http.client.methods; RequestBuilder; false; head; ; ; Argument[0]; request-forgery; manual | -| 225 | Sink: org.apache.http.client.methods; RequestBuilder; false; options; ; ; Argument[0]; request-forgery; manual | -| 226 | Sink: org.apache.http.client.methods; RequestBuilder; false; patch; ; ; Argument[0]; request-forgery; manual | -| 227 | Sink: org.apache.http.client.methods; RequestBuilder; false; post; ; ; Argument[0]; request-forgery; manual | -| 228 | Sink: org.apache.http.client.methods; RequestBuilder; false; put; ; ; Argument[0]; request-forgery; manual | -| 229 | Sink: org.apache.http.client.methods; RequestBuilder; false; setUri; ; ; Argument[0]; request-forgery; manual | -| 230 | Sink: org.apache.http.client.methods; RequestBuilder; false; trace; ; ; Argument[0]; request-forgery; manual | -| 231 | Sink: org.apache.http.message; BasicHttpEntityEnclosingRequest; false; BasicHttpEntityEnclosingRequest; (RequestLine); ; Argument[0]; request-forgery; manual | -| 232 | Sink: org.apache.http.message; BasicHttpEntityEnclosingRequest; false; BasicHttpEntityEnclosingRequest; (String,String); ; Argument[1]; request-forgery; manual | -| 233 | Sink: org.apache.http.message; BasicHttpEntityEnclosingRequest; false; BasicHttpEntityEnclosingRequest; (String,String,ProtocolVersion); ; Argument[1]; request-forgery; manual | -| 234 | Sink: org.apache.http.message; BasicHttpRequest; false; BasicHttpRequest; (RequestLine); ; Argument[0]; request-forgery; manual | -| 235 | Sink: org.apache.http.message; BasicHttpRequest; false; BasicHttpRequest; (String,String); ; Argument[1]; request-forgery; manual | -| 236 | Sink: org.apache.http.message; BasicHttpRequest; false; BasicHttpRequest; (String,String,ProtocolVersion); ; Argument[1]; request-forgery; manual | -| 237 | Sink: org.codehaus.cargo.container.installer; ZipURLInstaller; true; ZipURLInstaller; (URL,String,String); ; Argument[0]; request-forgery; ai-manual | -| 238 | Sink: org.jdbi.v3.core; Jdbi; false; create; (String); ; Argument[0]; request-forgery; manual | -| 239 | Sink: org.jdbi.v3.core; Jdbi; false; create; (String,Properties); ; Argument[0]; request-forgery; manual | -| 240 | Sink: org.jdbi.v3.core; Jdbi; false; create; (String,String,String); ; Argument[0]; request-forgery; manual | -| 241 | Sink: org.jdbi.v3.core; Jdbi; false; open; (String); ; Argument[0]; request-forgery; manual | -| 242 | Sink: org.jdbi.v3.core; Jdbi; false; open; (String,Properties); ; Argument[0]; request-forgery; manual | -| 243 | Sink: org.jdbi.v3.core; Jdbi; false; open; (String,String,String); ; Argument[0]; request-forgery; manual | -| 244 | Sink: org.kohsuke.stapler; HttpResponses; true; staticResource; (URL); ; Argument[0]; request-forgery; ai-manual | -| 245 | Sink: org.springframework.boot.jdbc; DataSourceBuilder; false; url; (String); ; Argument[0]; request-forgery; manual | -| 246 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (HttpMethod,URI); ; Argument[1]; request-forgery; manual | -| 247 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (MultiValueMap,HttpMethod,URI); ; Argument[2]; request-forgery; manual | -| 248 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (Object,HttpMethod,URI); ; Argument[2]; request-forgery; manual | -| 249 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (Object,HttpMethod,URI,Type); ; Argument[2]; request-forgery; manual | -| 250 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (Object,MultiValueMap,HttpMethod,URI); ; Argument[3]; request-forgery; manual | -| 251 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (Object,MultiValueMap,HttpMethod,URI,Type); ; Argument[3]; request-forgery; manual | -| 252 | Sink: org.springframework.http; RequestEntity; false; delete; ; ; Argument[0]; request-forgery; manual | -| 253 | Sink: org.springframework.http; RequestEntity; false; get; ; ; Argument[0]; request-forgery; manual | -| 254 | Sink: org.springframework.http; RequestEntity; false; head; ; ; Argument[0]; request-forgery; manual | -| 255 | Sink: org.springframework.http; RequestEntity; false; method; ; ; Argument[1]; request-forgery; manual | -| 256 | Sink: org.springframework.http; RequestEntity; false; options; ; ; Argument[0]; request-forgery; manual | -| 257 | Sink: org.springframework.http; RequestEntity; false; patch; ; ; Argument[0]; request-forgery; manual | -| 258 | Sink: org.springframework.http; RequestEntity; false; post; ; ; Argument[0]; request-forgery; manual | -| 259 | Sink: org.springframework.http; RequestEntity; false; put; ; ; Argument[0]; request-forgery; manual | -| 260 | Sink: org.springframework.jdbc.datasource; AbstractDriverBasedDataSource; false; setUrl; (String); ; Argument[0]; request-forgery; manual | -| 261 | Sink: org.springframework.jdbc.datasource; DriverManagerDataSource; false; DriverManagerDataSource; (String); ; Argument[0]; request-forgery; manual | -| 262 | Sink: org.springframework.jdbc.datasource; DriverManagerDataSource; false; DriverManagerDataSource; (String,Properties); ; Argument[0]; request-forgery; manual | -| 263 | Sink: org.springframework.jdbc.datasource; DriverManagerDataSource; false; DriverManagerDataSource; (String,String,String); ; Argument[0]; request-forgery; manual | -| 264 | Sink: org.springframework.web.client; RestTemplate; false; delete; ; ; Argument[0]; request-forgery; manual | -| 265 | Sink: org.springframework.web.client; RestTemplate; false; exchange; ; ; Argument[0]; request-forgery; manual | -| 266 | Sink: org.springframework.web.client; RestTemplate; false; execute; ; ; Argument[0]; request-forgery; manual | -| 267 | Sink: org.springframework.web.client; RestTemplate; false; getForEntity; ; ; Argument[0]; request-forgery; manual | -| 268 | Sink: org.springframework.web.client; RestTemplate; false; getForObject; ; ; Argument[0]; request-forgery; manual | -| 269 | Sink: org.springframework.web.client; RestTemplate; false; headForHeaders; ; ; Argument[0]; request-forgery; manual | -| 270 | Sink: org.springframework.web.client; RestTemplate; false; optionsForAllow; ; ; Argument[0]; request-forgery; manual | -| 271 | Sink: org.springframework.web.client; RestTemplate; false; patchForObject; ; ; Argument[0]; request-forgery; manual | -| 272 | Sink: org.springframework.web.client; RestTemplate; false; postForEntity; ; ; Argument[0]; request-forgery; manual | -| 273 | Sink: org.springframework.web.client; RestTemplate; false; postForLocation; ; ; Argument[0]; request-forgery; manual | -| 274 | Sink: org.springframework.web.client; RestTemplate; false; postForObject; ; ; Argument[0]; request-forgery; manual | -| 275 | Sink: org.springframework.web.client; RestTemplate; false; put; ; ; Argument[0]; request-forgery; manual | -| 276 | Sink: org.springframework.web.reactive.function.client; WebClient$Builder; false; baseUrl; ; ; Argument[0]; request-forgery; manual | -| 277 | Sink: org.springframework.web.reactive.function.client; WebClient; false; create; ; ; Argument[0]; request-forgery; manual | -| 278 | Sink: play.libs.ws; StandaloneWSClient; true; url; ; ; Argument[0]; request-forgery; manual | -| 279 | Sink: play.libs.ws; WSClient; true; url; ; ; Argument[0]; request-forgery; manual | -| 280 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | -| 281 | Summary: io.micronaut.http.uri; UriBuilder; true; build; (); ; Argument[this]; ReturnValue; taint; manual | -| 282 | Summary: io.micronaut.http.uri; UriBuilder; true; host; (String); ; Argument[0]; ReturnValue; taint; manual | -| 283 | Summary: java.lang; AbstractStringBuilder; true; append; ; ; Argument[0]; Argument[this]; taint; manual | -| 284 | Summary: java.lang; AbstractStringBuilder; true; append; ; ; Argument[this]; ReturnValue; value; manual | -| 285 | Summary: java.lang; CharSequence; true; toString; ; ; Argument[this]; ReturnValue; taint; manual | -| 286 | Summary: java.lang; String; false; format; (String,Object[]); ; Argument[1].ArrayElement; ReturnValue; taint; manual | -| 287 | Summary: java.lang; StringBuilder; true; StringBuilder; ; ; Argument[0]; Argument[this]; taint; manual | -| 288 | Summary: java.net.http; HttpRequest$Builder; true; build; (); ; Argument[this]; ReturnValue; taint; df-generated | -| 289 | Summary: java.net.http; HttpRequest; true; newBuilder; (URI); ; Argument[0]; ReturnValue; taint; df-generated | -| 290 | Summary: java.net; URI; false; URI; (String); ; Argument[0]; Argument[this]; taint; manual | -| 291 | Summary: java.net; URI; false; toString; ; ; Argument[this]; ReturnValue; taint; manual | -| 292 | Summary: java.net; URI; false; toURL; ; ; Argument[this]; ReturnValue; taint; manual | -| 293 | Summary: java.net; URL; false; URL; (String); ; Argument[0]; Argument[this]; taint; manual | -| 294 | Summary: java.util; List; false; of; (Object); ; Argument[0]; ReturnValue.Element; value; manual | -| 295 | Summary: java.util; List; true; get; (int); ; Argument[this].Element; ReturnValue; value; manual | -| 296 | Summary: java.util; Map; false; of; ; ; Argument[1]; ReturnValue.MapValue; value; manual | -| 297 | Summary: java.util; Map; false; of; ; ; Argument[3]; ReturnValue.MapValue; value; manual | -| 298 | Summary: java.util; Properties; true; setProperty; (String,String); ; Argument[1]; Argument[this].MapValue; value; manual | -| 299 | Summary: org.apache.hc.core5.http; HttpHost; true; HttpHost; (String); ; Argument[0]; Argument[this]; taint; hq-manual | -| 300 | Summary: org.apache.http.message; BasicRequestLine; false; BasicRequestLine; ; ; Argument[1]; Argument[this]; taint; manual | +| 3 | Sink: io.micronaut.http.client; BlockingHttpClient; true; exchange; (HttpRequest); ; Argument[0]; request-forgery; manual | +| 4 | Sink: io.micronaut.http.client; BlockingHttpClient; true; exchange; (String); ; Argument[0]; request-forgery; manual | +| 5 | Sink: io.micronaut.http.client; BlockingHttpClient; true; retrieve; (String); ; Argument[0]; request-forgery; manual | +| 6 | Sink: io.micronaut.http.client; BlockingHttpClient; true; retrieve; (String,Class); ; Argument[0]; request-forgery; manual | +| 7 | Sink: io.micronaut.http.client; HttpClient; true; exchange; (HttpRequest); ; Argument[0]; request-forgery; manual | +| 8 | Sink: io.micronaut.http.client; HttpClient; true; exchange; (String); ; Argument[0]; request-forgery; manual | +| 9 | Sink: jakarta.ws.rs.client; Client; true; target; ; ; Argument[0]; request-forgery; manual | +| 10 | Sink: java.net.http; HttpClient; true; send; (HttpRequest,HttpResponse$BodyHandler); ; Argument[0]; request-forgery; ai-manual | +| 11 | Sink: java.net.http; HttpRequest$Builder; false; uri; ; ; Argument[0]; request-forgery; manual | +| 12 | Sink: java.net.http; HttpRequest; false; newBuilder; ; ; Argument[0]; request-forgery; manual | +| 13 | Sink: java.net; DatagramSocket; true; connect; (SocketAddress); ; Argument[0]; request-forgery; ai-manual | +| 14 | Sink: java.net; URL; false; openConnection; (Proxy); ; Argument[0]; request-forgery; ai-manual | +| 15 | Sink: java.net; URL; false; openConnection; ; ; Argument[this]; request-forgery; manual | +| 16 | Sink: java.net; URL; false; openStream; ; ; Argument[this]; request-forgery; manual | +| 17 | Sink: java.net; URLClassLoader; false; URLClassLoader; (String,URL[],ClassLoader); ; Argument[1]; request-forgery; manual | +| 18 | Sink: java.net; URLClassLoader; false; URLClassLoader; (String,URL[],ClassLoader,URLStreamHandlerFactory); ; Argument[1]; request-forgery; manual | +| 19 | Sink: java.net; URLClassLoader; false; URLClassLoader; (URL[]); ; Argument[0]; request-forgery; manual | +| 20 | Sink: java.net; URLClassLoader; false; URLClassLoader; (URL[],ClassLoader); ; Argument[0]; request-forgery; manual | +| 21 | Sink: java.net; URLClassLoader; false; URLClassLoader; (URL[],ClassLoader,URLStreamHandlerFactory); ; Argument[0]; request-forgery; manual | +| 22 | Sink: java.net; URLClassLoader; false; newInstance; ; ; Argument[0]; request-forgery; manual | +| 23 | Sink: java.sql; Driver; false; connect; (String,Properties); ; Argument[0]; request-forgery; manual | +| 24 | Sink: java.sql; DriverManager; false; getConnection; (String); ; Argument[0]; request-forgery; manual | +| 25 | Sink: java.sql; DriverManager; false; getConnection; (String,Properties); ; Argument[0]; request-forgery; manual | +| 26 | Sink: java.sql; DriverManager; false; getConnection; (String,String,String); ; Argument[0]; request-forgery; manual | +| 27 | Sink: javafx.scene.web; WebEngine; false; load; (String); ; Argument[0]; request-forgery; ai-manual | +| 28 | Sink: javax.activation; URLDataSource; true; URLDataSource; ; ; Argument[0]; request-forgery; manual | +| 29 | Sink: javax.ws.rs.client; Client; true; target; ; ; Argument[0]; request-forgery; manual | +| 30 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (JellyContext,URL); ; Argument[1]; request-forgery; ai-manual | +| 31 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (JellyContext,URL,URL); ; Argument[1]; request-forgery; ai-manual | +| 32 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (JellyContext,URL,URL); ; Argument[2]; request-forgery; ai-manual | +| 33 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (URL); ; Argument[0]; request-forgery; ai-manual | +| 34 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (URL,URL); ; Argument[0]; request-forgery; ai-manual | +| 35 | Sink: org.apache.commons.jelly; JellyContext; true; JellyContext; (URL,URL); ; Argument[1]; request-forgery; ai-manual | +| 36 | Sink: org.apache.cxf.catalog; OASISCatalogManager; true; loadCatalog; (URL); ; Argument[0]; request-forgery; manual | +| 37 | Sink: org.apache.cxf.common.classloader; ClassLoaderUtils; true; getURLClassLoader; (List,ClassLoader); ; Argument[0]; request-forgery; manual | +| 38 | Sink: org.apache.cxf.common.classloader; ClassLoaderUtils; true; getURLClassLoader; (URL[],ClassLoader); ; Argument[0]; request-forgery; manual | +| 39 | Sink: org.apache.cxf.resource; ExtendedURIResolver; true; resolve; (String,String); ; Argument[0]; request-forgery; manual | +| 40 | Sink: org.apache.cxf.resource; URIResolver; true; URIResolver; (String); ; Argument[0]; request-forgery; manual | +| 41 | Sink: org.apache.cxf.resource; URIResolver; true; URIResolver; (String,String); ; Argument[1]; request-forgery; manual | +| 42 | Sink: org.apache.cxf.resource; URIResolver; true; URIResolver; (String,String,Class); ; Argument[1]; request-forgery; manual | +| 43 | Sink: org.apache.cxf.resource; URIResolver; true; resolve; (String,String,Class); ; Argument[1]; request-forgery; manual | +| 44 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 45 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (Method,String); ; Argument[1]; request-forgery; hq-manual | +| 46 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | +| 47 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | +| 48 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 49 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; delete; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 50 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | +| 51 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | +| 52 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; get; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 53 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; get; (String); ; Argument[0]; request-forgery; hq-manual | +| 54 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | +| 55 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; head; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 56 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; head; (String); ; Argument[0]; request-forgery; hq-manual | +| 57 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | +| 58 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; options; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 59 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; options; (String); ; Argument[0]; request-forgery; hq-manual | +| 60 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | +| 61 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; patch; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 62 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | +| 63 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | +| 64 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; post; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 65 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; post; (String); ; Argument[0]; request-forgery; hq-manual | +| 66 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | +| 67 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; put; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 68 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; put; (String); ; Argument[0]; request-forgery; hq-manual | +| 69 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | +| 70 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; trace; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 71 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | +| 72 | Sink: org.apache.hc.client5.http.async.methods; BasicHttpRequests; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | +| 73 | Sink: org.apache.hc.client5.http.async.methods; ConfigurableHttpRequest; true; ConfigurableHttpRequest; (String,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 74 | Sink: org.apache.hc.client5.http.async.methods; ConfigurableHttpRequest; true; ConfigurableHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 75 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; SimpleHttpRequest; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 76 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; SimpleHttpRequest; (Method,URI); ; Argument[1]; request-forgery; hq-manual | +| 77 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; SimpleHttpRequest; (String,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 78 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; SimpleHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 79 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; create; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 80 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | +| 81 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | +| 82 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequest; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 83 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 84 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (Method,String); ; Argument[1]; request-forgery; hq-manual | +| 85 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | +| 86 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | +| 87 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 88 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; delete; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 89 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | +| 90 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | +| 91 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; get; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 92 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; get; (String); ; Argument[0]; request-forgery; hq-manual | +| 93 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | +| 94 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; head; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 95 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; head; (String); ; Argument[0]; request-forgery; hq-manual | +| 96 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | +| 97 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; options; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 98 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; options; (String); ; Argument[0]; request-forgery; hq-manual | +| 99 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | +| 100 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; patch; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 101 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | +| 102 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | +| 103 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; post; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 104 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; post; (String); ; Argument[0]; request-forgery; hq-manual | +| 105 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | +| 106 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; put; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 107 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; put; (String); ; Argument[0]; request-forgery; hq-manual | +| 108 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | +| 109 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; trace; (HttpHost,String); ; Argument[0]; request-forgery; hq-manual | +| 110 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | +| 111 | Sink: org.apache.hc.client5.http.async.methods; SimpleHttpRequests; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | +| 112 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | +| 113 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | +| 114 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; get; (String); ; Argument[0]; request-forgery; hq-manual | +| 115 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | +| 116 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; head; (String); ; Argument[0]; request-forgery; hq-manual | +| 117 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | +| 118 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; options; (String); ; Argument[0]; request-forgery; hq-manual | +| 119 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | +| 120 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | +| 121 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | +| 122 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; post; (String); ; Argument[0]; request-forgery; hq-manual | +| 123 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | +| 124 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; put; (String); ; Argument[0]; request-forgery; hq-manual | +| 125 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | +| 126 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | +| 127 | Sink: org.apache.hc.client5.http.async.methods; SimpleRequestBuilder; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | +| 128 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; create; (Method,String); ; Argument[1]; request-forgery; hq-manual | +| 129 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | +| 130 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | +| 131 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 132 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | +| 133 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | +| 134 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; get; (String); ; Argument[0]; request-forgery; hq-manual | +| 135 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | +| 136 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; head; (String); ; Argument[0]; request-forgery; hq-manual | +| 137 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | +| 138 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; options; (String); ; Argument[0]; request-forgery; hq-manual | +| 139 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | +| 140 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | +| 141 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | +| 142 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; post; (String); ; Argument[0]; request-forgery; hq-manual | +| 143 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | +| 144 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; put; (String); ; Argument[0]; request-forgery; hq-manual | +| 145 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | +| 146 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | +| 147 | Sink: org.apache.hc.client5.http.classic.methods; ClassicHttpRequests; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | +| 148 | Sink: org.apache.hc.client5.http.classic.methods; HttpDelete; true; HttpDelete; (String); ; Argument[0]; request-forgery; hq-manual | +| 149 | Sink: org.apache.hc.client5.http.classic.methods; HttpDelete; true; HttpDelete; (URI); ; Argument[0]; request-forgery; hq-manual | +| 150 | Sink: org.apache.hc.client5.http.classic.methods; HttpGet; true; HttpGet; (String); ; Argument[0]; request-forgery; hq-manual | +| 151 | Sink: org.apache.hc.client5.http.classic.methods; HttpGet; true; HttpGet; (URI); ; Argument[0]; request-forgery; hq-manual | +| 152 | Sink: org.apache.hc.client5.http.classic.methods; HttpHead; true; HttpHead; (String); ; Argument[0]; request-forgery; hq-manual | +| 153 | Sink: org.apache.hc.client5.http.classic.methods; HttpHead; true; HttpHead; (URI); ; Argument[0]; request-forgery; hq-manual | +| 154 | Sink: org.apache.hc.client5.http.classic.methods; HttpOptions; true; HttpOptions; (String); ; Argument[0]; request-forgery; hq-manual | +| 155 | Sink: org.apache.hc.client5.http.classic.methods; HttpOptions; true; HttpOptions; (URI); ; Argument[0]; request-forgery; hq-manual | +| 156 | Sink: org.apache.hc.client5.http.classic.methods; HttpPatch; true; HttpPatch; (String); ; Argument[0]; request-forgery; hq-manual | +| 157 | Sink: org.apache.hc.client5.http.classic.methods; HttpPatch; true; HttpPatch; (URI); ; Argument[0]; request-forgery; hq-manual | +| 158 | Sink: org.apache.hc.client5.http.classic.methods; HttpPost; true; HttpPost; (String); ; Argument[0]; request-forgery; hq-manual | +| 159 | Sink: org.apache.hc.client5.http.classic.methods; HttpPost; true; HttpPost; (URI); ; Argument[0]; request-forgery; hq-manual | +| 160 | Sink: org.apache.hc.client5.http.classic.methods; HttpPut; true; HttpPut; (String); ; Argument[0]; request-forgery; hq-manual | +| 161 | Sink: org.apache.hc.client5.http.classic.methods; HttpPut; true; HttpPut; (URI); ; Argument[0]; request-forgery; hq-manual | +| 162 | Sink: org.apache.hc.client5.http.classic.methods; HttpTrace; true; HttpTrace; (String); ; Argument[0]; request-forgery; hq-manual | +| 163 | Sink: org.apache.hc.client5.http.classic.methods; HttpTrace; true; HttpTrace; (URI); ; Argument[0]; request-forgery; hq-manual | +| 164 | Sink: org.apache.hc.client5.http.classic.methods; HttpUriRequestBase; true; HttpUriRequestBase; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 165 | Sink: org.apache.hc.client5.http.fluent; Request; true; create; (Method,URI); ; Argument[1]; request-forgery; hq-manual | +| 166 | Sink: org.apache.hc.client5.http.fluent; Request; true; create; (String,String); ; Argument[1]; request-forgery; hq-manual | +| 167 | Sink: org.apache.hc.client5.http.fluent; Request; true; create; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 168 | Sink: org.apache.hc.client5.http.fluent; Request; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | +| 169 | Sink: org.apache.hc.client5.http.fluent; Request; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | +| 170 | Sink: org.apache.hc.client5.http.fluent; Request; true; get; (String); ; Argument[0]; request-forgery; hq-manual | +| 171 | Sink: org.apache.hc.client5.http.fluent; Request; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | +| 172 | Sink: org.apache.hc.client5.http.fluent; Request; true; head; (String); ; Argument[0]; request-forgery; hq-manual | +| 173 | Sink: org.apache.hc.client5.http.fluent; Request; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | +| 174 | Sink: org.apache.hc.client5.http.fluent; Request; true; options; (String); ; Argument[0]; request-forgery; hq-manual | +| 175 | Sink: org.apache.hc.client5.http.fluent; Request; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | +| 176 | Sink: org.apache.hc.client5.http.fluent; Request; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | +| 177 | Sink: org.apache.hc.client5.http.fluent; Request; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | +| 178 | Sink: org.apache.hc.client5.http.fluent; Request; true; post; (String); ; Argument[0]; request-forgery; hq-manual | +| 179 | Sink: org.apache.hc.client5.http.fluent; Request; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | +| 180 | Sink: org.apache.hc.client5.http.fluent; Request; true; put; (String); ; Argument[0]; request-forgery; hq-manual | +| 181 | Sink: org.apache.hc.client5.http.fluent; Request; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | +| 182 | Sink: org.apache.hc.client5.http.fluent; Request; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | +| 183 | Sink: org.apache.hc.client5.http.fluent; Request; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | +| 184 | Sink: org.apache.hc.core5.http.impl.bootstrap; HttpAsyncRequester; true; connect; (HttpHost,Timeout); ; Argument[0]; request-forgery; hq-manual | +| 185 | Sink: org.apache.hc.core5.http.impl.bootstrap; HttpAsyncRequester; true; connect; (HttpHost,Timeout,Object,FutureCallback); ; Argument[0]; request-forgery; hq-manual | +| 186 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; delete; (String); ; Argument[0]; request-forgery; hq-manual | +| 187 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; delete; (URI); ; Argument[0]; request-forgery; hq-manual | +| 188 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; get; (String); ; Argument[0]; request-forgery; hq-manual | +| 189 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; get; (URI); ; Argument[0]; request-forgery; hq-manual | +| 190 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; head; (String); ; Argument[0]; request-forgery; hq-manual | +| 191 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; head; (URI); ; Argument[0]; request-forgery; hq-manual | +| 192 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; options; (String); ; Argument[0]; request-forgery; hq-manual | +| 193 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; options; (URI); ; Argument[0]; request-forgery; hq-manual | +| 194 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; patch; (String); ; Argument[0]; request-forgery; hq-manual | +| 195 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; patch; (URI); ; Argument[0]; request-forgery; hq-manual | +| 196 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; post; (String); ; Argument[0]; request-forgery; hq-manual | +| 197 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; post; (URI); ; Argument[0]; request-forgery; hq-manual | +| 198 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; put; (String); ; Argument[0]; request-forgery; hq-manual | +| 199 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; put; (URI); ; Argument[0]; request-forgery; hq-manual | +| 200 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; trace; (String); ; Argument[0]; request-forgery; hq-manual | +| 201 | Sink: org.apache.hc.core5.http.io.support; ClassicRequestBuilder; true; trace; (URI); ; Argument[0]; request-forgery; hq-manual | +| 202 | Sink: org.apache.hc.core5.http.message; BasicClassicHttpRequest; true; BasicClassicHttpRequest; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 203 | Sink: org.apache.hc.core5.http.message; BasicClassicHttpRequest; true; BasicClassicHttpRequest; (Method,URI); ; Argument[1]; request-forgery; hq-manual | +| 204 | Sink: org.apache.hc.core5.http.message; BasicClassicHttpRequest; true; BasicClassicHttpRequest; (String,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 205 | Sink: org.apache.hc.core5.http.message; BasicClassicHttpRequest; true; BasicClassicHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 206 | Sink: org.apache.hc.core5.http.message; BasicHttpRequest; true; BasicHttpRequest; (Method,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 207 | Sink: org.apache.hc.core5.http.message; BasicHttpRequest; true; BasicHttpRequest; (Method,URI); ; Argument[1]; request-forgery; hq-manual | +| 208 | Sink: org.apache.hc.core5.http.message; BasicHttpRequest; true; BasicHttpRequest; (String,HttpHost,String); ; Argument[1]; request-forgery; hq-manual | +| 209 | Sink: org.apache.hc.core5.http.message; BasicHttpRequest; true; BasicHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 210 | Sink: org.apache.hc.core5.http.support; AbstractRequestBuilder; true; setHttpHost; (HttpHost); ; Argument[0]; request-forgery; hq-manual | +| 211 | Sink: org.apache.hc.core5.http.support; AbstractRequestBuilder; true; setUri; (String); ; Argument[0]; request-forgery; hq-manual | +| 212 | Sink: org.apache.hc.core5.http.support; AbstractRequestBuilder; true; setUri; (URI); ; Argument[0]; request-forgery; hq-manual | +| 213 | Sink: org.apache.hc.core5.http; HttpRequest; true; setUri; (URI); ; Argument[0]; request-forgery; hq-manual | +| 214 | Sink: org.apache.hc.core5.http; HttpRequestFactory; true; newHttpRequest; (String,String); ; Argument[1]; request-forgery; hq-manual | +| 215 | Sink: org.apache.hc.core5.http; HttpRequestFactory; true; newHttpRequest; (String,URI); ; Argument[1]; request-forgery; hq-manual | +| 216 | Sink: org.apache.http.client.methods; HttpDelete; false; HttpDelete; ; ; Argument[0]; request-forgery; manual | +| 217 | Sink: org.apache.http.client.methods; HttpGet; false; HttpGet; ; ; Argument[0]; request-forgery; manual | +| 218 | Sink: org.apache.http.client.methods; HttpHead; false; HttpHead; ; ; Argument[0]; request-forgery; manual | +| 219 | Sink: org.apache.http.client.methods; HttpOptions; false; HttpOptions; ; ; Argument[0]; request-forgery; manual | +| 220 | Sink: org.apache.http.client.methods; HttpPatch; false; HttpPatch; ; ; Argument[0]; request-forgery; manual | +| 221 | Sink: org.apache.http.client.methods; HttpPost; false; HttpPost; ; ; Argument[0]; request-forgery; manual | +| 222 | Sink: org.apache.http.client.methods; HttpPut; false; HttpPut; ; ; Argument[0]; request-forgery; manual | +| 223 | Sink: org.apache.http.client.methods; HttpRequestBase; true; setURI; ; ; Argument[0]; request-forgery; manual | +| 224 | Sink: org.apache.http.client.methods; HttpTrace; false; HttpTrace; ; ; Argument[0]; request-forgery; manual | +| 225 | Sink: org.apache.http.client.methods; RequestBuilder; false; delete; ; ; Argument[0]; request-forgery; manual | +| 226 | Sink: org.apache.http.client.methods; RequestBuilder; false; get; ; ; Argument[0]; request-forgery; manual | +| 227 | Sink: org.apache.http.client.methods; RequestBuilder; false; head; ; ; Argument[0]; request-forgery; manual | +| 228 | Sink: org.apache.http.client.methods; RequestBuilder; false; options; ; ; Argument[0]; request-forgery; manual | +| 229 | Sink: org.apache.http.client.methods; RequestBuilder; false; patch; ; ; Argument[0]; request-forgery; manual | +| 230 | Sink: org.apache.http.client.methods; RequestBuilder; false; post; ; ; Argument[0]; request-forgery; manual | +| 231 | Sink: org.apache.http.client.methods; RequestBuilder; false; put; ; ; Argument[0]; request-forgery; manual | +| 232 | Sink: org.apache.http.client.methods; RequestBuilder; false; setUri; ; ; Argument[0]; request-forgery; manual | +| 233 | Sink: org.apache.http.client.methods; RequestBuilder; false; trace; ; ; Argument[0]; request-forgery; manual | +| 234 | Sink: org.apache.http.message; BasicHttpEntityEnclosingRequest; false; BasicHttpEntityEnclosingRequest; (RequestLine); ; Argument[0]; request-forgery; manual | +| 235 | Sink: org.apache.http.message; BasicHttpEntityEnclosingRequest; false; BasicHttpEntityEnclosingRequest; (String,String); ; Argument[1]; request-forgery; manual | +| 236 | Sink: org.apache.http.message; BasicHttpEntityEnclosingRequest; false; BasicHttpEntityEnclosingRequest; (String,String,ProtocolVersion); ; Argument[1]; request-forgery; manual | +| 237 | Sink: org.apache.http.message; BasicHttpRequest; false; BasicHttpRequest; (RequestLine); ; Argument[0]; request-forgery; manual | +| 238 | Sink: org.apache.http.message; BasicHttpRequest; false; BasicHttpRequest; (String,String); ; Argument[1]; request-forgery; manual | +| 239 | Sink: org.apache.http.message; BasicHttpRequest; false; BasicHttpRequest; (String,String,ProtocolVersion); ; Argument[1]; request-forgery; manual | +| 240 | Sink: org.codehaus.cargo.container.installer; ZipURLInstaller; true; ZipURLInstaller; (URL,String,String); ; Argument[0]; request-forgery; ai-manual | +| 241 | Sink: org.jdbi.v3.core; Jdbi; false; create; (String); ; Argument[0]; request-forgery; manual | +| 242 | Sink: org.jdbi.v3.core; Jdbi; false; create; (String,Properties); ; Argument[0]; request-forgery; manual | +| 243 | Sink: org.jdbi.v3.core; Jdbi; false; create; (String,String,String); ; Argument[0]; request-forgery; manual | +| 244 | Sink: org.jdbi.v3.core; Jdbi; false; open; (String); ; Argument[0]; request-forgery; manual | +| 245 | Sink: org.jdbi.v3.core; Jdbi; false; open; (String,Properties); ; Argument[0]; request-forgery; manual | +| 246 | Sink: org.jdbi.v3.core; Jdbi; false; open; (String,String,String); ; Argument[0]; request-forgery; manual | +| 247 | Sink: org.kohsuke.stapler; HttpResponses; true; staticResource; (URL); ; Argument[0]; request-forgery; ai-manual | +| 248 | Sink: org.springframework.boot.jdbc; DataSourceBuilder; false; url; (String); ; Argument[0]; request-forgery; manual | +| 249 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (HttpMethod,URI); ; Argument[1]; request-forgery; manual | +| 250 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (MultiValueMap,HttpMethod,URI); ; Argument[2]; request-forgery; manual | +| 251 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (Object,HttpMethod,URI); ; Argument[2]; request-forgery; manual | +| 252 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (Object,HttpMethod,URI,Type); ; Argument[2]; request-forgery; manual | +| 253 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (Object,MultiValueMap,HttpMethod,URI); ; Argument[3]; request-forgery; manual | +| 254 | Sink: org.springframework.http; RequestEntity; false; RequestEntity; (Object,MultiValueMap,HttpMethod,URI,Type); ; Argument[3]; request-forgery; manual | +| 255 | Sink: org.springframework.http; RequestEntity; false; delete; ; ; Argument[0]; request-forgery; manual | +| 256 | Sink: org.springframework.http; RequestEntity; false; get; ; ; Argument[0]; request-forgery; manual | +| 257 | Sink: org.springframework.http; RequestEntity; false; head; ; ; Argument[0]; request-forgery; manual | +| 258 | Sink: org.springframework.http; RequestEntity; false; method; ; ; Argument[1]; request-forgery; manual | +| 259 | Sink: org.springframework.http; RequestEntity; false; options; ; ; Argument[0]; request-forgery; manual | +| 260 | Sink: org.springframework.http; RequestEntity; false; patch; ; ; Argument[0]; request-forgery; manual | +| 261 | Sink: org.springframework.http; RequestEntity; false; post; ; ; Argument[0]; request-forgery; manual | +| 262 | Sink: org.springframework.http; RequestEntity; false; put; ; ; Argument[0]; request-forgery; manual | +| 263 | Sink: org.springframework.jdbc.datasource; AbstractDriverBasedDataSource; false; setUrl; (String); ; Argument[0]; request-forgery; manual | +| 264 | Sink: org.springframework.jdbc.datasource; DriverManagerDataSource; false; DriverManagerDataSource; (String); ; Argument[0]; request-forgery; manual | +| 265 | Sink: org.springframework.jdbc.datasource; DriverManagerDataSource; false; DriverManagerDataSource; (String,Properties); ; Argument[0]; request-forgery; manual | +| 266 | Sink: org.springframework.jdbc.datasource; DriverManagerDataSource; false; DriverManagerDataSource; (String,String,String); ; Argument[0]; request-forgery; manual | +| 267 | Sink: org.springframework.web.client; RestTemplate; false; delete; ; ; Argument[0]; request-forgery; manual | +| 268 | Sink: org.springframework.web.client; RestTemplate; false; exchange; ; ; Argument[0]; request-forgery; manual | +| 269 | Sink: org.springframework.web.client; RestTemplate; false; execute; ; ; Argument[0]; request-forgery; manual | +| 270 | Sink: org.springframework.web.client; RestTemplate; false; getForEntity; ; ; Argument[0]; request-forgery; manual | +| 271 | Sink: org.springframework.web.client; RestTemplate; false; getForObject; ; ; Argument[0]; request-forgery; manual | +| 272 | Sink: org.springframework.web.client; RestTemplate; false; headForHeaders; ; ; Argument[0]; request-forgery; manual | +| 273 | Sink: org.springframework.web.client; RestTemplate; false; optionsForAllow; ; ; Argument[0]; request-forgery; manual | +| 274 | Sink: org.springframework.web.client; RestTemplate; false; patchForObject; ; ; Argument[0]; request-forgery; manual | +| 275 | Sink: org.springframework.web.client; RestTemplate; false; postForEntity; ; ; Argument[0]; request-forgery; manual | +| 276 | Sink: org.springframework.web.client; RestTemplate; false; postForLocation; ; ; Argument[0]; request-forgery; manual | +| 277 | Sink: org.springframework.web.client; RestTemplate; false; postForObject; ; ; Argument[0]; request-forgery; manual | +| 278 | Sink: org.springframework.web.client; RestTemplate; false; put; ; ; Argument[0]; request-forgery; manual | +| 279 | Sink: org.springframework.web.reactive.function.client; WebClient$Builder; false; baseUrl; ; ; Argument[0]; request-forgery; manual | +| 280 | Sink: org.springframework.web.reactive.function.client; WebClient; false; create; ; ; Argument[0]; request-forgery; manual | +| 281 | Sink: play.libs.ws; StandaloneWSClient; true; url; ; ; Argument[0]; request-forgery; manual | +| 282 | Sink: play.libs.ws; WSClient; true; url; ; ; Argument[0]; request-forgery; manual | +| 283 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual | +| 284 | Summary: io.micronaut.http.uri; UriBuilder; true; build; (); ; Argument[this]; ReturnValue; taint; manual | +| 285 | Summary: io.micronaut.http.uri; UriBuilder; true; host; (String); ; Argument[0]; Argument[this]; taint; manual | +| 286 | Summary: io.micronaut.http.uri; UriBuilder; true; host; (String); ; Argument[this]; ReturnValue; value; manual | +| 287 | Summary: io.micronaut.http; HttpRequest; true; GET; (String); ; Argument[0]; ReturnValue; taint; manual | +| 288 | Summary: java.lang; AbstractStringBuilder; true; append; ; ; Argument[0]; Argument[this]; taint; manual | +| 289 | Summary: java.lang; AbstractStringBuilder; true; append; ; ; Argument[this]; ReturnValue; value; manual | +| 290 | Summary: java.lang; CharSequence; true; toString; ; ; Argument[this]; ReturnValue; taint; manual | +| 291 | Summary: java.lang; String; false; format; (String,Object[]); ; Argument[1].ArrayElement; ReturnValue; taint; manual | +| 292 | Summary: java.lang; StringBuilder; true; StringBuilder; ; ; Argument[0]; Argument[this]; taint; manual | +| 293 | Summary: java.net.http; HttpRequest$Builder; true; build; (); ; Argument[this]; ReturnValue; taint; df-generated | +| 294 | Summary: java.net.http; HttpRequest; true; newBuilder; (URI); ; Argument[0]; ReturnValue; taint; df-generated | +| 295 | Summary: java.net; URI; false; URI; (String); ; Argument[0]; Argument[this]; taint; manual | +| 296 | Summary: java.net; URI; false; toString; ; ; Argument[this]; ReturnValue; taint; manual | +| 297 | Summary: java.net; URI; false; toURL; ; ; Argument[this]; ReturnValue; taint; manual | +| 298 | Summary: java.net; URL; false; URL; (String); ; Argument[0]; Argument[this]; taint; manual | +| 299 | Summary: java.util; List; false; of; (Object); ; Argument[0]; ReturnValue.Element; value; manual | +| 300 | Summary: java.util; List; true; get; (int); ; Argument[this].Element; ReturnValue; value; manual | +| 301 | Summary: java.util; Map; false; of; ; ; Argument[1]; ReturnValue.MapValue; value; manual | +| 302 | Summary: java.util; Map; false; of; ; ; Argument[3]; ReturnValue.MapValue; value; manual | +| 303 | Summary: java.util; Properties; true; setProperty; (String,String); ; Argument[1]; Argument[this].MapValue; value; manual | +| 304 | Summary: org.apache.hc.core5.http; HttpHost; true; HttpHost; (String); ; Argument[0]; Argument[this]; taint; hq-manual | +| 305 | Summary: org.apache.http.message; BasicRequestLine; false; BasicRequestLine; ; ; Argument[1]; Argument[this]; taint; manual | nodes | ApacheHttpSSRF.java:27:27:27:53 | getParameter(...) : String | semmle.label | getParameter(...) : String | | ApacheHttpSSRF.java:28:23:28:35 | new URI(...) : URI | semmle.label | new URI(...) : URI | @@ -1743,18 +1756,26 @@ nodes | JdbcUrlSSRF.java:86:19:86:25 | jdbcUrl | semmle.label | jdbcUrl | | JdbcUrlSSRF.java:87:19:87:25 | jdbcUrl | semmle.label | jdbcUrl | | JdbcUrlSSRF.java:88:19:88:25 | jdbcUrl | semmle.label | jdbcUrl | -| MicronautSSRF.java:14:32:14:53 | url : String | semmle.label | url : String | -| MicronautSSRF.java:15:45:15:47 | url | semmle.label | url | -| MicronautSSRF.java:19:42:19:63 | url : String | semmle.label | url : String | -| MicronautSSRF.java:20:45:20:47 | url | semmle.label | url | -| MicronautSSRF.java:24:37:24:58 | url : String | semmle.label | url : String | -| MicronautSSRF.java:25:45:25:47 | url | semmle.label | url | -| MicronautSSRF.java:29:34:29:56 | host : String | semmle.label | host : String | -| MicronautSSRF.java:30:19:30:64 | host(...) : UriBuilder | semmle.label | host(...) : UriBuilder | -| MicronautSSRF.java:30:19:30:72 | build(...) : URI | semmle.label | build(...) : URI | -| MicronautSSRF.java:30:60:30:63 | host : String | semmle.label | host : String | -| MicronautSSRF.java:31:45:31:47 | uri : URI | semmle.label | uri : URI | -| MicronautSSRF.java:31:45:31:58 | toString(...) | semmle.label | toString(...) | +| MicronautSSRF.java:15:32:15:53 | url : String | semmle.label | url : String | +| MicronautSSRF.java:16:45:16:47 | url | semmle.label | url | +| MicronautSSRF.java:20:42:20:63 | url : String | semmle.label | url : String | +| MicronautSSRF.java:21:45:21:47 | url | semmle.label | url | +| MicronautSSRF.java:25:37:25:58 | url : String | semmle.label | url : String | +| MicronautSSRF.java:26:45:26:47 | url | semmle.label | url | +| MicronautSSRF.java:30:34:30:56 | host : String | semmle.label | host : String | +| MicronautSSRF.java:31:19:31:64 | host(...) : UriBuilder | semmle.label | host(...) : UriBuilder | +| MicronautSSRF.java:31:19:31:72 | build(...) : URI | semmle.label | build(...) : URI | +| MicronautSSRF.java:31:60:31:63 | host : String | semmle.label | host : String | +| MicronautSSRF.java:32:45:32:47 | uri : URI | semmle.label | uri : URI | +| MicronautSSRF.java:32:45:32:58 | toString(...) | semmle.label | toString(...) | +| MicronautSSRF.java:36:39:36:60 | url : String | semmle.label | url : String | +| MicronautSSRF.java:37:45:37:64 | GET(...) | semmle.label | GET(...) | +| MicronautSSRF.java:37:61:37:63 | url : String | semmle.label | url : String | +| MicronautSSRF.java:41:35:41:56 | url : String | semmle.label | url : String | +| MicronautSSRF.java:42:32:42:34 | url | semmle.label | url | +| MicronautSSRF.java:46:42:46:63 | url : String | semmle.label | url : String | +| MicronautSSRF.java:47:32:47:51 | GET(...) | semmle.label | GET(...) | +| MicronautSSRF.java:47:48:47:50 | url : String | semmle.label | url : String | | ReactiveWebClientSSRF.java:15:26:15:52 | getParameter(...) : String | semmle.label | getParameter(...) : String | | ReactiveWebClientSSRF.java:16:52:16:54 | url | semmle.label | url | | ReactiveWebClientSSRF.java:32:26:32:52 | getParameter(...) : String | semmle.label | getParameter(...) : String | diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/convert/value/ConvertibleMultiValues.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/convert/value/ConvertibleMultiValues.java new file mode 100644 index 00000000000..2635af3d75c --- /dev/null +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/convert/value/ConvertibleMultiValues.java @@ -0,0 +1,10 @@ +package io.micronaut.core.convert.value; + +import java.util.List; +import java.util.Optional; + +public interface ConvertibleMultiValues extends ConvertibleValues> { + V get(CharSequence name); + List getAll(CharSequence name); + Optional getFirst(CharSequence name); +} diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/convert/value/ConvertibleValues.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/convert/value/ConvertibleValues.java new file mode 100644 index 00000000000..bb32d549357 --- /dev/null +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/convert/value/ConvertibleValues.java @@ -0,0 +1,15 @@ +package io.micronaut.core.convert.value; + +import java.util.Collection; +import java.util.Iterator; +import java.util.Map; +import java.util.Properties; + +public interface ConvertibleValues extends Iterable> { + Map asMap(); + Properties asProperties(); + V getValue(CharSequence name); + Iterator> iterator(); + Map subMap(String prefix, Class valueType); + Collection values(); +} diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/type/Argument.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/type/Argument.java new file mode 100644 index 00000000000..bc9c5da866c --- /dev/null +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/core/type/Argument.java @@ -0,0 +1,4 @@ +package io.micronaut.core.type; + +public class Argument { +} diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpHeaders.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpHeaders.java index ae68073fcdd..440e1928b81 100644 --- a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpHeaders.java +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpHeaders.java @@ -1,11 +1,6 @@ package io.micronaut.http; -import java.util.List; -import java.util.Optional; +import io.micronaut.core.convert.value.ConvertibleMultiValues; -public interface HttpHeaders { - String get(CharSequence name); - List getAll(CharSequence name); - Optional getFirst(CharSequence name); - java.util.Collection> values(); +public interface HttpHeaders extends ConvertibleMultiValues { } diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpParameters.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpParameters.java index 061391dbc3e..2d0253d1304 100644 --- a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpParameters.java +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpParameters.java @@ -1,10 +1,6 @@ package io.micronaut.http; -import java.util.List; -import java.util.Optional; +import io.micronaut.core.convert.value.ConvertibleMultiValues; -public interface HttpParameters { - String get(CharSequence name); - List getAll(CharSequence name); - Optional getFirst(CharSequence name); +public interface HttpParameters extends ConvertibleMultiValues { } diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpRequest.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpRequest.java index 5b51dba87f9..15429d6d4be 100644 --- a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpRequest.java +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpRequest.java @@ -17,10 +17,19 @@ public interface HttpRequest { String getMethodName(); static HttpRequest GET(String uri) { return null; } + static HttpRequest GET(URI uri) { return null; } static HttpRequest POST(String uri, T body) { return null; } + static HttpRequest POST(URI uri, T body) { return null; } static HttpRequest PUT(String uri, T body) { return null; } + static HttpRequest PUT(URI uri, T body) { return null; } static HttpRequest DELETE(String uri) { return null; } + static HttpRequest DELETE(String uri, T body) { return null; } + static HttpRequest DELETE(URI uri) { return null; } + static HttpRequest DELETE(URI uri, T body) { return null; } static HttpRequest PATCH(String uri, T body) { return null; } + static HttpRequest PATCH(URI uri, T body) { return null; } static HttpRequest HEAD(String uri) { return null; } + static HttpRequest HEAD(URI uri) { return null; } static HttpRequest OPTIONS(String uri) { return null; } + static HttpRequest OPTIONS(URI uri) { return null; } } diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpResponse.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpResponse.java index 7469ea3d566..c56f8f2ab3f 100644 --- a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpResponse.java +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/HttpResponse.java @@ -12,6 +12,9 @@ public interface HttpResponse { static MutableHttpResponse ok() { return null; } static MutableHttpResponse ok(T body) { return null; } static MutableHttpResponse redirect(URI location) { return null; } + static MutableHttpResponse permanentRedirect(URI location) { return null; } + static MutableHttpResponse seeOther(URI location) { return null; } + static MutableHttpResponse temporaryRedirect(URI location) { return null; } static MutableHttpResponse notFound() { return null; } static MutableHttpResponse badRequest() { return null; } static MutableHttpResponse serverError() { return null; } diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/BlockingHttpClient.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/BlockingHttpClient.java index 379ef4049d1..e22737a0a70 100644 --- a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/BlockingHttpClient.java +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/BlockingHttpClient.java @@ -2,12 +2,21 @@ package io.micronaut.http.client; import io.micronaut.http.HttpRequest; import io.micronaut.http.HttpResponse; +import io.micronaut.core.type.Argument; public interface BlockingHttpClient { HttpResponse exchange(HttpRequest request, Class bodyType); + HttpResponse exchange(HttpRequest request, Argument bodyType); + HttpResponse exchange(HttpRequest request, Argument bodyType, Argument errorType); HttpResponse exchange(HttpRequest request); + String retrieve(HttpRequest request); + O retrieve(HttpRequest request, Class bodyType); + O retrieve(HttpRequest request, Argument bodyType); + O retrieve(HttpRequest request, Argument bodyType, Argument errorType); String retrieve(String uri); O retrieve(String uri, Class bodyType); + O retrieve(String uri, Class bodyType, Class errorType); String exchange(String uri); HttpResponse exchange(String uri, Class bodyType); + HttpResponse exchange(String uri, Class bodyType, Class errorType); } diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/HttpClient.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/HttpClient.java index de5278de08e..f0b53483926 100644 --- a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/HttpClient.java +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/client/HttpClient.java @@ -1,5 +1,19 @@ package io.micronaut.http.client; +import io.micronaut.http.HttpRequest; +import io.micronaut.core.type.Argument; + public interface HttpClient { BlockingHttpClient toBlocking(); + Object exchange(HttpRequest request); + Object exchange(HttpRequest request, Class bodyType); + Object exchange(HttpRequest request, Argument bodyType); + Object exchange(HttpRequest request, Argument bodyType, Argument errorType); + Object exchange(String uri); + Object exchange(String uri, Class bodyType); + Object retrieve(HttpRequest request); + Object retrieve(HttpRequest request, Class bodyType); + Object retrieve(HttpRequest request, Argument bodyType); + Object retrieve(HttpRequest request, Argument bodyType, Argument errorType); + Object retrieve(String uri); } diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/uri/UriBuilder.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/uri/UriBuilder.java index 13eeeeb40ed..028bde03179 100644 --- a/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/uri/UriBuilder.java +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/http/uri/UriBuilder.java @@ -1,6 +1,7 @@ package io.micronaut.http.uri; import java.net.URI; +import java.util.Map; public interface UriBuilder { static UriBuilder of(CharSequence uri) { return null; } @@ -8,6 +9,11 @@ public interface UriBuilder { UriBuilder host(String host); UriBuilder path(String path); UriBuilder queryParam(String name, Object... values); + UriBuilder replacePath(String path); + UriBuilder replaceQueryParam(String name, Object... values); + UriBuilder scheme(String scheme); + UriBuilder userInfo(String userInfo); UriBuilder fragment(String fragment); URI build(); + URI expand(Map values); } diff --git a/java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/CloseReason.java b/java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/CloseReason.java new file mode 100644 index 00000000000..47be261e3cf --- /dev/null +++ b/java/ql/test/stubs/micronaut-4.x/io/micronaut/websocket/CloseReason.java @@ -0,0 +1,4 @@ +package io.micronaut.websocket; + +public class CloseReason { +}