Move to experimental and review feedback

java/ql/src/experimental/Security/CWE/CWE-346/UnvalidatedCors.ql

@@ -59,7 +59,7 @@ class CorsSourceReachesCheckConfig extends TaintTracking2::Configuration {
   }
 }
 
-class CorsOriginConfig extends TaintTracking::Configuration {
+private class CorsOriginConfig extends TaintTracking::Configuration {
   CorsOriginConfig() { this = "CorsOriginConfig" }
 
   override predicate isSource(DataFlow::Node source) { source instanceof RemoteFlowSource }

java/ql/test/experimental/query-tests/security/CWE-346/UnvalidatedCors.qlref

@@ -0,0 +1 @@
+experimental/Security/CWE/CWE-346/UnvalidatedCors.ql

java/ql/test/experimental/query-tests/security/CWE-346/options

@@ -0,0 +1 @@
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../stubs/servlet-api-2.4:${testdir}/../../../../stubs/apache-commons-lang3-3.7

java/ql/test/query-tests/security/CWE-346/UnvalidatedCors.qlref

@@ -1 +0,0 @@
-Security/CWE/CWE-346/UnvalidatedCors.ql

java/ql/test/query-tests/security/CWE-346/options

@@ -1 +0,0 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/servlet-api-2.4:${testdir}/../../../stubs/apache-commons-lang3-3.7