| test.py:6 | Attribute() | externally controlled string |
| test.py:10 | Attribute() | [externally controlled string] |
| test.py:11 | Subscript | externally controlled string |
| test.py:11 | args | [externally controlled string] |
| test.py:12 | name | externally controlled string |
| test.py:17 | Attribute | tornado.request.HttpRequest |
| test.py:18 | Attribute | {externally controlled string} |
| test.py:18 | req | tornado.request.HttpRequest |
| test.py:19 | Subscript | externally controlled string |
| test.py:19 | h | {externally controlled string} |
| test.py:20 | url | externally controlled string |
| test.py:26 | Attribute() | externally controlled string |