diff --git a/java/ql/lib/change-notes/2026-08-17-spring-url-redirect-sinks.md b/java/ql/lib/change-notes/2026-08-17-spring-url-redirect-sinks.md
new file mode 100644
index 000000000000..ad17bde080b9
--- /dev/null
+++ b/java/ql/lib/change-notes/2026-08-17-spring-url-redirect-sinks.md
@@ -0,0 +1,8 @@
+---
+category: minorAnalysis
+---
+* The `java/unvalidated-url-redirection` query now detects untrusted URLs used in returned Spring MVC
+  `RedirectView` objects and leading `redirect:` view names, including helper-generated names passed
+  to returned `ModelAndView` objects, conditional or branch-assigned names, and local prefix variables.
+  Redirect views wrapped in `ModelAndView` and view objects returned by response-body handlers are
+  also covered.
diff --git a/java/ql/lib/semmle/code/java/security/UrlRedirect.qll b/java/ql/lib/semmle/code/java/security/UrlRedirect.qll
index be6addfa2529..1b2cc26a0127 100644
--- a/java/ql/lib/semmle/code/java/security/UrlRedirect.qll
+++ b/java/ql/lib/semmle/code/java/security/UrlRedirect.qll
@@ -8,7 +8,10 @@ import semmle.code.java.frameworks.Servlets
 import semmle.code.java.frameworks.ApacheHttp
 private import semmle.code.java.dataflow.ExternalFlow
 private import semmle.code.java.dataflow.FlowSinks
+private import semmle.code.java.dataflow.SSA
+private import semmle.code.java.dataflow.TaintTracking
 private import semmle.code.java.frameworks.JaxWS
+private import semmle.code.java.frameworks.spring.SpringController
 private import semmle.code.java.security.RequestForgery
 
 /** A URL redirection sink. */
@@ -50,5 +53,193 @@ private class ApacheUrlRedirectSink extends UrlRedirectSink {
   }
 }
 
+/** An expression appended to a Spring `"redirect:"` view-name returned by a request handler. */
+private class SpringUrlRedirectPrefixSink extends UrlRedirectSink {
+  SpringUrlRedirectPrefixSink() {
+    exists(Expr name |
+      (isSpringMvcReturnedString(name) or isSpringModelAndViewName(name)) and
+      this.asExpr() = getRedirectTarget(name) and
+      TaintTracking::localTaint(this, DataFlow::exprNode(name))
+    )
+  }
+}
+
+/** A call to a helper that returns a Spring `"redirect:"` view name. */
+private class SpringUrlRedirectHelperSink extends UrlRedirectSink {
+  SpringUrlRedirectHelperSink() {
+    exists(Expr name, MethodCall call |
+      this.asExpr() = call and
+      (isSpringMvcReturnedString(name) or isSpringModelAndViewName(name)) and
+      call = getViewNamePrefix(name) and
+      returnsRedirectViewName(call.getCallee().getSourceDeclaration())
+    )
+  }
+}
+
+/** The exact Spring redirect prefix, without a fixed target path or host. */
+private class SpringRedirectPrefix extends CompileTimeConstantExpr {
+  SpringRedirectPrefix() { this.getStringValue() = "redirect:" }
+}
+
+/** Relates a local read to its reaching SSA definitions. */
+private predicate localViewDefinition(Expr value, SsaDefinition def) {
+  value.getUnderlyingExpr().(VarRead).getVariable() instanceof LocalScopeVariable and
+  def.getARead() = value.getUnderlyingExpr()
+}
+
+/** Gets a possible local view-name value, following conditional branches and SSA inputs. */
+pragma[nomagic]
+private Expr getAViewNameValue(Expr value) {
+  result = value.getUnderlyingExpr() and
+  not result instanceof ChooseExpr and
+  (
+    not localViewDefinition(value, _)
+    or
+    exists(SsaDefinition def, SsaDefinition ultimate |
+      localViewDefinition(value, def) and
+      ultimate = def.getAnUltimateDefinition() and
+      not exists(ultimate.(SsaExplicitWrite).getValue())
+    )
+  )
+  or
+  exists(SsaDefinition def |
+    localViewDefinition(value, def) and
+    result = getAViewNameValue(def.getAnUltimateDefinition().(SsaExplicitWrite).getValue())
+  )
+  or
+  result = getAViewNameValue(value.getUnderlyingExpr().(ChooseExpr).getAResultExpr())
+}
+
+/** Gets a possible leading expression, following only left-hand concatenation. */
+pragma[nomagic]
+private Expr getViewNamePrefix(Expr value) {
+  result = getAViewNameValue(value) and not result instanceof AddExpr
+  or
+  result = getViewNamePrefix(getAViewNameValue(value).(AddExpr).getLeftOperand())
+}
+
+/** Gets the target appended to an exact redirect prefix at the start of a view name. */
+pragma[nomagic]
+private Expr getRedirectTarget(Expr value) {
+  exists(AddExpr add | add = getAViewNameValue(value) |
+    getViewNamePrefix(add.getLeftOperand()) instanceof SpringRedirectPrefix and
+    result = add.getRightOperand()
+    or
+    result = getRedirectTarget(add.getLeftOperand())
+  )
+}
+
+/** Holds if `value` contributes to a view returned from a Spring MVC request handler. */
+pragma[nomagic]
+private predicate isSpringMvcViewResult(Expr value) {
+  exists(ReturnStmt ret |
+    ret.getEnclosingCallable() = value.getEnclosingCallable() and
+    ret.getEnclosingCallable() instanceof SpringRequestMappingMethod and
+    DataFlow::localFlow(DataFlow::exprNode(value), DataFlow::exprNode(ret.getExpr()))
+  )
+  or
+  exists(ClassInstanceExpr newModelAndView |
+    newModelAndView
+        .getConstructedType()
+        .hasQualifiedName("org.springframework.web.servlet", "ModelAndView") and
+    newModelAndView
+        .getConstructor()
+        .getParameter(0)
+        .getType()
+        .(RefType)
+        .hasQualifiedName("org.springframework.web.servlet", "View") and
+    DataFlow::localFlow(DataFlow::exprNode(value),
+      DataFlow::exprNode(newModelAndView.getArgument(0))) and
+    isSpringMvcViewResult(newModelAndView)
+  )
+}
+
+/** Holds if `name` is a string view name returned by a request handler. */
+private predicate isSpringMvcReturnedString(Expr name) {
+  exists(ReturnStmt ret, SpringRequestMappingMethod handler |
+    handler = name.getEnclosingCallable() and
+    ret.getEnclosingCallable() = handler and
+    not handler.isResponseBody() and
+    not handler instanceof SpringModelAttributeMethod and
+    name = ret.getExpr()
+  )
+}
+
+/** Holds if `name` is the string view name of a returned `ModelAndView`. */
+private predicate isSpringModelAndViewName(Expr name) {
+  exists(ClassInstanceExpr newModelAndView |
+    newModelAndView
+        .getConstructedType()
+        .hasQualifiedName("org.springframework.web.servlet", "ModelAndView") and
+    newModelAndView.getConstructor().getParameter(0).getType() instanceof TypeString and
+    name = newModelAndView.getArgument(0) and
+    isSpringMvcViewResult(newModelAndView)
+  )
+}
+
+/** Holds if a name is constant or is constructed from the exact redirect prefix. */
+private predicate isConstantOrRedirectViewName(Expr name) {
+  exists(getAViewNameValue(name)) and
+  forall(Expr value | value = getAViewNameValue(name) |
+    exists(value.(CompileTimeConstantExpr).getStringValue())
+    or
+    exists(getViewNamePrefix(value)) and
+    forall(Expr prefix | prefix = getViewNamePrefix(value) | prefix instanceof SpringRedirectPrefix)
+  )
+}
+
+/** Holds if `callable` returns redirect names without mixing in other dynamic view names. */
+pragma[nomagic]
+private predicate returnsRedirectViewName(Callable callable) {
+  exists(Expr target, ReturnStmt ret |
+    callable.(Method).getReturnType() instanceof TypeString and
+    forall(ReturnStmt r | r.getEnclosingCallable() = callable |
+      isConstantOrRedirectViewName(r.getExpr())
+    ) and
+    ret.getEnclosingCallable() = callable and
+    target = getRedirectTarget(ret.getExpr()) and
+    TaintTracking::localTaint(DataFlow::exprNode(target), DataFlow::exprNode(ret.getExpr()))
+  )
+  or
+  exists(MethodCall call, ReturnStmt ret |
+    callable.(Method).getReturnType() instanceof TypeString and
+    ret = unique(ReturnStmt r | r.getEnclosingCallable() = callable) and
+    call = unique(Expr prefix | prefix = getViewNamePrefix(ret.getExpr())) and
+    returnsRedirectViewName(call.getCallee().getSourceDeclaration())
+  )
+}
+
+/** A URL passed to a Spring `RedirectView` constructor. */
+private class SpringRedirectViewSink extends UrlRedirectSink {
+  SpringRedirectViewSink() {
+    exists(ClassInstanceExpr newRedirectView |
+      newRedirectView
+          .getConstructedType()
+          .hasQualifiedName("org.springframework.web.servlet.view", "RedirectView") and
+      isSpringMvcViewResult(newRedirectView) and
+      this.asExpr() = newRedirectView.getArgument(0)
+    )
+  }
+}
+
+/** A URL passed to `setUrl` on a Spring `RedirectView` that is returned by a request handler. */
+private class SpringRedirectViewSetUrlSink extends UrlRedirectSink {
+  SpringRedirectViewSetUrlSink() {
+    exists(MethodCall setUrl |
+      setUrl
+          .getMethod()
+          .getSourceDeclaration()
+          .hasQualifiedName("org.springframework.web.servlet.view", "AbstractUrlBasedView", "setUrl") and
+      DataFlow::exprNode(setUrl.getQualifier())
+          .getTypeBound()
+          .(RefType)
+          .getASupertype*()
+          .hasQualifiedName("org.springframework.web.servlet.view", "RedirectView") and
+      isSpringMvcViewResult(setUrl.getQualifier()) and
+      this.asExpr() = setUrl.getArgument(0)
+    )
+  }
+}
+
 private class DefaultUrlRedirectSanitizer extends UrlRedirectSanitizer instanceof RequestForgerySanitizer
 { }
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/SpringUrlRedirect.java b/java/ql/test/query-tests/security/CWE-601/semmle/tests/SpringUrlRedirect.java
new file mode 100644
index 000000000000..5a257fcbfb99
--- /dev/null
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/SpringUrlRedirect.java
@@ -0,0 +1,926 @@
+package test.cwe601.cwe.examples;
+
+import javax.servlet.http.HttpServletRequest;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.servlet.ModelAndView;
+import org.springframework.web.servlet.view.AbstractUrlBasedView;
+import org.springframework.web.servlet.view.RedirectView;
+
+class BaseController {
+    protected String redirect(String path) {
+        return "redirect:" + path;
+    }
+
+    protected String ordinaryView(String path) {
+        return "view:" + path;
+    }
+
+    protected String discardedRedirect(String path) {
+        return "redirect:" + path;
+    }
+}
+
+class LabeledRedirectView extends RedirectView {
+    LabeledRedirectView(String label, String url) {
+        super(url);
+    }
+
+    void setUrl(Object label) {
+    }
+}
+
+class OrdinaryUrlView extends AbstractUrlBasedView {
+}
+
+@Controller
+public class SpringUrlRedirect extends BaseController {
+    @GetMapping("/case1")
+    public String directViewName(HttpServletRequest request) {
+        String next = request.getHeader("referer"); // $ Source
+        return "redirect:" + next; // $ Alert
+    }
+
+    @GetMapping("/case2")
+    public ModelAndView modelAndView(HttpServletRequest request) {
+        String next = request.getHeader("referer"); // $ Source
+        return new ModelAndView("redirect:" + next); // $ Alert
+    }
+
+    @GetMapping("/case3")
+    public RedirectView redirectView(HttpServletRequest request) {
+        String next = request.getHeader("referer"); // $ Source
+        return new RedirectView(next); // $ Alert
+    }
+
+    @GetMapping("/case4")
+    public String helperViewName(HttpServletRequest request) {
+        String next = request.getHeader("referer"); // $ Source
+        return redirect(next); // $ Alert
+    }
+
+    @GetMapping("/case5")
+    public RedirectView configuredRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView();
+        view.setUrl(next); // $ Alert
+        return view;
+    }
+
+    @GetMapping("/case6")
+    public RedirectView overloadedRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new RedirectView(next, true); // $ Alert
+    }
+
+    @GetMapping("/safe-constant")
+    public String constantViewName() {
+        return "redirect:/account";
+    }
+
+    @GetMapping("/safe-path")
+    public String fixedPath(HttpServletRequest request) {
+        String tab = request.getParameter("tab");
+        return "redirect:/account?tab=" + tab;
+    }
+
+    @GetMapping("/safe-model-and-view")
+    public ModelAndView ordinaryModelAndView(HttpServletRequest request) {
+        String view = request.getParameter("view");
+        return new ModelAndView(ordinaryView(view));
+    }
+
+    @GetMapping("/safe-model-value")
+    public ModelAndView redirectInModel(HttpServletRequest request) {
+        String value = "redirect:" + request.getParameter("value");
+        return new ModelAndView("home", "value", value);
+    }
+
+    @GetMapping("/safe-discarded")
+    public String discardedRedirectValue(HttpServletRequest request) {
+        discardedRedirect(request.getParameter("next"));
+        return "home";
+    }
+
+    @GetMapping("/safe-redirect-view")
+    public RedirectView constantRedirectView() {
+        return new RedirectView("https://example.com/account");
+    }
+
+    @GetMapping("/safe-subclass-label")
+    public RedirectView customRedirectView(HttpServletRequest request) {
+        String label = request.getParameter("label");
+        return new LabeledRedirectView(label, "/account");
+    }
+
+    @GetMapping("/safe-set-url-overload")
+    public RedirectView customSetUrl(HttpServletRequest request) {
+        LabeledRedirectView view = new LabeledRedirectView("label", "/account");
+        Object label = request.getParameter("label");
+        view.setUrl(label);
+        return view;
+    }
+}
+
+@Controller
+class ResponseBodyController {
+    @ResponseBody
+    @GetMapping("/body")
+    public String responseBody(HttpServletRequest request) {
+        return "redirect:" + request.getParameter("value");
+    }
+}
+
+@RestController
+class JsonController {
+    @GetMapping("/json")
+    public String responseBody(HttpServletRequest request) {
+        return "redirect:" + request.getParameter("value");
+    }
+}
+
+class SharedRedirectHelper {
+    protected String redirectShared(String path) {
+        return "redirect:" + path;
+    }
+}
+
+@Controller
+class MvcViewUser extends SharedRedirectHelper {
+    @GetMapping("/constant-view")
+    public String view() {
+        return redirectShared("/account");
+    }
+}
+
+@Controller
+class ResponseBodyUser extends SharedRedirectHelper {
+    @ResponseBody
+    @GetMapping("/body-user")
+    public String body(HttpServletRequest request) {
+        return redirectShared(request.getParameter("value"));
+    }
+}
+
+@Controller
+class SpringRedirectRegressions extends BaseController {
+
+    protected String embeddedRedirect(String path) {
+        String base = "home";
+        return base + "redirect:" + path;
+    }
+
+    protected String fixedRelativeRedirect(String tab) {
+        return "redirect:/account?tab=" + tab;
+    }
+
+    protected String mixedRedirect(String path, boolean useConstant) {
+        if (useConstant) {
+            return "redirect:" + "/account";
+        }
+        return "home:" + path;
+    }
+
+    @GetMapping("/helper-model-and-view")
+    public ModelAndView helperModelAndView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(redirect(next)); // $ Alert
+    }
+
+    @GetMapping("/helper-model-and-view-model")
+    public ModelAndView helperModelAndViewWithModel(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(redirect(next), "note", "value"); // $ Alert
+    }
+
+    @GetMapping("/redirect-with-suffix")
+    public String redirectWithSuffix(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return "redirect:" + next + "?tab=profile"; // $ Alert
+    }
+
+    @GetMapping("/local-model-and-view-name")
+    public ModelAndView localModelAndViewName(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        String viewName = "redirect:" + next; // $ Alert
+        return new ModelAndView(viewName);
+    }
+
+    @GetMapping("/safe-leading-view-name")
+    public String leadingViewName(HttpServletRequest request) {
+        String next = request.getParameter("next");
+        String base = "home";
+        return base + "redirect:" + next;
+    }
+
+    @GetMapping("/safe-leading-model-and-view")
+    public ModelAndView leadingModelAndView(HttpServletRequest request) {
+        String next = request.getParameter("next");
+        String base = "home";
+        return new ModelAndView(base + "redirect:" + next);
+    }
+
+    @GetMapping("/safe-leading-helper-model-and-view")
+    public ModelAndView leadingHelperModelAndView(HttpServletRequest request) {
+        return new ModelAndView("home" + redirect(request.getParameter("next")));
+    }
+
+    @GetMapping("/safe-embedded-helper-prefix")
+    public String embeddedHelperPrefix(HttpServletRequest request) {
+        return embeddedRedirect(request.getParameter("next"));
+    }
+
+    @GetMapping("/safe-helper-model-value")
+    public ModelAndView helperInModel(HttpServletRequest request) {
+        return new ModelAndView("home", "value", redirect(request.getParameter("next")));
+    }
+
+    @GetMapping("/safe-discarded-model-and-view")
+    public ModelAndView discardedModelAndView(HttpServletRequest request) {
+        new ModelAndView(redirect(request.getParameter("next")));
+        return new ModelAndView("home");
+    }
+
+    @GetMapping("/safe-logged-helper")
+    public String loggedHelper(HttpServletRequest request) {
+        System.out.println(redirect(request.getParameter("next")));
+        return "home";
+    }
+
+    @GetMapping("/safe-leading-builder")
+    public String leadingBuilder(HttpServletRequest request) {
+        StringBuilder builder = new StringBuilder("home");
+        builder.append("redirect:");
+        builder.append(request.getParameter("next"));
+        return builder.toString();
+    }
+
+    @GetMapping("/safe-leading-format")
+    public String leadingFormat(HttpServletRequest request) {
+        return "home" + String.format("redirect:%s", request.getParameter("next"));
+    }
+
+    @GetMapping("/safe-fixed-relative-helper")
+    public ModelAndView fixedRelativeHelper(HttpServletRequest request) {
+        return new ModelAndView(fixedRelativeRedirect(request.getParameter("tab")));
+    }
+
+    @GetMapping("/safe-mixed-helper")
+    public ModelAndView mixedHelper(HttpServletRequest request, boolean useConstant) {
+        return new ModelAndView(mixedRedirect(request.getParameter("next"), useConstant));
+    }
+
+    @GetMapping("/safe-validated-helper")
+    public ModelAndView validatedHelper(HttpServletRequest request) throws Exception {
+        java.net.URI uri = new java.net.URI(request.getParameter("next"));
+        if ("example.com".equals(uri.getHost())) {
+            return new ModelAndView(redirect(uri.toString()));
+        }
+        return new ModelAndView("home");
+    }
+
+    // As with other redirect sinks, later property writes do not suppress an alert.
+    @GetMapping("/overwritten-constructor-url")
+    public RedirectView overwrittenConstructorUrl(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ SPURIOUS: Source
+        RedirectView view = new RedirectView(next); // $ SPURIOUS: Alert
+        view.setUrl("/safe");
+        return view;
+    }
+
+    @GetMapping("/overwritten-setter-url")
+    public RedirectView overwrittenSetterUrl(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ SPURIOUS: Source
+        RedirectView view = new RedirectView();
+        view.setUrl(next); // $ SPURIOUS: Alert
+        view.setUrl("/safe");
+        return view;
+    }
+
+    @GetMapping("/overwritten-model-and-view-name")
+    public ModelAndView overwrittenModelAndViewName(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ SPURIOUS: Source
+        ModelAndView view = new ModelAndView("redirect:" + next); // $ SPURIOUS: Alert
+        view.setViewName("home");
+        return view;
+    }
+}
+
+@Controller
+class ResponseBodyRedirectRegressions extends BaseController {
+
+    @ResponseBody
+    @GetMapping("/body-redirect-view")
+    public RedirectView redirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new RedirectView(next); // $ Alert
+    }
+
+    @ResponseBody
+    @GetMapping("/body-model-and-view")
+    public ModelAndView modelAndView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView("redirect:" + next); // $ Alert
+    }
+
+    @ResponseBody
+    @GetMapping("/body-helper-model-and-view")
+    public ModelAndView helperModelAndView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(redirect(next)); // $ Alert
+    }
+}
+
+@RestController
+class JsonRedirectRegressions extends BaseController {
+
+    @GetMapping("/json-redirect-view")
+    public RedirectView redirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new RedirectView(next); // $ Alert
+    }
+
+    @GetMapping("/json-model-and-view")
+    public ModelAndView modelAndView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView("redirect:" + next); // $ Alert
+    }
+
+    @GetMapping("/json-helper-model-and-view")
+    public ModelAndView helperModelAndView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(redirect(next)); // $ Alert
+    }
+
+    @GetMapping("/json-configured-redirect-view")
+    public RedirectView configuredRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView();
+        view.setUrl(next); // $ Alert
+        return view;
+    }
+
+    @GetMapping("/json-object-redirect-view")
+    public Object objectRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new RedirectView(next); // $ Alert
+    }
+}
+
+@Controller
+class SpringViewPropertyRegressions extends SpringRedirectRegressions {
+    @GetMapping("/conditional-url-overwrite")
+    public RedirectView conditionalUrlOverwrite(HttpServletRequest request, boolean replace) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView(next); // $ Alert
+        if (replace) {
+            view.setUrl("/safe");
+        }
+        return view;
+    }
+
+    @GetMapping("/other-view-url-overwrite")
+    public RedirectView otherViewUrlOverwrite(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView(next); // $ Alert
+        RedirectView other = new RedirectView("/account");
+        other.setUrl("/safe");
+        return view;
+    }
+
+    @GetMapping("/alias-url-overwrite")
+    public RedirectView aliasUrlOverwrite(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ SPURIOUS: Source
+        RedirectView view = new RedirectView(next); // $ SPURIOUS: Alert
+        RedirectView alias = view;
+        alias.setUrl("/safe");
+        return view;
+    }
+
+    @GetMapping("/conditional-alias-url-overwrite")
+    public RedirectView conditionalAliasUrlOverwrite(HttpServletRequest request, boolean replace) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView(next); // $ Alert
+        RedirectView alias = replace ? view : new RedirectView("/account");
+        alias.setUrl("/safe");
+        return view;
+    }
+
+    @GetMapping("/returned-before-url-overwrite")
+    public RedirectView returnedBeforeUrlOverwrite(HttpServletRequest request, boolean keepOriginal) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView(next); // $ Alert
+        if (keepOriginal) {
+            return view;
+        }
+        view.setUrl("/safe");
+        return view;
+    }
+
+    @GetMapping("/later-unsafe-url-overwrite")
+    public RedirectView laterUnsafeUrlOverwrite(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView(next); // $ Alert
+        view.setUrl("/safe");
+        view.setUrl(next); // $ Alert
+        return view;
+    }
+
+    @GetMapping("/safe-mixed-helper-string")
+    public String mixedHelperString(HttpServletRequest request, boolean useConstant) {
+        return mixedRedirect(request.getParameter("next"), useConstant);
+    }
+
+    @ResponseBody
+    @GetMapping("/safe-body-shared-view-helper")
+    public String responseBodySharedViewHelper(HttpServletRequest request) {
+        return redirect(request.getParameter("next"));
+    }
+}
+
+@Controller
+class SpringModelAndViewPropertyRegressions extends BaseController {
+    @GetMapping("/later-unsafe-model-and-view-overwrite")
+    public ModelAndView laterUnsafeModelAndViewOverwrite(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        ModelAndView view = new ModelAndView("redirect:" + next); // $ Alert
+        view.setViewName("home");
+        view.setViewName("redirect:" + next);
+        return view;
+    }
+}
+
+@Controller
+class SpringAdditionalPrefixRegressions extends BaseController {
+    protected String conditionalMixedRedirect(String path, boolean useConstant) {
+        return useConstant ? redirect("/safe") : "home:" + path;
+    }
+
+    protected String branchingRedirect(String path, boolean useConstant) {
+        if (useConstant) {
+            return "redirect:" + "/account";
+        }
+        return "redirect:" + path;
+    }
+
+    private static void restoreUrl(RedirectView view, String url) {
+        view.setUrl(url);
+    }
+
+    @GetMapping("/safe-conditional-mixed-helper")
+    public ModelAndView conditionalMixedHelper(HttpServletRequest request, boolean useConstant) {
+        return new ModelAndView(conditionalMixedRedirect(request.getParameter("next"), useConstant));
+    }
+
+    @GetMapping("/helper-restores-unsafe-url")
+    public RedirectView helperRestoresUnsafeUrl(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView(next); // $ Alert
+        view.setUrl("/safe");
+        restoreUrl(view, next);
+        return view;
+    }
+
+    @GetMapping("/safe-outer-relative-prefix")
+    public String outerRelativePrefix(HttpServletRequest request) {
+        String next = request.getParameter("next");
+        return "redirect:/safe/" + ("redirect:" + next);
+    }
+
+    @GetMapping("/safe-outer-relative-model-and-view")
+    public ModelAndView outerRelativeModelAndView(HttpServletRequest request) {
+        String next = request.getParameter("next");
+        return new ModelAndView("redirect:/safe/" + ("redirect:" + next));
+    }
+
+    @GetMapping("/branching-view-name")
+    public String branchingViewName(HttpServletRequest request, boolean useConstant) {
+        String next = request.getParameter("next"); // $ Source
+        return branchingRedirect(next, useConstant); // $ Alert
+    }
+
+    @GetMapping("/branching-model-and-view-name")
+    public ModelAndView branchingModelAndViewName(HttpServletRequest request, boolean useConstant) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(branchingRedirect(next, useConstant)); // $ Alert
+    }
+}
+
+@Controller
+class SpringRedirectHelperRegressions extends BaseController {
+    protected String internallyValidatedRedirect(String path) {
+        if (!java.util.Arrays.asList("/account", "/home").contains(path)) {
+            return "redirect:/safe";
+        }
+        return "redirect:" + path;
+    }
+
+    protected String internallySourcedRedirect(HttpServletRequest request) {
+        String next = request.getHeader("referer"); // $ Source
+        return "redirect:" + next;
+    }
+
+    protected String secondRedirect(String... paths) {
+        return "redirect:" + paths[1];
+    }
+
+    protected String fixedBranchingRedirect(String tab, boolean useConstant) {
+        if (useConstant) {
+            return "redirect:/account";
+        }
+        return "redirect:/account?tab=" + tab;
+    }
+
+    private static void restoreArrayUrl(RedirectView[] views, String url) {
+        views[0].setUrl(url);
+    }
+
+    @GetMapping("/safe-internally-validated-helper")
+    public ModelAndView internallyValidatedHelper(HttpServletRequest request) {
+        return new ModelAndView(internallyValidatedRedirect(request.getParameter("next")));
+    }
+
+    @GetMapping("/internally-sourced-helper")
+    public ModelAndView internallySourcedHelper(HttpServletRequest request) {
+        return new ModelAndView(internallySourcedRedirect(request)); // $ Alert
+    }
+
+    @GetMapping("/varargs-model-and-view-name")
+    public ModelAndView varargsModelAndViewName(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(secondRedirect("/safe", next)); // $ Alert
+    }
+
+    @GetMapping("/safe-fixed-branching-helper")
+    public ModelAndView fixedBranchingHelper(HttpServletRequest request, boolean useConstant) {
+        return new ModelAndView(fixedBranchingRedirect(request.getParameter("tab"), useConstant));
+    }
+
+    @GetMapping("/ambiguous-finally-url-overwrite")
+    public RedirectView ambiguousFinallyUrlOverwrite(
+            HttpServletRequest request, boolean flag, RedirectView supplied) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView result = new RedirectView(next); // $ Alert
+        RedirectView view = result;
+        try {
+            if (flag) {
+                return result;
+            }
+            view = supplied;
+        } finally {
+            view.setUrl("/safe");
+        }
+        return result;
+    }
+
+    @GetMapping("/array-helper-restores-unsafe-url")
+    public RedirectView arrayHelperRestoresUnsafeUrl(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView(next); // $ Alert
+        RedirectView[] views = { view };
+        view.setUrl("/safe");
+        restoreArrayUrl(views, next);
+        return view;
+    }
+}
+
+@Controller
+class SpringRedirectFallbackRegressions extends BaseController {
+    protected String branchingFallbackRedirect(String path, boolean useRedirect) {
+        if (useRedirect) {
+            return "redirect:" + path;
+        }
+        return "home";
+    }
+
+    @GetMapping("/branching-helper-with-ordinary-fallback")
+    public ModelAndView branchingFallbackModelAndView(HttpServletRequest request, boolean useRedirect) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(branchingFallbackRedirect(next, useRedirect)); // $ Alert
+    }
+}
+
+@Controller
+class SpringModelAttributeRedirectRegressions extends BaseController {
+    @org.springframework.web.bind.annotation.ModelAttribute("value")
+    @GetMapping("/safe-model-attribute-value")
+    public String modelAttributeValue(HttpServletRequest request) {
+        return "redirect:" + request.getParameter("next");
+    }
+
+    @org.springframework.web.bind.annotation.ModelAttribute("value")
+    @GetMapping("/model-attribute-redirect-view")
+    public RedirectView modelAttributeRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new RedirectView(next); // $ Alert
+    }
+
+    @org.springframework.web.bind.annotation.ModelAttribute("value")
+    @GetMapping("/model-attribute-model-and-view")
+    public ModelAndView modelAttributeModelAndView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView("redirect:" + next); // $ Alert
+    }
+}
+
+@Controller
+class SpringConditionalRedirectRegressions extends BaseController {
+    @GetMapping("/original-conditional-helper")
+    public String originalConditionalHelper(HttpServletRequest request) {
+        String referer = request.getHeader("referer"); // $ Source
+        return org.springframework.util.StringUtils.isEmpty(referer) ? redirect("/") : redirect(referer); // $ Alert
+    }
+
+    @GetMapping("/conditional-concatenation")
+    public String conditionalConcatenation(HttpServletRequest request, boolean useRedirect) {
+        String next = request.getParameter("next"); // $ Source
+        return useRedirect ? "redirect:" + next : "home"; // $ Alert
+    }
+
+    @GetMapping("/branch-assigned-name")
+    public ModelAndView branchAssignedName(HttpServletRequest request, boolean useRedirect) {
+        String next = request.getParameter("next"); // $ Source
+        String name;
+        if (useRedirect) {
+            name = "redirect:" + next; // $ Alert
+        } else {
+            name = "home";
+        }
+        return new ModelAndView(name);
+    }
+
+    @GetMapping("/branch-assigned-helper")
+    public String branchAssignedHelper(HttpServletRequest request, boolean useRedirect) {
+        String next = request.getParameter("next"); // $ Source
+        String name;
+        if (useRedirect) {
+            name = redirect(next); // $ Alert
+        } else {
+            name = "home";
+        }
+        return name;
+    }
+
+    @GetMapping("/local-prefix")
+    public String localPrefix(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        String prefix = "redirect:";
+        return prefix + next; // $ Alert
+    }
+
+    protected String localPrefixHelper(String next) {
+        String prefix = "redirect:";
+        return prefix + next;
+    }
+
+    @GetMapping("/local-prefix-helper")
+    public ModelAndView localPrefixHelperName(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(localPrefixHelper(next)); // $ Alert
+    }
+
+    @GetMapping("/conditional-prefix")
+    public String conditionalPrefix(HttpServletRequest request, boolean useRedirect) {
+        String next = request.getParameter("next"); // $ Source
+        String prefix = useRedirect ? "redirect:" : "home:";
+        return prefix + next; // $ Alert
+    }
+
+    @GetMapping("/safe-reassigned-prefix")
+    public String reassignedPrefix(HttpServletRequest request) {
+        String prefix = "redirect:";
+        prefix = "home:";
+        return prefix + request.getParameter("next");
+    }
+
+    @GetMapping("/safe-branch-assigned-name")
+    public String safeBranchAssignedName(HttpServletRequest request, boolean useRedirect) {
+        String name;
+        if (useRedirect) {
+            name = "redirect:/account";
+        } else {
+            name = "home:" + request.getParameter("next");
+        }
+        return name;
+    }
+
+    @GetMapping("/safe-conditional-relative-name")
+    public String conditionalRelativeName(HttpServletRequest request, boolean useRedirect) {
+        return useRedirect ? "redirect:/account?tab=" + request.getParameter("tab") : "home";
+    }
+
+    @GetMapping("/safe-local-embedded-prefix")
+    public String localEmbeddedPrefix(HttpServletRequest request) {
+        String prefix = "redirect:";
+        return "home" + prefix + request.getParameter("next");
+    }
+
+    @GetMapping("/safe-reassigned-view-name")
+    public String reassignedViewName(HttpServletRequest request) {
+        String name = "redirect:" + request.getParameter("next");
+        name = "home";
+        return name;
+    }
+
+    @GetMapping("/empty-prefix-part")
+    public String emptyPrefixPart(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        String empty = "";
+        return "redirect:" + empty + next; // $ Alert
+    }
+
+    @GetMapping("/local-scheme-prefix")
+    public String localSchemePrefix(HttpServletRequest request) {
+        String host = request.getParameter("host"); // $ Source
+        String scheme = "https://";
+        return "redirect:" + scheme + host; // $ Alert
+    }
+}
+
+@RestController
+class SpringWrappedRedirectRegressions {
+    @GetMapping("/wrapped-redirect-view")
+    public ModelAndView wrappedRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(new RedirectView(next)); // $ Alert
+    }
+
+    @GetMapping("/wrapped-configured-view")
+    public ModelAndView wrappedConfiguredView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView();
+        view.setUrl(next); // $ Alert
+        return new ModelAndView(view);
+    }
+
+    @GetMapping("/wrapped-view-with-model")
+    public ModelAndView wrappedViewWithModel(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        RedirectView view = new RedirectView(next); // $ Alert
+        ModelAndView result = new ModelAndView(view, "note", "value");
+        return result;
+    }
+
+    @GetMapping("/safe-discarded-wrapper")
+    public ModelAndView discardedWrapper(HttpServletRequest request) {
+        new ModelAndView(new RedirectView(request.getParameter("next")));
+        return new ModelAndView("home");
+    }
+
+    @GetMapping("/safe-view-in-model")
+    public ModelAndView viewInModel(HttpServletRequest request) {
+        return new ModelAndView("home", "view", new RedirectView(request.getParameter("next")));
+    }
+
+    @GetMapping("/safe-different-wrapped-view")
+    public ModelAndView differentWrappedView(HttpServletRequest request) {
+        RedirectView view = new RedirectView();
+        view.setUrl(request.getParameter("next"));
+        return new ModelAndView(new RedirectView("/account"));
+    }
+}
+
+@Controller
+class SpringAssignedParameterRegressions {
+    @GetMapping("/assigned-parameter-name")
+    public String assignedParameterName(HttpServletRequest request, String name) {
+        String next = request.getParameter("next"); // $ Source
+        name = "redirect:" + next; // $ Alert
+        return name;
+    }
+
+    @GetMapping("/branch-assigned-parameter-name")
+    public ModelAndView branchAssignedParameterName(
+            HttpServletRequest request, String name, boolean useRedirect) {
+        String next = request.getParameter("next"); // $ Source
+        if (useRedirect) {
+            name = "redirect:" + next; // $ Alert
+        } else {
+            name = "home";
+        }
+        return new ModelAndView(name);
+    }
+
+    @GetMapping("/safe-reassigned-parameter-name")
+    public String reassignedParameterName(HttpServletRequest request, String name) {
+        name = "redirect:" + request.getParameter("next");
+        name = "home";
+        return name;
+    }
+
+    protected String partiallyAssignedParameter(String name, String path, boolean useRedirect) {
+        if (useRedirect) {
+            name = "redirect:" + path;
+        }
+        return name;
+    }
+
+    @GetMapping("/safe-partially-assigned-helper-parameter")
+    public String partiallyAssignedHelperParameter(HttpServletRequest request, boolean useRedirect) {
+        return partiallyAssignedParameter("home:" + request.getParameter("next"), "/account", useRedirect);
+    }
+
+    @GetMapping("/safe-branch-assigned-parameter-name")
+    public String safeBranchAssignedParameterName(
+            HttpServletRequest request, String name, boolean useRedirect) {
+        String next = request.getParameter("next");
+        if (useRedirect) {
+            name = "redirect:/account?tab=" + next;
+        } else {
+            name = "home:" + next;
+        }
+        return name;
+    }
+}
+
+@Controller
+class SpringSwitchRedirectRegressions {
+    @GetMapping("/switch-view-name")
+    public String switchViewName(HttpServletRequest request, int choice) {
+        String next = request.getParameter("next"); // $ Source
+        return switch (choice) {
+            case 0 -> "redirect:" + next; // $ Alert
+            case 1 -> "redirect:/account?tab=" + next;
+            default -> "home:" + next;
+        };
+    }
+
+    protected String switchRedirect(String path, int choice) {
+        return switch (choice) {
+            case 0 -> {
+                yield "redirect:" + path + "?from=switch";
+            }
+            default -> "redirect:/account";
+        };
+    }
+
+    @GetMapping("/switch-helper-model-and-view")
+    public ModelAndView switchHelperModelAndView(HttpServletRequest request, int choice) {
+        String next = request.getParameter("next"); // $ Source
+        return new ModelAndView(switchRedirect(next, choice)); // $ Alert
+    }
+
+    protected String ordinarySwitchView(String path, int choice) {
+        return switch (choice) {
+            case 0 -> "redirect:/account";
+            default -> "home:" + path;
+        };
+    }
+
+    @GetMapping("/safe-ordinary-switch-helper")
+    public String ordinarySwitchHelper(HttpServletRequest request, int choice) {
+        return ordinarySwitchView(request.getParameter("next"), choice);
+    }
+
+    @GetMapping("/safe-fixed-path-switch")
+    public String fixedPathSwitch(HttpServletRequest request, int choice) {
+        return switch (choice) {
+            case 0 -> "redirect:/account?tab=" + request.getParameter("tab");
+            default -> "redirect:/account";
+        };
+    }
+}
+
+@Controller
+class SpringInferredViewTypeRegressions {
+    @GetMapping("/supertype-configured-redirect-view")
+    public AbstractUrlBasedView supertypeConfiguredRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        AbstractUrlBasedView view = new RedirectView();
+        view.setUrl(next); // $ Alert
+        return view;
+    }
+
+    @GetMapping("/supertype-alias-configured-redirect-view")
+    public AbstractUrlBasedView supertypeAliasConfiguredRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        AbstractUrlBasedView view = new RedirectView();
+        AbstractUrlBasedView alias = view;
+        alias.setUrl(next); // $ Alert
+        return alias;
+    }
+
+    @GetMapping("/supertype-wrapped-configured-redirect-view")
+    public ModelAndView supertypeWrappedConfiguredRedirectView(HttpServletRequest request) {
+        String next = request.getParameter("next"); // $ Source
+        AbstractUrlBasedView view = new RedirectView();
+        view.setUrl(next); // $ Alert
+        return new ModelAndView(view);
+    }
+
+    @GetMapping("/safe-supertype-ordinary-view")
+    public AbstractUrlBasedView supertypeOrdinaryView(HttpServletRequest request) {
+        AbstractUrlBasedView view = new OrdinaryUrlView();
+        view.setUrl(request.getParameter("next"));
+        return view;
+    }
+
+    @GetMapping("/safe-supertype-different-returned-view")
+    public ModelAndView supertypeDifferentReturnedView(HttpServletRequest request) {
+        AbstractUrlBasedView view = new RedirectView();
+        view.setUrl(request.getParameter("next"));
+        return new ModelAndView(new RedirectView("/account"));
+    }
+}
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
index c677916dd36d..fd7e7e15cccf 100644
--- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/UrlRedirect.expected
@@ -22,6 +22,64 @@
 | MicronautUrlRedirect.java:28:47:28:64 | create(...) | MicronautUrlRedirect.java:27:45:27:69 | target : String | MicronautUrlRedirect.java:28:47:28:64 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:27:45:27:69 | target | user-provided value |
 | MicronautUrlRedirect.java:33:38:33:55 | create(...) | MicronautUrlRedirect.java:32:44:32:68 | target : String | MicronautUrlRedirect.java:33:38:33:55 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:32:44:32:68 | target | user-provided value |
 | MicronautUrlRedirect.java:38:47:38:64 | create(...) | MicronautUrlRedirect.java:37:45:37:69 | target : String | MicronautUrlRedirect.java:38:47:38:64 | create(...) | Untrusted URL redirection depends on a $@. | MicronautUrlRedirect.java:37:45:37:69 | target | user-provided value |
+| SpringUrlRedirect.java:43:30:43:33 | next | SpringUrlRedirect.java:42:23:42:50 | getHeader(...) : String | SpringUrlRedirect.java:43:30:43:33 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:42:23:42:50 | getHeader(...) | user-provided value |
+| SpringUrlRedirect.java:49:47:49:50 | next | SpringUrlRedirect.java:48:23:48:50 | getHeader(...) : String | SpringUrlRedirect.java:49:47:49:50 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:48:23:48:50 | getHeader(...) | user-provided value |
+| SpringUrlRedirect.java:55:33:55:36 | next | SpringUrlRedirect.java:54:23:54:50 | getHeader(...) : String | SpringUrlRedirect.java:55:33:55:36 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:54:23:54:50 | getHeader(...) | user-provided value |
+| SpringUrlRedirect.java:61:16:61:29 | redirect(...) | SpringUrlRedirect.java:60:23:60:50 | getHeader(...) : String | SpringUrlRedirect.java:61:16:61:29 | redirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:60:23:60:50 | getHeader(...) | user-provided value |
+| SpringUrlRedirect.java:68:21:68:24 | next | SpringUrlRedirect.java:66:23:66:50 | getParameter(...) : String | SpringUrlRedirect.java:68:21:68:24 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:66:23:66:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:75:33:75:36 | next | SpringUrlRedirect.java:74:23:74:50 | getParameter(...) : String | SpringUrlRedirect.java:75:33:75:36 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:74:23:74:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:189:33:189:46 | redirect(...) | SpringUrlRedirect.java:188:23:188:50 | getParameter(...) : String | SpringUrlRedirect.java:189:33:189:46 | redirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:188:23:188:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:195:33:195:46 | redirect(...) | SpringUrlRedirect.java:194:23:194:50 | getParameter(...) : String | SpringUrlRedirect.java:195:33:195:46 | redirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:194:23:194:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:201:30:201:33 | next | SpringUrlRedirect.java:200:23:200:50 | getParameter(...) : String | SpringUrlRedirect.java:201:30:201:33 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:200:23:200:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:207:41:207:44 | next | SpringUrlRedirect.java:206:23:206:50 | getParameter(...) : String | SpringUrlRedirect.java:207:41:207:44 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:206:23:206:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:288:46:288:49 | next | SpringUrlRedirect.java:287:23:287:50 | getParameter(...) : String | SpringUrlRedirect.java:288:46:288:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:287:23:287:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:297:21:297:24 | next | SpringUrlRedirect.java:295:23:295:50 | getParameter(...) : String | SpringUrlRedirect.java:297:21:297:24 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:295:23:295:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:305:60:305:63 | next | SpringUrlRedirect.java:304:23:304:50 | getParameter(...) : String | SpringUrlRedirect.java:305:60:305:63 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:304:23:304:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:318:33:318:36 | next | SpringUrlRedirect.java:317:23:317:50 | getParameter(...) : String | SpringUrlRedirect.java:318:33:318:36 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:317:23:317:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:325:47:325:50 | next | SpringUrlRedirect.java:324:23:324:50 | getParameter(...) : String | SpringUrlRedirect.java:325:47:325:50 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:324:23:324:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:332:33:332:46 | redirect(...) | SpringUrlRedirect.java:331:23:331:50 | getParameter(...) : String | SpringUrlRedirect.java:332:33:332:46 | redirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:331:23:331:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:342:33:342:36 | next | SpringUrlRedirect.java:341:23:341:50 | getParameter(...) : String | SpringUrlRedirect.java:342:33:342:36 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:341:23:341:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:348:47:348:50 | next | SpringUrlRedirect.java:347:23:347:50 | getParameter(...) : String | SpringUrlRedirect.java:348:47:348:50 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:347:23:347:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:354:33:354:46 | redirect(...) | SpringUrlRedirect.java:353:23:353:50 | getParameter(...) : String | SpringUrlRedirect.java:354:33:354:46 | redirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:353:23:353:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:361:21:361:24 | next | SpringUrlRedirect.java:359:23:359:50 | getParameter(...) : String | SpringUrlRedirect.java:361:21:361:24 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:359:23:359:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:368:33:368:36 | next | SpringUrlRedirect.java:367:23:367:50 | getParameter(...) : String | SpringUrlRedirect.java:368:33:368:36 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:367:23:367:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:377:46:377:49 | next | SpringUrlRedirect.java:376:23:376:50 | getParameter(...) : String | SpringUrlRedirect.java:377:46:377:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:376:23:376:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:387:46:387:49 | next | SpringUrlRedirect.java:386:23:386:50 | getParameter(...) : String | SpringUrlRedirect.java:387:46:387:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:386:23:386:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:396:46:396:49 | next | SpringUrlRedirect.java:395:23:395:50 | getParameter(...) : String | SpringUrlRedirect.java:396:46:396:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:395:23:395:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:405:46:405:49 | next | SpringUrlRedirect.java:404:23:404:50 | getParameter(...) : String | SpringUrlRedirect.java:405:46:405:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:404:23:404:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:414:46:414:49 | next | SpringUrlRedirect.java:413:23:413:50 | getParameter(...) : String | SpringUrlRedirect.java:414:46:414:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:413:23:413:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:425:46:425:49 | next | SpringUrlRedirect.java:424:23:424:50 | getParameter(...) : String | SpringUrlRedirect.java:425:46:425:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:424:23:424:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:427:21:427:24 | next | SpringUrlRedirect.java:424:23:424:50 | getParameter(...) : String | SpringUrlRedirect.java:427:21:427:24 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:424:23:424:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:448:60:448:63 | next | SpringUrlRedirect.java:447:23:447:50 | getParameter(...) : String | SpringUrlRedirect.java:448:60:448:63 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:447:23:447:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:480:46:480:49 | next | SpringUrlRedirect.java:479:23:479:50 | getParameter(...) : String | SpringUrlRedirect.java:480:46:480:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:479:23:479:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:501:16:501:51 | branchingRedirect(...) | SpringUrlRedirect.java:500:23:500:50 | getParameter(...) : String | SpringUrlRedirect.java:501:16:501:51 | branchingRedirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:500:23:500:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:507:33:507:68 | branchingRedirect(...) | SpringUrlRedirect.java:506:23:506:50 | getParameter(...) : String | SpringUrlRedirect.java:507:33:507:68 | branchingRedirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:506:23:506:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:547:33:547:66 | internallySourcedRedirect(...) | SpringUrlRedirect.java:521:23:521:50 | getHeader(...) : String | SpringUrlRedirect.java:547:33:547:66 | internallySourcedRedirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:521:23:521:50 | getHeader(...) | user-provided value |
+| SpringUrlRedirect.java:553:33:553:61 | secondRedirect(...) | SpringUrlRedirect.java:552:23:552:50 | getParameter(...) : String | SpringUrlRedirect.java:553:33:553:61 | secondRedirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:552:23:552:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:565:48:565:51 | next | SpringUrlRedirect.java:564:23:564:50 | getParameter(...) : String | SpringUrlRedirect.java:565:48:565:51 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:564:23:564:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:581:46:581:49 | next | SpringUrlRedirect.java:580:23:580:50 | getParameter(...) : String | SpringUrlRedirect.java:581:46:581:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:580:23:580:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:601:33:601:76 | branchingFallbackRedirect(...) | SpringUrlRedirect.java:600:23:600:50 | getParameter(...) : String | SpringUrlRedirect.java:601:33:601:76 | branchingFallbackRedirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:600:23:600:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:617:33:617:36 | next | SpringUrlRedirect.java:616:23:616:50 | getParameter(...) : String | SpringUrlRedirect.java:617:33:617:36 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:616:23:616:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:624:47:624:50 | next | SpringUrlRedirect.java:623:23:623:50 | getParameter(...) : String | SpringUrlRedirect.java:624:47:624:50 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:623:23:623:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:633:88:633:104 | redirect(...) | SpringUrlRedirect.java:632:26:632:53 | getHeader(...) : String | SpringUrlRedirect.java:633:88:633:104 | redirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:632:26:632:53 | getHeader(...) | user-provided value |
+| SpringUrlRedirect.java:639:44:639:47 | next | SpringUrlRedirect.java:638:23:638:50 | getParameter(...) : String | SpringUrlRedirect.java:639:44:639:47 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:638:23:638:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:647:34:647:37 | next | SpringUrlRedirect.java:644:23:644:50 | getParameter(...) : String | SpringUrlRedirect.java:647:34:647:37 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:644:23:644:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:659:20:659:33 | redirect(...) | SpringUrlRedirect.java:656:23:656:50 | getParameter(...) : String | SpringUrlRedirect.java:659:20:659:33 | redirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:656:23:656:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:670:25:670:28 | next | SpringUrlRedirect.java:668:23:668:50 | getParameter(...) : String | SpringUrlRedirect.java:670:25:670:28 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:668:23:668:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:681:33:681:55 | localPrefixHelper(...) | SpringUrlRedirect.java:680:23:680:50 | getParameter(...) : String | SpringUrlRedirect.java:681:33:681:55 | localPrefixHelper(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:680:23:680:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:688:25:688:28 | next | SpringUrlRedirect.java:686:23:686:50 | getParameter(...) : String | SpringUrlRedirect.java:688:25:688:28 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:686:23:686:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:731:38:731:41 | next | SpringUrlRedirect.java:729:23:729:50 | getParameter(...) : String | SpringUrlRedirect.java:731:38:731:41 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:729:23:729:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:738:39:738:42 | host | SpringUrlRedirect.java:736:23:736:50 | getParameter(...) : String | SpringUrlRedirect.java:738:39:738:42 | host | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:736:23:736:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:747:50:747:53 | next | SpringUrlRedirect.java:746:23:746:50 | getParameter(...) : String | SpringUrlRedirect.java:747:50:747:53 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:746:23:746:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:754:21:754:24 | next | SpringUrlRedirect.java:752:23:752:50 | getParameter(...) : String | SpringUrlRedirect.java:754:21:754:24 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:752:23:752:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:761:46:761:49 | next | SpringUrlRedirect.java:760:23:760:50 | getParameter(...) : String | SpringUrlRedirect.java:761:46:761:49 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:760:23:760:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:790:30:790:33 | next | SpringUrlRedirect.java:789:23:789:50 | getParameter(...) : String | SpringUrlRedirect.java:790:30:790:33 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:789:23:789:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:799:34:799:37 | next | SpringUrlRedirect.java:797:23:797:50 | getParameter(...) : String | SpringUrlRedirect.java:799:34:799:37 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:797:23:797:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:844:37:844:40 | next | SpringUrlRedirect.java:842:23:842:50 | getParameter(...) : String | SpringUrlRedirect.java:844:37:844:40 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:842:23:842:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:862:33:862:60 | switchRedirect(...) | SpringUrlRedirect.java:861:23:861:50 | getParameter(...) : String | SpringUrlRedirect.java:862:33:862:60 | switchRedirect(...) | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:861:23:861:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:892:21:892:24 | next | SpringUrlRedirect.java:890:23:890:50 | getParameter(...) : String | SpringUrlRedirect.java:892:21:892:24 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:890:23:890:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:901:22:901:25 | next | SpringUrlRedirect.java:898:23:898:50 | getParameter(...) : String | SpringUrlRedirect.java:901:22:901:25 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:898:23:898:50 | getParameter(...) | user-provided value |
+| SpringUrlRedirect.java:909:21:909:24 | next | SpringUrlRedirect.java:907:23:907:50 | getParameter(...) : String | SpringUrlRedirect.java:909:21:909:24 | next | Untrusted URL redirection depends on a $@. | SpringUrlRedirect.java:907:23:907:50 | getParameter(...) | user-provided value |
 | UrlRedirect2.java:27:25:27:54 | getParameter(...) | UrlRedirect2.java:27:25:27:54 | getParameter(...) | UrlRedirect2.java:27:25:27:54 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect2.java:27:25:27:54 | getParameter(...) | user-provided value |
 | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | UrlRedirect.java:23:25:23:54 | getParameter(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:23:25:23:54 | getParameter(...) | user-provided value |
 | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | Untrusted URL redirection depends on a $@. | UrlRedirect.java:32:37:32:66 | getParameter(...) | user-provided value |
@@ -30,75 +88,169 @@
 | mad/Test.java:14:22:14:38 | (...)... | mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:22:14:38 | (...)... | Untrusted URL redirection depends on a $@. | mad/Test.java:9:16:9:41 | getParameter(...) | user-provided value |
 edges
 | HostComparisonRedirect.java:9:19:9:54 | new URI(...) : URI | HostComparisonRedirect.java:10:31:10:33 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:9:27:9:53 | getParameter(...) : String | HostComparisonRedirect.java:9:19:9:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:10:31:10:33 | uri : URI | HostComparisonRedirect.java:10:31:10:44 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:9:27:9:53 | getParameter(...) : String | HostComparisonRedirect.java:9:19:9:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:10:31:10:33 | uri : URI | HostComparisonRedirect.java:10:31:10:44 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:51:19:51:54 | new URI(...) : URI | HostComparisonRedirect.java:53:35:53:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:51:27:51:53 | getParameter(...) : String | HostComparisonRedirect.java:51:19:51:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:53:35:53:37 | uri : URI | HostComparisonRedirect.java:53:35:53:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:51:27:51:53 | getParameter(...) : String | HostComparisonRedirect.java:51:19:51:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:53:35:53:37 | uri : URI | HostComparisonRedirect.java:53:35:53:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:58:19:58:54 | new URI(...) : URI | HostComparisonRedirect.java:60:35:60:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:58:27:58:53 | getParameter(...) : String | HostComparisonRedirect.java:58:19:58:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:60:35:60:37 | uri : URI | HostComparisonRedirect.java:60:35:60:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:58:27:58:53 | getParameter(...) : String | HostComparisonRedirect.java:58:19:58:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:60:35:60:37 | uri : URI | HostComparisonRedirect.java:60:35:60:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:69:19:69:54 | new URI(...) : URI | HostComparisonRedirect.java:71:35:71:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:69:27:69:53 | getParameter(...) : String | HostComparisonRedirect.java:69:19:69:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:71:35:71:37 | uri : URI | HostComparisonRedirect.java:71:35:71:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:69:27:69:53 | getParameter(...) : String | HostComparisonRedirect.java:69:19:69:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:71:35:71:37 | uri : URI | HostComparisonRedirect.java:71:35:71:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:85:19:85:54 | new URI(...) : URI | HostComparisonRedirect.java:87:35:87:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:85:27:85:53 | getParameter(...) : String | HostComparisonRedirect.java:85:19:85:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:87:35:87:37 | uri : URI | HostComparisonRedirect.java:87:35:87:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:85:27:85:53 | getParameter(...) : String | HostComparisonRedirect.java:85:19:85:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:87:35:87:37 | uri : URI | HostComparisonRedirect.java:87:35:87:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:93:20:93:55 | new URI(...) : URI | HostComparisonRedirect.java:95:35:95:38 | used : URI | provenance |  |
-| HostComparisonRedirect.java:93:28:93:54 | getParameter(...) : String | HostComparisonRedirect.java:93:20:93:55 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:95:35:95:38 | used : URI | HostComparisonRedirect.java:95:35:95:49 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:93:28:93:54 | getParameter(...) : String | HostComparisonRedirect.java:93:20:93:55 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:95:35:95:38 | used : URI | HostComparisonRedirect.java:95:35:95:49 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:104:19:104:54 | new URI(...) : URI | HostComparisonRedirect.java:106:35:106:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:104:27:104:53 | getParameter(...) : String | HostComparisonRedirect.java:104:19:104:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:106:35:106:37 | uri : URI | HostComparisonRedirect.java:106:35:106:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:104:27:104:53 | getParameter(...) : String | HostComparisonRedirect.java:104:19:104:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:106:35:106:37 | uri : URI | HostComparisonRedirect.java:106:35:106:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:112:20:112:55 | new URI(...) : URI | HostComparisonRedirect.java:114:35:114:38 | used : URI | provenance |  |
-| HostComparisonRedirect.java:112:28:112:54 | getParameter(...) : String | HostComparisonRedirect.java:112:20:112:55 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:114:35:114:38 | used : URI | HostComparisonRedirect.java:114:35:114:49 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:112:28:112:54 | getParameter(...) : String | HostComparisonRedirect.java:112:20:112:55 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:114:35:114:38 | used : URI | HostComparisonRedirect.java:114:35:114:49 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:119:19:119:54 | new URI(...) : URI | HostComparisonRedirect.java:123:35:123:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:119:27:119:53 | getParameter(...) : String | HostComparisonRedirect.java:119:19:119:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:123:35:123:37 | uri : URI | HostComparisonRedirect.java:123:35:123:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:119:27:119:53 | getParameter(...) : String | HostComparisonRedirect.java:119:19:119:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:123:35:123:37 | uri : URI | HostComparisonRedirect.java:123:35:123:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:128:19:128:54 | new URI(...) : URI | HostComparisonRedirect.java:134:35:134:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:128:27:128:53 | getParameter(...) : String | HostComparisonRedirect.java:128:19:128:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:134:35:134:37 | uri : URI | HostComparisonRedirect.java:134:35:134:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:128:27:128:53 | getParameter(...) : String | HostComparisonRedirect.java:128:19:128:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:134:35:134:37 | uri : URI | HostComparisonRedirect.java:134:35:134:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:141:15:141:50 | new URI(...) : URI | HostComparisonRedirect.java:143:35:143:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:141:23:141:49 | getParameter(...) : String | HostComparisonRedirect.java:141:15:141:50 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:143:35:143:37 | uri : URI | HostComparisonRedirect.java:143:35:143:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:141:23:141:49 | getParameter(...) : String | HostComparisonRedirect.java:141:15:141:50 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:143:35:143:37 | uri : URI | HostComparisonRedirect.java:143:35:143:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:148:19:148:54 | new URI(...) : URI | HostComparisonRedirect.java:150:35:150:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:148:27:148:53 | getParameter(...) : String | HostComparisonRedirect.java:148:19:148:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:150:35:150:37 | uri : URI | HostComparisonRedirect.java:150:35:150:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:148:27:148:53 | getParameter(...) : String | HostComparisonRedirect.java:148:19:148:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:150:35:150:37 | uri : URI | HostComparisonRedirect.java:150:35:150:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:155:19:155:54 | new URI(...) : URI | HostComparisonRedirect.java:157:35:157:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:155:27:155:53 | getParameter(...) : String | HostComparisonRedirect.java:155:19:155:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:157:35:157:37 | uri : URI | HostComparisonRedirect.java:157:35:157:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:155:27:155:53 | getParameter(...) : String | HostComparisonRedirect.java:155:19:155:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:157:35:157:37 | uri : URI | HostComparisonRedirect.java:157:35:157:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:178:19:178:54 | new URI(...) : URI | HostComparisonRedirect.java:185:39:185:41 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:178:27:178:53 | getParameter(...) : String | HostComparisonRedirect.java:178:19:178:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:185:39:185:41 | uri : URI | HostComparisonRedirect.java:185:39:185:52 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:178:27:178:53 | getParameter(...) : String | HostComparisonRedirect.java:178:19:178:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:185:39:185:41 | uri : URI | HostComparisonRedirect.java:185:39:185:52 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:224:19:224:54 | new URI(...) : URI | HostComparisonRedirect.java:227:35:227:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:224:27:224:53 | getParameter(...) : String | HostComparisonRedirect.java:224:19:224:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:227:35:227:37 | uri : URI | HostComparisonRedirect.java:227:35:227:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:224:27:224:53 | getParameter(...) : String | HostComparisonRedirect.java:224:19:224:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:227:35:227:37 | uri : URI | HostComparisonRedirect.java:227:35:227:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:240:19:240:54 | new URI(...) : URI | HostComparisonRedirect.java:243:35:243:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:240:27:240:53 | getParameter(...) : String | HostComparisonRedirect.java:240:19:240:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:243:35:243:37 | uri : URI | HostComparisonRedirect.java:243:35:243:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:240:27:240:53 | getParameter(...) : String | HostComparisonRedirect.java:240:19:240:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:243:35:243:37 | uri : URI | HostComparisonRedirect.java:243:35:243:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:248:19:248:54 | new URI(...) : URI | HostComparisonRedirect.java:251:35:251:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:248:27:248:53 | getParameter(...) : String | HostComparisonRedirect.java:248:19:248:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:251:35:251:37 | uri : URI | HostComparisonRedirect.java:251:35:251:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:248:27:248:53 | getParameter(...) : String | HostComparisonRedirect.java:248:19:248:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:251:35:251:37 | uri : URI | HostComparisonRedirect.java:251:35:251:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:273:19:273:54 | new URI(...) : URI | HostComparisonRedirect.java:277:35:277:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:273:27:273:53 | getParameter(...) : String | HostComparisonRedirect.java:273:19:273:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:277:35:277:37 | uri : URI | HostComparisonRedirect.java:277:35:277:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:273:27:273:53 | getParameter(...) : String | HostComparisonRedirect.java:273:19:273:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:277:35:277:37 | uri : URI | HostComparisonRedirect.java:277:35:277:48 | toString(...) | provenance | MaD:12 |
 | HostComparisonRedirect.java:282:19:282:54 | new URI(...) : URI | HostComparisonRedirect.java:286:35:286:37 | uri : URI | provenance |  |
-| HostComparisonRedirect.java:282:27:282:53 | getParameter(...) : String | HostComparisonRedirect.java:282:19:282:54 | new URI(...) : URI | provenance | Src:MaD:6 MaD:8 |
-| HostComparisonRedirect.java:286:35:286:37 | uri : URI | HostComparisonRedirect.java:286:35:286:48 | toString(...) | provenance | MaD:10 |
+| HostComparisonRedirect.java:282:27:282:53 | getParameter(...) : String | HostComparisonRedirect.java:282:19:282:54 | new URI(...) : URI | provenance | Src:MaD:8 MaD:10 |
+| HostComparisonRedirect.java:286:35:286:37 | uri : URI | HostComparisonRedirect.java:286:35:286:48 | toString(...) | provenance | MaD:12 |
 | MicronautUrlRedirect.java:12:39:12:63 | target : String | MicronautUrlRedirect.java:14:49:14:54 | target : String | provenance |  |
-| MicronautUrlRedirect.java:14:49:14:54 | target : String | MicronautUrlRedirect.java:14:38:14:55 | create(...) | provenance | MaD:9 Sink:MaD:2 |
+| MicronautUrlRedirect.java:14:49:14:54 | target : String | MicronautUrlRedirect.java:14:38:14:55 | create(...) | provenance | MaD:11 Sink:MaD:2 |
 | MicronautUrlRedirect.java:27:45:27:69 | target : String | MicronautUrlRedirect.java:28:58:28:63 | target : String | provenance |  |
-| MicronautUrlRedirect.java:28:58:28:63 | target : String | MicronautUrlRedirect.java:28:47:28:64 | create(...) | provenance | MaD:9 Sink:MaD:1 |
+| MicronautUrlRedirect.java:28:58:28:63 | target : String | MicronautUrlRedirect.java:28:47:28:64 | create(...) | provenance | MaD:11 Sink:MaD:1 |
 | MicronautUrlRedirect.java:32:44:32:68 | target : String | MicronautUrlRedirect.java:33:49:33:54 | target : String | provenance |  |
-| MicronautUrlRedirect.java:33:49:33:54 | target : String | MicronautUrlRedirect.java:33:38:33:55 | create(...) | provenance | MaD:9 Sink:MaD:3 |
+| MicronautUrlRedirect.java:33:49:33:54 | target : String | MicronautUrlRedirect.java:33:38:33:55 | create(...) | provenance | MaD:11 Sink:MaD:3 |
 | MicronautUrlRedirect.java:37:45:37:69 | target : String | MicronautUrlRedirect.java:38:58:38:63 | target : String | provenance |  |
-| MicronautUrlRedirect.java:38:58:38:63 | target : String | MicronautUrlRedirect.java:38:47:38:64 | create(...) | provenance | MaD:9 Sink:MaD:4 |
-| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | provenance | Src:MaD:6 MaD:7 |
-| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | provenance | Src:MaD:6  |
+| MicronautUrlRedirect.java:38:58:38:63 | target : String | MicronautUrlRedirect.java:38:47:38:64 | create(...) | provenance | MaD:11 Sink:MaD:4 |
+| SpringUrlRedirect.java:13:31:13:41 | path : String | SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | provenance |  |
+| SpringUrlRedirect.java:42:23:42:50 | getHeader(...) : String | SpringUrlRedirect.java:43:30:43:33 | next | provenance | Src:MaD:7  |
+| SpringUrlRedirect.java:48:23:48:50 | getHeader(...) : String | SpringUrlRedirect.java:49:47:49:50 | next | provenance | Src:MaD:7  |
+| SpringUrlRedirect.java:54:23:54:50 | getHeader(...) : String | SpringUrlRedirect.java:55:33:55:36 | next | provenance | Src:MaD:7  |
+| SpringUrlRedirect.java:60:23:60:50 | getHeader(...) : String | SpringUrlRedirect.java:61:25:61:28 | next : String | provenance | Src:MaD:7  |
+| SpringUrlRedirect.java:61:25:61:28 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | provenance |  |
+| SpringUrlRedirect.java:61:25:61:28 | next : String | SpringUrlRedirect.java:61:16:61:29 | redirect(...) | provenance |  |
+| SpringUrlRedirect.java:66:23:66:50 | getParameter(...) : String | SpringUrlRedirect.java:68:21:68:24 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:74:23:74:50 | getParameter(...) : String | SpringUrlRedirect.java:75:33:75:36 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:188:23:188:50 | getParameter(...) : String | SpringUrlRedirect.java:189:42:189:45 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:189:42:189:45 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | provenance |  |
+| SpringUrlRedirect.java:189:42:189:45 | next : String | SpringUrlRedirect.java:189:33:189:46 | redirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:194:23:194:50 | getParameter(...) : String | SpringUrlRedirect.java:195:42:195:45 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:195:42:195:45 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | provenance |  |
+| SpringUrlRedirect.java:195:42:195:45 | next : String | SpringUrlRedirect.java:195:33:195:46 | redirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:200:23:200:50 | getParameter(...) : String | SpringUrlRedirect.java:201:30:201:33 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:206:23:206:50 | getParameter(...) : String | SpringUrlRedirect.java:207:41:207:44 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:287:23:287:50 | getParameter(...) : String | SpringUrlRedirect.java:288:46:288:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:295:23:295:50 | getParameter(...) : String | SpringUrlRedirect.java:297:21:297:24 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:304:23:304:50 | getParameter(...) : String | SpringUrlRedirect.java:305:60:305:63 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:317:23:317:50 | getParameter(...) : String | SpringUrlRedirect.java:318:33:318:36 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:324:23:324:50 | getParameter(...) : String | SpringUrlRedirect.java:325:47:325:50 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:331:23:331:50 | getParameter(...) : String | SpringUrlRedirect.java:332:42:332:45 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:332:42:332:45 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | provenance |  |
+| SpringUrlRedirect.java:332:42:332:45 | next : String | SpringUrlRedirect.java:332:33:332:46 | redirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:341:23:341:50 | getParameter(...) : String | SpringUrlRedirect.java:342:33:342:36 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:347:23:347:50 | getParameter(...) : String | SpringUrlRedirect.java:348:47:348:50 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:353:23:353:50 | getParameter(...) : String | SpringUrlRedirect.java:354:42:354:45 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:354:42:354:45 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | provenance |  |
+| SpringUrlRedirect.java:354:42:354:45 | next : String | SpringUrlRedirect.java:354:33:354:46 | redirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:359:23:359:50 | getParameter(...) : String | SpringUrlRedirect.java:361:21:361:24 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:367:23:367:50 | getParameter(...) : String | SpringUrlRedirect.java:368:33:368:36 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:376:23:376:50 | getParameter(...) : String | SpringUrlRedirect.java:377:46:377:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:386:23:386:50 | getParameter(...) : String | SpringUrlRedirect.java:387:46:387:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:395:23:395:50 | getParameter(...) : String | SpringUrlRedirect.java:396:46:396:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:404:23:404:50 | getParameter(...) : String | SpringUrlRedirect.java:405:46:405:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:413:23:413:50 | getParameter(...) : String | SpringUrlRedirect.java:414:46:414:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:424:23:424:50 | getParameter(...) : String | SpringUrlRedirect.java:425:46:425:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:424:23:424:50 | getParameter(...) : String | SpringUrlRedirect.java:427:21:427:24 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:447:23:447:50 | getParameter(...) : String | SpringUrlRedirect.java:448:60:448:63 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:461:40:461:50 | path : String | SpringUrlRedirect.java:465:16:465:33 | ... + ... : String | provenance |  |
+| SpringUrlRedirect.java:479:23:479:50 | getParameter(...) : String | SpringUrlRedirect.java:480:46:480:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:500:23:500:50 | getParameter(...) : String | SpringUrlRedirect.java:501:34:501:37 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:501:34:501:37 | next : String | SpringUrlRedirect.java:461:40:461:50 | path : String | provenance |  |
+| SpringUrlRedirect.java:501:34:501:37 | next : String | SpringUrlRedirect.java:501:16:501:51 | branchingRedirect(...) | provenance |  |
+| SpringUrlRedirect.java:506:23:506:50 | getParameter(...) : String | SpringUrlRedirect.java:507:51:507:54 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:507:51:507:54 | next : String | SpringUrlRedirect.java:461:40:461:50 | path : String | provenance |  |
+| SpringUrlRedirect.java:507:51:507:54 | next : String | SpringUrlRedirect.java:507:33:507:68 | branchingRedirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:521:23:521:50 | getHeader(...) : String | SpringUrlRedirect.java:522:16:522:33 | ... + ... : String | provenance | Src:MaD:7  |
+| SpringUrlRedirect.java:522:16:522:33 | ... + ... : String | SpringUrlRedirect.java:547:33:547:66 | internallySourcedRedirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:525:37:525:51 | paths : String[] [[]] : String | SpringUrlRedirect.java:526:30:526:34 | paths : String[] [[]] : String | provenance |  |
+| SpringUrlRedirect.java:526:30:526:34 | paths : String[] [[]] : String | SpringUrlRedirect.java:526:30:526:37 | ...[...] : String | provenance |  |
+| SpringUrlRedirect.java:526:30:526:37 | ...[...] : String | SpringUrlRedirect.java:526:16:526:37 | ... + ... : String | provenance |  |
+| SpringUrlRedirect.java:552:23:552:50 | getParameter(...) : String | SpringUrlRedirect.java:553:57:553:60 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:553:33:553:61 | new ..[] { .. } : String[] [[]] : String | SpringUrlRedirect.java:525:37:525:51 | paths : String[] [[]] : String | provenance |  |
+| SpringUrlRedirect.java:553:33:553:61 | new ..[] { .. } : String[] [[]] : String | SpringUrlRedirect.java:553:33:553:61 | secondRedirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:553:57:553:60 | next : String | SpringUrlRedirect.java:553:33:553:61 | new ..[] { .. } : String[] [[]] : String | provenance |  |
+| SpringUrlRedirect.java:564:23:564:50 | getParameter(...) : String | SpringUrlRedirect.java:565:48:565:51 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:580:23:580:50 | getParameter(...) : String | SpringUrlRedirect.java:581:46:581:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:591:48:591:58 | path : String | SpringUrlRedirect.java:593:20:593:37 | ... + ... : String | provenance |  |
+| SpringUrlRedirect.java:600:23:600:50 | getParameter(...) : String | SpringUrlRedirect.java:601:59:601:62 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:601:59:601:62 | next : String | SpringUrlRedirect.java:591:48:591:58 | path : String | provenance |  |
+| SpringUrlRedirect.java:601:59:601:62 | next : String | SpringUrlRedirect.java:601:33:601:76 | branchingFallbackRedirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:616:23:616:50 | getParameter(...) : String | SpringUrlRedirect.java:617:33:617:36 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:623:23:623:50 | getParameter(...) : String | SpringUrlRedirect.java:624:47:624:50 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:632:26:632:53 | getHeader(...) : String | SpringUrlRedirect.java:633:97:633:103 | referer : String | provenance | Src:MaD:7  |
+| SpringUrlRedirect.java:633:97:633:103 | referer : String | SpringUrlRedirect.java:13:31:13:41 | path : String | provenance |  |
+| SpringUrlRedirect.java:633:97:633:103 | referer : String | SpringUrlRedirect.java:633:88:633:104 | redirect(...) | provenance |  |
+| SpringUrlRedirect.java:638:23:638:50 | getParameter(...) : String | SpringUrlRedirect.java:639:44:639:47 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:644:23:644:50 | getParameter(...) : String | SpringUrlRedirect.java:647:34:647:37 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:656:23:656:50 | getParameter(...) : String | SpringUrlRedirect.java:659:29:659:32 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:659:29:659:32 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | provenance |  |
+| SpringUrlRedirect.java:659:29:659:32 | next : String | SpringUrlRedirect.java:659:20:659:33 | redirect(...) | provenance |  |
+| SpringUrlRedirect.java:668:23:668:50 | getParameter(...) : String | SpringUrlRedirect.java:670:25:670:28 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:673:40:673:50 | next : String | SpringUrlRedirect.java:675:16:675:28 | ... + ... : String | provenance |  |
+| SpringUrlRedirect.java:680:23:680:50 | getParameter(...) : String | SpringUrlRedirect.java:681:51:681:54 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:681:51:681:54 | next : String | SpringUrlRedirect.java:673:40:673:50 | next : String | provenance |  |
+| SpringUrlRedirect.java:681:51:681:54 | next : String | SpringUrlRedirect.java:681:33:681:55 | localPrefixHelper(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:686:23:686:50 | getParameter(...) : String | SpringUrlRedirect.java:688:25:688:28 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:729:23:729:50 | getParameter(...) : String | SpringUrlRedirect.java:731:38:731:41 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:736:23:736:50 | getParameter(...) : String | SpringUrlRedirect.java:738:39:738:42 | host | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:746:23:746:50 | getParameter(...) : String | SpringUrlRedirect.java:747:50:747:53 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:752:23:752:50 | getParameter(...) : String | SpringUrlRedirect.java:754:21:754:24 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:760:23:760:50 | getParameter(...) : String | SpringUrlRedirect.java:761:46:761:49 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:789:23:789:50 | getParameter(...) : String | SpringUrlRedirect.java:790:30:790:33 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:797:23:797:50 | getParameter(...) : String | SpringUrlRedirect.java:799:34:799:37 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:842:23:842:50 | getParameter(...) : String | SpringUrlRedirect.java:844:37:844:40 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:850:37:850:47 | path : String | SpringUrlRedirect.java:851:16:851:30 | switch (...) : String | provenance |  |
+| SpringUrlRedirect.java:861:23:861:50 | getParameter(...) : String | SpringUrlRedirect.java:862:48:862:51 | next : String | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:862:48:862:51 | next : String | SpringUrlRedirect.java:850:37:850:47 | path : String | provenance |  |
+| SpringUrlRedirect.java:862:48:862:51 | next : String | SpringUrlRedirect.java:862:33:862:60 | switchRedirect(...) | provenance | Sink:MaD:6 |
+| SpringUrlRedirect.java:890:23:890:50 | getParameter(...) : String | SpringUrlRedirect.java:892:21:892:24 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:898:23:898:50 | getParameter(...) : String | SpringUrlRedirect.java:901:22:901:25 | next | provenance | Src:MaD:8  |
+| SpringUrlRedirect.java:907:23:907:50 | getParameter(...) : String | SpringUrlRedirect.java:909:21:909:24 | next | provenance | Src:MaD:8  |
+| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | provenance | Src:MaD:8 MaD:9 |
+| UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | provenance | Src:MaD:8  |
 | UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:14 | input : String | provenance |  |
-| UrlRedirect.java:46:10:46:14 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | provenance | MaD:7 |
-| mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:31:14:38 | source(...) : String | provenance | Src:MaD:6  |
+| UrlRedirect.java:46:10:46:14 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | provenance | MaD:9 |
+| mad/Test.java:9:16:9:41 | getParameter(...) : String | mad/Test.java:14:31:14:38 | source(...) : String | provenance | Src:MaD:8  |
 | mad/Test.java:14:31:14:38 | source(...) : String | mad/Test.java:14:22:14:38 | (...)... | provenance | Sink:MaD:5 |
 models
 | 1 | Sink: io.micronaut.http; HttpResponse; true; permanentRedirect; (URI); ; Argument[0]; url-redirection; manual |
@@ -106,11 +258,13 @@ models
 | 3 | Sink: io.micronaut.http; HttpResponse; true; seeOther; (URI); ; Argument[0]; url-redirection; manual |
 | 4 | Sink: io.micronaut.http; HttpResponse; true; temporaryRedirect; (URI); ; Argument[0]; url-redirection; manual |
 | 5 | Sink: org.kohsuke.stapler; HttpResponses; true; redirectTo; (String); ; Argument[0]; url-redirection; ai-manual |
-| 6 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual |
-| 7 | Summary: java.lang; String; false; replaceAll; ; ; Argument[this]; ReturnValue; taint; manual |
-| 8 | Summary: java.net; URI; false; URI; (String); ; Argument[0]; Argument[this]; taint; manual |
-| 9 | Summary: java.net; URI; false; create; ; ; Argument[0]; ReturnValue; taint; manual |
-| 10 | Summary: java.net; URI; false; toString; ; ; Argument[this]; ReturnValue; taint; manual |
+| 6 | Sink: org.springframework.web.servlet; ModelAndView; false; ModelAndView; ; ; Argument[0]; url-forward; manual |
+| 7 | Source: javax.servlet.http; HttpServletRequest; false; getHeader; (String); ; ReturnValue; remote; manual |
+| 8 | Source: javax.servlet; ServletRequest; false; getParameter; (String); ; ReturnValue; remote; manual |
+| 9 | Summary: java.lang; String; false; replaceAll; ; ; Argument[this]; ReturnValue; taint; manual |
+| 10 | Summary: java.net; URI; false; URI; (String); ; Argument[0]; Argument[this]; taint; manual |
+| 11 | Summary: java.net; URI; false; create; ; ; Argument[0]; ReturnValue; taint; manual |
+| 12 | Summary: java.net; URI; false; toString; ; ; Argument[this]; ReturnValue; taint; manual |
 nodes
 | HostComparisonRedirect.java:9:19:9:54 | new URI(...) : URI | semmle.label | new URI(...) : URI |
 | HostComparisonRedirect.java:9:27:9:53 | getParameter(...) : String | semmle.label | getParameter(...) : String |
@@ -200,6 +354,150 @@ nodes
 | MicronautUrlRedirect.java:37:45:37:69 | target : String | semmle.label | target : String |
 | MicronautUrlRedirect.java:38:47:38:64 | create(...) | semmle.label | create(...) |
 | MicronautUrlRedirect.java:38:58:38:63 | target : String | semmle.label | target : String |
+| SpringUrlRedirect.java:13:31:13:41 | path : String | semmle.label | path : String |
+| SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | semmle.label | ... + ... : String |
+| SpringUrlRedirect.java:42:23:42:50 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| SpringUrlRedirect.java:43:30:43:33 | next | semmle.label | next |
+| SpringUrlRedirect.java:48:23:48:50 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| SpringUrlRedirect.java:49:47:49:50 | next | semmle.label | next |
+| SpringUrlRedirect.java:54:23:54:50 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| SpringUrlRedirect.java:55:33:55:36 | next | semmle.label | next |
+| SpringUrlRedirect.java:60:23:60:50 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| SpringUrlRedirect.java:61:16:61:29 | redirect(...) | semmle.label | redirect(...) |
+| SpringUrlRedirect.java:61:25:61:28 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:66:23:66:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:68:21:68:24 | next | semmle.label | next |
+| SpringUrlRedirect.java:74:23:74:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:75:33:75:36 | next | semmle.label | next |
+| SpringUrlRedirect.java:188:23:188:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:189:33:189:46 | redirect(...) | semmle.label | redirect(...) |
+| SpringUrlRedirect.java:189:42:189:45 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:194:23:194:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:195:33:195:46 | redirect(...) | semmle.label | redirect(...) |
+| SpringUrlRedirect.java:195:42:195:45 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:200:23:200:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:201:30:201:33 | next | semmle.label | next |
+| SpringUrlRedirect.java:206:23:206:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:207:41:207:44 | next | semmle.label | next |
+| SpringUrlRedirect.java:287:23:287:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:288:46:288:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:295:23:295:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:297:21:297:24 | next | semmle.label | next |
+| SpringUrlRedirect.java:304:23:304:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:305:60:305:63 | next | semmle.label | next |
+| SpringUrlRedirect.java:317:23:317:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:318:33:318:36 | next | semmle.label | next |
+| SpringUrlRedirect.java:324:23:324:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:325:47:325:50 | next | semmle.label | next |
+| SpringUrlRedirect.java:331:23:331:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:332:33:332:46 | redirect(...) | semmle.label | redirect(...) |
+| SpringUrlRedirect.java:332:42:332:45 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:341:23:341:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:342:33:342:36 | next | semmle.label | next |
+| SpringUrlRedirect.java:347:23:347:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:348:47:348:50 | next | semmle.label | next |
+| SpringUrlRedirect.java:353:23:353:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:354:33:354:46 | redirect(...) | semmle.label | redirect(...) |
+| SpringUrlRedirect.java:354:42:354:45 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:359:23:359:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:361:21:361:24 | next | semmle.label | next |
+| SpringUrlRedirect.java:367:23:367:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:368:33:368:36 | next | semmle.label | next |
+| SpringUrlRedirect.java:376:23:376:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:377:46:377:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:386:23:386:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:387:46:387:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:395:23:395:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:396:46:396:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:404:23:404:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:405:46:405:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:413:23:413:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:414:46:414:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:424:23:424:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:425:46:425:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:427:21:427:24 | next | semmle.label | next |
+| SpringUrlRedirect.java:447:23:447:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:448:60:448:63 | next | semmle.label | next |
+| SpringUrlRedirect.java:461:40:461:50 | path : String | semmle.label | path : String |
+| SpringUrlRedirect.java:465:16:465:33 | ... + ... : String | semmle.label | ... + ... : String |
+| SpringUrlRedirect.java:479:23:479:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:480:46:480:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:500:23:500:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:501:16:501:51 | branchingRedirect(...) | semmle.label | branchingRedirect(...) |
+| SpringUrlRedirect.java:501:34:501:37 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:506:23:506:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:507:33:507:68 | branchingRedirect(...) | semmle.label | branchingRedirect(...) |
+| SpringUrlRedirect.java:507:51:507:54 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:521:23:521:50 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| SpringUrlRedirect.java:522:16:522:33 | ... + ... : String | semmle.label | ... + ... : String |
+| SpringUrlRedirect.java:525:37:525:51 | paths : String[] [[]] : String | semmle.label | paths : String[] [[]] : String |
+| SpringUrlRedirect.java:526:16:526:37 | ... + ... : String | semmle.label | ... + ... : String |
+| SpringUrlRedirect.java:526:30:526:34 | paths : String[] [[]] : String | semmle.label | paths : String[] [[]] : String |
+| SpringUrlRedirect.java:526:30:526:37 | ...[...] : String | semmle.label | ...[...] : String |
+| SpringUrlRedirect.java:547:33:547:66 | internallySourcedRedirect(...) | semmle.label | internallySourcedRedirect(...) |
+| SpringUrlRedirect.java:552:23:552:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:553:33:553:61 | new ..[] { .. } : String[] [[]] : String | semmle.label | new ..[] { .. } : String[] [[]] : String |
+| SpringUrlRedirect.java:553:33:553:61 | secondRedirect(...) | semmle.label | secondRedirect(...) |
+| SpringUrlRedirect.java:553:57:553:60 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:564:23:564:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:565:48:565:51 | next | semmle.label | next |
+| SpringUrlRedirect.java:580:23:580:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:581:46:581:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:591:48:591:58 | path : String | semmle.label | path : String |
+| SpringUrlRedirect.java:593:20:593:37 | ... + ... : String | semmle.label | ... + ... : String |
+| SpringUrlRedirect.java:600:23:600:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:601:33:601:76 | branchingFallbackRedirect(...) | semmle.label | branchingFallbackRedirect(...) |
+| SpringUrlRedirect.java:601:59:601:62 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:616:23:616:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:617:33:617:36 | next | semmle.label | next |
+| SpringUrlRedirect.java:623:23:623:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:624:47:624:50 | next | semmle.label | next |
+| SpringUrlRedirect.java:632:26:632:53 | getHeader(...) : String | semmle.label | getHeader(...) : String |
+| SpringUrlRedirect.java:633:88:633:104 | redirect(...) | semmle.label | redirect(...) |
+| SpringUrlRedirect.java:633:97:633:103 | referer : String | semmle.label | referer : String |
+| SpringUrlRedirect.java:638:23:638:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:639:44:639:47 | next | semmle.label | next |
+| SpringUrlRedirect.java:644:23:644:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:647:34:647:37 | next | semmle.label | next |
+| SpringUrlRedirect.java:656:23:656:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:659:20:659:33 | redirect(...) | semmle.label | redirect(...) |
+| SpringUrlRedirect.java:659:29:659:32 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:668:23:668:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:670:25:670:28 | next | semmle.label | next |
+| SpringUrlRedirect.java:673:40:673:50 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:675:16:675:28 | ... + ... : String | semmle.label | ... + ... : String |
+| SpringUrlRedirect.java:680:23:680:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:681:33:681:55 | localPrefixHelper(...) | semmle.label | localPrefixHelper(...) |
+| SpringUrlRedirect.java:681:51:681:54 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:686:23:686:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:688:25:688:28 | next | semmle.label | next |
+| SpringUrlRedirect.java:729:23:729:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:731:38:731:41 | next | semmle.label | next |
+| SpringUrlRedirect.java:736:23:736:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:738:39:738:42 | host | semmle.label | host |
+| SpringUrlRedirect.java:746:23:746:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:747:50:747:53 | next | semmle.label | next |
+| SpringUrlRedirect.java:752:23:752:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:754:21:754:24 | next | semmle.label | next |
+| SpringUrlRedirect.java:760:23:760:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:761:46:761:49 | next | semmle.label | next |
+| SpringUrlRedirect.java:789:23:789:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:790:30:790:33 | next | semmle.label | next |
+| SpringUrlRedirect.java:797:23:797:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:799:34:799:37 | next | semmle.label | next |
+| SpringUrlRedirect.java:842:23:842:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:844:37:844:40 | next | semmle.label | next |
+| SpringUrlRedirect.java:850:37:850:47 | path : String | semmle.label | path : String |
+| SpringUrlRedirect.java:851:16:851:30 | switch (...) : String | semmle.label | switch (...) : String |
+| SpringUrlRedirect.java:861:23:861:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:862:33:862:60 | switchRedirect(...) | semmle.label | switchRedirect(...) |
+| SpringUrlRedirect.java:862:48:862:51 | next : String | semmle.label | next : String |
+| SpringUrlRedirect.java:890:23:890:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:892:21:892:24 | next | semmle.label | next |
+| SpringUrlRedirect.java:898:23:898:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:901:22:901:25 | next | semmle.label | next |
+| SpringUrlRedirect.java:907:23:907:50 | getParameter(...) : String | semmle.label | getParameter(...) : String |
+| SpringUrlRedirect.java:909:21:909:24 | next | semmle.label | next |
 | UrlRedirect2.java:27:25:27:54 | getParameter(...) | semmle.label | getParameter(...) |
 | UrlRedirect.java:23:25:23:54 | getParameter(...) | semmle.label | getParameter(...) |
 | UrlRedirect.java:32:25:32:67 | weakCleanup(...) | semmle.label | weakCleanup(...) |
@@ -213,4 +511,17 @@ nodes
 | mad/Test.java:14:22:14:38 | (...)... | semmle.label | (...)... |
 | mad/Test.java:14:31:14:38 | source(...) : String | semmle.label | source(...) : String |
 subpaths
+| SpringUrlRedirect.java:61:25:61:28 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | SpringUrlRedirect.java:61:16:61:29 | redirect(...) |
+| SpringUrlRedirect.java:189:42:189:45 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | SpringUrlRedirect.java:189:33:189:46 | redirect(...) |
+| SpringUrlRedirect.java:195:42:195:45 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | SpringUrlRedirect.java:195:33:195:46 | redirect(...) |
+| SpringUrlRedirect.java:332:42:332:45 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | SpringUrlRedirect.java:332:33:332:46 | redirect(...) |
+| SpringUrlRedirect.java:354:42:354:45 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | SpringUrlRedirect.java:354:33:354:46 | redirect(...) |
+| SpringUrlRedirect.java:501:34:501:37 | next : String | SpringUrlRedirect.java:461:40:461:50 | path : String | SpringUrlRedirect.java:465:16:465:33 | ... + ... : String | SpringUrlRedirect.java:501:16:501:51 | branchingRedirect(...) |
+| SpringUrlRedirect.java:507:51:507:54 | next : String | SpringUrlRedirect.java:461:40:461:50 | path : String | SpringUrlRedirect.java:465:16:465:33 | ... + ... : String | SpringUrlRedirect.java:507:33:507:68 | branchingRedirect(...) |
+| SpringUrlRedirect.java:553:33:553:61 | new ..[] { .. } : String[] [[]] : String | SpringUrlRedirect.java:525:37:525:51 | paths : String[] [[]] : String | SpringUrlRedirect.java:526:16:526:37 | ... + ... : String | SpringUrlRedirect.java:553:33:553:61 | secondRedirect(...) |
+| SpringUrlRedirect.java:601:59:601:62 | next : String | SpringUrlRedirect.java:591:48:591:58 | path : String | SpringUrlRedirect.java:593:20:593:37 | ... + ... : String | SpringUrlRedirect.java:601:33:601:76 | branchingFallbackRedirect(...) |
+| SpringUrlRedirect.java:633:97:633:103 | referer : String | SpringUrlRedirect.java:13:31:13:41 | path : String | SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | SpringUrlRedirect.java:633:88:633:104 | redirect(...) |
+| SpringUrlRedirect.java:659:29:659:32 | next : String | SpringUrlRedirect.java:13:31:13:41 | path : String | SpringUrlRedirect.java:14:16:14:33 | ... + ... : String | SpringUrlRedirect.java:659:20:659:33 | redirect(...) |
+| SpringUrlRedirect.java:681:51:681:54 | next : String | SpringUrlRedirect.java:673:40:673:50 | next : String | SpringUrlRedirect.java:675:16:675:28 | ... + ... : String | SpringUrlRedirect.java:681:33:681:55 | localPrefixHelper(...) |
+| SpringUrlRedirect.java:862:48:862:51 | next : String | SpringUrlRedirect.java:850:37:850:47 | path : String | SpringUrlRedirect.java:851:16:851:30 | switch (...) : String | SpringUrlRedirect.java:862:33:862:60 | switchRedirect(...) |
 | UrlRedirect.java:32:37:32:66 | getParameter(...) : String | UrlRedirect.java:45:28:45:39 | input : String | UrlRedirect.java:46:10:46:40 | replaceAll(...) : String | UrlRedirect.java:32:25:32:67 | weakCleanup(...) |
diff --git a/java/ql/test/query-tests/security/CWE-601/semmle/tests/options b/java/ql/test/query-tests/security/CWE-601/semmle/tests/options
index e0a964b29dc4..40aeb909d3fa 100644
--- a/java/ql/test/query-tests/security/CWE-601/semmle/tests/options
+++ b/java/ql/test/query-tests/security/CWE-601/semmle/tests/options
@@ -1 +1 @@
-//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/micronaut-4.x:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/stapler-1.263:${testdir}/../../../../../stubs/javax-servlet-2.5:${testdir}/../../../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../../../stubs/saxon-xqj-9.x:${testdir}/../../../../../stubs/apache-commons-beanutils:${testdir}/../../../../../stubs/dom4j-2.1.1:${testdir}/../../../../../stubs/apache-commons-lang:${testdir}/../../../../../stubs/jaxen-1.2.0
+//semmle-extractor-options: --javac-args -cp ${testdir}/../../../../../stubs/micronaut-4.x:${testdir}/../../../../../stubs/servlet-api-2.4:${testdir}/../../../../../stubs/stapler-1.263:${testdir}/../../../../../stubs/javax-servlet-2.5:${testdir}/../../../../../stubs/apache-commons-jelly-1.0.1:${testdir}/../../../../../stubs/apache-commons-fileupload-1.4:${testdir}/../../../../../stubs/saxon-xqj-9.x:${testdir}/../../../../../stubs/apache-commons-beanutils:${testdir}/../../../../../stubs/dom4j-2.1.1:${testdir}/../../../../../stubs/apache-commons-lang:${testdir}/../../../../../stubs/jaxen-1.2.0:${testdir}/../../../../../stubs/springframework-5.8.x --release 17
diff --git a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/servlet/view/AbstractUrlBasedView.java b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/servlet/view/AbstractUrlBasedView.java
index 9efd87af12f3..8c948a8a4ce7 100644
--- a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/servlet/view/AbstractUrlBasedView.java
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/servlet/view/AbstractUrlBasedView.java
@@ -3,7 +3,7 @@
 import java.util.Locale;
 import org.springframework.lang.Nullable;
 
-public abstract class AbstractUrlBasedView {
+public abstract class AbstractUrlBasedView extends AbstractView {
     @Nullable
     private String url;
 
diff --git a/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/servlet/view/AbstractView.java b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/servlet/view/AbstractView.java
new file mode 100644
index 000000000000..5c632428601e
--- /dev/null
+++ b/java/ql/test/stubs/springframework-5.8.x/org/springframework/web/servlet/view/AbstractView.java
@@ -0,0 +1,11 @@
+package org.springframework.web.servlet.view;
+
+import java.util.Map;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import org.springframework.web.servlet.View;
+
+public abstract class AbstractView implements View {
+    @Override
+    public void render(Map<String, ?> model, HttpServletRequest request, HttpServletResponse response) throws Exception { }
+}