CVE

This query has not been tested against all lgtm projects. So, there is no CVE found using this PR.

Report

This query detects instances where user input is embedded in a template in an unsafe manner.

The PR adds support for multiple Java templating engines. As of now it covers

1. Velocity Templating Engine
2. Freemarker Templating Engine
3. Pebble Templating Engine

I also plan on including the Jinjava Templating Engine

The PR is as of now a WIP. I can't get the unit tests to run properly as the stubs for the libraries are not yet included. I had raised this concern over slack a few days back but I haven't received any responses yet.

Link to the PR:[github/codeql#3353]