Avoid reflecting servlet request data through response writers
Servlet writers should not emit raw request parameters or headers without encoding or policy checks.
#Metadata
#Why it matters
Writing request-controlled strings directly into HTTP responses is a common reflected XSS vector for servlet stacks.
#Remediation
Contextually encode output for HTML or JSON consumers, validate redirect-like flows separately, and prefer templating APIs that auto-escape.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/java/java.security.reflected-output-from-request.rule.yaml.