Find log injection vulnerabilities

Finds logging statements where HTTP request input flows unsanitized into the log argument, allowing attackers to inject forged log entries via CRLF injection (CWE-117). Sources are servlet request accessors (getParameter, getHeader, getReader, getInputStream, etc.), Spring WebRequest accessors, and Spring MVC handler parameters bound with @RequestParam, @PathVariable, @RequestHeader, @RequestBody, @RequestPart, @CookieValue, or @MatrixVariable. Uses taint analysis so input assigned to a variable, field, or built into a larger string before being logged is also detected.