Find server-side template injection

Finds calls that put HTTP request input into the text of a server-side template. A template engine evaluates the expressions in its template text, so an attacker who controls that text can run expressions on the server, and in FreeMarker and Velocity this can lead to running arbitrary code. The calls searched are FreeMarker new Template(..) and StringTemplateLoader.putTemplate(..), Velocity evaluate(..), parse(..) and StringResourceRepository.putStringResource(..), Handlebars.java compileInline(..), JMustache Mustache.Compiler.compile(..) and mustache.java MustacheFactory.compile(Reader, ..); only their template text argument is checked. Request input is what servlet and Spring WebRequest accessors return, a Reader built from it, and Spring MVC handler parameters annotated with @RequestParam, @PathVariable, @RequestHeader, @RequestBody, @RequestPart, @CookieValue or @MatrixVariable, unless they are numbers, booleans or UUIDs, or an array, collection or Optional of those. Input converted with the parse or valueOf methods of Integer, Long, Double or Boolean, or with UUID.fromString, is no longer followed. Input used as a template name, log tag or data model value is not marked, since the engine does not parse it as template syntax. Thymeleaf is not searched, because whether TemplateEngine.process(..) receives template text depends on how the engine is configured. Known gaps: a concatenation written inside a Reader constructor that is passed straight to the call, as in new Template("t", new StringReader("Hello " + name)), is missed, and a conversion call in an if condition stops following every variable read in that condition. Test sources are not searched.