Predicate unprotectedStateChange
Holds if source
is an unprotected request handler that may
change an application’s state.
Import path
import semmle.code.java.security.CsrfUnprotectedRequestTypeQuery
predicate unprotectedStateChange(CallPathNode source, CallPathNode sink)