Predicate unprotectedStateChange
Holds if source is an unprotected request handler that may
change an application’s state.
Import path
import semmle.code.java.security.CsrfUnprotectedRequestTypeQuerypredicate unprotectedStateChange(CallPathNode source, CallPathNode sink)