category minorAnalysis Data passed to the Response constructor is now treated as a sink for js/reflected-xss.