GitHub Security Lab: CodeQL query to detect XSLT injections

This bug was reported directly to GitHub Security Lab...