import javax.servlet.http.HttpServletRequest;
import org.apache.commons.lang3.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.ResponseBody;

@Controller
public class UseOfLessTrustedSource {

    @Autowired
    private HttpServletRequest request;

    @GetMapping(value = "bad1")
    public void bad1(HttpServletRequest request) {
        String ip = getClientIP();
        if (!StringUtils.startsWith(ip, "192.168.")) {
            new Exception("ip illegal");
        }
    }

    @GetMapping(value = "bad2")
    public void bad2(HttpServletRequest request) {
        String ip = getClientIP();
        if (!"127.0.0.1".equals(ip)) {
            new Exception("ip illegal");
        }
    }

    @GetMapping(value = "good1")
    @ResponseBody
    public String good1(HttpServletRequest request) {
        String remoteAddr = "";
        if (request != null) {
            remoteAddr = request.getHeader("X-FORWARDED-FOR");
            remoteAddr = remoteAddr.split(",")[remoteAddr.split(",").length - 1]; // good
            if (remoteAddr == null || "".equals(remoteAddr)) {
                remoteAddr = request.getRemoteAddr();
            }
        }
        return remoteAddr;
    }

    protected String getClientIP() {
        String xfHeader = request.getHeader("X-Forwarded-For");
        if (xfHeader == null) {
            return request.getRemoteAddr();
        }
        return xfHeader.split(",")[0];
    }
}
@@ -995,339 +995,339 @@
 ing 
-remoteAddr = %22%22;%0A        if (request != null) %7B%0A            remoteAddr = request.getHeader(%22X-FORWARDED-FOR%22);%0A            remoteAddr = remoteAddr.split(%22,%22)%5BremoteAddr.split(%22,%22).length - 1%5D; // good%0A            if (remoteAddr == null %7C%7C %22%22.equals(remoteAddr)) %7B%0A                remoteAddr = request.getRemoteAddr();%0A            %7D
+ip = request.getHeader(%22X-FORWARDED-FOR%22);%0A        String%5B%5D parts = ip.split(%22,%22);%0A        // Good: if this application runs behind a reverse proxy it may append the real remote IP to the end of any client-supplied X-Forwarded-For header.%0A        ip = parts%5Bparts.length - 1%5D;%0A        if (!StringUtils.startsWith(ip, %22192.168.%22)) %7B
 %0A   
@@ -1335,36 +1335,50 @@
     
-%7D%0A
     
-    return remoteAddr;
+new Exception(%22ip illegal%22);%0A        %7D
 %0A   
@@ -1614,8 +1614,9 @@
 %0A    %7D%0A%7D
+%0A

Update java/ql/src/experimental/Security/CWE/CWE-348/UseOfLessTrustedSource.java