To be fair they follow up with > A staggering 90% of the call sites do not use any mitigation technique at all. > Another 9% attempt to sanitise input using r

To be fair they follow up with > A staggering 90% of the call sites do not use any mitigation technique at all. > Another 9% attempt to sanitise input using regular expressions. Unfortunately, most of those were not correctly implemented