param is not really part of the bug - if I understand correctly, any argument passed to the these tags will be evaluated twice. So you have to check for message

param is not really part of the bug - if I understand correctly, any argument passed to the these tags will be evaluated twice. So you have to check for message/theme/bind/nestedpath/transform tags and ensure no user-influenced data is fed to it. And if you use a templating engine that uses these tags you'd have to trace whether they are invoked anywhere... So it's not as simple as a grep at all.