False negative in java/unvalidated-url-redirection for Spring MVC redirect view names

I ran into a false negative in the Java URL redirection queries for a common Spring MVC pattern.

`java/unvalidated-url-redirection` does not appear to cover redirects expressed through Spring view names like `return "redirect:" + userControlledValue`, especially when that construction is wrapped in a helper method.

I found this on a public CVE, `CVE-2025-8813`, in `atjiu/pybbs`.

Vulnerable code:

```java
@GetMapping("changeLanguage")
public String changeLanguage(String lang, HttpSession session, HttpServletRequest request) {
String referer = request.getHeader("referer");
if ("zh".equals(lang)) {
session.setAttribute(SessionLocaleResolver.LOCALE_SESSION_ATTRIBUTE_NAME, Locale.SIMPLIFIED_CHINESE);
} else if ("en".equals(lang)) {
session.setAttribute(SessionLocaleResolver.LOCALE_SESSION_ATTRIBUTE_NAME, Locale.US);
}
return StringUtils.isEmpty(referer) ? redirect("/") : redirect(referer);
}
```

```java
protected String redirect(String path) {
return "redirect:" + path;
}
```

This was fixed upstream by removing the user-controlled redirect target:
https://github.com/atjiu/pybbs/commit/edb14ff13e9e05394960ba46c3d31d844ff2deac

My understanding is that the stable query covers servlet-style redirect sinks such as `sendRedirect(...)` and `Location` headers, but not the Spring MVC redirect-by-view-name sink family. In this case the source is straightforward (`request.getHeader("referer")`) and the flow is short, so the gap seems to be sink coverage rather than source modeling.

This pattern is common in practice:

- `return "redirect:" + next`
- `return new ModelAndView("redirect:" + next)`
- `return new RedirectView(next)`
- helper wrappers such as `redirect(next)` in a base controller or utility class

That last form is especially common in real Spring code, so this is not just a one-off CVE shape. I would expect similar misses whenever a project centralizes redirect construction in a helper.

There is already an experimental query, `java/spring-unvalidated-url-redirection`, so this may just be a case where the relevant Spring sink modeling has not made it into the stable query set yet.

A reasonable fix might be to bring the Spring redirect sink coverage into the stable rule family, especially for:

- `"redirect:" + tainted`
- `new ModelAndView("redirect:" + tainted)`
- `new RedirectView(tainted)`
- helper-mediated variants that ultimately construct a Spring redirect view name

首先比较稳定的 java/unvalidated-url-redirection 查询与实验性的 java/spring-unvalidated-url-redirection 查询，重点关注 Spring 重定向视图名称和由辅助函数介导的流程。复现列出的模式，包括 redirect:、ModelAndView 和 RedirectView 形式，并验证用户控制的目标会被报告，而安全的重定向不受影响。

由索引模型根据 Issue 内容生成。