diff --git a/.github/workflows/ci-analyzer-owasp.yaml b/.github/workflows/ci-analyzer-owasp.yaml
index 40a63024a..0d1b424d0 100644
--- a/.github/workflows/ci-analyzer-owasp.yaml
+++ b/.github/workflows/ci-analyzer-owasp.yaml
@@ -21,7 +21,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  EXPECTED_TRACES: 3011
+  EXPECTED_TRACES: 3835
 
 jobs:
   owasp:
diff --git a/core/opentaint-java-querylang/samples/src/main/java/issues/i98/Builder.java b/core/opentaint-java-querylang/samples/src/main/java/issues/i98/Builder.java
new file mode 100644
index 000000000..1430d4819
--- /dev/null
+++ b/core/opentaint-java-querylang/samples/src/main/java/issues/i98/Builder.java
@@ -0,0 +1,9 @@
+package issues.i98;
+
+public class Builder {
+    public void cfg(String key, String value) { }
+
+    public void sink(String taint) { }
+
+    public static String source() { return "oops"; }
+}
diff --git a/core/opentaint-java-querylang/samples/src/main/java/issues/issue98.java b/core/opentaint-java-querylang/samples/src/main/java/issues/issue98.java
new file mode 100644
index 000000000..8eab6b500
--- /dev/null
+++ b/core/opentaint-java-querylang/samples/src/main/java/issues/issue98.java
@@ -0,0 +1,64 @@
+package issues;
+
+import base.RuleSample;
+import base.RuleSet;
+import issues.i98.Builder;
+
+/**
+ * Engine bug: a `pattern-not-inside` whose discriminator-arg metavariable is
+ * narrowed by a sibling `metavariable-pattern` is silently ignored.
+ *
+ * The rule (issue98.yaml):
+ *   - binds `$X` via `pattern-inside: Builder $X = new Builder(); ...`
+ *   - binds `$UNTRUSTED` via the positive sink `$X.sink($UNTRUSTED)`
+ *   - subtracts via `pattern-not-inside: $X.cfg("Content-Type", $V)` plus
+ *     `metavariable-pattern: $V matches "application/json"`
+ *
+ * Every metavariable in the pattern-not-inside is bound: `$X` from
+ * `pattern-inside`, `$V` constrained by `metavariable-pattern`. With the
+ * literal-arg form `pattern-not-inside: $X.cfg("Content-Type",
+ * "application/json")` (no metavariable-pattern) the engine correctly
+ * subtracts the match — this test passes. Replacing the literal arg with a
+ * metavariable + `metavariable-pattern` constraint (the same shape the XSS
+ * rule uses for `$CT_SAFE`) loses the subtraction.
+ *
+ * Expected:
+ *   - PositiveStmtNoCfg fires (no `.cfg` call in scope).
+ *   - NegativeStmtWithCfg is subtracted (`.cfg("Content-Type",
+ *     "application/json")` matches the pattern-not-inside, and
+ *     `metavariable-pattern` accepts the literal).
+ *
+ * Actual: NegativeStmtWithCfg also fires.
+ *
+ * Motivation: matches the `(HttpServletResponse $R).setContentType($CT_SAFE); …`
+ * + `metavariable-pattern: $CT_SAFE ∈ {non-HTML strings}` subtractor in
+ * `servlet-xss-html-response-sinks.yaml` that fails to clear the
+ * `SafeChainedWriterJsonServlet` / `SafeOutputStreamOctetServlet` FPs.
+ */
+@RuleSet("issues/issue98.yaml")
+public abstract class issue98 implements RuleSample {
+    /** No discriminator call in scope — sink should fire. */
+    static class PositiveStmtNoCfg extends issue98 {
+        @Override
+        public void entrypoint() {
+            Builder b = new Builder();
+            b.sink(Builder.source());
+        }
+    }
+
+    /**
+     * Discriminator `b.cfg("Content-Type", "application/json")` is present in
+     * the method body. The pattern-not-inside + metavariable-pattern pair
+     * should subtract this match — but does not. Disabled until the engine
+     * honors metavariable-pattern-narrowed arguments inside
+     * pattern-not-inside.
+     */
+    static class NegativeStmtWithCfg extends issue98 {
+        @Override
+        public void entrypoint() {
+            Builder b = new Builder();
+            b.cfg("Content-Type", "application/json");
+            b.sink(Builder.source());
+        }
+    }
+}
diff --git a/core/opentaint-java-querylang/samples/src/main/resources/issues/issue98.yaml b/core/opentaint-java-querylang/samples/src/main/resources/issues/issue98.yaml
new file mode 100644
index 000000000..9f3d8324f
--- /dev/null
+++ b/core/opentaint-java-querylang/samples/src/main/resources/issues/issue98.yaml
@@ -0,0 +1,30 @@
+rules:
+  - id: i98
+    message: >
+      pattern-not-inside whose discriminator-arg metavariable is narrowed by
+      a sibling metavariable-pattern is silently ignored. Replacing the
+      metavariable with the equivalent literal makes the subtraction work.
+      See issue98.java for the demonstration and the motivating XSS rule
+      context (`servlet-xss-html-response-sinks.yaml` subtractor on
+      `(HttpServletResponse $R).setContentType($CT_SAFE); ...` plus
+      `metavariable-pattern: $CT_SAFE ∈ {non-HTML strings}`).
+    severity: ERROR
+    languages:
+      - java
+    mode: taint
+    pattern-sources:
+      - pattern: source()
+    pattern-sinks:
+      - patterns:
+          - pattern-inside: |
+              $X = new Builder();
+              ...
+          - patterns:
+              - pattern-not-inside: $X.cfg("Content-Type", $V)
+              - metavariable-pattern:
+                  metavariable: $V
+                  patterns:
+                    - pattern-either:
+                        - pattern: '"application/json"'
+          - pattern: $X.sink($UNTRUSTED)
+          - focus-metavariable: $UNTRUSTED
diff --git a/core/opentaint-java-querylang/src/test/kotlin/org/opentaint/semgrep/IssuesTest.kt b/core/opentaint-java-querylang/src/test/kotlin/org/opentaint/semgrep/IssuesTest.kt
index 185fe851c..2ea56a9e8 100644
--- a/core/opentaint-java-querylang/src/test/kotlin/org/opentaint/semgrep/IssuesTest.kt
+++ b/core/opentaint-java-querylang/src/test/kotlin/org/opentaint/semgrep/IssuesTest.kt
@@ -16,6 +16,7 @@ import issues.issue94
 import issues.issue95
 import issues.issue96
 import issues.issue97
+import issues.issue98
 import org.junit.jupiter.api.AfterAll
 import org.junit.jupiter.api.Disabled
 import org.junit.jupiter.api.TestInstance
@@ -105,6 +106,10 @@ class IssuesTest : SampleBasedTest() {
     @Test
     fun `issue 97`() = runTest<issue97>()
 
+    @Test
+    @Disabled // todo: pattern-not-inside ignored when its discriminator metavariable is narrowed by a sibling metavariable-pattern
+    fun `issue 98`() = runTest<issue98>()
+
     @AfterAll
     fun close() {
         closeRunner()
diff --git a/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml b/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml
new file mode 100644
index 000000000..fa20148f0
--- /dev/null
+++ b/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml
@@ -0,0 +1,108 @@
+rules:
+  - id: java-servlet-xss-html-response-sink
+    options:
+      lib: true
+    severity: NOTE
+    message: Direct write of unvalidated user input into a response without safe content type
+    metadata:
+      provenance:
+        - https://github.com/github/codeql/blob/main/java/ql/lib/semmle/code/java/security/XSS.qll
+    languages:
+      - java
+    mode: taint
+
+    # Servlet defaults Content-Type to text/html — writer/OutputStream is XSS
+    # unless setContentType pins non-HTML. Spring sibling for raw HttpServlet handlers.
+
+    pattern-sanitizers:
+      - patterns:
+          - pattern-either:
+              - pattern: Encode.forHtml(..., $UNTRUSTED, ...)
+              - pattern: (PolicyFactory $POLICY).sanitize(..., $UNTRUSTED, ...)
+              - pattern: (AntiSamy $AS).scan(..., $UNTRUSTED, ...)
+              - pattern: JSoup.clean(..., $UNTRUSTED, ...)
+              - pattern: HtmlUtils.htmlEscape(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.text.StringEscapeUtils.escapeHtml3(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.text.StringEscapeUtils.escapeHtml4(..., $UNTRUSTED, ...)
+              - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(..., $UNTRUSTED, ...)
+          - focus-metavariable: $UNTRUSTED
+
+    pattern-sinks:
+      - patterns:
+          - patterns:
+            - pattern-either:
+              - pattern-inside: |
+                  $RETURNTYPE $ENTRYPOINT(..., javax.servlet.http.HttpServletResponse $RESPONSE, ...) {
+                  ...
+                  }
+            - pattern-inside: |
+                  $RETURNTYPE $ENTRYPOINT(..., jakarta.servlet.http.HttpServletResponse $RESPONSE, ...) {
+                  ...
+                  }
+            - metavariable-pattern:
+                metavariable: $ENTRYPOINT
+                pattern-either:
+                  - pattern: doDelete
+                  - pattern: doGet
+                  - pattern: doPost
+                  - pattern: doPut
+                  - pattern: doTrace
+                  - pattern: _jspService
+          - pattern-either:
+              - patterns:
+                - pattern-either:
+                  - pattern-inside: |
+                      $W = (javax.servlet.http.HttpServletResponse $RESPONSE).getWriter(...);
+                      ...
+                  - pattern-inside: |
+                      $W = (jakarta.servlet.http.HttpServletResponse $RESPONSE).getWriter(...);
+                      ...
+                - pattern: |
+                    $W.$WRITE(..., $UNTRUSTED, ...);
+              - patterns:
+                - pattern-either:
+                  - pattern-inside: |
+                      $S = (javax.servlet.http.HttpServletResponse $RESPONSE).getOutputStream(...);
+                      ...
+                  - pattern-inside: |
+                      $S = (jakarta.servlet.http.HttpServletResponse $RESPONSE).getOutputStream(...);
+                      ...
+                - pattern: |
+                    $S.$WRITE(..., $UNTRUSTED, ...);
+              - pattern: (HttpServletResponse $RESPONSE).sendError($CODE, $UNTRUSTED)
+              - pattern: (jakarta.servlet.jsp.JspWriter $W).$WRITE(..., $UNTRUSTED, ...)
+              - pattern: (javax.servlet.jsp.JspWriter $W).$WRITE(..., $UNTRUSTED, ...)
+
+          # $CT_SAFE OUTSIDE quotes binds to the whole string-literal expression;
+          # bare `application/json` can't be used — engine parses `/` `-` as Java operators.
+          - patterns:
+              - pattern-not-inside: |
+                  (HttpServletResponse $RESPONSE).setContentType($CT_SAFE);
+                  ...
+              - metavariable-pattern:
+                  metavariable: $CT_SAFE
+                  patterns:
+                    - pattern-either:
+                        - pattern: '"application/json"'
+                        - pattern: '"application/json;charset=UTF-8"'
+                        - pattern: '"text/plain"'
+                        - pattern: '"application/pdf"'
+                        - pattern: '"application/octet-stream"'
+                        - pattern: '"application/xml"'
+                        - pattern: '"text/xml"'
+                        - pattern: '"image/png"'
+                        - pattern: '"image/jpeg"'
+                        - pattern: '"image/gif"'
+                        # MediaType.X_VALUE constants — dev analyzer constant-folds; kept
+                        # explicit for analyzer-regression / older-build robustness.
+                        - pattern: MediaType.APPLICATION_JSON_VALUE
+                        - pattern: MediaType.TEXT_PLAIN_VALUE
+                        - pattern: MediaType.APPLICATION_PDF_VALUE
+                        - pattern: MediaType.APPLICATION_OCTET_STREAM_VALUE
+                        - pattern: MediaType.APPLICATION_XML_VALUE
+                        - pattern: MediaType.TEXT_XML_VALUE
+                        - pattern: MediaType.IMAGE_PNG_VALUE
+                        - pattern: MediaType.IMAGE_JPEG_VALUE
+                        - pattern: MediaType.IMAGE_GIF_VALUE
+          - focus-metavariable: $UNTRUSTED
diff --git a/rules/ruleset/java/lib/generic/servlet-xss-sinks.yaml b/rules/ruleset/java/lib/generic/servlet-xss-sinks.yaml
index f27ac3b02..a4d375e11 100644
--- a/rules/ruleset/java/lib/generic/servlet-xss-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/servlet-xss-sinks.yaml
@@ -10,34 +10,63 @@ rules:
       - java
     mode: taint
     pattern-sanitizers:
-      - pattern-either:
-          - pattern: Encode.forHtml(...)
-          - pattern: (PolicyFactory $POLICY).sanitize(...)
-          - pattern: (AntiSamy $AS).scan(...)
-          - pattern: JSoup.clean(...)
-          - pattern: HtmlUtils.htmlEscape(...)
-          - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(...)
-          - pattern: org.apache.commons.text.StringEscapeUtils.escapeHtml3(...)
-          - pattern: org.apache.commons.text.StringEscapeUtils.escapeHtml4(...)
-          - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(...)
+      - patterns:
+          - pattern-either:
+              - pattern: Encode.forHtml(..., $UNTRUSTED, ...)
+              - pattern: (PolicyFactory $POLICY).sanitize(..., $UNTRUSTED, ...)
+              - pattern: (AntiSamy $AS).scan(..., $UNTRUSTED, ...)
+              - pattern: JSoup.clean(..., $UNTRUSTED, ...)
+              - pattern: HtmlUtils.htmlEscape(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.text.StringEscapeUtils.escapeHtml3(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.text.StringEscapeUtils.escapeHtml4(..., $UNTRUSTED, ...)
+              - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(..., $UNTRUSTED, ...)
+          - focus-metavariable: $UNTRUSTED
 
     pattern-sinks:
       - patterns:
           - pattern-either:
-              - pattern: |
-                  (HttpServletResponse $RESPONSE).getWriter(...).$WRITE(..., $UNTRUSTED, ...)
-              - pattern: |
-                  (HttpServletResponse $RESPONSE).getOutputStream(...).$WRITE(..., $UNTRUSTED, ...)
-              - pattern: |
-                  (HttpServletResponse $RESPONSE).sendError($CODE, $UNTRUSTED)
-              - pattern: |
-                  (java.io.PrintWriter $WRITER).$WRITE(..., $UNTRUSTED, ...)
-              - pattern: |
-                  (PrintWriter $WRITER).$WRITE(..., $UNTRUSTED, ...)
-              - pattern: |
-                  (javax.servlet.ServletOutputStream $WRITER).$WRITE(..., $UNTRUSTED, ...)
-              - pattern: |
-                  (ServletOutputStream $WRITER).$WRITE(..., $UNTRUSTED, ...)
-              - pattern: |
-                  (jakarta.servlet.jsp.JspWriter $WRITER).$WRITE(..., $UNTRUSTED, ...)
+              - patterns:
+                - patterns:
+                  - pattern-either:
+                    - pattern-inside: |
+                        $RETURNTYPE $ENTRYPOINT(..., javax.servlet.http.HttpServletResponse $RESPONSE, ...) {
+                        ...
+                        }
+                    - pattern-inside: |
+                        $RETURNTYPE $ENTRYPOINT(..., jakarta.servlet.http.HttpServletResponse $RESPONSE, ...) {
+                        ...
+                        }
+                  - metavariable-pattern:
+                      metavariable: $ENTRYPOINT
+                      pattern-either:
+                        - pattern: doDelete
+                        - pattern: doGet
+                        - pattern: doPost
+                        - pattern: doPut
+                        - pattern: doTrace
+                        - pattern: _jspService
+                - patterns:
+                  - pattern-either:
+                    - pattern-inside: |
+                        $W = (javax.servlet.http.HttpServletResponse $RESPONSE).getWriter(...);
+                        ...
+                    - pattern-inside: |
+                        $W = (jakarta.servlet.http.HttpServletResponse $RESPONSE).getWriter(...);
+                        ...
+                  - pattern: |
+                      $W.$WRITE(..., $UNTRUSTED, ...);
+                - patterns:
+                  - pattern-either:
+                    - pattern-inside: |
+                        $S = (javax.servlet.http.HttpServletResponse $RESPONSE).getOutputStream(...);
+                        ...
+                    - pattern-inside: |
+                        $S = (jakarta.servlet.http.HttpServletResponse $RESPONSE).getOutputStream(...);
+                        ...
+                  - pattern: |
+                      $S.$WRITE(..., $UNTRUSTED, ...);
+              - pattern: (HttpServletResponse $RESPONSE).sendError($CODE, $UNTRUSTED)
+              - pattern: (jakarta.servlet.jsp.JspWriter $W).$WRITE(..., $UNTRUSTED, ...)
+              - pattern: (javax.servlet.jsp.JspWriter $W).$WRITE(..., $UNTRUSTED, ...)
           - focus-metavariable: $UNTRUSTED
diff --git a/rules/ruleset/java/lib/spring/spring-xss-html-response-sinks.yaml b/rules/ruleset/java/lib/spring/spring-xss-html-response-sinks.yaml
new file mode 100644
index 000000000..9550f81c3
--- /dev/null
+++ b/rules/ruleset/java/lib/spring/spring-xss-html-response-sinks.yaml
@@ -0,0 +1,510 @@
+rules:
+  - id: spring-xss-html-response-sink
+    options:
+      lib: true
+    severity: NOTE
+    message: Return of unvalidated user input from a Spring handler vulnerable to XSS
+    metadata:
+      provenance:
+        - https://github.com/github/codeql/blob/main/java/ql/lib/semmle/code/java/frameworks/spring/SpringHttp.qll
+    languages:
+      - java
+    mode: taint
+
+    # Branches 1/1b/1c: DEFAULT-DANGEROUS handler returns unless a non-HTML signal subtracts.
+    # Branch 2 (servlet writer): DEFAULT-SAFE — fires only on explicit text/html.
+
+    pattern-sanitizers:
+      # HTML encoders. focus-metavariable scopes sanitization to the encoded argument.
+      - patterns:
+          - pattern-either:
+              - pattern: Encode.forHtml(..., $UNTRUSTED, ...)
+              - pattern: (PolicyFactory $POLICY).sanitize(..., $UNTRUSTED, ...)
+              - pattern: (AntiSamy $AS).scan(..., $UNTRUSTED, ...)
+              - pattern: JSoup.clean(..., $UNTRUSTED, ...)
+              - pattern: HtmlUtils.htmlEscape(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.lang.StringEscapeUtils.escapeHtml(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.text.StringEscapeUtils.escapeHtml3(..., $UNTRUSTED, ...)
+              - pattern: org.apache.commons.text.StringEscapeUtils.escapeHtml4(..., $UNTRUSTED, ...)
+              - pattern: org.owasp.esapi.ESAPI.encoder().encodeForHTML(..., $UNTRUSTED, ...)
+          - focus-metavariable: $UNTRUSTED
+
+
+      # new ResponseEntity(body, headers, status) with non-HTML preset on headers.
+      # Same engine TODO as above (no-op until focus-metavariable on sanitizers lands).
+      - patterns:
+          - pattern-either:
+              - pattern: |
+                  $H.setContentType(MediaType.APPLICATION_JSON);
+                  ...
+                  new ResponseEntity($UNTRUSTED, $H, ...);
+              - pattern: |
+                  $H.setContentType(MediaType.APPLICATION_PDF);
+                  ...
+                  new ResponseEntity($UNTRUSTED, $H, ...);
+              - pattern: |
+                  $H.setContentType(MediaType.APPLICATION_OCTET_STREAM);
+                  ...
+                  new ResponseEntity($UNTRUSTED, $H, ...);
+              - pattern: |
+                  $H.setContentType(MediaType.TEXT_PLAIN);
+                  ...
+                  new ResponseEntity($UNTRUSTED, $H, ...);
+              - pattern: |
+                  $H.setContentType(MediaType.APPLICATION_XML);
+                  ...
+                  new ResponseEntity($UNTRUSTED, $H, ...);
+          - focus-metavariable: $UNTRUSTED
+
+    pattern-sinks:
+      # Branch 1: DEFAULT-DANGEROUS return types. Use pattern-not-inside (not
+      # pattern-not — automata bug SemgrepRuleToAutomata.kt:82-84).
+      - patterns:
+          - metavariable-pattern:
+              metavariable: $ANNOTATION
+              patterns:
+                - pattern-either:
+                    - pattern: GetMapping
+                    - pattern: PostMapping
+                    - pattern: PutMapping
+                    - pattern: PatchMapping
+                    - pattern: DeleteMapping
+                    - pattern: RequestMapping
+          # Body-typed returns feed via `return $UNTRUSTED;`;
+          # DeferredResult<$T> feeds via `$DR.setResult(tainted)` before returning the wrapper.
+          - pattern-either:
+              - patterns:
+                  - pattern-either:
+                      - pattern: |
+                          return ResponseEntity.ok($UNTRUSTED);
+                      - patterns:
+                          - patterns:
+                              - pattern-not-inside: | 
+                                  $X.contentType(MediaType.APPLICATION_JSON);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.contentType(MediaType.APPLICATION_PDF);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.contentType(MediaType.APPLICATION_OCTET_STREAM);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.contentType(MediaType.TEXT_PLAIN);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.contentType(MediaType.APPLICATION_XML);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.contentType(MediaType.IMAGE_PNG);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.contentType(MediaType.IMAGE_JPEG);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.contentType(MediaType.IMAGE_GIF);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", "application/json");
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", "application/pdf");
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", "application/octet-stream");
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", "text/plain");
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", "application/xml");
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", "image/png");
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", "image/jpeg");
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", "image/gif");
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", MediaType.APPLICATION_JSON_VALUE);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", MediaType.APPLICATION_PDF_VALUE);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", MediaType.APPLICATION_OCTET_STREAM_VALUE);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", MediaType.TEXT_PLAIN_VALUE);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", MediaType.APPLICATION_XML_VALUE);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", MediaType.IMAGE_PNG_VALUE);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", MediaType.IMAGE_JPEG_VALUE);
+                                  ...
+                              - pattern-not-inside: | 
+                                  $X.header("Content-Type", MediaType.IMAGE_GIF_VALUE);
+                                  ...
+                          - pattern-either:
+                              - pattern-inside: |
+                                  $X = ResponseEntity.status(...);
+                                  ...
+                              - pattern-inside: |
+                                  $X = ResponseEntity.ok();
+                                  ...
+                              - pattern-inside: |
+                                  $X = ResponseEntity.internalServerError();
+                                  ...
+                              - pattern-inside: |
+                                  $X = ResponseEntity.accepted();
+                                  ...
+                              - pattern-inside: |
+                                  $X = ResponseEntity.badRequest();
+                                  ...
+                              - pattern-inside: |
+                                  $X = ResponseEntity.created(...);
+                                  ...
+                              - pattern-inside: |
+                                  $X = ResponseEntity.unprocessableContent();
+                                  ...
+                              - pattern-inside: |
+                                  $X = ResponseEntity.unprocessableEntity();
+                                  ...
+                          - pattern: |
+                              return $X.body($UNTRUSTED);
+
+                      - patterns:
+                          - patterns:
+                              - pattern-not-inside: |
+                                  $H.setContentType(MediaType.APPLICATION_JSON);
+                                  ...
+                              - pattern-not-inside: |
+                                  $H.setContentType(MediaType.APPLICATION_PDF);
+                                  ...
+                              - pattern-not-inside: |
+                                  $H.setContentType(MediaType.APPLICATION_OCTET_STREAM);
+                                  ...
+                              - pattern-not-inside: |
+                                  $H.setContentType(MediaType.TEXT_PLAIN);
+                                  ...
+                              - pattern-not-inside: |
+                                  $H.setContentType(MediaType.APPLICATION_XML);
+                                  ...
+                              - pattern-not-inside: |
+                                  $H.setContentType(MediaType.IMAGE_PNG);
+                                  ...
+                              - pattern-not-inside: |
+                                  $H.setContentType(MediaType.IMAGE_JPEG);
+                                  ...
+                              - pattern-not-inside: |
+                                  $H.setContentType(MediaType.IMAGE_GIF);
+                                  ...
+                          - pattern-either:
+                              - pattern-inside: |
+                                  $H = new HttpHeaders(...);
+                                  ...
+                          - pattern: |
+                              return new ResponseEntity($UNTRUSTED, $H, ...);
+                  - pattern-either:
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<Object> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<String> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<byte[]> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<Resource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<InputStreamResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<ByteArrayResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<ClassPathResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<FileSystemResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ResponseEntity<UrlResource> $METHOD(...) {
+                            ...
+                          }
+              - patterns:
+                  - pattern-either:
+                      # Type-arg matching is exact at the return position; <String>/<byte[]>
+                      # are discriminators, not placeholders (Stirling-PDF rescan: 42 → 9 FPs).
+
+                      # String return NOT gated by @ResponseBody/@RestController: StringHttpMessageConverter
+                      # negotiates to text/html under browser Accept; @Controller view-name shape doesn't dataflow.
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          String $METHOD(...) {
+                            ...
+                          }
+                      # Bare byte[] / Resource family — converters advertise wildcard, browser
+                      # Accept lifts to text/html. Object excluded (subsumes class returns, FP).
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          byte[] $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          Resource $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          InputStreamResource $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ByteArrayResource $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          ClassPathResource $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          FileSystemResource $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          UrlResource $METHOD(...) {
+                            ...
+                          }
+                      # Raw ResponseEntity is caught by the parameterized branches above —
+                      # raw matches any parameterization at the decl position, so no dedicated branch needed.
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<String> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<byte[]> $METHOD(...) {
+                            ...
+                          }
+                      # CompletableFuture: Spring unwraps and applies converters to the inner value.
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<Object> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<Resource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<InputStreamResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<ByteArrayResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<ClassPathResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<FileSystemResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          CompletableFuture<UrlResource> $METHOD(...) {
+                            ...
+                          }
+                  - pattern: return $UNTRUSTED;
+              - patterns:
+                  - pattern-either:
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<String> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<byte[]> $METHOD(...) {
+                            ...
+                          }
+                      # DeferredResult: same wrapper-unwrap as CompletableFuture.
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<Object> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<Resource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<InputStreamResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<ByteArrayResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<ClassPathResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<FileSystemResource> $METHOD(...) {
+                            ...
+                          }
+                      - pattern-inside: |
+                          @$ANNOTATION(...)
+                          DeferredResult<UrlResource> $METHOD(...) {
+                            ...
+                          }
+                  - pattern: $DR.setResult(..., $UNTRUSTED, ...);
+
+          # image/svg+xml NOT excluded — SVG can host inline <script>.
+
+          # $PRODUCES OUTSIDE quotes binds to whole annotation-arg (string OR MediaType.X_VALUE);
+          # bare `application/json` can't appear — engine parses `/` `-` as Java operators.
+          - patterns:
+              - pattern-not-inside: |
+                  @$ANNOTATION(..., produces = $PRODUCES, ...)
+                  $RETURNTYPE $METHOD(...) { ... }
+              - metavariable-pattern:
+                  metavariable: $PRODUCES
+                  patterns:
+                    - pattern-either:
+                        - pattern: '"application/json"'
+                        - pattern: '"text/plain"'
+                        - pattern: '"application/pdf"'
+                        - pattern: '"application/octet-stream"'
+                        - pattern: '"application/xml"'
+                        - pattern: '"text/xml"'
+                        - pattern: '"image/png"'
+                        - pattern: '"image/jpeg"'
+                        - pattern: '"image/gif"'
+                        - pattern: MediaType.APPLICATION_JSON_VALUE
+                        - pattern: MediaType.TEXT_PLAIN_VALUE
+                        - pattern: MediaType.APPLICATION_PDF_VALUE
+                        - pattern: MediaType.APPLICATION_OCTET_STREAM_VALUE
+                        - pattern: MediaType.APPLICATION_XML_VALUE
+                        - pattern: MediaType.TEXT_XML_VALUE
+                        - pattern: MediaType.IMAGE_PNG_VALUE
+                        - pattern: MediaType.IMAGE_JPEG_VALUE
+                        - pattern: MediaType.IMAGE_GIF_VALUE
+          - focus-metavariable: $UNTRUSTED
+
+      # Branch 1b: explicit HTML/SVG produces= — fires regardless of @RestController
+      # ($PRODUCES_HTML must be a bare metavar at the annotation-arg position).
+      - patterns:
+          - pattern-inside: |
+              @$ANNOTATION(..., produces = $PRODUCES_HTML, ...)
+              $RT $METHOD(...) { ... }
+          - metavariable-pattern:
+              metavariable: $PRODUCES_HTML
+              patterns:
+                - pattern-either:
+                    - pattern: '"text/html"'
+                    - pattern: '"text/html;charset=UTF-8"'
+                    - pattern: '"text/html;charset=utf-8"'
+                    - pattern: '"image/svg+xml"'
+                    - pattern: MediaType.TEXT_HTML_VALUE
+                    - pattern: MediaType.IMAGE_SVG_XML_VALUE
+          - pattern: return $UNTRUSTED;
+          - focus-metavariable: $UNTRUSTED
+
+      # Branch 1c: explicit HTML/SVG on a ResponseEntity builder chain. Sink is the return —
+      # .contentType() overrides the framework default; only MediaType instance constants apply.
+      - patterns:
+          - metavariable-pattern:
+              metavariable: $ANNOTATION
+              patterns:
+                - pattern-either:
+                    - pattern: GetMapping
+                    - pattern: PostMapping
+                    - pattern: PutMapping
+                    - pattern: PatchMapping
+                    - pattern: DeleteMapping
+                    - pattern: RequestMapping
+          - pattern-inside: |
+                @$ANNOTATION(...)
+                $RETURNTYPE $METHOD(...) {
+                  ...
+                }
+          - pattern-either:
+              - pattern: return $X.contentType(MediaType.TEXT_HTML).body($UNTRUSTED);
+              - pattern: return $X.contentType(MediaType.IMAGE_SVG_XML).body($UNTRUSTED);
+          - focus-metavariable: $UNTRUSTED
+
+      # Branch 2: servlet writer — DEFAULT-SAFE; fires only on explicit text/html
+      # via setContentType / setHeader / addHeader.
+
+      # $CT_HTML INSIDE quotes ("$CT_HTML") binds to literal contents (OUTSIDE is silently
+      # ignored). Writer-call arities are split (engine issue 99 — name-metavar intersection).
+      - patterns:
+          - pattern-either:
+              - pattern: |
+                  (HttpServletResponse $R).setContentType("$CT_HTML");
+                  ...
+                  $W = (HttpServletResponse $R).getWriter(...);
+                  ...
+                  $W.$WRITE(..., $UNTRUSTED, ...);
+              - pattern: |
+                  (HttpServletResponse $R).setHeader("Content-Type", "$CT_HTML");
+                  ...
+                  $W = (HttpServletResponse $R).getWriter(...);
+                  ...
+                  $W.$WRITE(..., $UNTRUSTED, ...);
+              - pattern: |
+                  (HttpServletResponse $R).addHeader("Content-Type", "$CT_HTML");
+                  ...
+                  $W = (HttpServletResponse $R).getWriter(...);
+                  ...
+                  $W.$WRITE(..., $UNTRUSTED, ...);
+          - metavariable-regex:
+              metavariable: $CT_HTML
+              regex: '^text/html(\s*;.*)?$'
+          - focus-metavariable: $UNTRUSTED
diff --git a/rules/ruleset/java/lib/spring/spring-xss-sinks.yaml b/rules/ruleset/java/lib/spring/spring-xss-sinks.yaml
index df8b223a3..1a21ef492 100644
--- a/rules/ruleset/java/lib/spring/spring-xss-sinks.yaml
+++ b/rules/ruleset/java/lib/spring/spring-xss-sinks.yaml
@@ -41,7 +41,6 @@ rules:
                       - pattern: PatchMapping
                       - pattern: PostMapping
                       - pattern: PutMapping
-          - pattern: (HttpServletResponse $RESPONSE).sendError($CODE, $UNTRUSTED)
           - pattern: |
               (HttpServletResponse $RESPONSE).getWriter(...).$WRITE(..., $UNTRUSTED, ...)
           - pattern: |
diff --git a/rules/ruleset/java/security/xss.yaml b/rules/ruleset/java/security/xss.yaml
index f4466a91a..62e43612e 100644
--- a/rules/ruleset/java/security/xss.yaml
+++ b/rules/ruleset/java/security/xss.yaml
@@ -1,6 +1,40 @@
 rules:
   - id: xss-in-servlet-app
     severity: ERROR
+    message: >-
+      XSS: writing user input directly to an HTML response. The response content type is set to
+      text/html, making this directly exploitable in a browser.
+    metadata:
+      cwe: CWE-79
+      short-description: Cross-site scripting (XSS) in HTML response
+      full-description: |-
+        Cross-Site Scripting (XSS) is a class of vulnerabilities that allows an attacker to inject malicious
+        client-side code (usually JavaScript) into web pages viewed by other users.
+        This finding is reported at ERROR severity because the servlet explicitly sets
+        the response content type to text/html, confirming that the browser will render the response
+        as HTML and execute any injected scripts.
+
+        To remediate, apply context-appropriate output encoding (e.g., HTML-escape with
+        `StringEscapeUtils.escapeHtml4()` or `HtmlUtils.htmlEscape()`) before writing user input
+        to the response.
+      references:
+        - https://owasp.org/www-community/attacks/xss/
+      provenance:
+        - https://github.com/semgrep/semgrep-rules/blob/develop/java/lang/security/audit/xss/no-direct-response-writer.yaml
+    languages:
+      - java
+    mode: join
+    join:
+      refs:
+        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+          as: untrusted-data
+        - rule: java/lib/generic/servlet-xss-html-response-sinks.yaml#java-servlet-xss-html-response-sink
+          as: sink
+      on:
+        - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
+
+  - id: response-injection-in-servlet-app
+    severity: NOTE
     message: >-
       Potential XSS: writing user input directly to a web page.
     metadata:
@@ -136,6 +170,43 @@ rules:
 
   - id: xss-in-spring-app
     severity: ERROR
+    message: >-
+      XSS: writing user input directly to an HTML response. The response content type is set to
+      text/html, making this directly exploitable in a browser.
+    metadata:
+      cwe: CWE-79
+      short-description: Cross-site scripting (XSS) in HTML response
+      full-description: |-
+        Cross-Site Scripting (XSS) is a class of vulnerabilities that allows an attacker to inject malicious
+        client-side code (usually JavaScript) into web pages viewed by other users.
+        This finding is reported at ERROR severity because the response content type is determined
+        to be text/html, confirming that the browser will render the response as HTML and execute
+        any injected scripts.
+
+        In Spring applications, this occurs when a handler method writes untrusted input
+        directly to HttpServletResponse with an HTML content type, or returns untrusted data
+        from a handler annotated with produces = "text/html".
+
+        To remediate, apply context-appropriate output encoding (e.g., `HtmlUtils.htmlEscape()`)
+        before writing user input to the response.
+      references:
+        - https://owasp.org/www-community/attacks/xss/
+      provenance:
+        - https://github.com/semgrep/semgrep-rules/blob/develop/java/spring/security/injection/tainted-html-string.yaml
+    languages:
+      - java
+    mode: join
+    join:
+      refs:
+        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+          as: untrusted-data
+        - rule: java/lib/spring/spring-xss-html-response-sinks.yaml#spring-xss-html-response-sink
+          as: sink
+      on:
+        - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
+
+  - id: response-injection-in-spring-app
+    severity: NOTE
     message: >-
       Potential XSS: writing user input directly to a web page.
     metadata:
diff --git a/rules/test/src/main/java/security/xss/SafeDtoRestController.java b/rules/test/src/main/java/security/xss/SafeDtoRestController.java
new file mode 100644
index 000000000..6785acd76
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/SafeDtoRestController.java
@@ -0,0 +1,24 @@
+package security.xss;
+
+import org.opentaint.sast.test.util.NegativeRuleSample;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+// @RestController + ResponseEntity<DTO> — Jackson converter serializes as application/json.
+// Suppressed by exact type-arg matching at the method-decl return position.
+@RestController
+public class SafeDtoRestController {
+
+    public static class GreetingDto {
+        public String name;
+        public GreetingDto(String name) { this.name = name; }
+    }
+
+    @GetMapping("/safe-dto")
+    @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+    public ResponseEntity<GreetingDto> safeDto(@RequestParam(required = false, defaultValue = "") String name) {
+        return ResponseEntity.ok(new GreetingDto(name));
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/UnsafeBareBytesController.java b/rules/test/src/main/java/security/xss/UnsafeBareBytesController.java
new file mode 100644
index 000000000..073486730
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/UnsafeBareBytesController.java
@@ -0,0 +1,20 @@
+package security.xss;
+
+import java.nio.charset.StandardCharsets;
+
+import org.opentaint.sast.test.util.PositiveRuleSample;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+// @RestController + bare byte[] return. ByteArrayHttpMessageConverter advertises wildcard,
+// so browser Accept lifts the response to text/html and the inline <script> executes.
+@RestController
+public class UnsafeBareBytesController {
+
+    @GetMapping("/unsafe-bare-bytes")
+    @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+    public byte[] unsafeBareBytes(@RequestParam(required = false, defaultValue = "") String name) {
+        return ("<h1>hi " + name + "</h1>").getBytes(StandardCharsets.UTF_8);
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/UnsafeBareResourceController.java b/rules/test/src/main/java/security/xss/UnsafeBareResourceController.java
new file mode 100644
index 000000000..e37d97144
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/UnsafeBareResourceController.java
@@ -0,0 +1,22 @@
+package security.xss;
+
+import java.nio.charset.StandardCharsets;
+
+import org.opentaint.sast.test.util.PositiveRuleSample;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+// @RestController + bare Resource return. ResourceHttpMessageConverter advertises wildcard;
+// browser Accept ranks text/html first, so the converter writes bytes labeled text/html.
+@RestController
+public class UnsafeBareResourceController {
+
+    @GetMapping("/unsafe-bare-resource")
+    @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+    public Resource unsafeBareResource(@RequestParam(required = false, defaultValue = "") String name) {
+        return new ByteArrayResource(("<h1>hi " + name + "</h1>").getBytes(StandardCharsets.UTF_8));
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/UnsafeHtmlRestController.java b/rules/test/src/main/java/security/xss/UnsafeHtmlRestController.java
new file mode 100644
index 000000000..23b1ba25e
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/UnsafeHtmlRestController.java
@@ -0,0 +1,18 @@
+package security.xss;
+
+import org.opentaint.sast.test.util.PositiveRuleSample;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+// @RestController + explicit produces = "text/html". Branch 1b fires regardless of
+// @RestController — explicit produces overrides Spring's converter default.
+@RestController
+public class UnsafeHtmlRestController {
+
+    @GetMapping(value = "/unsafe-html", produces = "text/html")
+    @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+    public String unsafeHtml(@RequestParam(required = false, defaultValue = "") String name) {
+        return "<h1>Hello, " + name + "!</h1>";
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/UnsafeResponseEntityIsrController.java b/rules/test/src/main/java/security/xss/UnsafeResponseEntityIsrController.java
new file mode 100644
index 000000000..44580d9bb
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/UnsafeResponseEntityIsrController.java
@@ -0,0 +1,24 @@
+package security.xss;
+
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+
+import org.opentaint.sast.test.util.PositiveRuleSample;
+import org.springframework.core.io.InputStreamResource;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+// @RestController + ResponseEntity<InputStreamResource>. Same Resource-family wildcard
+// converter mechanics; the inner stream is served as text/html under browser Accept.
+@RestController
+public class UnsafeResponseEntityIsrController {
+
+    @GetMapping("/unsafe-responseentity-isr")
+    @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+    public ResponseEntity<InputStreamResource> unsafeResponseEntityIsr(@RequestParam(required = false, defaultValue = "") String name) {
+        byte[] bytes = ("<h1>hi " + name + "</h1>").getBytes(StandardCharsets.UTF_8);
+        return ResponseEntity.ok(new InputStreamResource(new ByteArrayInputStream(bytes)));
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/UnsafeResponseEntityRawController.java b/rules/test/src/main/java/security/xss/UnsafeResponseEntityRawController.java
new file mode 100644
index 000000000..3f037796c
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/UnsafeResponseEntityRawController.java
@@ -0,0 +1,20 @@
+package security.xss;
+
+import org.opentaint.sast.test.util.PositiveRuleSample;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+// @RestController + raw ResponseEntity wrapping a String body — caught by the
+// parameterized ResponseEntity<String> pattern (raw matches any parameterization at decl).
+@RestController
+@SuppressWarnings({"rawtypes", "unchecked"})
+public class UnsafeResponseEntityRawController {
+
+    @GetMapping("/unsafe-responseentity-raw")
+    @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+    public ResponseEntity unsafeResponseEntityRaw(@RequestParam(required = false, defaultValue = "") String name) {
+        return ResponseEntity.ok("<h1>hi " + name + "</h1>");
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/UnsafeResponseEntityResourceController.java b/rules/test/src/main/java/security/xss/UnsafeResponseEntityResourceController.java
new file mode 100644
index 000000000..73a1e13b4
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/UnsafeResponseEntityResourceController.java
@@ -0,0 +1,23 @@
+package security.xss;
+
+import java.nio.charset.StandardCharsets;
+
+import org.opentaint.sast.test.util.PositiveRuleSample;
+import org.springframework.core.io.ByteArrayResource;
+import org.springframework.core.io.Resource;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.RestController;
+
+// @RestController + ResponseEntity<Resource>. Same wildcard-converter mechanics as
+// bare Resource — browser Accept ranks text/html first, bytes labeled text/html.
+@RestController
+public class UnsafeResponseEntityResourceController {
+
+    @GetMapping("/unsafe-responseentity-resource")
+    @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+    public ResponseEntity<Resource> unsafeResponseEntityResource(@RequestParam(required = false, defaultValue = "") String name) {
+        return ResponseEntity.ok(new ByteArrayResource(("<h1>hi " + name + "</h1>").getBytes(StandardCharsets.UTF_8)));
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/XssHtmlResponseServletSamples.java b/rules/test/src/main/java/security/xss/XssHtmlResponseServletSamples.java
new file mode 100644
index 000000000..6b6cd1b86
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/XssHtmlResponseServletSamples.java
@@ -0,0 +1,188 @@
+package security.xss;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+
+import javax.servlet.ServletException;
+import javax.servlet.ServletOutputStream;
+import javax.servlet.annotation.WebServlet;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.opentaint.sast.test.util.NegativeRuleSample;
+import org.opentaint.sast.test.util.PositiveRuleSample;
+
+/**
+ * Servlet-based samples for xss-in-servlet-app (ERROR).
+ *
+ * XSS in servlets is ERROR by default because the Servlet spec defaults
+ * to text/html when no content type is set.
+ */
+public class XssHtmlResponseServletSamples {
+
+    // ── Positive: explicit text/html ────────────────────────────────────────
+
+    @WebServlet("/xss-in-servlet-app/unsafe-html-explicit")
+    public static class UnsafeHtmlServlet extends HttpServlet {
+
+        @Override
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            response.setContentType("text/html;charset=UTF-8");
+            PrintWriter out = response.getWriter();
+            String name = request.getParameter("name");
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Positive: no content type (servlet defaults to text/html) ───────────
+
+    @WebServlet("/xss-in-servlet-app/unsafe-no-content-type")
+    public static class UnsafeNoContentTypeServlet extends HttpServlet {
+
+        @Override
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            PrintWriter out = response.getWriter();
+            String name = request.getParameter("name");
+            out.println("Hello, " + name + "!");
+        }
+    }
+
+    // ── Positive: chained getWriter().write() (no local var) ────────────────
+
+    @WebServlet("/xss-in-servlet-app/unsafe-chained-writer")
+    public static class UnsafeChainedWriterServlet extends HttpServlet {
+
+        @Override
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            String name = request.getParameter("name");
+            response.getWriter().println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Positive: chained getOutputStream().write() ─────────────────────────
+
+    @WebServlet("/xss-in-servlet-app/unsafe-chained-output-stream")
+    public static class UnsafeChainedOutputStreamServlet extends HttpServlet {
+
+        @Override
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            String name = request.getParameter("name");
+            response.getOutputStream().write(("<h1>Hello, " + name + "!</h1>").getBytes());
+        }
+    }
+
+    // ── Positive: getOutputStream() local-var assignment ────────────────────
+
+    @WebServlet("/xss-in-servlet-app/unsafe-output-stream-local")
+    public static class UnsafeOutputStreamLocalServlet extends HttpServlet {
+
+        @Override
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            String name = request.getParameter("name");
+            ServletOutputStream out = response.getOutputStream();
+            out.write(("<h1>Hello, " + name + "!</h1>").getBytes());
+        }
+    }
+
+    // ── Positive: sendError(code, message) renders message as text/html ─────
+
+    @WebServlet("/xss-in-servlet-app/unsafe-send-error")
+    public static class UnsafeSendErrorServlet extends HttpServlet {
+
+        @Override
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            String name = request.getParameter("name");
+            response.sendError(400, "Bad input: " + name);
+        }
+    }
+
+    // ── Positive: pre-existing typed PrintWriter local ──────────────────────
+
+    @WebServlet("/xss-in-servlet-app/unsafe-typed-print-writer")
+    public static class UnsafeTypedPrintWriterServlet extends HttpServlet {
+
+        @Override
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            String name = request.getParameter("name");
+            PrintWriter out = obtainWriter(response);
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+
+        private static PrintWriter obtainWriter(HttpServletResponse response) throws IOException {
+            return response.getWriter();
+        }
+    }
+
+    // ── Negative: chained getWriter().write() with JSON content type ────────
+
+    @WebServlet("/xss-in-servlet-app/safe-chained-writer-json")
+    public static class SafeChainedWriterJsonServlet extends HttpServlet {
+
+        @Override
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            response.setContentType("application/json;charset=UTF-8");
+            String name = request.getParameter("name");
+            response.getWriter().println("{\"greeting\": \"Hello, " + name + "\"}");
+        }
+    }
+
+    // ── Negative: getOutputStream() with octet-stream content type ──────────
+
+    @WebServlet("/xss-in-servlet-app/safe-output-stream-octet")
+    public static class SafeOutputStreamOctetServlet extends HttpServlet {
+
+        @Override
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            response.setContentType("application/octet-stream");
+            String name = request.getParameter("name");
+            response.getOutputStream().write(name.getBytes());
+        }
+    }
+
+    // ── Negative: sanitized output ──────────────────────────────────────────
+
+    @WebServlet("/xss-in-servlet-app/safe-html-explicit")
+    public static class SafeHtmlServlet extends HttpServlet {
+
+        @Override
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            response.setContentType("text/html;charset=UTF-8");
+            PrintWriter out = response.getWriter();
+            String name = request.getParameter("name");
+            if (name == null) { name = ""; }
+            String safeName = org.apache.commons.text.StringEscapeUtils.escapeHtml4(name);
+            out.println("<h1>Hello, " + safeName + "!</h1>");
+        }
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/XssHtmlResponseSpringSamples.java b/rules/test/src/main/java/security/xss/XssHtmlResponseSpringSamples.java
new file mode 100644
index 000000000..eb1c49623
--- /dev/null
+++ b/rules/test/src/main/java/security/xss/XssHtmlResponseSpringSamples.java
@@ -0,0 +1,826 @@
+package security.xss;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
+import java.util.concurrent.CompletableFuture;
+
+import javax.servlet.http.HttpServletResponse;
+
+import org.opentaint.sast.test.util.NegativeRuleSample;
+import org.opentaint.sast.test.util.PositiveRuleSample;
+import org.springframework.http.HttpHeaders;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.http.ResponseEntity;
+import org.springframework.stereotype.Controller;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.bind.annotation.ResponseBody;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.context.request.async.DeferredResult;
+import org.springframework.web.util.HtmlUtils;
+
+import java.nio.charset.Charset;
+
+
+/**
+ * Spring MVC samples for xss-in-spring-app (ERROR).
+ *
+ * XSS in Spring is ERROR by default because:
+ * - StringHttpMessageConverter negotiates to text/html for String returns
+ * - Servlet spec defaults to text/html for direct response writers
+ * - ResponseEntity without explicit content type is subject to content sniffing
+ */
+public class XssHtmlResponseSpringSamples {
+
+    // ── String return from @RestController (content negotiation → text/html) ─
+
+    @RestController
+    public static class UnsafeStringReturnController {
+
+        /**
+         * String return from @RestController without produces.
+         * StringHttpMessageConverter negotiates to text/html with browser Accept header.
+         */
+        @GetMapping("/xss-in-spring-app/unsafe-string-return")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String unsafeStringReturn(@RequestParam(required = false) String name) {
+            return "<h1>Hello, " + name + "!</h1>";
+        }
+    }
+
+    // ── ResponseEntity<String> return ───────────────────────────────────────
+
+    @Controller
+    public static class UnsafeResponseEntityStringController {
+
+        /**
+         * ResponseEntity&lt;String&gt; — body goes through StringHttpMessageConverter.
+         */
+        @PostMapping("/xss-in-spring-app/unsafe-response-entity-string")
+        @ResponseBody
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<String> unsafeResponseEntityString(@RequestParam String filename) {
+            String errorMessage = "Conversion failed for " + filename;
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(errorMessage);
+        }
+    }
+
+    // ── Direct response writer with text/html content type ──────────────────
+
+    @Controller
+    public static class UnsafeSetContentTypeController {
+
+        @GetMapping("/xss-in-spring-app/unsafe-html")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void unsafeHtmlGreet(@RequestParam(required = false) String name, HttpServletResponse response) throws IOException {
+            response.setContentType("text/html;charset=UTF-8");
+            PrintWriter out = response.getWriter();
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── setHeader("Content-Type", "text/html") ──────────────────────────────
+
+    @Controller
+    public static class UnsafeSetHeaderController {
+
+        @GetMapping("/xss-in-spring-app/unsafe-set-header")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void unsafeSetHeaderGreet(@RequestParam(required = false) String name, HttpServletResponse response) throws IOException {
+            response.setHeader("Content-Type", "text/html;charset=UTF-8");
+            PrintWriter out = response.getWriter();
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Negative: sanitized HTML output ─────────────────────────────────────
+
+    @Controller
+    public static class SafeHtmlController {
+
+        @GetMapping("/xss-in-spring-app/safe-html")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void safeHtmlGreet(@RequestParam(required = false, defaultValue = "") String name, HttpServletResponse response) throws IOException {
+            response.setContentType("text/html;charset=UTF-8");
+            PrintWriter out = response.getWriter();
+            String safeName = HtmlUtils.htmlEscape(name, "UTF-8");
+            out.println("<h1>Hello, " + safeName + "!</h1>");
+        }
+    }
+
+    // ── ResponseEntity<byte[]> WITH produces = "text/html" — XSS ────────────
+    // Explicit HTML content type forces the browser to render the bytes as
+    // HTML, so untrusted input embedded in those bytes is exploitable.
+    //
+    // Note on ResponseEntity<byte[]> WITHOUT produces: Spring's
+    // ByteArrayHttpMessageConverter defaults to application/octet-stream, so a
+    // raw ResponseEntity<byte[]> response is not rendered as HTML by modern
+    // browsers and is generally not XSS-exploitable in practice. The current
+    // Spring XSS sink rule cannot distinguish the body type and will flag
+    // byte[]-body controllers that reflect untrusted input — this is an
+    // acceptable over-approximation given that any downstream change to the
+    // handler's content type would make the response vulnerable.
+
+    @Controller
+    public static class UnsafeResponseEntityBytesHtmlController {
+
+        @GetMapping(value = "/xss-in-spring-app/unsafe-bytes-html", produces = "text/html")
+        @ResponseBody
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<byte[]> unsafeBytesHtml(@RequestParam String name) {
+            byte[] body = ("<h1>Hello, " + name + "!</h1>").getBytes(Charset.defaultCharset());
+            return ResponseEntity.status(HttpStatus.OK).body(body);
+        }
+    }
+
+    // ── String return WITH produces = "application/json" — NOT XSS ──────────
+
+    @RestController
+    public static class SafeJsonStringReturnController {
+
+        @GetMapping(value = "/xss-in-spring-app/safe-json-string", produces = "application/json")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String safeJsonStringReturn(@RequestParam(required = false, defaultValue = "") String name) {
+            return "{\"name\":\"" + name + "\"}";
+        }
+    }
+
+    // ── Negative: sanitized String return ────────────────────────────────────
+
+    @RestController
+    public static class SafeStringReturnController {
+
+        @GetMapping("/xss-in-spring-app/safe-string-return")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String safeStringReturn(@RequestParam(required = false, defaultValue = "") String name) {
+            String safeName = HtmlUtils.htmlEscape(name, "UTF-8");
+            return "<h1>Hello, " + safeName + "!</h1>";
+        }
+    }
+
+    // ── Row 02: String, produces="text/html" — TP ──────────────────────────
+
+    @RestController
+    public static class Row02StringProducesHtmlController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-02", produces = "text/html")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row02(@RequestParam(required = false, defaultValue = "") String name) {
+            return "<h1>Hello, " + name + "!</h1>";
+        }
+    }
+
+    // ── Row 04: String, produces="text/plain" — FP ─────────────────────────
+
+    @RestController
+    public static class Row04StringProducesTextPlainController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-04", produces = "text/plain")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row04(@RequestParam(required = false, defaultValue = "") String name) {
+            return "Hello, " + name;
+        }
+    }
+
+    // ── Row 05: String, produces="application/pdf" — FP ────────────────────
+
+    @RestController
+    public static class Row05StringProducesPdfController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-05", produces = "application/pdf")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row05(@RequestParam(required = false, defaultValue = "") String name) {
+            return "<h1>Hello, " + name + "!</h1>";
+        }
+    }
+
+    // ── Row 06: String, produces="application/octet-stream" — FP ───────────
+
+    @RestController
+    public static class Row06StringProducesOctetStreamController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-06", produces = "application/octet-stream")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row06(@RequestParam(required = false, defaultValue = "") String name) {
+            return "<h1>Hello, " + name + "!</h1>";
+        }
+    }
+
+    // ── Row 08: ResponseEntity<String>, produces="application/json" — FP ───
+
+    @RestController
+    public static class Row08ResponseEntityStringProducesJsonController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-08", produces = "application/json")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<String> row08(@RequestParam(required = false, defaultValue = "") String name) {
+            return ResponseEntity.ok("{\"name\":\"" + name + "\"}");
+        }
+    }
+
+    // ── Row 09: ResponseEntity<String>.contentType(TEXT_HTML) — TP ─────────
+
+    @RestController
+    public static class Row09ResponseEntityStringContentTypeHtmlController {
+
+        @GetMapping("/xss-in-spring-app/row-09")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<String> row09(@RequestParam(required = false, defaultValue = "") String name) {
+            return ResponseEntity.ok()
+                    .contentType(MediaType.TEXT_HTML)
+                    .body("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 10: ResponseEntity<String>.contentType(APPLICATION_JSON) — FP ──
+    // Empirical browser verdict (Playwright Chromium, Appendix A.2): no XSS
+    // — the response is delivered as Content-Type: application/json,
+    // Chromium does not MIME-sniff JSON to HTML, the injected <script>
+    // is not parsed, alert(1) does not fire. The rule currently lacks a
+    // discriminator for builder-chain content types, so it over-flags
+    // this sample. This FP is the expected behavior until opentaint
+    // gains expression-level sanitizer propagation (see Appendix D).
+
+    @RestController
+    public static class Row10ResponseEntityStringContentTypeJsonController {
+
+        @GetMapping("/xss-in-spring-app/row-10")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<String> row10(@RequestParam(required = false, defaultValue = "") String name) {
+            return ResponseEntity.ok()
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .body("{\"name\":\"" + name + "\"}");
+        }
+    }
+
+    // ── Row 11: ResponseEntity<String>.header("Content-Type","text/html") — TP
+
+    @RestController
+    public static class Row11ResponseEntityStringHeaderHtmlController {
+
+        @GetMapping("/xss-in-spring-app/row-11")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<String> row11(@RequestParam(required = false, defaultValue = "") String name) {
+            return ResponseEntity.ok()
+                    .header("Content-Type", "text/html")
+                    .body("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 12: ResponseEntity<String>.header("Content-Type","application/json") — FP
+    // Empirical browser verdict (Playwright Chromium, Appendix A.2): no
+    // XSS — the builder `.header("Content-Type", "application/json")`
+    // pins the response to application/json; Chromium does not
+    // MIME-sniff it to HTML, alert(1) does not fire. The rule currently
+    // over-flags this because opentaint cannot discriminate builder-
+    // chain non-HTML content types (see Appendix D).
+
+    @RestController
+    public static class Row12ResponseEntityStringHeaderJsonController {
+
+        @GetMapping("/xss-in-spring-app/row-12")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<String> row12(@RequestParam(required = false, defaultValue = "") String name) {
+            return ResponseEntity.ok()
+                    .header("Content-Type", "application/json")
+                    .body("{\"name\":\"" + name + "\"}");
+        }
+    }
+
+    // ── Row 13: new ResponseEntity<>(body, headers, status), HttpHeaders sets JSON — FP
+    // Empirical browser verdict (Playwright Chromium, Appendix A.2): no
+    // XSS — HttpHeaders.setContentType(APPLICATION_JSON) pins the
+    // response content type; Chromium does not MIME-sniff JSON to HTML,
+    // alert(1) does not fire. The rule currently over-flags this because
+    // opentaint cannot track content-type state on a separate HttpHeaders
+    // object passed to the ResponseEntity constructor (see Appendix D).
+
+    @RestController
+    public static class Row13NewResponseEntityHeadersJsonController {
+
+        @GetMapping("/xss-in-spring-app/row-13")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<String> row13(@RequestParam(required = false, defaultValue = "") String name) {
+            HttpHeaders headers = new HttpHeaders();
+            headers.setContentType(MediaType.APPLICATION_JSON);
+            return new ResponseEntity<>("{\"name\":\"" + name + "\"}", headers, HttpStatus.OK);
+        }
+    }
+
+    // ── Row 14: raw ResponseEntity, no contentType — TP ────────────────────
+
+    @RestController
+    @SuppressWarnings({"rawtypes", "unchecked"})
+    public static class Row14RawResponseEntityNoContentTypeController {
+
+        @GetMapping("/xss-in-spring-app/row-14")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity row14(@RequestParam(required = false, defaultValue = "") String name) {
+            return ResponseEntity.ok("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 15: raw ResponseEntity.contentType(APPLICATION_JSON) — FP ─────
+    // Empirical browser verdict (Playwright Chromium, Appendix A.2): no
+    // XSS — raw ResponseEntity with .contentType(APPLICATION_JSON) pins
+    // the response content type; Chromium does not MIME-sniff JSON to
+    // HTML, alert(1) does not fire. The rule currently over-flags this
+    // because opentaint cannot discriminate builder-chain non-HTML
+    // content types (see Appendix D).
+
+    @RestController
+    @SuppressWarnings({"rawtypes", "unchecked"})
+    public static class Row15RawResponseEntityContentTypeJsonController {
+
+        @GetMapping("/xss-in-spring-app/row-15")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity row15(@RequestParam(required = false, defaultValue = "") String name) {
+            return ResponseEntity.ok()
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .body("{\"name\":\"" + name + "\"}");
+        }
+    }
+
+    // ── Row 16: Stirling-PDF ResponseEntity<byte[]> no content type — TP ───
+
+    @RestController
+    public static class Row16StirlingPdfShapeController {
+
+        @GetMapping("/xss-in-spring-app/row-16")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<byte[]> row16(@RequestParam(required = false, defaultValue = "") String filename) {
+            String err = "Conversion failed for " + filename;
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(err.getBytes(StandardCharsets.UTF_8));
+        }
+    }
+
+    // ── Row 18: ResponseEntity<byte[]>.contentType(APPLICATION_PDF) — FP ─
+    // Empirical browser verdict (Playwright Chromium, Appendix A.2): no
+    // XSS — Content-Type: application/pdf triggers a download prompt;
+    // Chromium does not render the bytes inline as HTML, alert(1) does
+    // not fire. The rule currently over-flags this because opentaint
+    // cannot discriminate builder-chain non-HTML content types (see
+    // Appendix D).
+
+    @RestController
+    public static class Row18ResponseEntityBytesContentTypePdfController {
+
+        @GetMapping("/xss-in-spring-app/row-18")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<byte[]> row18(@RequestParam(required = false, defaultValue = "") String name) {
+            byte[] body = ("PDF-1.4% fake for " + name).getBytes(StandardCharsets.UTF_8);
+            return ResponseEntity.ok()
+                    .contentType(MediaType.APPLICATION_PDF)
+                    .body(body);
+        }
+    }
+
+    // ── Row 19: ResponseEntity<byte[]>.contentType(APPLICATION_OCTET_STREAM) — FP
+    // Empirical browser verdict (Playwright Chromium, Appendix A.2): no
+    // XSS — Content-Type: application/octet-stream triggers a download
+    // prompt; Chromium does not render the bytes inline as HTML,
+    // alert(1) does not fire. The rule currently over-flags this because
+    // opentaint cannot discriminate builder-chain non-HTML content types
+    // (see Appendix D).
+
+    @RestController
+    public static class Row19ResponseEntityBytesContentTypeOctetStreamController {
+
+        @GetMapping("/xss-in-spring-app/row-19")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<byte[]> row19(@RequestParam(required = false, defaultValue = "") String name) {
+            byte[] body = ("binary-for-" + name).getBytes(StandardCharsets.UTF_8);
+            return ResponseEntity.ok()
+                    .contentType(MediaType.APPLICATION_OCTET_STREAM)
+                    .body(body);
+        }
+    }
+
+    // ── Row 20: HttpServletResponse.setContentType("application/json") — FP
+
+    @Controller
+    public static class Row20ServletSetContentTypeJsonController {
+
+        @GetMapping("/xss-in-spring-app/row-20")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row20(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.setContentType("application/json");
+            PrintWriter out = response.getWriter();
+            out.print("{\"name\":\"" + name + "\"}");
+        }
+    }
+
+    // ── Row 21: HttpServletResponse.setHeader("Content-Type","application/json") — FP
+
+    @Controller
+    public static class Row21ServletSetHeaderJsonController {
+
+        @GetMapping("/xss-in-spring-app/row-21")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row21(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.setHeader("Content-Type", "application/json");
+            PrintWriter out = response.getWriter();
+            out.print("{\"name\":\"" + name + "\"}");
+        }
+    }
+
+    // ── Row 22: String, produces = MediaType.APPLICATION_JSON_VALUE — FP ───
+    // Empirical browser verdict (Playwright Chromium, Appendix A.2 / E):
+    // no XSS — the handler annotation's produces = APPLICATION_JSON_VALUE
+    // causes Spring to set Content-Type: application/json, Chromium does
+    // not MIME-sniff JSON to HTML, alert(1) does not fire. The rule
+    // excludes this via a pattern-not-inside on the MediaType constant
+    // form of the annotation.
+
+    @RestController
+    public static class Row22StringProducesMediaTypeJsonConstantController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-22", produces = MediaType.APPLICATION_JSON_VALUE)
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row22(@RequestParam(required = false, defaultValue = "") String name) {
+            return "{\"payload\":\"" + name + "\"}";
+        }
+    }
+
+    // ── Row 23: String, produces = MediaType.TEXT_HTML_VALUE — TP ─────────
+    // Empirical browser verdict (Playwright Chromium, Appendix E): XSS
+    // fires — Content-Type: text/html;charset=UTF-8, alert(1) executes.
+    // Rule matches via the handler annotation's pattern-inside (the
+    // MediaType.TEXT_HTML_VALUE constant is NOT in any pattern-not-inside).
+
+    @RestController
+    public static class Row23StringProducesMediaTypeTextHtmlConstantController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-23", produces = MediaType.TEXT_HTML_VALUE)
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row23(@RequestParam(required = false, defaultValue = "") String name) {
+            return "<h1>Hello, " + name + "!</h1>";
+        }
+    }
+
+    // ── Row 24: String, produces = "application/xml" — FP ─────────────────
+    // Empirical browser verdict (Playwright Chromium, Appendix E): no
+    // XSS — Content-Type: application/xml; Chromium renders the response
+    // as an XML document (raw XML source, no script execution), alert(1)
+    // does not fire. The rule excludes this via pattern-not-inside for
+    // application/xml and MediaType.APPLICATION_XML_VALUE.
+
+    @RestController
+    public static class Row24StringProducesApplicationXmlController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-24", produces = "application/xml")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row24(@RequestParam(required = false, defaultValue = "") String name) {
+            return "<note>" + name + "</note>";
+        }
+    }
+
+    // ── Row 25: String, produces = "image/svg+xml" — TP ───────────────────
+    // Empirical browser verdict (Playwright Chromium, Appendix E): XSS
+    // fires — SVG documents loaded as top-level navigation render as
+    // image/svg+xml and can host inline <script> that Chromium executes,
+    // so untrusted input injected into a served SVG body is exploitable.
+    // The rule does NOT exclude image/svg+xml — it correctly fires here.
+
+    @RestController
+    public static class Row25StringProducesSvgController {
+
+        @GetMapping(value = "/xss-in-spring-app/row-25", produces = "image/svg+xml")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row25(@RequestParam(required = false, defaultValue = "") String name) {
+            return "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"200\" height=\"50\">"
+                    + "<text x=\"10\" y=\"20\">" + name + "</text>"
+                    + "</svg>";
+        }
+    }
+
+    // ── Row 27: DeferredResult<String> resolved with tainted data — TP ────
+    // Empirical browser verdict (Playwright Chromium, Appendix E): XSS
+    // fires — Spring resolves the DeferredResult via String content
+    // negotiation against the browser's Accept header, the response lands
+    // on Content-Type: text/html;charset=UTF-8, alert(1) executes.
+
+    @RestController
+    public static class Row27DeferredResultStringController {
+
+        @GetMapping("/xss-in-spring-app/row-27")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public DeferredResult<String> row27(@RequestParam(required = false, defaultValue = "") String name) {
+            DeferredResult<String> result = new DeferredResult<>();
+            result.setResult("<h1>Hello, " + name + "!</h1>");
+            return result;
+        }
+    }
+
+    // ── Row 28: CompletableFuture<String> with tainted data — TP ──────────
+    // Empirical browser verdict (Playwright Chromium, Appendix E): XSS
+    // fires — Spring resolves the future via String content negotiation,
+    // response lands on Content-Type: text/html;charset=UTF-8, alert(1)
+    // executes.
+
+    @RestController
+    public static class Row28CompletableFutureStringController {
+
+        @GetMapping("/xss-in-spring-app/row-28")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public CompletableFuture<String> row28(@RequestParam(required = false, defaultValue = "") String name) {
+            return CompletableFuture.completedFuture("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 30: setContentType("text/html;charset=utf-16") + writer — TP ──
+    // Empirical browser verdict (Playwright Chromium, Appendix E): XSS
+    // fires — Content-Type: text/html;charset=utf-16, Chromium decodes
+    // the body and alert(1) executes. NOTE: the rule's block 2
+    // pattern-inside list enumerates charsets UTF-8 / utf-8 / ISO-8859-1
+    // but NOT utf-16. This sample is therefore an exposed FN — see
+    // Appendix E for the discussion on whether to enumerate all charset
+    // variants or switch to a charset-agnostic regex.
+
+    @Controller
+    public static class Row30ServletSetContentTypeHtmlUtf16Controller {
+
+        @GetMapping("/xss-in-spring-app/row-30")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row30(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.setContentType("text/html;charset=utf-16");
+            PrintWriter out = response.getWriter();
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 31: @RestController + class-level @RequestMapping(produces=JSON) — FP
+    // Class-level @RequestMapping(produces = APPLICATION_JSON_VALUE)
+    // propagates to every handler in the class. The handler reflects
+    // user-controlled data, but Spring sets Content-Type:
+    // application/json; Chromium does not MIME-sniff JSON to HTML,
+    // alert(1) does not fire. The rule's class-level pattern-not-inside
+    // is intended to exclude these. See the engine-limitations comment in
+    // spring-xss-html-response-sinks.yaml — currently this still reports
+    // an FP because pattern-not-inside on annotation arguments is not
+    // honored end-to-end.
+
+    @RestController
+    @org.springframework.web.bind.annotation.RequestMapping(value = "/xss-in-spring-app/row-31", produces = "application/json")
+    public static class Row31RestControllerClassLevelJsonController {
+
+        @GetMapping
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row31(@RequestParam(required = false, defaultValue = "") String name) {
+            return "{\"name\":\"" + name + "\"}";
+        }
+    }
+
+    // ── Row 32: @RestController + class-level @RequestMapping(produces=text/html) — TP
+    // Same class-level inheritance, but produces is text/html — handler
+    // returns are HTML, so reflected user input IS XSS. The rule must
+    // still fire here.
+
+    @RestController
+    @org.springframework.web.bind.annotation.RequestMapping(value = "/xss-in-spring-app/row-32", produces = "text/html")
+    public static class Row32RestControllerClassLevelHtmlController {
+
+        @GetMapping
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row32(@RequestParam(required = false, defaultValue = "") String name) {
+            return "<h1>Hello, " + name + "!</h1>";
+        }
+    }
+
+    // ── Row 34: setHeader("Content-Type", "text/html") + writer + tainted — TP
+    // Reflected XSS through setHeader rather than setContentType.
+    // The rule's pattern-inside list in the writer block enumerates this
+    // form, so the rule fires.
+
+    @org.springframework.stereotype.Controller
+    public static class Row34ServletSetHeaderTextHtmlController {
+
+        @GetMapping("/xss-in-spring-app/row-34")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row34(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.setHeader("Content-Type", "text/html");
+            PrintWriter out = response.getWriter();
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 35: addHeader("Content-Type", "application/json") + writer — FP
+    // addHeader (vs setHeader / setContentType) form for the safe
+    // content-type signal. Currently the writer block's pattern-not-inside
+    // covers addHeader for application/json, so the writer call should
+    // not be flagged. Same pattern-not-inside engine limitation applies as
+    // for setHeader / setContentType.
+
+    @org.springframework.stereotype.Controller
+    public static class Row35ServletAddHeaderJsonController {
+
+        @GetMapping("/xss-in-spring-app/row-35")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row35(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.addHeader("Content-Type", "application/json");
+            PrintWriter out = response.getWriter();
+            out.print("{\"name\":\"" + name + "\"}");
+        }
+    }
+
+    // ── Row 36: assignment-form ResponseEntity safe builder chain — should be FP-free
+    // Same `.contentType(MediaType.APPLICATION_JSON).body(...)` shape as
+    // Row10, but written with an explicit LHS assignment. The
+    // assignment-form sanitizer (pattern: `$RESULT = $X.contentType($CT).body(...);`,
+    // focus-metavariable $RESULT) should sanitize the `result` variable
+    // and the subsequent `return result;` should see clean data.
+
+    @RestController
+    public static class Row36ResponseEntityAssignmentJsonController {
+
+        @GetMapping("/xss-in-spring-app/row-36")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public ResponseEntity<String> row36(@RequestParam(required = false, defaultValue = "") String name) {
+            ResponseEntity<String> result = ResponseEntity.ok()
+                    .contentType(MediaType.APPLICATION_JSON)
+                    .body("{\"name\":\"" + name + "\"}");
+            return result;
+        }
+    }
+
+    // ── Rows 40/41/42/43: @RestController + parameterized return cases ─────
+    // Moved to dedicated `spring-app-tests/` sub-projects so they're
+    // analyzed via Spring dispatch rather than direct method-as-entry:
+    //   - rules/test/spring-app-tests/xss-rest-controller-string-positive
+    //   - rules/test/spring-app-tests/xss-rest-controller-dto-negative
+    //   - rules/test/spring-app-tests/xss-rest-controller-html-positive
+    // Method-as-entry analysis (the default for samples in this file)
+    // does not honor class-level `pattern-not-inside` end-to-end, so
+    // these cases need the SpringTestSample wrapper to reflect what
+    // `opentaint scan` actually produces.
+
+    // ── Row 37: assignment-form servlet writer with safe setContentType
+    // Same shape as Row20, but the writer call is on a separate line and
+    // the data argument is held in a variable. Multi-statement single-
+    // pattern sanitizer should match
+    //   $R.setContentType("application/json"); ... $R.getWriter()....print($UNTRUSTED);
+    // and sanitize $UNTRUSTED at the writer's argument position.
+
+    @org.springframework.stereotype.Controller
+    public static class Row37ServletSetContentTypeJsonAssignmentController {
+
+        @GetMapping("/xss-in-spring-app/row-37")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row37(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.setContentType("application/json");
+            String body = "{\"name\":\"" + name + "\"}";
+            PrintWriter out = response.getWriter();
+            out.print(body);
+        }
+    }
+
+    // ── Row 50: setContentType(MediaType.TEXT_HTML_VALUE) + writer — TP
+    // `setContentType` accepts `String`, so passing the
+    // `MediaType.TEXT_HTML_VALUE` constant (which IS a `String`) is
+    // valid Spring code. Equivalent to `setContentType("text/html")` at
+    // runtime, so reflected user input is XSS-exploitable. The Branch 2
+    // sink alternatives currently only enumerate the bare-string form;
+    // this sample pins the constant-form coverage.
+
+    @org.springframework.stereotype.Controller
+    public static class Row50ServletSetContentTypeHtmlConstantController {
+
+        @GetMapping("/xss-in-spring-app/row-50")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row50(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.setContentType(MediaType.TEXT_HTML_VALUE);
+            PrintWriter out = response.getWriter();
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 51: setHeader("Content-Type", MediaType.TEXT_HTML_VALUE) + writer — TP
+
+    @org.springframework.stereotype.Controller
+    public static class Row51ServletSetHeaderHtmlConstantController {
+
+        @GetMapping("/xss-in-spring-app/row-51")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row51(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.setHeader("Content-Type", MediaType.TEXT_HTML_VALUE);
+            PrintWriter out = response.getWriter();
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 52: addHeader("Content-Type", MediaType.TEXT_HTML_VALUE) + writer — TP
+
+    @org.springframework.stereotype.Controller
+    public static class Row52ServletAddHeaderHtmlConstantController {
+
+        @GetMapping("/xss-in-spring-app/row-52")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public void row52(@RequestParam(required = false, defaultValue = "") String name,
+                          HttpServletResponse response) throws IOException {
+            response.addHeader("Content-Type", MediaType.TEXT_HTML_VALUE);
+            PrintWriter out = response.getWriter();
+            out.println("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 53: Object return + chained `return`-anchored builder + tainted body — TP
+    // Return type `Object` is NOT in Branch 1's default-dangerous
+    // enumeration (String / ResponseEntity<String|byte[]> / etc.) and
+    // there is no `produces=` annotation, so Branch 1 / 1b do not
+    // match this method-decl shape. The builder chain's explicit
+    // `.contentType(MediaType.TEXT_HTML)` is the runtime HTML signal
+    // (it overrides any framework default). Branch 1c is the only
+    // branch that catches this pattern; the sink is the `return`
+    // statement itself, not the bare `.body(...)` call.
+
+    @RestController
+    public static class Row53BuilderChainHtmlObjectReturnController {
+
+        @GetMapping("/xss-in-spring-app/row-53")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public Object row53(@RequestParam(required = false, defaultValue = "") String name) {
+            return ResponseEntity.ok()
+                    .contentType(MediaType.TEXT_HTML)
+                    .body("<h1>Hello, " + name + "!</h1>");
+        }
+    }
+
+    // ── Row 54: Object return + multi-statement (local-var) builder + return — TP
+    // Same default-`produces` case as Row 53, but the entity is built
+    // into a local variable and then returned on a subsequent line.
+    // Pins the multi-statement form of Branch 1c.
+
+    @RestController
+    public static class Row54BuilderChainHtmlMultiStatementController {
+
+        @GetMapping("/xss-in-spring-app/row-54")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public Object row54(@RequestParam(required = false, defaultValue = "") String name) {
+            ResponseEntity<String> entity = ResponseEntity.ok()
+                    .contentType(MediaType.TEXT_HTML)
+                    .body("<h1>Hello, " + name + "!</h1>");
+            return entity;
+        }
+    }
+
+    // ── Row 55: builder-chain HTML entity built but NOT returned — TN
+    // The handler constructs a `ResponseEntity` with
+    // `MediaType.TEXT_HTML` and a tainted body, but the entity is
+    // discarded — the method is `void` and the entity never reaches
+    // the dispatcher. No HTTP response carries the tainted data, so
+    // no XSS. Branch 1c is anchored at the `return` statement, so it
+    // correctly does NOT fire here. (An earlier `.body($UNTRUSTED)`-
+    // anchored Branch 1c would have raised an FP on this sample.)
+
+    @RestController
+    public static class Row55BuilderChainHtmlEntityDiscardedController {
+
+        @GetMapping("/xss-in-spring-app/row-55")
+        @NegativeRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        @SuppressWarnings("unused")
+        public void row55(@RequestParam(required = false, defaultValue = "") String name) {
+            ResponseEntity<String> entity = ResponseEntity.ok()
+                    .contentType(MediaType.TEXT_HTML)
+                    .body("<h1>Hello, " + name + "!</h1>");
+            // `entity` is never returned, never written to the response.
+        }
+    }
+
+    // ── Row 56: plain @Controller + @ResponseBody + String + no produces — TP
+    // Empirical browser verdict (Playwright Chromium, see
+    // `spring-app-tests/xss-in-spring-app-dynamic`): XSS fires —
+    // `@ResponseBody` makes Spring write the return value through
+    // `StringHttpMessageConverter`, which content-negotiates against the
+    // browser's `Accept: text/html` and serves
+    // `Content-Type: text/html;charset=UTF-8`. `alert(1)` executes.
+    //
+    // This is the case the previous rule missed: it had a
+    // `pattern-not-inside @ResponseBody` exclusion on the `String`
+    // return shape under the (incorrect) assumption that `text/plain`
+    // was the converter's default. Removing the exclusion is what makes
+    // this row a true positive.
+
+    @Controller
+    public static class Row56ControllerResponseBodyStringController {
+
+        @GetMapping("/xss-in-spring-app/row-56")
+        @ResponseBody
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "xss-in-spring-app")
+        public String row56(@RequestParam(required = false, defaultValue = "") String name) {
+            return "<h1>Hello, " + name + "!</h1>";
+        }
+    }
+}
diff --git a/rules/test/src/main/java/security/xss/XssServletSamples.java b/rules/test/src/main/java/security/xss/XssServletSamples.java
index 61a11ea7f..be5cd3c41 100644
--- a/rules/test/src/main/java/security/xss/XssServletSamples.java
+++ b/rules/test/src/main/java/security/xss/XssServletSamples.java
@@ -74,4 +74,23 @@ protected void doGet(HttpServletRequest request, HttpServletResponse response)
             out.println("</html>");
         }
     }
+
+    /**
+     * Unsafe servlet with JSON content type — positive for INFO rule.
+     * The ERROR rule should NOT fire (safe content type excludes it).
+     */
+    @WebServlet("/response-injection-in-servlet-app/unsafe-json")
+    public static class UnsafeJsonInfoServlet extends HttpServlet {
+
+        @Override
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "response-injection-in-servlet-app")
+        protected void doGet(HttpServletRequest request, HttpServletResponse response)
+                throws ServletException, IOException {
+
+            response.setContentType("application/json;charset=UTF-8");
+            PrintWriter out = response.getWriter();
+            String name = request.getParameter("name");
+            out.println("{\"greeting\": \"Hello, " + name + "\"}");
+        }
+    }
 }
diff --git a/rules/test/src/main/java/security/xss/XssSpringSamples.java b/rules/test/src/main/java/security/xss/XssSpringSamples.java
index b26eafc6c..64e5beb7d 100644
--- a/rules/test/src/main/java/security/xss/XssSpringSamples.java
+++ b/rules/test/src/main/java/security/xss/XssSpringSamples.java
@@ -2,13 +2,17 @@
 
 import java.io.IOException;
 import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
 
 import javax.servlet.http.HttpServletResponse;
 
 import org.opentaint.sast.test.util.NegativeRuleSample;
 import org.opentaint.sast.test.util.PositiveRuleSample;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.util.HtmlUtils;
 
@@ -71,4 +75,40 @@ public void safeGreet(@RequestParam(required = false, defaultValue = "") String
         }
     }
 
+    @Controller
+    public static class UnsafeNoContentTypeSpringController {
+
+        /**
+         * Spring handler with no explicit content type that writes untrusted data.
+         * Positive for the INFO rule (untrusted data flows to response).
+         * The HTML-context ERROR rule should NOT fire (no HTML evidence).
+         */
+        @GetMapping("/xss-in-spring-app/unsafe-no-content-type")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "response-injection-in-spring-app")
+        public void unsafeNoContentType(@RequestParam(required = false) String name, HttpServletResponse response) throws IOException {
+            PrintWriter out = response.getWriter();
+
+            out.println("Hello, " + name + "!");
+        }
+    }
+
+    /**
+     * Modeled after Stirling-PDF ConvertEmlToPDF.java — a Spring handler that returns
+     * ResponseEntity with user-controlled data in error messages.
+     *
+     * Tests that taint propagates through ResponseEntity builder chains:
+     *   request param → errorMessage string concat → .getBytes() → ResponseEntity.body()  → return
+     */
+    @Controller
+    public static class UnsafeResponseEntityController {
+
+        @PostMapping("/xss-in-spring-app/unsafe-response-entity")
+        @PositiveRuleSample(value = "java/security/xss.yaml", id = "response-injection-in-spring-app")
+        public ResponseEntity<byte[]> unsafeResponseEntity(@RequestParam String filename) {
+            String errorMessage = "Conversion failed for " + filename;
+            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
+                    .body(errorMessage.getBytes(StandardCharsets.UTF_8));
+        }
+    }
+
 }