Test case 139777

Description

CWE: 470 Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)
BadSource: getQueryString_Servlet Parse id param out of the URL query string (without using getParameter())
GoodSource: Set data to a hardcoded class name
Sinks:
BadSink : Instantiate class named in data
Flow Variant: 21 Control flow: Flow controlled by value of a private variable. All functions contained in one file.