Add BAD markers to samples

Author: egregius313

java/ql/src/Security/CWE/CWE-078/ExecTaintedEnvironmentName.java

@@ -3,7 +3,8 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) {
     String value = request.getParameter("value");
 
     Map<String, String> env = processBuilder.environment();
-    env.put(attribute, value);
+    // BAD: attr and value are tainted and being added to the environment
+    env.put(attr, value);
 
     processBuilder.start();
 }

java/ql/src/Security/CWE/CWE-078/ExecTaintedEnvironmentValue.java

@@ -2,6 +2,7 @@ public void doGet(HttpServletRequest request, HttpServletResponse response) {
     String path = request.getParameter("path");
 
     Map<String, String> env = processBuilder.environment();
+    // BAD: path is tainted and being added to the environment
     env.put("PATH", path);
 
     processBuilder.start();