diff --git a/rules/README.md b/rules/README.md
index 6efed4230e..d06d7bc579 100644
--- a/rules/README.md
+++ b/rules/README.md
@@ -91,31 +91,50 @@ Key points:
 
 Many rules under `ruleset/` combine multiple library rules using **`mode: join`**.
 
+Library rules expose their roles through tags:
+
+```yaml
+- id: java-ssrf-sink
+  options:
+    lib: true
+  tags:
+    - ssrf-sink
+```
+
 Example (from `ruleset/java/security/ssrf.yaml`):
 
 ```yaml
-- id: ssrf-in-servlet-app
+- id: ssrf
   languages:
     - java
   mode: join
   join:
     refs:
-      - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
-        as: untrusted-data
-      - rule: java/lib/generic/ssrf-sinks.yaml#java-ssrf-sink
+      - tag: servlet-untrusted-data-source
+        as: servlet-untrusted-data
+      - tag: spring-untrusted-data-source
+        as: spring-untrusted-data
+      - tag: ssrf-sink
         as: sink
     on:
-      - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
+      - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
+      - 'spring-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
 ```
 
 Semantics:
 
 - `mode: join` derives a composite rule from other rules referenced in `join.refs`.
-- `refs` defines:
-  - `rule`: path to the library rule file plus `#<rule-id>` inside that YAML
-  - `as`: local alias for referencing captures/variables from that rule
-- `on` describes how to correlate matches from referenced rules:
-  - `untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED` expresses a **dataflow relationship** between the `$UNTRUSTED` captured in the source rule and the same `$UNTRUSTED` captured in the sink rule.
+- Each `ref` selects a library rule and assigns a local alias:
+  - `tag` selects every enabled rule with that tag in the join's language. Adding the same tag to a
+    custom rule extends the join.
+  - `rule` selects one rule by `<path>#<rule-id>`.
+  - `as` defines the alias used in `on`.
+- `on` correlates captures from the referenced rules. For example,
+  `servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED` requires dataflow from the source capture
+  to the sink capture.
+
+Built-in joins use language-scoped, per-source and per-sink tags. Use `rule` when a join must
+reference one specific rule.
 
 This join mode is **based on Semgrep's join mode**, but OpenTaint extends it with custom features (such as the `->` notation in the `on` section) to express taint-style flows across multiple rule components.
 
@@ -227,7 +246,8 @@ When introducing or changing rules, follow these guidelines:
    - Add `options.lib: true` for library fragments in `lib/` (or exceptionally in `ruleset/` if they are not meant to be executed directly).
 
 3. **Avoid duplicates**
-   - Reuse existing library rules from `lib/` and compose them via `mode: join` where applicable.
+   - Reuse library rules from `lib/` and compose them with `mode: join` where applicable.
+   - Reference join sources and sinks by `tag`, and tag each new library source or sink.
 
 4. **Update tests**
    - Add at least one `@PositiveRuleSample` (and typically `@NegativeRuleSample`) under `test/src/main/java/security/`.
diff --git a/rules/ruleset/go/lib/cmdi-sinks.yaml b/rules/ruleset/go/lib/cmdi-sinks.yaml
index cb983c17c1..2f500e18e9 100644
--- a/rules/ruleset/go/lib/cmdi-sinks.yaml
+++ b/rules/ruleset/go/lib/cmdi-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: cmdi-sinks
     options:
       lib: true
+    tags:
+      - command-injection-sink
     severity: NOTE
     message: Untrusted data reaches an OS command execution API
     metadata:
diff --git a/rules/ruleset/go/lib/http-sources-header-index.yaml b/rules/ruleset/go/lib/http-sources-header-index.yaml
index e1a666b09e..94da796760 100644
--- a/rules/ruleset/go/lib/http-sources-header-index.yaml
+++ b/rules/ruleset/go/lib/http-sources-header-index.yaml
@@ -2,6 +2,8 @@ rules:
   - id: http-sources-header-index
     options:
       lib: true
+    tags:
+      - beego-header-untrusted-data-source
     severity: NOTE
     message: Untrusted beego request-header value source
     metadata:
diff --git a/rules/ruleset/go/lib/http-sources-requesturi.yaml b/rules/ruleset/go/lib/http-sources-requesturi.yaml
index 804bb7290d..da95f7d879 100644
--- a/rules/ruleset/go/lib/http-sources-requesturi.yaml
+++ b/rules/ruleset/go/lib/http-sources-requesturi.yaml
@@ -2,6 +2,8 @@ rules:
   - id: http-sources-requesturi
     options:
       lib: true
+    tags:
+      - request-uri-untrusted-data-source
     severity: NOTE
     message: Untrusted request URI source
     metadata:
diff --git a/rules/ruleset/go/lib/http-sources.yaml b/rules/ruleset/go/lib/http-sources.yaml
index c3d682b2f9..3ed32986bb 100644
--- a/rules/ruleset/go/lib/http-sources.yaml
+++ b/rules/ruleset/go/lib/http-sources.yaml
@@ -2,6 +2,8 @@ rules:
   - id: http-sources
     options:
       lib: true
+    tags:
+      - http-untrusted-data-source
     severity: NOTE
     message: Untrusted user input originates here
     metadata:
diff --git a/rules/ruleset/go/lib/path-sinks.yaml b/rules/ruleset/go/lib/path-sinks.yaml
index 81fb48a8af..4dadd1bc48 100644
--- a/rules/ruleset/go/lib/path-sinks.yaml
+++ b/rules/ruleset/go/lib/path-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: path-sinks
     options:
       lib: true
+    tags:
+      - path-traversal-sink
     severity: NOTE
     message: Untrusted data reaches a filesystem path API
     metadata:
diff --git a/rules/ruleset/go/lib/sql-sinks.yaml b/rules/ruleset/go/lib/sql-sinks.yaml
index 4a12c3e47b..d721c041f5 100644
--- a/rules/ruleset/go/lib/sql-sinks.yaml
+++ b/rules/ruleset/go/lib/sql-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: sql-sinks
     options:
       lib: true
+    tags:
+      - sqli-sink
     severity: NOTE
     message: Untrusted data reaches a SQL execution API
     metadata:
diff --git a/rules/ruleset/go/lib/ssrf-sinks.yaml b/rules/ruleset/go/lib/ssrf-sinks.yaml
index 7e84962eb2..e1426d3ddf 100644
--- a/rules/ruleset/go/lib/ssrf-sinks.yaml
+++ b/rules/ruleset/go/lib/ssrf-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: ssrf-sinks
     options:
       lib: true
+    tags:
+      - ssrf-sink
     severity: NOTE
     message: Untrusted data reaches an outbound HTTP request API
     metadata:
diff --git a/rules/ruleset/go/lib/ssti-sinks.yaml b/rules/ruleset/go/lib/ssti-sinks.yaml
index 121f2d69d6..7ba59dc243 100644
--- a/rules/ruleset/go/lib/ssti-sinks.yaml
+++ b/rules/ruleset/go/lib/ssti-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: ssti-sinks
     options:
       lib: true
+    tags:
+      - ssti-sink
     severity: NOTE
     message: Untrusted data reaches a template-source parse API
     metadata:
diff --git a/rules/ruleset/go/lib/xss-sinks.yaml b/rules/ruleset/go/lib/xss-sinks.yaml
index bcea2c5bfc..54dea4997a 100644
--- a/rules/ruleset/go/lib/xss-sinks.yaml
+++ b/rules/ruleset/go/lib/xss-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: xss-sinks
     options:
       lib: true
+    tags:
+      - xss-sink
     severity: NOTE
     message: Untrusted data reaches an HTTP response write API
     metadata:
diff --git a/rules/ruleset/go/security/cmdinj.yaml b/rules/ruleset/go/security/cmdinj.yaml
index 2883577f0d..68c2d7b736 100644
--- a/rules/ruleset/go/security/cmdinj.yaml
+++ b/rules/ruleset/go/security/cmdinj.yaml
@@ -53,11 +53,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/http-sources-header-index.yaml#http-sources-header-index
+        - tag: beego-header-untrusted-data-source
           as: extra_header
-        - rule: go/lib/cmdi-sinks.yaml#cmdi-sinks
+        - tag: command-injection-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/go/security/path-traversal.yaml b/rules/ruleset/go/security/path-traversal.yaml
index a25054ab2a..bdd28c7112 100644
--- a/rules/ruleset/go/security/path-traversal.yaml
+++ b/rules/ruleset/go/security/path-traversal.yaml
@@ -53,9 +53,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/path-sinks.yaml#path-sinks
+        - tag: path-traversal-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/go/security/sql-injection.yaml b/rules/ruleset/go/security/sql-injection.yaml
index d2039c8814..b330f5f06f 100644
--- a/rules/ruleset/go/security/sql-injection.yaml
+++ b/rules/ruleset/go/security/sql-injection.yaml
@@ -48,13 +48,13 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/http-sources-requesturi.yaml#http-sources-requesturi
+        - tag: request-uri-untrusted-data-source
           as: extra_requesturi
-        - rule: go/lib/http-sources-header-index.yaml#http-sources-header-index
+        - tag: beego-header-untrusted-data-source
           as: extra_header
-        - rule: go/lib/sql-sinks.yaml#sql-sinks
+        - tag: sqli-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/go/security/ssrf.yaml b/rules/ruleset/go/security/ssrf.yaml
index e47131816d..0dfe246bdf 100644
--- a/rules/ruleset/go/security/ssrf.yaml
+++ b/rules/ruleset/go/security/ssrf.yaml
@@ -55,9 +55,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/ssrf-sinks.yaml#ssrf-sinks
+        - tag: ssrf-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/go/security/ssti.yaml b/rules/ruleset/go/security/ssti.yaml
index 55d16b1779..bd8d7cf845 100644
--- a/rules/ruleset/go/security/ssti.yaml
+++ b/rules/ruleset/go/security/ssti.yaml
@@ -48,9 +48,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/ssti-sinks.yaml#ssti-sinks
+        - tag: ssti-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/go/security/xss.yaml b/rules/ruleset/go/security/xss.yaml
index 1e2217c4de..3745a989d7 100644
--- a/rules/ruleset/go/security/xss.yaml
+++ b/rules/ruleset/go/security/xss.yaml
@@ -48,9 +48,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: go/lib/http-sources.yaml#http-sources
+        - tag: http-untrusted-data-source
           as: src
-        - rule: go/lib/xss-sinks.yaml#xss-sinks
+        - tag: xss-sink
           as: sink
       on:
         - 'src.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/lib/generic/code-injection-sinks.yaml b/rules/ruleset/java/lib/generic/code-injection-sinks.yaml
index 5ababc37c8..fbd67c0a59 100644
--- a/rules/ruleset/java/lib/generic/code-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/code-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: ognl-injection-sinks
     options:
       lib: true
+    tags:
+      - ognl-injection-sink
     severity: NOTE
     message: Untrusted input reaches OGNL expression
     metadata:
@@ -54,6 +56,8 @@ rules:
   - id: dangerous-groovy-shell
     options:
       lib: true
+    tags:
+      - groovy-injection-sink
     severity: NOTE
     message: Groovy shell run of externally-manipulated script
     metadata:
@@ -84,6 +88,8 @@ rules:
   - id: dangerous-script-engine-eval
     options:
       lib: true
+    tags:
+      - script-engine-injection-sink
     severity: NOTE
     message: Risky code evaluation with user-controled value
     metadata:
diff --git a/rules/ruleset/java/lib/generic/command-injection-sinks.yaml b/rules/ruleset/java/lib/generic/command-injection-sinks.yaml
index eced2b5f4e..143f4ab239 100644
--- a/rules/ruleset/java/lib/generic/command-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/command-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: command-injection-sinks
     options:
       lib: true
+    tags:
+      - command-injection-sink
     severity: NOTE
     message: Executing OS command with user-controlled data
     metadata:
@@ -46,6 +48,8 @@ rules:
   - id: java-expression-language-sinks
     options:
       lib: true
+    tags:
+      - el-injection-sink
     severity: NOTE
     message: Java EL evaluation directly with user-supplied input
     metadata:
diff --git a/rules/ruleset/java/lib/generic/data-query-injection-sinks.yaml b/rules/ruleset/java/lib/generic/data-query-injection-sinks.yaml
index db69139484..64eab7ad91 100644
--- a/rules/ruleset/java/lib/generic/data-query-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/data-query-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-xpath-injection-sinks
     options:
       lib: true
+    tags:
+      - xpath-injection-sink
     severity: NOTE
     message: XPath query contains user-manipulated data
     metadata:
@@ -21,6 +23,8 @@ rules:
   - id: java-mongodb-nosql-injection
     options:
       lib: true
+    tags:
+      - mongodb-injection-sink
     severity: NOTE
     message: >-
       User-controled data passed into a NoSQL query using the 'where' evaluation operator.
diff --git a/rules/ruleset/java/lib/generic/http-response-splitting-sinks.yaml b/rules/ruleset/java/lib/generic/http-response-splitting-sinks.yaml
index 5052e48ec1..5f279e2169 100644
--- a/rules/ruleset/java/lib/generic/http-response-splitting-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/http-response-splitting-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-http-response-splitting-sink
     options:
       lib: true
+    tags:
+      - http-response-splitting-sink
     severity: NOTE
     message: Improper neutralization of CRLF sequences in HTTP headers
     metadata:
diff --git a/rules/ruleset/java/lib/generic/ldap-injection-sinks.yaml b/rules/ruleset/java/lib/generic/ldap-injection-sinks.yaml
index 514f203349..6b0a8e25b8 100644
--- a/rules/ruleset/java/lib/generic/ldap-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/ldap-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-ldap-injection-sinks
     options:
       lib: true
+    tags:
+      - ldap-injection-sink
     severity: NOTE
     message: Call of LDAP injection-sensitive function with untrusted data.
     metadata:
diff --git a/rules/ruleset/java/lib/generic/logging-sinks.yaml b/rules/ruleset/java/lib/generic/logging-sinks.yaml
index 782fb1b6bb..af89a3db58 100644
--- a/rules/ruleset/java/lib/generic/logging-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/logging-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-logging-sinks
     options:
       lib: true
+    tags:
+      - log-injection-sink
     severity: NOTE
     message: Logging the data
     metadata:
@@ -33,6 +35,8 @@ rules:
   - id: seam-log-injection-sinks
     options:
       lib: true
+    tags:
+      - seam-log-injection-sink
     severity: NOTE
     message: Potential injection into Seam logging expression language
     metadata:
diff --git a/rules/ruleset/java/lib/generic/path-traversal-sinks.yaml b/rules/ruleset/java/lib/generic/path-traversal-sinks.yaml
index 273dc16b4d..5e0a0a1ec7 100644
--- a/rules/ruleset/java/lib/generic/path-traversal-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/path-traversal-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-path-traversal-sinks
     options:
       lib: true
+    tags:
+      - path-traversal-sink
     severity: NOTE
     message: Use a file with untrusted path
     metadata:
diff --git a/rules/ruleset/java/lib/generic/seam-untrusted-data-source.yaml b/rules/ruleset/java/lib/generic/seam-untrusted-data-source.yaml
index 7ff97e3ac1..2fc4e17032 100644
--- a/rules/ruleset/java/lib/generic/seam-untrusted-data-source.yaml
+++ b/rules/ruleset/java/lib/generic/seam-untrusted-data-source.yaml
@@ -2,6 +2,8 @@ rules:
   - id: seam-untrusted-data-source
     options:
       lib: true
+    tags:
+      - seam-untrusted-data-source
     message: Untrusted data flows from here
     severity: NOTE
     metadata:
diff --git a/rules/ruleset/java/lib/generic/servlet-response-injection-sinks.yaml b/rules/ruleset/java/lib/generic/servlet-response-injection-sinks.yaml
index 3e46893943..39fc885163 100644
--- a/rules/ruleset/java/lib/generic/servlet-response-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/servlet-response-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-servlet-response-injection-sink
     options:
       lib: true
+    tags:
+      - servlet-response-injection-sink
     severity: NOTE
     message: Direct write of unvalidated user input into response
     metadata:
diff --git a/rules/ruleset/java/lib/generic/servlet-untrusted-data-source.yaml b/rules/ruleset/java/lib/generic/servlet-untrusted-data-source.yaml
index b5012df767..8f5535d196 100644
--- a/rules/ruleset/java/lib/generic/servlet-untrusted-data-source.yaml
+++ b/rules/ruleset/java/lib/generic/servlet-untrusted-data-source.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-servlet-untrusted-data-source
     options:
       lib: true
+    tags:
+      - servlet-untrusted-data-source
     severity: NOTE
     message: Untrusted data flows from here
     metadata:
diff --git a/rules/ruleset/java/lib/generic/servlet-unvalidated-redirect-sinks.yaml b/rules/ruleset/java/lib/generic/servlet-unvalidated-redirect-sinks.yaml
index 40564aa287..ce75c2f04b 100644
--- a/rules/ruleset/java/lib/generic/servlet-unvalidated-redirect-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/servlet-unvalidated-redirect-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-servlet-unvalidated-redirect-sinks
     options:
       lib: true
+    tags:
+      - servlet-unvalidated-redirect-sink
     severity: NOTE
     message: Potential redirect to an untrusted URL
     metadata:
diff --git a/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml b/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml
index 127d188a3f..c36ea12ac4 100644
--- a/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/servlet-xss-html-response-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-servlet-xss-html-response-sink
     options:
       lib: true
+    tags:
+      - servlet-xss-sink
     severity: NOTE
     message: Direct write of unvalidated user input into a response without safe content type
     metadata:
diff --git a/rules/ruleset/java/lib/generic/smtp-injection-sinks.yaml b/rules/ruleset/java/lib/generic/smtp-injection-sinks.yaml
index 799826fd9b..aa7d3ab285 100644
--- a/rules/ruleset/java/lib/generic/smtp-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/smtp-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-smtp-crlf-injection-sinks
     options:
       lib: true
+    tags:
+      - smtp-injection-sink
     severity: NOTE
     message: Unvalidated user-manipulated data reaches sensitive MimeMessage parts
     metadata:
diff --git a/rules/ruleset/java/lib/generic/ssrf-sinks.yaml b/rules/ruleset/java/lib/generic/ssrf-sinks.yaml
index 71e7306b1e..335cb9562e 100644
--- a/rules/ruleset/java/lib/generic/ssrf-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/ssrf-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-ssrf-sink
     options:
       lib: true
+    tags:
+      - ssrf-sink
     severity: NOTE
     message: Requesting URL obtained from untrusted data without
     metadata:
@@ -29,6 +31,8 @@ rules:
   - id: java-http-parameter-pollution-sinks
     options:
       lib: true
+    tags:
+      - http-parameter-pollution-sink
     severity: NOTE
     message: Unvalidated user input has been included into a URL
     metadata:
diff --git a/rules/ruleset/java/lib/generic/template-injection-sinks.yaml b/rules/ruleset/java/lib/generic/template-injection-sinks.yaml
index 737633132c..8c7d9cc910 100644
--- a/rules/ruleset/java/lib/generic/template-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/template-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-ssti-sinks
     options:
       lib: true
+    tags:
+      - template-injection-sink
     severity: NOTE
     message: Unvalidated user data flows into template engine
     metadata:
diff --git a/rules/ruleset/java/lib/generic/unsafe-deserialization-sinks.yaml b/rules/ruleset/java/lib/generic/unsafe-deserialization-sinks.yaml
index 56642cf4ca..389d0a5321 100644
--- a/rules/ruleset/java/lib/generic/unsafe-deserialization-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/unsafe-deserialization-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: jackson-unsafe-deserialization
     options:
       lib: true
+    tags:
+      - jackson-deserialization-sink
     severity: NOTE
     message: Jackson deserialization of JSON to Java objects with default typing, this can lead to RCE
     metadata:
@@ -59,6 +61,8 @@ rules:
   - id: yaml-unsafe-deserialization-sink
     options:
       lib: true
+    tags:
+      - snakeyaml-deserialization-sink
     severity: NOTE
     message: Parsing of untrusted data with org.yaml.snakeyaml.Yaml() constructed with no arguments
     metadata:
diff --git a/rules/ruleset/java/lib/generic/unsafe-reflection.yaml b/rules/ruleset/java/lib/generic/unsafe-reflection.yaml
index 44ef9acfed..1f6f8fd76d 100644
--- a/rules/ruleset/java/lib/generic/unsafe-reflection.yaml
+++ b/rules/ruleset/java/lib/generic/unsafe-reflection.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-unsafe-reflection-sinks
     options:
       lib: true
+    tags:
+      - unsafe-reflection-sink
     severity: NOTE
     message: Using reflection on user-manipulated name
     languages:
diff --git a/rules/ruleset/java/lib/generic/xxe-sinks.yaml b/rules/ruleset/java/lib/generic/xxe-sinks.yaml
index 859fae0826..68c6daa767 100644
--- a/rules/ruleset/java/lib/generic/xxe-sinks.yaml
+++ b/rules/ruleset/java/lib/generic/xxe-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: java-xxe-sinks
     options:
       lib: true
+    tags:
+      - xxe-sink
     severity: NOTE
     message: Parsing untrusted XML data with insufficient safety control
     metadata:
diff --git a/rules/ruleset/java/lib/spring/jdbc-sqli-sinks.yaml b/rules/ruleset/java/lib/spring/jdbc-sqli-sinks.yaml
index ed9ab91648..5d9311a8a4 100644
--- a/rules/ruleset/java/lib/spring/jdbc-sqli-sinks.yaml
+++ b/rules/ruleset/java/lib/spring/jdbc-sqli-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: spring-sqli-sink
     options:
       lib: true
+    tags:
+      - sqli-sink
     severity: NOTE
     message: SQL query with unescaped untrusted data
     metadata:
diff --git a/rules/ruleset/java/lib/spring/spel-injection-sinks.yaml b/rules/ruleset/java/lib/spring/spel-injection-sinks.yaml
index d37c4097b3..1a41f75c1c 100644
--- a/rules/ruleset/java/lib/spring/spel-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/spring/spel-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: spel-injection-sinks
     options:
       lib: true
+    tags:
+      - spel-injection-sink
     severity: NOTE
     message: Dangerous SpEL expression evaluation
     metadata:
diff --git a/rules/ruleset/java/lib/spring/spring-response-injection-sinks.yaml b/rules/ruleset/java/lib/spring/spring-response-injection-sinks.yaml
index 792a023291..75de76dbaf 100644
--- a/rules/ruleset/java/lib/spring/spring-response-injection-sinks.yaml
+++ b/rules/ruleset/java/lib/spring/spring-response-injection-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: spring-response-injection-sink
     options:
       lib: true
+    tags:
+      - spring-response-injection-sink
     severity: NOTE
     message: Direct write of unvalidated user input into response
     metadata:
diff --git a/rules/ruleset/java/lib/spring/spring-xss-html-response-sinks.yaml b/rules/ruleset/java/lib/spring/spring-xss-html-response-sinks.yaml
index cb1da00d48..6095dcc0ab 100644
--- a/rules/ruleset/java/lib/spring/spring-xss-html-response-sinks.yaml
+++ b/rules/ruleset/java/lib/spring/spring-xss-html-response-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: spring-xss-html-response-sink
     options:
       lib: true
+    tags:
+      - spring-xss-sink
     severity: NOTE
     message: Return of unvalidated user input from a Spring handler vulnerable to XSS
     metadata:
diff --git a/rules/ruleset/java/lib/spring/untrusted-data-source.yaml b/rules/ruleset/java/lib/spring/untrusted-data-source.yaml
index 2047bc456e..d6ed438f63 100644
--- a/rules/ruleset/java/lib/spring/untrusted-data-source.yaml
+++ b/rules/ruleset/java/lib/spring/untrusted-data-source.yaml
@@ -2,6 +2,8 @@ rules:
   - id: spring-untrusted-data-source
     options:
       lib: true
+    tags:
+      - spring-untrusted-data-source
     severity: NOTE
     message: Untrusted data flows from here
     metadata:
diff --git a/rules/ruleset/java/lib/spring/untrusted-path-source.yaml b/rules/ruleset/java/lib/spring/untrusted-path-source.yaml
index f3d1a60065..ff09f31b41 100644
--- a/rules/ruleset/java/lib/spring/untrusted-path-source.yaml
+++ b/rules/ruleset/java/lib/spring/untrusted-path-source.yaml
@@ -2,6 +2,8 @@ rules:
   - id: spring-untrusted-path-source
     options:
       lib: true
+    tags:
+      - spring-untrusted-path-source
     severity: NOTE
     message: Untrusted data flows from here
     metadata:
diff --git a/rules/ruleset/java/lib/spring/unvalidated-redirect-sinks.yaml b/rules/ruleset/java/lib/spring/unvalidated-redirect-sinks.yaml
index 88e617ed0e..a31db5e9e4 100644
--- a/rules/ruleset/java/lib/spring/unvalidated-redirect-sinks.yaml
+++ b/rules/ruleset/java/lib/spring/unvalidated-redirect-sinks.yaml
@@ -2,6 +2,8 @@ rules:
   - id: spring-unvalidated-redirect-sinks
     options:
       lib: true
+    tags:
+      - spring-unvalidated-redirect-sink
     severity: NOTE
     message: Potential redirect to an untrusted URL
     metadata:
diff --git a/rules/ruleset/java/security/code-injection.yaml b/rules/ruleset/java/security/code-injection.yaml
index 42db2048e3..4ca20711a4 100644
--- a/rules/ruleset/java/security/code-injection.yaml
+++ b/rules/ruleset/java/security/code-injection.yaml
@@ -51,11 +51,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/code-injection-sinks.yaml#dangerous-groovy-shell
+        - tag: groovy-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -114,11 +114,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/code-injection-sinks.yaml#ognl-injection-sinks
+        - tag: ognl-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$INPUT'
@@ -186,11 +186,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/code-injection-sinks.yaml#dangerous-script-engine-eval
+        - tag: script-engine-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -257,11 +257,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/template-injection-sinks.yaml#java-ssti-sinks
+        - tag: template-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -365,9 +365,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/generic/command-injection-sinks.yaml#java-expression-language-sinks
+        - tag: el-injection-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$EXPR'
@@ -474,9 +474,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/spring/spel-injection-sinks.yaml#spel-injection-sinks
+        - tag: spel-injection-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/security/command-injection.yaml b/rules/ruleset/java/security/command-injection.yaml
index f23d607402..fdedf55488 100644
--- a/rules/ruleset/java/security/command-injection.yaml
+++ b/rules/ruleset/java/security/command-injection.yaml
@@ -57,11 +57,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/command-injection-sinks.yaml#command-injection-sinks
+        - tag: command-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/security/crlf-injection.yaml b/rules/ruleset/java/security/crlf-injection.yaml
index 6955046b84..df49178cc7 100644
--- a/rules/ruleset/java/security/crlf-injection.yaml
+++ b/rules/ruleset/java/security/crlf-injection.yaml
@@ -50,11 +50,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/http-response-splitting-sinks.yaml#java-http-response-splitting-sink
+        - tag: http-response-splitting-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -114,11 +114,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/smtp-injection-sinks.yaml#java-smtp-crlf-injection-sinks
+        - tag: smtp-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/security/data-query-injection.yaml b/rules/ruleset/java/security/data-query-injection.yaml
index 7a22540eb9..4f36401f51 100644
--- a/rules/ruleset/java/security/data-query-injection.yaml
+++ b/rules/ruleset/java/security/data-query-injection.yaml
@@ -59,11 +59,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/data-query-injection-sinks.yaml#java-xpath-injection-sinks
+        - tag: xpath-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -121,11 +121,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/data-query-injection-sinks.yaml#java-mongodb-nosql-injection
+        - tag: mongodb-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$INPUT'
diff --git a/rules/ruleset/java/security/external-configuration-control.yaml b/rules/ruleset/java/security/external-configuration-control.yaml
index b70e52e0e1..572b4ecfac 100644
--- a/rules/ruleset/java/security/external-configuration-control.yaml
+++ b/rules/ruleset/java/security/external-configuration-control.yaml
@@ -119,9 +119,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: untrusted-data
-        - rule: java/security/external-configuration-control.yaml#bean-injection-sink
+        - tag: bean-injection-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -129,6 +129,8 @@ rules:
   - id: bean-injection-sink
     options:
       lib: true
+    tags:
+      - bean-injection-sink
     severity: NOTE
     mode: taint
     metadata:
@@ -204,11 +206,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/security/external-configuration-control.yaml#java-sql-catalog-sink
+        - tag: sql-catalog-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -217,6 +219,8 @@ rules:
   - id: java-sql-catalog-sink
     options:
       lib: true
+    tags:
+      - sql-catalog-sink
     severity: NOTE
     message: Setting SQL connection catalog with user-manipulated data
     metadata:
@@ -285,11 +289,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/unsafe-reflection.yaml#java-unsafe-reflection-sinks
+        - tag: unsafe-reflection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/security/ldap.yaml b/rules/ruleset/java/security/ldap.yaml
index 668d29ee54..bc2524a311 100644
--- a/rules/ruleset/java/security/ldap.yaml
+++ b/rules/ruleset/java/security/ldap.yaml
@@ -54,11 +54,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/ldap-injection-sinks.yaml#java-ldap-injection-sinks
+        - tag: ldap-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$QUERY'
diff --git a/rules/ruleset/java/security/log-injection.yaml b/rules/ruleset/java/security/log-injection.yaml
index dac2d1b70f..a7532255b7 100644
--- a/rules/ruleset/java/security/log-injection.yaml
+++ b/rules/ruleset/java/security/log-injection.yaml
@@ -54,11 +54,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/logging-sinks.yaml#java-logging-sinks
+        - tag: log-injection-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$DATA'
@@ -179,9 +179,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/seam-untrusted-data-source.yaml#seam-untrusted-data-source
+        - tag: seam-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/generic/logging-sinks.yaml#seam-log-injection-sinks
+        - tag: seam-log-injection-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$DATA'
diff --git a/rules/ruleset/java/security/path-traversal.yaml b/rules/ruleset/java/security/path-traversal.yaml
index 1e22c66032..44f970a8b0 100644
--- a/rules/ruleset/java/security/path-traversal.yaml
+++ b/rules/ruleset/java/security/path-traversal.yaml
@@ -67,12 +67,12 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
-          as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-path-source.yaml#spring-untrusted-path-source
+        - tag: servlet-untrusted-data-source
+          as: untrusted-data
+        - tag: spring-untrusted-path-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/path-traversal-sinks.yaml#java-path-traversal-sinks
+        - tag: path-traversal-sink
           as: sink
       on:
-        - 'servlet-untrusted-data.$UNTRUSTED -> sink.$FILE'
+        - 'untrusted-data.$UNTRUSTED -> sink.$FILE'
         - 'spring-untrusted-data.$UNTRUSTED -> sink.$FILE'
diff --git a/rules/ruleset/java/security/sensitive-data-exposure.yaml b/rules/ruleset/java/security/sensitive-data-exposure.yaml
index 1cdc5283fe..fb8a7863cd 100644
--- a/rules/ruleset/java/security/sensitive-data-exposure.yaml
+++ b/rules/ruleset/java/security/sensitive-data-exposure.yaml
@@ -255,6 +255,29 @@ rules:
                 ...
               }
 
+  - id: file-disclosure-request-dispatcher-sink
+    options:
+      lib: true
+    tags:
+      - file-disclosure-sink
+    message: Request dispatcher called with untrusted path
+    severity: NOTE
+    languages:
+      - java
+    mode: taint
+    pattern-sinks:
+      - patterns:
+          - pattern-not-inside: |
+              $VAL = $MAP.getOrDefault(..., "...");
+              ...
+          - pattern-inside: |
+              $REQ = $HTTP.getRequestDispatcher($UNTRUSTED);
+              ...
+          - focus-metavariable: $UNTRUSTED
+          - pattern-either:
+              - pattern: $REQ.include(...)
+              - pattern: $REQ.forward(...)
+
   - id: file-disclosure-request-dispatcher
     severity: ERROR
     message: >-
@@ -296,31 +319,38 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: untrusted-data
-        - rule: file-disclosure-request-dispatcher-sink
+        - tag: file-disclosure-sink
           as: sink
       on:
       - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
-      rules:
-      - id: file-disclosure-request-dispatcher-sink
-        message: Request dispatcher called with untrusted path
-        severity: NOTE
-        languages:
-          - java
-        mode: taint
-        pattern-sinks:
-        - patterns:
-          - pattern-not-inside: |
-              $VAL = $MAP.getOrDefault(..., "...");
+
+  - id: spring-file-disclosure-model-and-view-sink
+    options:
+      lib: true
+    tags:
+      - jsp-file-disclosure-sink
+    message: ModelAndView called with untrusted path
+    severity: NOTE
+    languages:
+      - java
+    patterns:
+      - pattern-either:
+          - pattern: |
+              new org.springframework.web.servlet.ModelAndView($UNTRUSTED, ...);
+          - pattern: |
+              $MVC = new org.springframework.web.servlet.ModelAndView();
               ...
-          - pattern-inside: |
-              $REQ = $HTTP.getRequestDispatcher($UNTRUSTED);
+              $MVC.setViewName($UNTRUSTED);
+          - pattern: new org.apache.struts.action.ActionForward($UNTRUSTED)
+          - pattern: new org.apache.struts.action.ActionForward($UNTRUSTED, $SND)
+          - pattern: new org.apache.struts.action.ActionForward($FST, $UNTRUSTED, $TRD)
+          - pattern: new org.apache.struts.action.ActionForward($FST, $SND, $UNTRUSTED)
+          - pattern: |
+              $ACTION = new org.apache.struts.action.ActionForward();
               ...
-          - focus-metavariable: $UNTRUSTED
-          - pattern-either:
-            - pattern: $REQ.include(...)
-            - pattern: $REQ.forward(...)
+              $ACTION.setPath($UNTRUSTED)
 
   - id: jsp-file-disclosure
     severity: ERROR
@@ -384,34 +414,12 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: untrusted-data
-        - rule: spring-file-disclosure-model-and-view-sink
+        - tag: jsp-file-disclosure-sink
           as: sink
       on:
       - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
-      rules:
-        - id: spring-file-disclosure-model-and-view-sink
-          message: ModelAndView called with untrusted path
-          severity: NOTE
-          languages:
-            - java
-          patterns:
-            - pattern-either:
-                - pattern: |
-                    new org.springframework.web.servlet.ModelAndView($UNTRUSTED, ...);
-                - pattern: |
-                    $MVC = new org.springframework.web.servlet.ModelAndView();
-                    ...
-                    $MVC.setViewName($UNTRUSTED);
-                - pattern: new org.apache.struts.action.ActionForward($UNTRUSTED)
-                - pattern: new org.apache.struts.action.ActionForward($UNTRUSTED, $SND)
-                - pattern: new org.apache.struts.action.ActionForward($FST, $UNTRUSTED, $TRD)
-                - pattern: new org.apache.struts.action.ActionForward($FST, $SND, $UNTRUSTED)
-                - pattern: |
-                    $ACTION = new org.apache.struts.action.ActionForward();
-                    ...
-                    $ACTION.setPath($UNTRUSTED)
 
   - id: stacktrace-printing-in-error-message
     severity: WARNING
diff --git a/rules/ruleset/java/security/sqli.yaml b/rules/ruleset/java/security/sqli.yaml
index d57d43fd5c..53c2bc419d 100644
--- a/rules/ruleset/java/security/sqli.yaml
+++ b/rules/ruleset/java/security/sqli.yaml
@@ -62,11 +62,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/spring/jdbc-sqli-sinks.yaml#spring-sqli-sink
+        - tag: sqli-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/security/ssrf.yaml b/rules/ruleset/java/security/ssrf.yaml
index f6ea85f2a9..c60a692cb6 100644
--- a/rules/ruleset/java/security/ssrf.yaml
+++ b/rules/ruleset/java/security/ssrf.yaml
@@ -70,11 +70,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/ssrf-sinks.yaml#java-ssrf-sink
+        - tag: ssrf-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -161,9 +161,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/generic/ssrf-sinks.yaml#java-http-parameter-pollution-sinks
+        - tag: http-parameter-pollution-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/security/strings.yaml b/rules/ruleset/java/security/strings.yaml
index 045ed0b5e9..2f6c3cfaee 100644
--- a/rules/ruleset/java/security/strings.yaml
+++ b/rules/ruleset/java/security/strings.yaml
@@ -90,11 +90,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/security/strings.yaml#java-string-format-sinks
+        - tag: format-string-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$FORMAT_STR'
@@ -103,6 +103,8 @@ rules:
   - id: java-string-format-sinks
     options:
       lib: true
+    tags:
+      - format-string-sink
     severity: NOTE
     message: String formatter is obtained from untrusted data source
     metadata:
diff --git a/rules/ruleset/java/security/unsafe-deserialization.yaml b/rules/ruleset/java/security/unsafe-deserialization.yaml
index 4db652b575..b332fe87b2 100644
--- a/rules/ruleset/java/security/unsafe-deserialization.yaml
+++ b/rules/ruleset/java/security/unsafe-deserialization.yaml
@@ -23,11 +23,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java-unsafe-object-mapper-sink
+        - tag: unsafe-object-mapper-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -36,6 +36,8 @@ rules:
   - id: java-unsafe-object-mapper-sink
     options:
       lib: true
+    tags:
+      - unsafe-object-mapper-sink
     severity: NOTE
     message: Deserialization of untrusted data with ObjectMapper
     metadata:
@@ -102,11 +104,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/unsafe-deserialization-sinks.yaml#jackson-unsafe-deserialization
+        - tag: jackson-deserialization-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$JSON'
@@ -164,11 +166,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/unsafe-deserialization-sinks.yaml#yaml-unsafe-deserialization-sink
+        - tag: snakeyaml-deserialization-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$YAML'
diff --git a/rules/ruleset/java/security/unvalidated-redirect.yaml b/rules/ruleset/java/security/unvalidated-redirect.yaml
index e78099a1a0..aa2a9869fe 100644
--- a/rules/ruleset/java/security/unvalidated-redirect.yaml
+++ b/rules/ruleset/java/security/unvalidated-redirect.yaml
@@ -119,9 +119,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/generic/servlet-unvalidated-redirect-sinks.yaml#java-servlet-unvalidated-redirect-sinks
+        - tag: servlet-unvalidated-redirect-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$URL'
@@ -241,9 +241,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/spring/unvalidated-redirect-sinks.yaml#spring-unvalidated-redirect-sinks
+        - tag: spring-unvalidated-redirect-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$URL'
diff --git a/rules/ruleset/java/security/xss.yaml b/rules/ruleset/java/security/xss.yaml
index 0ab8d35fc8..f4c6634e3f 100644
--- a/rules/ruleset/java/security/xss.yaml
+++ b/rules/ruleset/java/security/xss.yaml
@@ -74,9 +74,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/generic/servlet-xss-html-response-sinks.yaml#java-servlet-xss-html-response-sink
+        - tag: servlet-xss-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -216,9 +216,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/generic/servlet-response-injection-sinks.yaml#java-servlet-response-injection-sink
+        - tag: servlet-response-injection-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -310,9 +310,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/spring/spring-xss-html-response-sinks.yaml#spring-xss-html-response-sink
+        - tag: spring-xss-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
@@ -439,9 +439,9 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: untrusted-data
-        - rule: java/lib/spring/spring-response-injection-sinks.yaml#spring-response-injection-sink
+        - tag: spring-response-injection-sink
           as: sink
       on:
         - 'untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'
diff --git a/rules/ruleset/java/security/xxe.yaml b/rules/ruleset/java/security/xxe.yaml
index b063daa00e..9ccd5a9fd9 100644
--- a/rules/ruleset/java/security/xxe.yaml
+++ b/rules/ruleset/java/security/xxe.yaml
@@ -66,11 +66,11 @@ rules:
     mode: join
     join:
       refs:
-        - rule: java/lib/generic/servlet-untrusted-data-source.yaml#java-servlet-untrusted-data-source
+        - tag: servlet-untrusted-data-source
           as: servlet-untrusted-data
-        - rule: java/lib/spring/untrusted-data-source.yaml#spring-untrusted-data-source
+        - tag: spring-untrusted-data-source
           as: spring-untrusted-data
-        - rule: java/lib/generic/xxe-sinks.yaml#java-xxe-sinks
+        - tag: xxe-sink
           as: sink
       on:
         - 'servlet-untrusted-data.$UNTRUSTED -> sink.$UNTRUSTED'