From 1f4c810f543ca424da0711d580fea13436b69703 Mon Sep 17 00:00:00 2001
From: Jochen Theodorou <blackdrag@gmx.org>
Date: Wed, 16 Sep 2026 18:36:32 +0200
Subject: [PATCH] Update GroovyInjection.qhelp link for Orange Tsai

---
 java/ql/src/Security/CWE/CWE-094/GroovyInjection.qhelp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/java/ql/src/Security/CWE/CWE-094/GroovyInjection.qhelp b/java/ql/src/Security/CWE/CWE-094/GroovyInjection.qhelp
index 9c5ce91a8933..470a01fba788 100644
--- a/java/ql/src/Security/CWE/CWE-094/GroovyInjection.qhelp
+++ b/java/ql/src/Security/CWE/CWE-094/GroovyInjection.qhelp
@@ -54,7 +54,7 @@ The following example uses classloader block-list approach to exclude loading da
 <references>
 <li>
   Orange Tsai:
-  <a href="https://blog.orange.tw/2019/02/abusing-meta-programming-for-unauthenticated-rce.html">Abusing Meta Programming for Unauthenticated RCE!</a>.
+  <a href="https://devco.re/blog/2019/02/19/hacking-Jenkins-part2-abusing-meta-programming-for-unauthenticated-RCE-en/">Abusing Meta Programming for Unauthenticated RCE!</a>.
 </li>
 <li>
   Cédric Champeau: