"Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.

      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the

        String actualUserName = ntlmRequest.getRemoteUser();

        // Assert: Verify that the returned user name is the expected one
        assertEquals(expectedUserName, actualUserName, "getRemoteUser should return the principal's name.");
    }

    /**
     * Test method for {@link NtlmHttpServletRequest#getUserPrincipal()}.
     * Verifies that the method returns the correct principal object.
     */
    @Test

## Wildcards { #wildcards }

It's also possible to declare the list as `"*"` (a "wildcard") to say that all are allowed.

But that will only allow certain types of communication, excluding everything that involves credentials: Cookies, Authorization headers like those used with Bearer Tokens, etc.

   * generates a synthetic method for the body of the lambda, the actual method calls that Animal
   * Sniffer is flagging don't appear inside toImmutableSortedMultiset but rather inside that
   * synthetic method. By moving those calls to a named method, we're able to apply
   * @IgnoreJRERequirement somewhere that it will help.
   */

In that case **this attack / risk doesn't apply to you**.

This risk and attack is mainly relevant when the app runs on the **local network** and that is the **only assumed protection**.

## Allowing Requests Without Content-Type { #allowing-requests-without-content-type }

        bh.consume(ords);
        ords.close();
    }

    /**
     * Emulates an aggregation that collects from a single bucket "by accident".
     * This can happen if an aggregation is under, say, a {@code terms}
     * aggregation and there is only a single value for that term in the index
     * but we can't tell that up front.
     */
    @Benchmark
    public void singleBucketIntoMulti(Blackhole bh) {

  <exclude name="**/testing/**"/>
</source>

<!--
    We used to set this only for packages that had manual supersource. That
    worked everywhere that I know of except for one place: when running the GWT
    util.concurrent tests under Guava.

    The problem is that GWT responds poorly to two .gwt.xml files in the same
    Java package; see

    assertThat(server.takeRequest().exchangeIndex).isEqualTo(1) // New connection.
  }

  /**
   * We had a bug where we'd perform infinite retries of route that fail with connection shutdown
   * errors. The problem was that the logic that decided whether to reuse a route didn't track
   * certain HTTP/2 errors. https://github.com/square/okhttp/issues/5547
   */
  @Test
  fun noRecoveryFromTwoRefusedStreams() {

          <sourcepath>doesnotexist</sourcepath>
          <!-- Note that we do need to build Javadoc for *some* class. Otherwise, we get an empty Javadoc jar, which the Sonatype repository manager rejects. To avoid that, we've introduced a dummy class. But we made it package-private so that no one can depend on it. That in turn forced us to configure Javadoc to show package-private APIs. -->
          <show>package</show>

  /**
   * Adds {@code equalityGroup} with objects that are supposed to be equal to each other and not
   * equal to any other equality groups added to this tester.
   *
   * <p>The {@code @Nullable} annotations on the {@code equalityGroup} parameter imply that the
   * objects, and the array itself, can be null. That is for programmer convenience, when the
   * objects come from factory methods that are themselves {@code @Nullable}. In reality neither the