diff --git a/ql/src/semmle/go/frameworks/XPath.qll b/ql/src/semmle/go/frameworks/XPath.qll index 932d0b04cd5..a7665e4ad26 100644 --- a/ql/src/semmle/go/frameworks/XPath.qll +++ b/ql/src/semmle/go/frameworks/XPath.qll @@ -6,12 +6,25 @@ import go /** Provides classes for working with XPath-related APIs. */ module XPath { + /** + * A data-flow node whose string value is interpreted as (part of) an XPath expression. + * + * Extend this class to refine existing API models. If you want to model new APIs, + * extend `XPath::XPathExpressionString::Range` instead. + */ + class XPathExpressionString extends DataFlow::Node { + XPathExpressionString::Range self; + + XPathExpressionString() { this = self } + } + /** Provides classes for working with XPath expression strings. */ module XPathExpressionString { /** * A data-flow node whose string value is interpreted as (part of) an XPath expression. * - * Extend this class to model new APIs. + * Extend this class to model new APIs. If you want to refine existing API models, + * extend `XPath::XPathExpressionString` instead. */ abstract class Range extends DataFlow::Node { } diff --git a/ql/src/semmle/go/security/XPathInjectionCustomizations.qll b/ql/src/semmle/go/security/XPathInjectionCustomizations.qll index b3a25fc2857..1164c4c9761 100644 --- a/ql/src/semmle/go/security/XPathInjectionCustomizations.qll +++ b/ql/src/semmle/go/security/XPathInjectionCustomizations.qll @@ -36,6 +36,6 @@ module XPathInjection { /** An XPath expression string, considered as a taint sink for XPath injection. */ class XPathExpressionStringAsSink extends Sink { - XPathExpressionStringAsSink() { this instanceof XPath::XPathExpressionString::Range } + XPathExpressionStringAsSink() { this instanceof XPath::XPathExpressionString } } }