diff --git a/ql/src/semmle/go/dataflow/internal/DataFlowUtil.qll b/ql/src/semmle/go/dataflow/internal/DataFlowUtil.qll index 13c536a7a48..0482b23225c 100644 --- a/ql/src/semmle/go/dataflow/internal/DataFlowUtil.qll +++ b/ql/src/semmle/go/dataflow/internal/DataFlowUtil.qll @@ -1115,7 +1115,10 @@ predicate localFlow(Node source, Node sink) { localFlowStep*(source, sink) } * characteristic predicate precisely specifying the guard, and override * `checks` to specify what is being validated and in which branch. * - * It is important that all extending classes in scope are disjoint. + * When using a data-flow or taint-flow configuration `cfg`, it is important + * that any classes extending BarrierGuard in scope which are not used in `cfg` + * are disjoint from any classes extending BarrierGuard in scope which are used + * in `cfg`. */ abstract class BarrierGuard extends Node { /** Holds if this guard validates `e` upon evaluating to `branch`. */