diff --git a/go/ql/lib/ext/github.com.beego.beego.server.web.model.yml b/go/ql/lib/ext/github.com.beego.beego.server.web.model.yml index 0c539522c5a..8588af2652c 100644 --- a/go/ql/lib/ext/github.com.beego.beego.server.web.model.yml +++ b/go/ql/lib/ext/github.com.beego.beego.server.web.model.yml @@ -50,3 +50,8 @@ extensions: - ["group:beego", "Controller", True, "GetString", "", "", "ReturnValue[0]", "remote", "manual"] - ["group:beego", "Controller", True, "GetStrings", "", "", "ReturnValue[0]", "remote", "manual"] - ["group:beego", "Controller", True, "Input", "", "", "ReturnValue[0]", "remote", "manual"] + - addsTo: + pack: codeql/go-all + extensible: barrierModel + data: + - ["group:beego", "", True, "Htmlquote", "", "", "ReturnValue", "html-injection", "manual"] diff --git a/go/ql/lib/semmle/go/frameworks/Beego.qll b/go/ql/lib/semmle/go/frameworks/Beego.qll index 952958cebf0..383be8ec42a 100644 --- a/go/ql/lib/semmle/go/frameworks/Beego.qll +++ b/go/ql/lib/semmle/go/frameworks/Beego.qll @@ -165,14 +165,6 @@ module Beego { override string getAContentType() { none() } } - private class HtmlQuoteSanitizer extends SharedXss::Sanitizer { - HtmlQuoteSanitizer() { - exists(DataFlow::CallNode c | c.getTarget().hasQualifiedName(packagePath(), "Htmlquote") | - this = c.getArgument(0) - ) - } - } - private class UtilsTaintPropagators extends TaintTracking::FunctionModel { UtilsTaintPropagators() { this.hasQualifiedName(utilsPackagePath(), "GetDisplayString") }