Elaborate comment and change-note a little

change-notes/2021-04-20-tuple-types.md

@@ -1,2 +1,2 @@
 lgtm,codescanning
-* Fixed a bug where data flow was not correctly computed through two-value index expressions. This may cause more results from the security queries.
+* Fixed a bug where data flow was not correctly computed through two-value index expressions (e.g. `got, ok := myMap[someIndex]`). This may lead to extra results from any dataflow query when an index expression would form part of an important dataflow path.

ql/test/query-tests/Security/CWE-079/reflectedxsstest.go

@@ -51,6 +51,6 @@ func QueryMapTest(w http.ResponseWriter, r http.Request) {
 	keys, ok := r.URL.Query()["data_id"]
 	if ok && len(keys[0]) > 0 {
 		key := keys[0]
-		w.Write([]byte(key)) // BAD
+		w.Write([]byte(key)) // BAD: query string is user-controlled
 	}
 }