Address review comments

ql/src/semmle/go/security/ReflectedXssCustomizations.qll

@@ -109,7 +109,11 @@ module ReflectedXss {
    */
   class EqualityTestGuard extends SanitizerGuard, DataFlow::EqualityTestNode {
     override predicate checks(Expr e, boolean outcome) {
-      e = this.getAnOperand().asExpr() and this.eq(outcome, _, _)
+      exists(DataFlow::Node const | const.isConst() |
+        const = this.getAnOperand() and
+        e = this.getAnOperand().asExpr() and
+        this.eq(outcome, _, _)
+      )
     }
   }
 }

ql/test/query-tests/Security/CWE-079/tst.go

@@ -48,7 +48,7 @@ func serve8() {
 		if service != "service1" && service != "service2" {
 			fmt.Fprintln(w, "Service not found")
 		} else {
-			// OK: json data cannot cause an HTML content type to be detected
+			// OK, but caught: service is known to be either "service1" or "service2" here
 			w.Write([]byte(service))
 		}
 	})