Address reviews - update comments, remove unneeded stubs

Author: joefarebrother

go/ql/lib/semmle/go/concepts/HTTP.qll

@@ -427,10 +427,10 @@ module Http {
   /** Provides a class for modeling the new APIs for writes to options of an HTTP cookie. */
   module CookieOptionWrite {
     /**
-     * A write to an HTTP cookie object.
+     * A write to an option of an HTTP cookie object.
      *
      * Extend this class to model new APIs. If you want to refine existing API models,
-     * extend `HTTP::CookieOptions` instead.
+     * extend `HTTP::CookieOptionWrite` instead.
      */
     abstract class Range extends DataFlow::Node {
       /** Gets the node representing the cookie object for the options being set. */
@@ -451,10 +451,10 @@ module Http {
   }
 
   /**
-   * A write to an HTTP cookie object.
+   * A write to an option of an HTTP cookie object.
    *
    * Extend this class to refine existing API models. If you want to model new APIs,
-   * extend `HTTP::CookieOptions::Range` instead.
+   * extend `HTTP::CookieOptionWrite::Range` instead.
    */
   class CookieOptionWrite extends DataFlow::Node instanceof CookieOptionWrite::Range {
     /** Gets the node representing the cookie object for the options being set. */

go/ql/lib/semmle/go/security/CookieWithoutHttpOnly.qll

@@ -48,7 +48,7 @@ module BooleanCookieHttpOnlyFlow = TaintTracking::Global<BooleanCookieHttpOnlyCo
 
 /** Holds if `cw` has the `HttpOnly` attribute left at its default value of `false`. */
 predicate isNonHttpOnlyDefault(Http::CookieWrite cw) {
-  not BooleanCookieHttpOnlyFlow::flow(_, cw.getHttpOnly())
+  not BooleanCookieHttpOnlyFlow::flowTo(cw.getHttpOnly())
 }
 
 /** Holds if `cw` has the `HttpOnly` attribute explicitly set to `false`, from the expression `boolFalse`. */

go/ql/lib/semmle/go/security/CookieWithoutSecure.qll

@@ -21,7 +21,7 @@ module BooleanCookieSecureFlow = TaintTracking::Global<BooleanCookieSecureConfig
 
 /** Holds if `cw` has the `Secure` attribute left at its default value of `false`. */
 predicate isInsecureDefault(Http::CookieWrite cw) {
-  not BooleanCookieSecureFlow::flow(_, cw.getSecure())
+  not BooleanCookieSecureFlow::flowTo(cw.getSecure())
 }
 
 /** Holds if `cw` has the `Secure` attribute explicitly set to `false`, from the expression `boolFalse`. */

go/ql/test/query-tests/Security/CWE-1004/vendor/github.com/gorilla/sessions/stub.go

@@ -1,6 +1,3 @@
 # github.com/gin-gonic/gin v1.7.1
 ## explicit
 github.com/gin-gonic/gin
-# github.com/gorilla/sessions v1.2.1
-## explicit
-github.com/gorilla/sessions

go/ql/test/query-tests/Security/CWE-1004/vendor/modules.txt

@@ -1,6 +1,3 @@
 # github.com/gin-gonic/gin v1.7.1
 ## explicit
 github.com/gin-gonic/gin
-# github.com/gorilla/sessions v1.2.1
-## explicit
-github.com/gorilla/sessions