github
diff --git a/‎ruby/ql/lib/codeql/ruby/security/XSS.qll
Copy file name to clipboardExpand all lines: ruby/ql/lib/codeql/ruby/security/XSS.qll
+4-1Lines changed: 4 additions & 1 deletion b/‎ruby/ql/lib/codeql/ruby/security/XSS.qll
Copy file name to clipboardExpand all lines: ruby/ql/lib/codeql/ruby/security/XSS.qll
+4-1Lines changed: 4 additions & 1 deletion
@@ -289,7 +289,10 @@ private module OrmTracking {
       Shared::isAdditionalXssFlowStep(node1, node2)
     }
 
-    predicate isBarrierIn(DataFlow::Node node) { node instanceof DataFlow::SelfParameterNode }
+    predicate isBarrierIn(DataFlow::Node node) {
+      node instanceof DataFlow::SelfParameterNode and
+      not node.getLocation().getFile() instanceof ErbFile
+    }
   }
 
   import DataFlow::Global<Config>
Original file line number	Diff line number	Diff line change
`@@ -289,7 +289,10 @@ private module OrmTracking {`
`289`	`289`	`Shared::isAdditionalXssFlowStep(node1, node2)`
`290`	`290`	`}`
`291`	`291`
`292`		`- predicate isBarrierIn(DataFlow::Node node) { node instanceof DataFlow::SelfParameterNode }`
	`292`	`+ predicate isBarrierIn(DataFlow::Node node) {`
	`293`	`+ node instanceof DataFlow::SelfParameterNode and`
	`294`	`+ not node.getLocation().getFile() instanceof ErbFile`
	`295`	`+ }`
`293`	`296`	`}`
`294`	`297`
`295`	`298`	`import DataFlow::Global<Config>`