fix #9097

Author: cokeBeer

ql/lib/semmle/go/frameworks/Beego.qll

@@ -12,8 +12,17 @@ private import semmle.go.security.SafeUrlFlowCustomizations
  * from the [Beego](https://github.com/beego/beego) package.
  */
 module Beego {
-  /** Gets the module path `github.com/astaxie/beego` or `github.com/beego/beego`. */
-  string modulePath() { result = ["github.com/astaxie/beego", "github.com/beego/beego"] }
+  /** 
+   * Gets the module path `github.com/astaxie/beego` or `github.com/beego/beego` 
+   * or `github.com/beego/beego/v2/server/web`. 
+   */
+  string modulePath() { 
+    result = 
+    [
+      "github.com/astaxie/beego", "github.com/beego/beego",
+      "github.com/beego/beego/v2/server/web"
+    ] 
+  }
 
   /** Gets the path for the root package of beego. */
   string packagePath() { result = package(modulePath(), "") }

ql/lib/semmle/go/frameworks/stdlib/NetHttp.qll

@@ -29,7 +29,7 @@ module NetHttp {
     UserControlledRequestField() {
       exists(string fieldName | this.getField().hasQualifiedName("net/http", "Request", fieldName) |
         fieldName =
-          ["Body", "GetBody", "Form", "PostForm", "MultipartForm", "Header", "Trailer", "URL"]
+          ["Body", "GetBody", "Form", "PostForm", "MultipartForm", "Header", "Trailer", "URL", "Host"]
       )
     }
   }