Reject unsafe direct inline expectation edits

Require generated expectation atoms to round-trip through the inline grammar before emitting an edit. Let language implementations reject unsafe end-of-line appends, and conservatively disable Python appends where explicit continuation lines cannot be distinguished at this seam.

Cover unsafe hash, whitespace, newline, and Python continuation cases through the public learnEdits relation.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 1adfa307-c48e-43f5-94e3-8286e4a8c083

Author: d10c

java/ql/test/library-tests/InlineExpectationsTest/learn-edits/Test.expected

@@ -0,0 +1,2 @@
+| Test.java | 3 | append | 0 | 0 |  // $ java-direct=safe |
+| Test.java | 4 | replace | 25 | 37 | // $ foreign java-direct=safe |

java/ql/test/library-tests/InlineExpectationsTest/learn-edits/Test.java

@@ -1,3 +1,8 @@
 class Test {
   void target() {} // $ java-direct
+  void safeAppend() {}
+  void safeReplace() {} // $ foreign
+  void unsafeHash() {}
+  void unsafeSpace() {} // $ foreign
+  void unsafeNewline() {} // $ foreign
 }

java/ql/test/library-tests/InlineExpectationsTest/learn-edits/Test.ql

@@ -4,16 +4,34 @@ import utils.test.InlineExpectationsTest
 module DirectTest implements TestSig {
   string getARelevantTag() { result = "java-direct" }
 
+  predicate tagIsIgnored(string expectedTag) { expectedTag = "foreign" }
+
   predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(Method method |
-      method.getName() = "target" and
+      method.getName() =
+        ["target", "safeAppend", "safeReplace", "unsafeHash", "unsafeSpace", "unsafeNewline"] and
       method.fromSource() and
       location = method.getLocation() and
       element = method.toString() and
       tag = "java-direct" and
-      value = ""
+      if method.getName() = "unsafeHash"
+      then value = "a#b"
+      else
+        if method.getName() = "unsafeSpace"
+        then value = "hello world"
+        else
+          if method.getName() = "unsafeNewline"
+          then value = "hello\nworld"
+          else
+            if method.getName() = ["safeAppend", "safeReplace"]
+            then value = "safe"
+            else value = ""
     )
   }
 }
 
-import MakeTest<DirectTest>
+private module Test = MakeTest<DirectTest>;
+
+from string file, int line, string operation, int startColumn, int endColumn, string text
+where Test::learnEdits(file, line, operation, startColumn, endColumn, text)
+select file, line, operation, startColumn, endColumn, text

python/ql/lib/utils/test/internal/InlineExpectationsTestImpl.qll

@@ -30,4 +30,8 @@ module Impl implements InlineExpectationsTestSig {
     relativePath.regexpMatch(".*\\.(py|pyi)") and
     result = "#"
   }
+
+  // Python source lines are not available here, so an explicit `\` continuation cannot be excluded.
+  bindingset[relativePath, line]
+  predicate canAppendCommentAtEndOfLine(string relativePath, int line) { none() }
 }

python/ql/test/library-tests/InlineExpectationsTest/learn-edits/Test.ql

@@ -13,7 +13,7 @@ module DirectTest implements TestSig {
 
   predicate hasActualResult(Location location, string element, string tag, string value) {
     exists(Name name |
-      name.getId() = "target" and
+      name.getId() = ["target", "target_continuation"] and
       location = name.getLocation() and
       element = name.toString() and
       tag = "direct" and
@@ -22,4 +22,8 @@ module DirectTest implements TestSig {
   }
 }
 
-import MakeTest<DirectTest>
+private module Test = MakeTest<DirectTest>;
+
+from string file, int line, string operation, int startColumn, int endColumn, string text
+where Test::learnEdits(file, line, operation, startColumn, endColumn, text)
+select file, line, operation, startColumn, endColumn, text

python/ql/test/library-tests/InlineExpectationsTest/learn-edits/test.py

@@ -1 +1,3 @@
 target = 1  # $ direct[alias] foreign
+target_continuation = 1 \
+    + 1

shared/util/codeql/util/test/InlineExpectationsTest.qll

@@ -124,6 +124,12 @@ signature module InlineExpectationsTestSig {
   bindingset[relativePath]
   string getStartCommentMarker(string relativePath);
 
+  /**
+   * Holds if a comment can safely be appended at the end of `line` in `relativePath`.
+   */
+  bindingset[relativePath, line]
+  default predicate canAppendCommentAtEndOfLine(string relativePath, int line) { any() }
+
   /**
    * Gets the marker that ends a comment (for example `"-->"`) in the source file with the
    * given `relativePath`. Has no result by default, which is correct for languages whose
@@ -318,6 +324,7 @@ module Make<InlineExpectationsTestSig Impl> {
           parseRelativeUrl(Impl::getRelativeUrl(comment.getLocation()), relativePath, resultLine, _,
             _, _)
         ) and
+        Impl::canAppendCommentAtEndOfLine(relativePath, resultLine) and
         file = relativePath and
         line = resultLine and
         operation = "append" and
@@ -626,7 +633,8 @@ module Make<InlineExpectationsTestSig Impl> {
           ) and
           parseRelativeUrl(Impl::getRelativeUrl(actualResult.getLocation()), relativePath, line, _,
             line, _) and
-          text = actualResult.getExpectationText()
+          text = actualResult.getExpectationText() and
+          expectationAtomRoundTrips(actualResult.getTag(), actualResult.getValue(), text)
         )
       }
 
@@ -919,6 +927,23 @@ private module ExpectationParser<InlineExpectationsTestSig Impl> {
   }
 }
 
+bindingset[tag, value, text]
+private predicate expectationAtomRoundTrips(string tag, string value, string text) {
+  exists(string content, string parsedTag, string parsedValue |
+    content = ("$ " + text).regexpCapture(expectationCommentPattern(), 1).trim() and
+    content = text and
+    content.regexpMatch(expectationPattern()) and
+    parsedTag = content.regexpCapture(expectationPattern(), 1) and
+    parsedTag = tag and
+    (
+      parsedValue = content.regexpCapture(expectationPattern(), 2)
+      or
+      not exists(content.regexpCapture(expectationPattern(), 2)) and parsedValue = ""
+    ) and
+    parsedValue = value
+  )
+}
+
 /**
  * Provides logic for creating a `@kind test-postprocess` query that checks
  * inline test expectations using `$ Alert` markers.
@@ -1564,21 +1589,29 @@ module TestPostProcessing {
       }
 
       /**
-       * Renders a current-query atom in its canonical cohort form: bare when every member produces
-       * it, otherwise qualified with the current query ID.
+       * Renders a current-query tag in its canonical cohort form: bare when every member produces
+       * the atom, otherwise qualified with the current query ID.
        */
       bindingset[relativePath, line, tag, value]
-      private string renderCohortAtom(string relativePath, int line, string tag, string value) {
+      private string renderCohortTag(string relativePath, int line, string tag, string value) {
         (
           not inCohortMode()
           or
           isCollapsedAtom(relativePath, line, tag, value)
         ) and
-        result = renderAtom(tag, value)
+        result = tag
         or
         inCohortMode() and
         not isCollapsedAtom(relativePath, line, tag, value) and
-        result = renderAtom(tag + "[" + getQueryId() + "]", value)
+        result = tag + "[" + getQueryId() + "]"
+      }
+
+      /**
+       * Renders a current-query atom in its canonical cohort form.
+       */
+      bindingset[relativePath, line, tag, value]
+      private string renderCohortAtom(string relativePath, int line, string tag, string value) {
+        result = renderAtom(renderCohortTag(relativePath, line, tag, value), value)
       }
 
       /**
@@ -1699,8 +1732,12 @@ module TestPostProcessing {
           ) and
           parseRelativeUrl(actualResult.getLocation().getRelativeUrl(), relativePath, endLine, _,
             endLine, _) and
-          text =
-            renderCohortAtom(relativePath, endLine, actualResult.getTag(), actualResult.getValue())
+          exists(string renderedTag |
+            renderedTag =
+              renderCohortTag(relativePath, endLine, actualResult.getTag(), actualResult.getValue()) and
+            text = renderAtom(renderedTag, actualResult.getValue()) and
+            expectationAtomRoundTrips(renderedTag, actualResult.getValue(), text)
+          )
         )
       }