Module TestPostProcessing
Provides logic for creating a @kind test-postprocess
query that checks
inline test expectations using $ Alert
markers.
The postprocessing query works for queries of kind problem
and path-problem
,
and each query result must have a matching $ Alert
comment. It is possible to
augment the comment with a query ID, in order to support cases where multiple
.qlref
tests share the same test code:
var x = ""; // $ Alert[rust/unused-value]
return;
foo(); // $ Alert[rust/unreachable-code]
In the example above, the $ Alert[rust/unused-value]
commment is only taken
into account in the test for the query with ID rust/unused-value
, and vice
versa for the $ Alert[rust/unreachable-code]
comment.
For path-problem
queries, each source and sink must additionally be annotated
($ Source
and $ Sink
, respectively), except when their location coincides
with the location of the alert itself, in which case only $ Alert
is needed.
Example:
var queryParam = Request.QueryString["param"]; // $ Source
Write(Html.Raw(queryParam)); // $ Alert
Morover, it is possible to tag sources with a unique identifier:
var queryParam = Request.QueryString["param"]; // $ Source=source1
Write(Html.Raw(queryParam)); // $ Alert=source1
In this case, the source and sink must have the same tag in order to be matched.
Import path
import codeql.util.test.InlineExpectationsTest