Convert to inline expectations test

owen-mc · owen-mc · commit c7cac9629bd2 · 2026-07-03T09:27:40.000+01:00
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-295/AcceptAnyCertificate/AcceptAnyCertificate.expected b/csharp/ql/test/query-tests/Security Features/CWE-295/AcceptAnyCertificate/AcceptAnyCertificate.expected
@@ -1,3 +1,16 @@
+#select
+| Test.cs:14:13:14:57 | (...) => ... | Test.cs:14:13:14:57 | (...) => ... | Test.cs:14:13:14:57 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:14:13:14:57 | (...) => ... | uses a callback |
+| Test.cs:22:13:25:13 | (...) => ... | Test.cs:22:13:25:13 | (...) => ... | Test.cs:22:13:25:13 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:22:13:25:13 | (...) => ... | uses a callback |
+| Test.cs:33:13:33:74 | access to property DangerousAcceptAnyServerCertificateValidator | Test.cs:33:13:33:74 | access to property DangerousAcceptAnyServerCertificateValidator | Test.cs:33:13:33:74 | access to property DangerousAcceptAnyServerCertificateValidator | This TLS certificate validation $@, which trusts any certificate. | Test.cs:33:13:33:74 | access to property DangerousAcceptAnyServerCertificateValidator | uses a callback |
+| Test.cs:40:13:40:56 | (...) => ... | Test.cs:40:13:40:56 | (...) => ... | Test.cs:40:13:40:56 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:40:13:40:56 | (...) => ... | uses a callback |
+| Test.cs:47:13:47:61 | (...) => ... | Test.cs:47:13:47:61 | (...) => ... | Test.cs:47:13:47:61 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:47:13:47:61 | (...) => ... | uses a callback |
+| Test.cs:49:68:49:87 | (...) => ... | Test.cs:49:68:49:87 | (...) => ... | Test.cs:49:68:49:87 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:49:68:49:87 | (...) => ... | uses a callback |
+| Test.cs:51:68:51:92 | delegate(...) { ... } | Test.cs:51:68:51:92 | delegate(...) { ... } | Test.cs:51:68:51:92 | delegate(...) { ... } | This TLS certificate validation $@, which trusts any certificate. | Test.cs:51:68:51:92 | delegate(...) { ... } | uses a callback |
+| Test.cs:69:67:69:75 | delegate creation of type RemoteCertificateValidationCallback | Test.cs:69:67:69:75 | delegate creation of type RemoteCertificateValidationCallback | Test.cs:69:67:69:75 | delegate creation of type RemoteCertificateValidationCallback | This TLS certificate validation $@, which trusts any certificate. | Test.cs:69:67:69:75 | delegate creation of type RemoteCertificateValidationCallback | uses a callback |
+| Test.cs:76:13:76:76 | delegate creation of type RemoteCertificateValidationCallback | Test.cs:76:13:76:76 | delegate creation of type RemoteCertificateValidationCallback | Test.cs:76:13:76:76 | delegate creation of type RemoteCertificateValidationCallback | This TLS certificate validation $@, which trusts any certificate. | Test.cs:76:13:76:76 | delegate creation of type RemoteCertificateValidationCallback | uses a callback |
+| Test.cs:83:13:83:56 | (...) => ... | Test.cs:83:13:83:56 | (...) => ... | Test.cs:83:13:83:56 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:83:13:83:56 | (...) => ... | uses a callback |
+| Test.cs:89:13:89:56 | (...) => ... | Test.cs:89:13:89:56 | (...) => ... | Test.cs:89:13:89:56 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:89:13:89:56 | (...) => ... | uses a callback |
+| Test.cs:91:48:91:55 | access to local variable callback | Test.cs:89:13:89:56 | (...) => ... : (...) => ... | Test.cs:91:48:91:55 | access to local variable callback | This TLS certificate validation $@, which trusts any certificate. | Test.cs:89:13:89:56 | (...) => ... | uses a callback |
 edges
 | Test.cs:88:45:88:52 | access to local variable callback : (...) => ... | Test.cs:91:48:91:55 | access to local variable callback | provenance |  |
 | Test.cs:89:13:89:56 | (...) => ... : (...) => ... | Test.cs:88:45:88:52 | access to local variable callback : (...) => ... | provenance |  |
@@ -17,16 +30,3 @@ nodes
 | Test.cs:89:13:89:56 | (...) => ... : (...) => ... | semmle.label | (...) => ... : (...) => ... |
 | Test.cs:91:48:91:55 | access to local variable callback | semmle.label | access to local variable callback |
 subpaths
-#select
-| Test.cs:14:13:14:57 | (...) => ... | Test.cs:14:13:14:57 | (...) => ... | Test.cs:14:13:14:57 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:14:13:14:57 | (...) => ... | uses a callback |
-| Test.cs:22:13:25:13 | (...) => ... | Test.cs:22:13:25:13 | (...) => ... | Test.cs:22:13:25:13 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:22:13:25:13 | (...) => ... | uses a callback |
-| Test.cs:33:13:33:74 | access to property DangerousAcceptAnyServerCertificateValidator | Test.cs:33:13:33:74 | access to property DangerousAcceptAnyServerCertificateValidator | Test.cs:33:13:33:74 | access to property DangerousAcceptAnyServerCertificateValidator | This TLS certificate validation $@, which trusts any certificate. | Test.cs:33:13:33:74 | access to property DangerousAcceptAnyServerCertificateValidator | uses a callback |
-| Test.cs:40:13:40:56 | (...) => ... | Test.cs:40:13:40:56 | (...) => ... | Test.cs:40:13:40:56 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:40:13:40:56 | (...) => ... | uses a callback |
-| Test.cs:47:13:47:61 | (...) => ... | Test.cs:47:13:47:61 | (...) => ... | Test.cs:47:13:47:61 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:47:13:47:61 | (...) => ... | uses a callback |
-| Test.cs:49:68:49:87 | (...) => ... | Test.cs:49:68:49:87 | (...) => ... | Test.cs:49:68:49:87 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:49:68:49:87 | (...) => ... | uses a callback |
-| Test.cs:51:68:51:92 | delegate(...) { ... } | Test.cs:51:68:51:92 | delegate(...) { ... } | Test.cs:51:68:51:92 | delegate(...) { ... } | This TLS certificate validation $@, which trusts any certificate. | Test.cs:51:68:51:92 | delegate(...) { ... } | uses a callback |
-| Test.cs:69:67:69:75 | delegate creation of type RemoteCertificateValidationCallback | Test.cs:69:67:69:75 | delegate creation of type RemoteCertificateValidationCallback | Test.cs:69:67:69:75 | delegate creation of type RemoteCertificateValidationCallback | This TLS certificate validation $@, which trusts any certificate. | Test.cs:69:67:69:75 | delegate creation of type RemoteCertificateValidationCallback | uses a callback |
-| Test.cs:76:13:76:76 | delegate creation of type RemoteCertificateValidationCallback | Test.cs:76:13:76:76 | delegate creation of type RemoteCertificateValidationCallback | Test.cs:76:13:76:76 | delegate creation of type RemoteCertificateValidationCallback | This TLS certificate validation $@, which trusts any certificate. | Test.cs:76:13:76:76 | delegate creation of type RemoteCertificateValidationCallback | uses a callback |
-| Test.cs:83:13:83:56 | (...) => ... | Test.cs:83:13:83:56 | (...) => ... | Test.cs:83:13:83:56 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:83:13:83:56 | (...) => ... | uses a callback |
-| Test.cs:89:13:89:56 | (...) => ... | Test.cs:89:13:89:56 | (...) => ... | Test.cs:89:13:89:56 | (...) => ... | This TLS certificate validation $@, which trusts any certificate. | Test.cs:89:13:89:56 | (...) => ... | uses a callback |
-| Test.cs:91:48:91:55 | access to local variable callback | Test.cs:89:13:89:56 | (...) => ... : (...) => ... | Test.cs:91:48:91:55 | access to local variable callback | This TLS certificate validation $@, which trusts any certificate. | Test.cs:89:13:89:56 | (...) => ... | uses a callback |
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-295/AcceptAnyCertificate/AcceptAnyCertificate.qlref b/csharp/ql/test/query-tests/Security Features/CWE-295/AcceptAnyCertificate/AcceptAnyCertificate.qlref
@@ -1 +1,2 @@
-Security Features/CWE-295/AcceptAnyCertificate.ql
+query: Security Features/CWE-295/AcceptAnyCertificate.ql
+postprocess: utils/test/InlineExpectationsTestQuery.ql
diff --git a/csharp/ql/test/query-tests/Security Features/CWE-295/AcceptAnyCertificate/Test.cs b/csharp/ql/test/query-tests/Security Features/CWE-295/AcceptAnyCertificate/Test.cs
@@ -11,7 +11,7 @@ public void HttpClientHandlerBad()
         var handler = new HttpClientHandler();
         // BAD: always trusts any certificate.
         handler.ServerCertificateCustomValidationCallback =
-            (request, certificate, chain, errors) => true;
+            (request, certificate, chain, errors) => true; // $ Alert
     }
 
     public void HttpClientHandlerBlockBodyBad()
@@ -22,33 +22,33 @@ public void HttpClientHandlerBlockBodyBad()
             (request, certificate, chain, errors) =>
             {
                 return true;
-            };
+            }; // $ Alert
     }
 
     public void HttpClientHandlerDangerousBad()
     {
         var handler = new HttpClientHandler();
         // BAD: built-in callback that accepts any certificate.
         handler.ServerCertificateCustomValidationCallback =
-            HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;
+            HttpClientHandler.DangerousAcceptAnyServerCertificateValidator; // $ Alert
     }
 
     public void ServicePointManagerBad()
     {
         // BAD: always trusts any certificate.
         ServicePointManager.ServerCertificateValidationCallback =
-            (sender, certificate, chain, errors) => true;
+            (sender, certificate, chain, errors) => true; // $ Alert
     }
 
     public void ServicePointManagerCompoundBad()
     {
         // BAD: always trusts any certificate (compound assignment).
         ServicePointManager.ServerCertificateValidationCallback +=
-            (sender, cert, chain, errors) => { return true; };
+            (sender, cert, chain, errors) => { return true; }; // $ Alert
         // BAD
-        ServicePointManager.ServerCertificateValidationCallback += (a, b, c, d) => true;
+        ServicePointManager.ServerCertificateValidationCallback += (a, b, c, d) => true; // $ Alert
         // BAD: parameterless anonymous method.
-        ServicePointManager.ServerCertificateValidationCallback += delegate { return true; };
+        ServicePointManager.ServerCertificateValidationCallback += delegate { return true; }; // $ Alert
     }
 
     private static bool AcceptAll(object sender, X509Certificate certificate, X509Chain chain,
@@ -66,29 +66,29 @@ public bool AcceptAllNonStatic(object sender, X509Certificate certificate, X509C
     public void MethodGroupBad()
     {
         // BAD: the referenced static method always returns true.
-        ServicePointManager.ServerCertificateValidationCallback = AcceptAll;
+        ServicePointManager.ServerCertificateValidationCallback = AcceptAll; // $ Alert
     }
 
     public void MethodGroupNonStaticBad()
     {
         // BAD: the referenced instance method always returns true.
         ServicePointManager.ServerCertificateValidationCallback =
-            new RemoteCertificateValidationCallback(this.AcceptAllNonStatic);
+            new RemoteCertificateValidationCallback(this.AcceptAllNonStatic); // $ Alert
     }
 
     public void SslStreamBad(Stream stream)
     {
         // BAD: the validation callback always returns true.
         var ssl = new SslStream(stream, false,
-            (sender, certificate, chain, errors) => true);
+            (sender, certificate, chain, errors) => true); // $ Alert
     }
 
     public void IndirectBad(Stream stream)
     {
         RemoteCertificateValidationCallback callback =
-            (sender, certificate, chain, errors) => true;
+            (sender, certificate, chain, errors) => true; // $ Source Alert
         // BAD: the callback flowing here always returns true.
-        var ssl = new SslStream(stream, false, callback);
+        var ssl = new SslStream(stream, false, callback); // $ Alert
     }
 
     public void HttpClientHandlerGood()

Original file line number	Diff line number	Diff line change
`@@ -1 +1,2 @@`
`1`		`-Security Features/CWE-295/AcceptAnyCertificate.ql`
	`1`	`+query: Security Features/CWE-295/AcceptAnyCertificate.ql`
	`2`	`+postprocess: utils/test/InlineExpectationsTestQuery.ql`
Original file line number	Diff line number	Diff line change
`@@ -11,7 +11,7 @@ public void HttpClientHandlerBad()`
`11`	`11`	`var handler = new HttpClientHandler();`
`12`	`12`	`// BAD: always trusts any certificate.`
`13`	`13`	`handler.ServerCertificateCustomValidationCallback =`
`14`		`- (request, certificate, chain, errors) => true;`
	`14`	`+ (request, certificate, chain, errors) => true; // $ Alert`
`15`	`15`	`}`
`16`	`16`
`17`	`17`	`public void HttpClientHandlerBlockBodyBad()`
`@@ -22,33 +22,33 @@ public void HttpClientHandlerBlockBodyBad()`
`22`	`22`	`(request, certificate, chain, errors) =>`
`23`	`23`	`{`
`24`	`24`	`return true;`
`25`		`- };`
	`25`	`+ }; // $ Alert`
`26`	`26`	`}`
`27`	`27`
`28`	`28`	`public void HttpClientHandlerDangerousBad()`
`29`	`29`	`{`
`30`	`30`	`var handler = new HttpClientHandler();`
`31`	`31`	`// BAD: built-in callback that accepts any certificate.`
`32`	`32`	`handler.ServerCertificateCustomValidationCallback =`
`33`		`- HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;`
	`33`	`+ HttpClientHandler.DangerousAcceptAnyServerCertificateValidator; // $ Alert`
`34`	`34`	`}`
`35`	`35`
`36`	`36`	`public void ServicePointManagerBad()`
`37`	`37`	`{`
`38`	`38`	`// BAD: always trusts any certificate.`
`39`	`39`	`ServicePointManager.ServerCertificateValidationCallback =`
`40`		`- (sender, certificate, chain, errors) => true;`
	`40`	`+ (sender, certificate, chain, errors) => true; // $ Alert`
`41`	`41`	`}`
`42`	`42`
`43`	`43`	`public void ServicePointManagerCompoundBad()`
`44`	`44`	`{`
`45`	`45`	`// BAD: always trusts any certificate (compound assignment).`
`46`	`46`	`ServicePointManager.ServerCertificateValidationCallback +=`
`47`		`- (sender, cert, chain, errors) => { return true; };`
	`47`	`+ (sender, cert, chain, errors) => { return true; }; // $ Alert`
`48`	`48`	`// BAD`
`49`		`- ServicePointManager.ServerCertificateValidationCallback += (a, b, c, d) => true;`
	`49`	`+ ServicePointManager.ServerCertificateValidationCallback += (a, b, c, d) => true; // $ Alert`
`50`	`50`	`// BAD: parameterless anonymous method.`
`51`		`- ServicePointManager.ServerCertificateValidationCallback += delegate { return true; };`
	`51`	`+ ServicePointManager.ServerCertificateValidationCallback += delegate { return true; }; // $ Alert`
`52`	`52`	`}`
`53`	`53`
`54`	`54`	`private static bool AcceptAll(object sender, X509Certificate certificate, X509Chain chain,`
`@@ -66,29 +66,29 @@ public bool AcceptAllNonStatic(object sender, X509Certificate certificate, X509C`
`66`	`66`	`public void MethodGroupBad()`
`67`	`67`	`{`
`68`	`68`	`// BAD: the referenced static method always returns true.`
`69`		`- ServicePointManager.ServerCertificateValidationCallback = AcceptAll;`
	`69`	`+ ServicePointManager.ServerCertificateValidationCallback = AcceptAll; // $ Alert`
`70`	`70`	`}`
`71`	`71`
`72`	`72`	`public void MethodGroupNonStaticBad()`
`73`	`73`	`{`
`74`	`74`	`// BAD: the referenced instance method always returns true.`
`75`	`75`	`ServicePointManager.ServerCertificateValidationCallback =`
`76`		`- new RemoteCertificateValidationCallback(this.AcceptAllNonStatic);`
	`76`	`+ new RemoteCertificateValidationCallback(this.AcceptAllNonStatic); // $ Alert`
`77`	`77`	`}`
`78`	`78`
`79`	`79`	`public void SslStreamBad(Stream stream)`
`80`	`80`	`{`
`81`	`81`	`// BAD: the validation callback always returns true.`
`82`	`82`	`var ssl = new SslStream(stream, false,`
`83`		`- (sender, certificate, chain, errors) => true);`
	`83`	`+ (sender, certificate, chain, errors) => true); // $ Alert`
`84`	`84`	`}`
`85`	`85`
`86`	`86`	`public void IndirectBad(Stream stream)`
`87`	`87`	`{`
`88`	`88`	`RemoteCertificateValidationCallback callback =`
`89`		`- (sender, certificate, chain, errors) => true;`
	`89`	`+ (sender, certificate, chain, errors) => true; // $ Source Alert`
`90`	`90`	`// BAD: the callback flowing here always returns true.`
`91`		`- var ssl = new SslStream(stream, false, callback);`
	`91`	`+ var ssl = new SslStream(stream, false, callback); // $ Alert`
`92`	`92`	`}`
`93`	`93`
`94`	`94`	`public void HttpClientHandlerGood()`