Merge pull request #21734 from owen-mc/java/fix-partial-path-traversal

Java: fix bug in partial path traversal

Author: owen-mc

java/ql/lib/change-notes/2026-04-18-partial-path-traversal-fix.md

@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `java/partial-path-traversal` and `java/partial-path-traversal-from-remote` queries now correctly recognize file separator appends using `+=`.

java/ql/lib/semmle/code/java/security/PartialPathTraversal.qll

@@ -40,8 +40,11 @@ private class CharacterLiteralFileSeparatorExpr extends FileSeparatorExpr, Chara
   CharacterLiteralFileSeparatorExpr() { this.getValue() = "/" or this.getValue() = "\\" }
 }
 
-private class FileSeparatorAppend extends AddExpr {
-  FileSeparatorAppend() { this.getRightOperand() instanceof FileSeparatorExpr }
+private class FileSeparatorAppend extends BinaryExpr {
+  FileSeparatorAppend() {
+    this.(AddExpr).getRightOperand() instanceof FileSeparatorExpr or
+    this.(AssignAddExpr).getRightOperand() instanceof FileSeparatorExpr
+  }
 }
 
 private predicate isSafe(Expr expr) {

java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversal.qlref

@@ -1 +1,4 @@
-Security/CWE/CWE-023/PartialPathTraversal.ql
+query: Security/CWE/CWE-023/PartialPathTraversal.ql
+postprocess:
+  - utils/test/PrettyPrintModels.ql
+  - utils/test/InlineExpectationsTestQuery.ql