Add queries for VisibleForTesting annotations

Author: Marcono1234

codeql-custom-queries-java/queries/api-misuse/using-element-visible-for-testing-from-main-code.ql

@@ -0,0 +1,47 @@
+/**
+ * Finds code which uses elements that are only intended to be used by tests.
+ * 
+ * Since these elements are not considered part of the public API, relying on them
+ * should be avoided because they could be removed in future versions or their behavior
+ * could change without any announcement.
+ * 
+ * @kind problem
+ */
+
+import java
+
+class TestOnlyAnnotation extends Annotation {
+    TestOnlyAnnotation() {
+        getType().hasName([
+            // JetBrains annotations
+            "TestOnly",
+        ])
+    }
+}
+
+from Annotatable elementForTesting, Expr usage
+where
+    (
+        elementForTesting.getAnAnnotation() instanceof TestOnlyAnnotation
+        or
+        elementForTesting.getAnAnnotation().getType().hasName([
+            // Android, Guava and JetBrains annotations
+            "VisibleForTesting",
+        ])
+        // To reduce false positives only consider elements which are public for testing and
+        // are used from other package
+        and elementForTesting.getCompilationUnit().getPackage() != usage.getCompilationUnit().getPackage()
+    )
+    and (
+        elementForTesting.(Field).getAnAccess() = usage
+        or elementForTesting = usage.(Call).getCallee().getSourceDeclaration()
+        or elementForTesting = usage.(TypeAccess).getType().(RefType).getSourceDeclaration()
+    )
+    // Ignore if access is from test code
+    and not (
+        usage.getEnclosingCallable().getDeclaringType() instanceof TestClass
+        or usage.getFile().getAbsolutePath().matches("%/test/%")
+    )
+    // Ignore if caller is itself also only intended for testing
+    and not usage.getEnclosingCallable().getAnAnnotation() instanceof TestOnlyAnnotation
+select usage, "Uses element '$@' which is only visible for testing", elementForTesting, elementForTesting.getName()

codeql-custom-queries-java/queries/error-prone/protected-or-public-VisibleForTesting.ql

@@ -0,0 +1,30 @@
+/**
+ * Finds `protected` and `public` elements which are annotated with an annotation indicating
+ * that the element is only supposed to be used by test code, respectively only has increased
+ * visibility to be accessible by tests.
+ * 
+ * Prefer making the element at most package-private (i.e. no access modifier), otherwise
+ * the element might be accessed by accident outside of test code. Normally test code is in
+ * the same package and can therefore access package-private elements. If the test is not
+ * in the same package for some reason, a workaround could be to create a `public` accessor
+ * class in the same package in the test sources which provides access to package-private
+ * elements in the main source for the tests in the other package.
+ * 
+ * @kind problem
+ */
+
+import java
+
+from Annotatable annotated
+where
+    annotated.getAnAnnotation().getType().hasName([
+        // Android, Guava and JetBrains annotations
+        "VisibleForTesting",
+        // JetBrains annotations
+        "TestOnly",
+    ])
+    and (
+        annotated.(Modifiable).isProtected()
+        or annotated.(Modifiable).isPublic()
+    )
+select annotated, "Element is made publicly visible for testing; should be at most package-private"