Java: Resolve spurious VisibleForTestingAbuse alerts for inner class access patterns

Author: Napalys

java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.ql

@@ -15,12 +15,15 @@
 import java
 
 /**
- * Holds if a `Callable` is within some `RefType` (including through lambdas and inner classes)
+ * Holds if a `Callable` is within the same type hierarchy as `RefType`
+ * (including through lambdas, inner classes, and outer classes)
  */
 predicate isWithinType(Callable c, RefType t) {
-  c.getDeclaringType() = t
-  or
-  c.getDeclaringType().getEnclosingType*() = t
+  // Either the callable is in the target type, or they share a common enclosing type
+  exists(RefType commonType |
+    (c.getDeclaringType() = commonType or c.getDeclaringType().getEnclosingType*() = commonType) and
+    (t = commonType or t.getEnclosingType*() = commonType)
+  )
 }
 
 /**

java/ql/test/query-tests/VisibleForTestingAbuse/VisibleForTestingAbuse.expected

@@ -14,7 +14,6 @@
 | packageone/SourcePackage.java:26:31:26:42 | Annotated.m2 | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:11:26:11:27 | m2 | element |
 | packageone/SourcePackage.java:29:28:29:46 | fPublic(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:26:23:26:29 | fPublic | element |
 | packageone/SourcePackage.java:30:28:30:49 | fProtected(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:31:26:31:35 | fProtected | element |
-| packagetwo/Annotated.java:89:20:89:34 | getSize(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:79:13:79:19 | getSize | element |
 | packagetwo/Source.java:8:20:8:30 | Annotated.m | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:7:19:7:19 | m | element |
 | packagetwo/Source.java:14:17:14:29 | f(...) | Access of $@ annotated with VisibleForTesting found in production code. | packagetwo/Annotated.java:16:16:16:16 | f | element |
 | packagetwo/Source.java:20:28:20:47 | new AnnotatedClass(...) | Access of $@ annotated with VisibleForTesting found in production code. | packageone/AnnotatedClass.java:4:14:4:27 | AnnotatedClass | element |

java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/Annotated.java

@@ -86,7 +86,7 @@ int getSize() {
 
     private void useInnerClass() {
         InnerTestClass inner = new InnerTestClass();
-        int size = inner.getSize(); // $ SPURIOUS: Alert
+        int size = inner.getSize();
         String value = inner.data;
     }
 }