Java: fix bug in partial path traversal

[owen-mc]

The code to recognise file separator appends worked for x = x + File.separator but not for +=, as in x += File.separator.

[Copilot]

Pull request overview

Fixes recognition of file-separator appends in the Java partial path traversal queries so that x += File.separator is handled correctly (in addition to x = x + File.separator), and updates the associated tests and release notes.

Changes:

• Extend the separator-append detection to cover += in the PartialPathTraversal library.
• Convert the PartialPathTraversal test to inline expectations with per-query alert IDs and add a regression case for += File.separator.
• Add a changelog entry describing the analysis fix.

Show a summary per file

File	Description
java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversalTest.java	Updates inline alert expectations to be query-id specific and adds foo25 covering path += File.separator.
java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversal.qlref	Switches to query: + postprocess: format and enables PrettyPrintModels + InlineExpectations postprocessing.
java/ql/lib/semmle/code/java/security/PartialPathTraversal.qll	Updates separator-append matching to include compound += expressions.
java/ql/lib/change-notes/2026-04-18-partial-path-traversal-fix.md	Adds change note for the fix affecting both query variants.

Copilot's findings

Comments suppressed due to low confidence (1)

java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversalTest.java:238

• Adding foo25 here shifts all subsequent line numbers in PartialPathTraversalTest.java. The PartialPathTraversalFromRemoteTest.expected file references later locations (for example around the sock.getInputStream() source currently on line 260), so its expected output will need to be regenerated/updated to account for the new line numbering.

    void foo25(File parent) throws IOException {
        String path = parent.getCanonicalPath();
        path += File.separator;
        if (!dir().getCanonicalPath().startsWith(path)) {
            throw new IOException("Invalid directory: " + dir().getCanonicalPath());
        }
    }

• Files reviewed: 4/4 changed files
• Comments generated: 1

[owen-mc]

Rerun has been triggered: 4 restarted 🚀

• Java Integration tests Windows
• Java Language Tests Linux
• Java Integration tests MacOS
• Unit Tests Windows

[aschackmull]

LGTM