Ruby: Address testFailures in inline expectations tests (part 2)

[geoffw0]

Address further testFailures in inline expectations tests. Annotations should always be updated so that the testFailures section of the .expected file is empty.

The improper_memoization.rb change is trivial. The other one is in a .erb file, so I had to add support for inline expectations comments in .erb files in order to make the testFailures result go away. I'm fairly happy with that aspect of the PR.

I'd appreciate confirmation that the taint flow result in the .erb is a valid result, and shouldn't be marked as SPURIOUS:. It looks like that's the intent, but I wasn't 100% confident what was going on.

[Copilot]

Pull request overview

This PR fixes remaining failures in Ruby inline-expectations-based tests by (1) updating test annotations to match intended outcomes and (2) extending the Ruby inline expectations implementation so expectation markers can be written in .erb template comments.

Changes:

• Mark the improper_memoization.rb m14 result as a known false positive (SPURIOUS) to eliminate an “Unexpected result” test failure.
• Add support for parsing inline expectation markers from ERB comments (<%# ... %>) in the Ruby inline expectations test implementation.
• Update the Sinatra ERB view test to annotate the expected taint flow on the relevant line, clearing the .expected file testFailures section.

Show a summary per file

File	Description
ruby/ql/test/query-tests/experimental/improper-memoization/ImproperMemoization.expected	Removes a testFailures entry now that the test source is annotated appropriately.
ruby/ql/test/query-tests/experimental/improper-memoization/improper_memoization.rb	Adds an inline SPURIOUS annotation for m14 on the end line.
ruby/ql/test/library-tests/frameworks/sinatra/views/index.erb	Adds an ERB comment inline expectation for hasTaintFlow on the sink line.
ruby/ql/test/library-tests/frameworks/sinatra/Flow.expected	Removes the testFailures entry for the ERB taint flow result.
ruby/ql/lib/utils/test/internal/InlineExpectationsTestImpl.qll	Extends Ruby inline expectations comment handling to include ERB comment tokens.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Low

[hvitved]

Why not just inline this into ExpectationComment?

[geoffw0]

Done. I've also cleaned up the CodeQL slightly using any.

[hvitved]

One more small suggestion.

[hvitved]

Suggested change

	string toString() {
	result = any(Ruby::Comment c | this = RubyComment(c)).toString()
	or
	result = any(R::ErbComment c | this = ErbComment(c)).toString()
	}
	Location getLocation() {
	result = any(Ruby::Comment c | this = RubyComment(c)).getLocation()
	or
	result = any(R::ErbComment c | this = ErbComment(c)).getLocation()
	}
	string getContents() {
	result = any(Ruby::Comment c | this = RubyComment(c)).getValue().suffix(1)
	or
	result = any(R::ErbComment c | this = ErbComment(c)).getValue().suffix(1)
	}
	Ruby::Comment asRubyComment() { this = RubyComment(result) }
	R::ErbComment asErbComment() { this = ErbComment(result) }
	string toString() {
	result = this.asRubyComment().toString()
	or
	result = this.asErbComment().toString()
	}
	Location getLocation() {
	result = this.asRubyComment().getLocation()
	or
	result = this.asErbComment().getLocation()
	}
	string getContents() {
	result = this.asRubyComment().getValue().suffix(1)
	or
	result = this.asErbComment().getValue().suffix(1)
	}