Add SPURIOUS test for += File.separator

Author: owen-mc

java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversal.expected

@@ -14,3 +14,4 @@
 | PartialPathTraversalTest.java:176:14:176:65 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal. |
 | PartialPathTraversalTest.java:194:18:194:87 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal. |
 | PartialPathTraversalTest.java:212:14:212:64 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal. |
+| PartialPathTraversalTest.java:234:14:234:54 | startsWith(...) | Partial Path Traversal Vulnerability due to insufficient guard against path traversal. |

java/ql/test/query-tests/security/CWE-023/semmle/tests/PartialPathTraversalTest.java

@@ -228,6 +228,14 @@ void foo24(File parent) throws IOException {
         }
     }
 
+    void foo25(File parent) throws IOException {
+        String path = parent.getCanonicalPath();
+        path += File.separator;
+        if (!dir().getCanonicalPath().startsWith(path)) { // $ SPURIOUS: Alert[java/partial-path-traversal-from-remote] Alert[java/partial-path-traversal]
+            throw new IOException("Invalid directory: " + dir().getCanonicalPath());
+        }
+    }
+
     public void doesNotFlagOptimalSafeVersion(File parent) throws IOException {
         if (!dir().toPath().normalize().startsWith(parent.toPath())) { // Safe
             throw new IOException("Path traversal attempt: " + dir().getCanonicalPath());