Updates for compatibility with main-merged PRs

Author: data-douser

client/internal/testing/runner.go

@@ -223,6 +223,10 @@ func (r *Runner) runSingleTest(toolName, testCase, toolDir string) {
 	// Resolve {{tmpdir}} placeholders in all params
 	params = resolvePathPlaceholders(params, r.tmpBase)
 
+	// Clean up stale interpretedOutput from prior test runs so that
+	// directory comparisons only see output from this invocation.
+	cleanStaleOutput(toolName, params, ".")
+
 	// Call the tool (using server tool name which may differ from fixture dir name)
 	content, isError, callErr := r.caller.CallToolRaw(serverToolName, params)
 	elapsed := time.Since(start)
@@ -438,6 +442,37 @@ func fileExists(path string) bool {
 	return err == nil
 }
 
+// cleanStaleOutput removes stale interpretedOutput files or directories from
+// prior codeql_query_run test invocations. This prevents stale results from
+// affecting directory comparisons. Only relative paths without directory
+// traversals are cleaned (CWE-22 prevention).
+func cleanStaleOutput(toolName string, params map[string]any, baseDir string) {
+	if toolName != "codeql_query_run" {
+		return
+	}
+	outputVal, ok := params["interpretedOutput"]
+	if !ok {
+		return
+	}
+	outputPath, ok := outputVal.(string)
+	if !ok || outputPath == "" {
+		return
+	}
+
+	normalized := filepath.Clean(outputPath)
+
+	// Reject absolute paths and directory traversals (CWE-22).
+	if filepath.IsAbs(normalized) ||
+		strings.HasPrefix(normalized, ".."+string(filepath.Separator)) ||
+		normalized == ".." {
+		fmt.Fprintf(os.Stderr, "  Skipping interpretedOutput cleanup: unsafe path %q\n", outputPath)
+		return
+	}
+
+	fullPath := filepath.Join(baseDir, normalized)
+	os.RemoveAll(fullPath)
+}
+
 func truncate(s string, max int) string {
 	s = strings.ReplaceAll(s, "\n", " ")
 	if len(s) > max {

client/internal/testing/runner_test.go

@@ -365,3 +365,98 @@ func TestRunnerAssertionFailure(t *testing.T) {
 		t.Error("mock_tool/assertion_test result not found")
 	}
 }
+
+func TestCleanStaleOutputRelativeFile(t *testing.T) {
+	dir := t.TempDir()
+	staleFile := filepath.Join(dir, "query-results.sarif")
+	os.WriteFile(staleFile, []byte("stale"), 0o600)
+
+	params := map[string]any{
+		"interpretedOutput": "query-results.sarif",
+	}
+
+	cleanStaleOutput("codeql_query_run", params, dir)
+
+	if fileExists(staleFile) {
+		t.Error("expected stale file to be removed")
+	}
+}
+
+func TestCleanStaleOutputRelativeDir(t *testing.T) {
+	dir := t.TempDir()
+	staleDir := filepath.Join(dir, "query-results")
+	os.MkdirAll(filepath.Join(staleDir, "subdir"), 0o755)
+	os.WriteFile(filepath.Join(staleDir, "subdir", "file.txt"), []byte("stale"), 0o600)
+
+	params := map[string]any{
+		"interpretedOutput": "query-results",
+	}
+
+	cleanStaleOutput("codeql_query_run", params, dir)
+
+	if fileExists(staleDir) {
+		t.Error("expected stale directory to be removed")
+	}
+}
+
+func TestCleanStaleOutputRejectsAbsolutePath(t *testing.T) {
+	dir := t.TempDir()
+	absFile := filepath.Join(dir, "safe-file")
+	os.WriteFile(absFile, []byte("keep"), 0o600)
+
+	params := map[string]any{
+		"interpretedOutput": absFile, // absolute path
+	}
+
+	cleanStaleOutput("codeql_query_run", params, dir)
+
+	if !fileExists(absFile) {
+		t.Error("absolute path should NOT be removed")
+	}
+}
+
+func TestCleanStaleOutputRejectsTraversal(t *testing.T) {
+	dir := t.TempDir()
+	parentFile := filepath.Join(dir, "parent-file")
+	os.WriteFile(parentFile, []byte("keep"), 0o600)
+
+	childDir := filepath.Join(dir, "child")
+	os.MkdirAll(childDir, 0o755)
+
+	params := map[string]any{
+		"interpretedOutput": "../parent-file",
+	}
+
+	cleanStaleOutput("codeql_query_run", params, childDir)
+
+	if !fileExists(parentFile) {
+		t.Error("traversal path should NOT be removed")
+	}
+}
+
+func TestCleanStaleOutputSkipsNonQueryRun(t *testing.T) {
+	dir := t.TempDir()
+	staleFile := filepath.Join(dir, "output.txt")
+	os.WriteFile(staleFile, []byte("keep"), 0o600)
+
+	params := map[string]any{
+		"interpretedOutput": "output.txt",
+	}
+
+	cleanStaleOutput("codeql_test_run", params, dir)
+
+	if !fileExists(staleFile) {
+		t.Error("non-codeql_query_run tool should not trigger cleanup")
+	}
+}
+
+func TestCleanStaleOutputSkipsWhenNoParam(t *testing.T) {
+	dir := t.TempDir()
+	params := map[string]any{
+		"query":    "example.ql",
+		"database": "/some/db",
+	}
+
+	// Should not panic or error — just no-op
+	cleanStaleOutput("codeql_query_run", params, dir)
+}