Java: fix @Pattern sanitization for java/path-injection

[owen-mc]

There was a bug in the way this was previously implemented for this query. This PR adds a test showing the bug, fixes the bug and the test, and then refactors how barrier nodes should be created for RegexMatchs to avoid the same bug happening in future.

[Copilot]

Pull request overview

This PR fixes a bug in the java/path-injection sanitizer modeling so that regex constraints expressed via @javax.validation.constraints.Pattern are treated as sanitizers, and extends the Java query tests accordingly.

Changes:

• Update PathSanitizer.qll to handle @Pattern-based regex checks as sanitizers in the directory-characters sanitizer logic.
• Add a new Spring controller test case exercising a vulnerable flow and a @Pattern-constrained variant, and extend the test classpath with a Bean Validation stub.
• Update the expected results and add a change note documenting the analysis behavior change.

Show a summary per file

File	Description
java/ql/test/query-tests/security/CWE-022/semmle/tests/TaintedPath.expected	Updates expected results to include the new test case output.
java/ql/test/query-tests/security/CWE-022/semmle/tests/SanitizationTests2.java	Adds a new test controller covering @Pattern sanitization behavior.
java/ql/test/query-tests/security/CWE-022/semmle/tests/options	Adds the javax-validation-constraints stub to the test compilation classpath.
java/ql/lib/semmle/code/java/security/PathSanitizer.qll	Adjusts sanitizer logic to recognize annotation-based regex checks appropriately.
java/ql/lib/change-notes/2026-07-03-fix-pattern-sanitizer-tainted-path.md	Documents the analysis change in a new change note.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 3
• Review effort level: Low

[owen-mc]

DCA shows slower analysis time in apache__commons-math. However, when I download the database and run the three main queries which use these sanitizers (log injection, path injection, request forgery) I find that the first two run faster and the third slower, with no obvious causal connection to the contents of this PR.

[aschackmull]

This is poorly named, since it's not just about Regex barriers - it's a generalisation of DataFlow::BarrierGuard that also supports Annotations-as-Guards. Most of the time DataFlow::BarrierGuard will be invoked with just regular guards, but whenever it's invoked with annotations as well then this is what we want. Therefore I think it would be better to simply extend the functionality of DataFlow::BarrierGuard directly to also cover annotations, i.e. drop this module and add the annotation-guard-related disjunct directly in DataFlow::BarrierGuard in java/ql/lib/semmle/code/java/dataflow/internal/DataFlowUtil.qll.

[owen-mc]

Thanks, that is a lot better. I've force-pushed, since there isn't much point keeping the old way in the git history. The new code is in the commit "Refactor creating barriers with annotations".