query: reject duplicate selected properties by berezovskyi · Pull Request #1010 · OSLC/oslc4net

berezovskyi · 2026-09-19T13:23:41Z

Summary

Reject duplicate selected properties with ParseException during select and properties parsing.
Harden prefix URI extraction and keep the PascalCase ParseProperties API while retaining the legacy lower-case alias.
Document the intentional RDF namespace URL literals for the scanner and consolidate duplicate-selection regression coverage.

Validation

Full non-server test suite: 154 passed, 1 pre-existing skip.
OSLC4Net.Fuzzing Release build: 0 warnings, 0 errors.
Local AFL++ 5.03c setup reached the target but could not complete the fork-server handshake on macOS; no crash files were produced.

Follow-up to #1008 addressing its review comments.

coderabbitai · 2026-09-19T13:23:47Z

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: OSLC/oslc4net/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: da472d68-4fda-40a0-9174-55ab58b91d1e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

codacy-production · 2026-09-19T13:25:51Z

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 12 complexity · -2 duplication

Metric Results

Complexity 12

Duplication -2

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

codecov · 2026-09-19T13:26:55Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 54.69%. Comparing base (36697d5) to head (1e9bc7c).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1010      +/-   ##
==========================================
+ Coverage   54.64%   54.69%   +0.04%     
==========================================
  Files         184      184              
  Lines       10979    10998      +19     
  Branches     1188     1194       +6     
==========================================
+ Hits         6000     6015      +15     
- Misses       4673     4675       +2     
- Partials      306      308       +2

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codacy-production

Pull Request Overview

This PR implements validation to reject duplicate selected properties in OSLC queries and refactors the property parsing API. While the core logic for flat and nested properties is sound, there is a logic gap regarding nested wildcards (e.g., '*{a}, *{b}') which currently bypasses the duplicate check and is silently merged later in the processing pipeline.

Codacy analysis indicates the PR is up to standards, though complexity in QueryUtils.cs has increased significantly (+12) due to the new recursive validation logic. Notably, several acceptance criteria related to prefix URI hardening and the legacy API alias lack corresponding unit tests to verify failure cases.

About this PR

The new prefix URI validation logic (line 62 in QueryUtils.cs) and the legacy alias 'parseProperties' lack specific unit tests to verify failure cases (missing brackets, empty URIs) or functional parity.

Test suggestions

Reject duplicate top-level properties in oslc.select (e.g., 'p1,p1')
Reject duplicate nested properties in oslc.select (e.g., 'p1{a},p1{b}')
Reject duplicate properties in oslc.properties
Throw ParseException for prefix URIs missing angle brackets
Throw ParseException for empty prefix URIs (e.g., '<>')
Verify 'parseProperties' legacy alias correctly calls 'ParseProperties'
Ensure full coverage for recursive property validation in QueryUtils.cs

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Throw ParseException for prefix URIs missing angle brackets
2. Throw ParseException for empty prefix URIs (e.g., '<>')
3. Verify 'parseProperties' legacy alias correctly calls 'ParseProperties'
4. Ensure full coverage for recursive property validation in QueryUtils.cs

_{TIP Improve review quality by adding custom instructions}
_{TIP How was this review? Give us feedback}

codacy-production · 2026-09-19T13:27:08Z

+        {
+            if (property is NestedProperty nestedProperty)
+            {
+                if (!property.IsWildcard &&


_{🟡 MEDIUM RISK}

The validation for NestedProperty explicitly skips the duplicate identifier check when IsWildcard is true. This allows multiple nested wildcards (e.g., '*{a}, *{b}') to bypass validation and be silently merged later during inversion (lines 363-368), contradicting the goal of strictly rejecting all duplicate selections. Wildcards should be tracked in the selectedProperties set just like named properties to ensure uniqueness.

codacy-production · 2026-09-19T13:27:08Z

+    ) => ParseProperties(propertiesExpression, prefixMap);
+
+    private static void
+    ValidateNoDuplicateProperties(Properties properties)


_{🟡 MEDIUM RISK}

This method introduces recursive property validation, contributing to a complexity increase of 12 for this file. As the coverage report is currently unavailable for this complex file, ensure that the new test cases in QueryBasicTest.cs provide full coverage for both flat and nested duplicate scenarios.

See Complexity in Codacy

codacy-production · 2026-09-19T13:27:08Z

+    GetPropertyName(Property property)
+    {
+        var propertyName = property.Identifier;
+        return propertyName.ns + propertyName.local;


_{🟡 MEDIUM RISK}

Suggestion: Concatenating the namespace and local name without a delimiter can lead to false-positive duplicate detection if different combinations result in the same string (e.g., 'urn:a:' + 'bc' vs 'urn:ab:' + 'c'). Consider using a delimiter like '|' to ensure property identity is unique.

codacy-production · 2026-09-19T13:27:08Z

-        ["rdf"] = "http://www.w3.org/1999/02/22-rdf-syntax-ns#",
-        ["xs"] = "http://www.w3.org/2001/XMLSchema"
+        ["dcterms"] = "http://purl.org/dc/terms/", // NOSONAR: RDF namespace identifier, not a network endpoint.
+        ["oslc"] = "http://open-services.net/ns/core#", // NOSONAR: RDF namespace identifier, not a network endpoint.


_{⚪ LOW RISK}

This URI is a standard RDF namespace identifier, not a network endpoint. The developer's use of // NOSONAR correctly identifies this as a false positive, as changing it to 'https' would break the string identity required for RDF compatibility.

See Issue in Codacy
See Issue in Codacy

query: reject duplicate selected properties

f26a483

berezovskyi requested a review from a team as a code owner September 19, 2026 13:23

codacy-production Bot reviewed Sep 19, 2026

View reviewed changes

build: use explicit CodeQL build steps

1e9bc7c

Navigation Menu

query: reject duplicate selected properties - #1010

query: reject duplicate selected properties#1010
berezovskyi wants to merge 2 commits into
mainfrom
codex/fuzzing-cleanup

berezovskyi commented Sep 19, 2026

Uh oh!

coderabbitai Bot commented Sep 19, 2026 •

edited

Loading

Review skipped

Uh oh!

codacy-production Bot commented Sep 19, 2026

Uh oh!

codecov Bot commented Sep 19, 2026 •

edited

Loading

Uh oh!

codacy-production Bot left a comment

Uh oh!

codacy-production Bot Sep 19, 2026

Uh oh!

codacy-production Bot Sep 19, 2026

Uh oh!

codacy-production Bot Sep 19, 2026

Uh oh!

codacy-production Bot Sep 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

berezovskyi commented Sep 19, 2026

Summary

Validation

Uh oh!

coderabbitai Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

codacy-production Bot commented Sep 19, 2026

Up to standards ✅

Uh oh!

codecov Bot commented Sep 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codacy-production Bot left a comment

Choose a reason for hiding this comment

Pull Request Overview

About this PR

Test suggestions

Uh oh!

codacy-production Bot Sep 19, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Sep 19, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Sep 19, 2026

Choose a reason for hiding this comment

Uh oh!

codacy-production Bot Sep 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Sep 19, 2026 •

edited

Loading

codecov Bot commented Sep 19, 2026 •

edited

Loading