Java: Fix VisibleForTestingAbuse false positives in annotations

Author: Napalys

java/ql/src/Violations of Best Practice/Implementation Hiding/VisibleForTestingAbuse.ql

@@ -95,6 +95,8 @@ where
   not e.getEnclosingCallable() instanceof LikelyTestMethod and
   // not when the accessing method or any enclosing method is @VisibleForTesting (test-to-test communication)
   not isWithinVisibleForTestingContext(e.getEnclosingCallable()) and
+  // not when used in annotation contexts
+  not e.getParent*() instanceof Annotation and
   // also omit our own ql unit test where it is acceptable
   not e.getEnclosingCallable()
       .getFile()

java/ql/test/query-tests/VisibleForTestingAbuse/packagetwo/UseWithinAnnotation.java

@@ -0,0 +1,18 @@
+package packagetwo;
+
+import packageone.*;
+
+@interface Range {
+    int min() default 0;
+    int max() default 100;
+}
+
+public class UseWithinAnnotation {
+    @VisibleForTesting
+    static final int MAX_LISTING_LENGTH_MIN = 1;
+    @VisibleForTesting
+    static final int MAX_LISTING_LENGTH_MAX = 1000;
+
+    @Range(min = MAX_LISTING_LENGTH_MIN, max = MAX_LISTING_LENGTH_MAX)
+    private int maxListingLength = MAX_LISTING_LENGTH_MAX;
+}