fix(service-patterns): end the Angular receiver rows at a separator (#2768)

The new HttpClient receiver rows matched by prefix, and an uppercase
letter after an id counts as CamelCase glue, so "this.http" also matched
this.httpAdapter.get (a NestJS route registration) and this.httpServer.post,
and "$http" matched $httpBackend.expectGET (an AngularJS test double).

Each receiver row now ends in a dot, like "gin.", plus a line-break twin
(LF, and CR for CRLF files): a chain wrapped before the verb keeps the break
in its callee text ("this.http\n      .post"). On
gothinkster/angular-realworld-example-app 5 of the 18 client calls are
written that way; with dot-only rows they fell back to phantom route
registrations. "HttpClient" duplicated the Java/C# row and
"this.httpClient." is covered by "httpClient.".

Unit cases pin both directions, and the Angular pipeline test gains a
wrapped call on both resolver routes.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>

internal/cbm/service_patterns.c

@@ -46,13 +46,25 @@ static const lib_pattern_t http_libraries[] = {
      * case-sensitive, so without this entry `Axios.get(url)` fell through to
      * the `.get` route-suffix fallback and became a route registration. */
     {"Axios", CBM_SVC_HTTP, NULL},
+    /* Angular HttpClient (#2768). The receiver rows end in a dot, like "gin.":
+     * a bare "this.http" / "$http" would also match this.httpAdapter.get
+     * (NestJS route registration) and $httpBackend.expectGET (an AngularJS test
+     * double), because an uppercase letter after an id counts as CamelCase
+     * glue. A chain wrapped before the verb keeps its line break in the callee
+     * text ("this.http\n      .post", prettier's style), so each receiver also
+     * has a line-break twin: LF, and CR for CRLF files. Java/C# HttpClient is
+     * already listed below. */
     {"@angular/common/http", CBM_SVC_HTTP, NULL},
     {"angular.common.http", CBM_SVC_HTTP, NULL},
-    {"HttpClient", CBM_SVC_HTTP, NULL},
-    {"httpClient", CBM_SVC_HTTP, NULL},
-    {"this.http", CBM_SVC_HTTP, NULL},
-    {"this.httpClient", CBM_SVC_HTTP, NULL},
-    {"$http", CBM_SVC_HTTP, NULL},
+    {"this.http.", CBM_SVC_HTTP, NULL},
+    {"this.http\n", CBM_SVC_HTTP, NULL},
+    {"this.http\r", CBM_SVC_HTTP, NULL},
+    {"httpClient.", CBM_SVC_HTTP, NULL},
+    {"httpClient\n", CBM_SVC_HTTP, NULL},
+    {"httpClient\r", CBM_SVC_HTTP, NULL},
+    {"$http.", CBM_SVC_HTTP, NULL},
+    {"$http\n", CBM_SVC_HTTP, NULL},
+    {"$http\r", CBM_SVC_HTTP, NULL},
     {"superagent", CBM_SVC_HTTP, NULL},
     {"needle", CBM_SVC_HTTP, NULL},
     {"node-fetch", CBM_SVC_HTTP, NULL},

tests/test_infrascan.c

@@ -173,6 +173,13 @@ TEST(infrascan_service_pattern_match_rejects_ids_inside_words) {
         {"kafkaesque.story.tell", CBM_SVC_NONE},
         /* "Axios" glued to a lowercase continuation */
         {"geo.Axiosphere.map", CBM_SVC_NONE},
+        /* Angular receiver rows end in a dot (#2768): a longer receiver that
+         * only starts with the same letters is not the HttpClient (NestJS
+         * route registration, AngularJS test double) */
+        {"this.httpAdapter.get", CBM_SVC_NONE},
+        {"this.httpServer.post", CBM_SVC_NONE},
+        {"$httpBackend.expectGET", CBM_SVC_NONE},
+        {"this.httpAdapter\n      .get", CBM_SVC_NONE},
         {NULL, CBM_SVC_NONE},
     };
     ASSERT_EQ(svc_case_mismatches(cases), 0);
@@ -202,6 +209,18 @@ TEST(infrascan_service_pattern_match_keeps_real_library_qns) {
         {"Axios.post", CBM_SVC_HTTP},
         {"AxiosInstance.get", CBM_SVC_HTTP},
         {"curl_exec", CBM_SVC_HTTP},
+        /* Angular HttpClient receivers (#2768); `_httpClient` is the common
+         * C# field spelling of the same client */
+        {"this.http.get", CBM_SVC_HTTP},
+        {"this.httpClient.post", CBM_SVC_HTTP},
+        {"httpClient.put", CBM_SVC_HTTP},
+        {"_httpClient.GetAsync", CBM_SVC_HTTP},
+        {"$http.get", CBM_SVC_HTTP},
+        /* a chain wrapped before the verb keeps the line break (LF / CRLF) */
+        {"this.http\n      .post", CBM_SVC_HTTP},
+        {"this.http\r\n      .delete", CBM_SVC_HTTP},
+        {"this.httpClient\n      .put", CBM_SVC_HTTP},
+        {"$http\n    .get", CBM_SVC_HTTP},
         {"surf.get", CBM_SVC_HTTP},
         {"hyper.Client.request", CBM_SVC_HTTP},
         {"phin.promisified", CBM_SVC_HTTP},

tests/test_pipeline.c

@@ -14972,6 +14972,11 @@ static int angular_http_client_typed_case(int fillers) {
                     "  deleteItem(id: string) {\n"
                     "    return this.http.delete(`/items/${id}`);\n"
                     "  }\n"
+                    "\n"
+                    "  updateItem(id: string, item: any) {\n"
+                    "    return this.http\n"
+                    "      .put(`/items/${id}`, item);\n"
+                    "  }\n"
                     "}\n");
 
     for (int i = 0; i < fillers; i++) {
@@ -15002,6 +15007,9 @@ static int angular_http_client_typed_case(int fillers) {
     ASSERT_EQ(http_calls_to_route(s, project, "getItem", "__route__GET__/items/{}"), 1);
     ASSERT_EQ(http_calls_to_route(s, project, "createItem", "__route__POST__/items"), 1);
     ASSERT_EQ(http_calls_to_route(s, project, "deleteItem", "__route__DELETE__/items/{}"), 1);
+    /* A chain wrapped before the verb (prettier style) is the same client call */
+    ASSERT_EQ(http_calls_to_route(s, project, "updateItem", "__route__PUT__/items/{}"), 1);
+    ASSERT_EQ(http_calls_to_route(s, project, "updateItem", "__route__ANY__"), 0);
 
     /* Assert no ANY twins */
     ASSERT_EQ(http_calls_to_route(s, project, "getItems", "__route__ANY__"), 0);