Add negative-regression tests for identifier and gradle-property confinement

ober

fc02cd4ecec0ea15444089bae0fab1716881ee1d

diff --git a/tests/fixtures/gradle-property-newline.ss b/tests/fixtures/gradle-property-newline.ss
new file mode 100644
index 0000000..ca7c6b2
--- /dev/null
+++ b/tests/fixtures/gradle-property-newline.ss
@@ -0,0 +1,7 @@
+(import (jerboa prelude))
+
+(def app
+  '(android-app
+     (id "org.jerboa.security")
+     (gradle-property "android.useAndroidX" "true\norg.gradle.jvmargs=-Xmx9g")
+     (screen Main (text "security fixture"))))
diff --git a/tests/fixtures/state-name-injection.ss b/tests/fixtures/state-name-injection.ss
new file mode 100644
index 0000000..c022ab7
--- /dev/null
+++ b/tests/fixtures/state-name-injection.ss
@@ -0,0 +1,8 @@
+(import (jerboa prelude))
+
+(def app
+  '(android-app
+     (id "org.jerboa.security")
+     (screen Main
+       (state |x;{}| 0)
+       (text "security fixture"))))
diff --git a/tests/fixtures/state-name-newline.ss b/tests/fixtures/state-name-newline.ss
new file mode 100644
index 0000000..fbdbe4a
--- /dev/null
+++ b/tests/fixtures/state-name-newline.ss
@@ -0,0 +1,9 @@
+(import (jerboa prelude))
+
+(def app
+  '(android-app
+     (id "org.jerboa.security")
+     (screen Main
+       (state |x
+fun pwn(){}| 0)
+       (text "security fixture"))))
diff --git a/tests/fixtures/string-control-char.ss b/tests/fixtures/string-control-char.ss
new file mode 100644
index 0000000..5c53cd3
--- /dev/null
+++ b/tests/fixtures/string-control-char.ss
@@ -0,0 +1,6 @@
+(import (jerboa prelude))
+
+(def app
+  '(android-app
+     (id "org.jerboa.security")
+     (screen Main (text "security\ffixture"))))
diff --git a/tests/security-test.sh b/tests/security-test.sh
index 0bf61be..901638a 100755
--- a/tests/security-test.sh
+++ b/tests/security-test.sh
@@ -55,6 +55,13 @@ expect_rejected tests/fixtures/path-backslash.ss "$tmp/backslash-output"
 expect_rejected tests/fixtures/package-separator.ss "$tmp/package-output"
 expect_rejected tests/fixtures/dependency-dynamic.ss "$tmp/dependency-output"
 
+# Spec identifiers and gradle properties must stay inside their literal
+# abstractions: injection payloads are rejected, not emitted.
+expect_rejected tests/fixtures/state-name-injection.ss "$tmp/state-injection-output"
+expect_rejected tests/fixtures/state-name-newline.ss "$tmp/state-newline-output"
+expect_rejected tests/fixtures/gradle-property-newline.ss "$tmp/gradle-newline-output"
+expect_rejected tests/fixtures/string-control-char.ss "$tmp/string-control-output"
+
 # A pre-existing symlink at a generated parent must fail closed.
 symlink_output="$tmp/symlink-output"
 mkdir -p "$symlink_output/app"