Inline Expectation Tests: Disallow tag[[[foo bar]

Author: RasmusWL

python/ql/test/TestUtilities/InlineExpectationsTest.qll

@@ -242,17 +242,21 @@ private string getColumnString(TColumn column) {
  * more comma-separated tags optionally followed by `=` and the expected value.
  *
  * Tags must be only letters, digits, `-` and `_` (note that the first character
- * must not be a digit), but can contain anything enclosed in a square brackets.
+ * must not be a digit), but can contain anything enclosed in a single set of
+ * square brackets.
  *
  * Examples:
  * - `tag`
  * - `tag=value`
  * - `tag,tag2=value`
  * - `tag[foo bar]=value`
+ *
+ * Not allowed:
+ * - `tag[[[foo bar]`
  */
 private string expectationPattern() {
   exists(string tag, string tags, string value |
-    tag = "[A-Za-z-_](?:[A-Za-z-_0-9]|\\[[^\\]]*\\])*" and
+    tag = "[A-Za-z-_](?:[A-Za-z-_0-9]|\\[[^\\]\\]]*\\])*" and
     tags = "((?:" + tag + ")(?:\\s*,\\s*" + tag + ")*)" and
     // In Python, we allow both `"` and `'` for strings, as well as the prefixes `bru`.
     // For example, `b"foo"`.