- Adds a test case for sanitizers

- Add controls as JsControl

Author: mbaluda

javascript/frameworks/ui5/ext/ui5.model.yml

@@ -6,6 +6,9 @@ extensions:
       - ["SapUICoreInstance", "global", "Member[sap].Member[ui].Member[getCore].ReturnValue"]
       - ["Control", "Control", "Instance"]
       - ["Control", "sap/ui/core/Control", ""]
+      - ["Control", "UI5HTMLControl", ""]
+      - ["Control", "UI5InputControl", ""]
+      - ["Control", "CustomControl", ""]
       - ["Control", "global", "Member[sap].Member[ui].Member[core].Member[Control]"]
       - ["Controller", "Controller", "Instance"]
       - ["Controller", "sap/ui/core/mvc/Controller", ""]
@@ -108,6 +111,7 @@ extensions:
     data:
       - ["UI5InputControl", "Member[value]", "remote"]
       - ["UI5InputControl", "Member[getValue].ReturnValue", "remote"]
+      - ["UI5HTMLControl", "Member[getContent].ReturnValue", "remote"]
       - ["UI5CodeEditor", "Member[value]", "remote"]
       - ["UI5CodeEditor", "Member[getCurrentValue].ReturnValue", "remote"]
       - ["global", "Member[jQuery].Member[sap].Member[syncHead,syncGet,syncGetText,syncPost,syncPostText].ReturnValue", "remote"]

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll

@@ -692,6 +692,8 @@ private newtype TUI5Control =
             .(ArrayLiteralNode)
             .asExpr()
     )
+    or
+    control = ModelOutput::getATypeNode("Control").getAnInvocation()
   }
 
 class UI5Control extends TUI5Control {
@@ -739,7 +741,9 @@ class UI5Control extends TUI5Control {
     )
     or
     exists(NewNode control | control = this.asJsControl() |
-      result = this.asJsControl().asExpr().getAChildExpr().(DotExpr).getQualifiedName()
+      result = control.asExpr().getAChildExpr().(PropAccess).getQualifiedName()
+      or
+      control = API::moduleImport(result).getAnInvocation()
     )
   }
 
@@ -863,11 +867,12 @@ class UI5Control extends TUI5Control {
     )
     or
     /* 3. `sanitizeContent` attribute is set programmatically using a setter. */
-    exists(CallNode node |
-      node =
-        this.getAReference()
-            .getAMemberCall("set" + propName.prefix(1).toUpperCase() + propName.suffix(1)) and
+    exists(CallNode node, string setterName |
+      setterName = "set" + propName.prefix(1).toUpperCase() + propName.suffix(1) and
       not node.getArgument(0).mayHaveBooleanValue(val.booleanNot())
+    |
+      node = this.getAReference().getAMemberCall(setterName) or
+      node = this.asJsControl().getAMemberCall(setterName)
     )
   }
 }

javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-sanitized/UI5Xss.expected

@@ -0,0 +1 @@
+UI5Xss/UI5Xss.ql

javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-sanitized/UI5Xss.qlref

@@ -0,0 +1,5 @@
+{
+  "name": "sap-ui5-xss",
+  "version": "1.0.0",
+  "main": "index.js"
+}

javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-sanitized/package-lock.json

@@ -0,0 +1,7 @@
+specVersion: '3.0'
+metadata:
+  name: sap-ui5-xss
+type: application
+framework:
+  name: SAPUI5
+  version: "1.115.0"

javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-sanitized/package.json

@@ -0,0 +1,28 @@
+sap.ui.define([
+    "sap/ui/core/mvc/Controller",
+    "sap/ui/model/json/JSONModel",
+    "sap/ui/core/HTML"
+], function (Controller, JSONModel, HTML) {
+    "use strict";
+    return Controller.extend("codeql-sap-js.controller.app", {
+        onInit: function () {
+            var oData = {
+                input: null,
+                output: null,
+            };
+            var oModel = new JSONModel(oData);
+            this.getView().setModel(oModel);
+
+            jQuery.sap.globalEval(oModel.getProperty('/input')); // UNSAFE: evaluating user input
+
+            var sanitizer = new HTML();
+            sanitizer.setSanitizeContent(true);
+            sanitizer.setContent(oModel.getProperty('/input')); // SAFE: content is sanitized before eval
+            jQuery.sap.globalEval(sanitizer.getContent()); // SAFE: content is sanitized before eval
+
+            let htmlSanitized = this.getView().byId("htmlSanitized");
+            jQuery.sap.globalEval(htmlSanitized.getContent()); // SAFE: content is sanitized declaratively in the view
+        }
+    });
+}
+);

javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-sanitized/ui5.yaml

@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+
+    <meta charset="utf-8">
+    <title>SAPUI5 XSS</title>
+    <script src="https://sdk.openui5.org/resources/sap-ui-core.js" 
+        data-sap-ui-libs="sap.m"
+        data-sap-ui-onInit="module:codeql-sap-js/index" 
+        data-sap-ui-resourceroots='{
+            "codeql-sap-js": "./"
+        }'>
+        </script>
+</head>
+
+<body class="sapUiBody" id="content">
+
+</body>
+
+</html>

javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-sanitized/webapp/controller/app.controller.js

@@ -0,0 +1,11 @@
+sap.ui.define([
+    "sap/ui/core/mvc/XMLView"
+], function (XMLView) {
+    "use strict";
+    XMLView.create({
+        viewName: "codeql-sap-js.view.app"
+    }).then(function (oView) {
+        oView.placeAt("content");
+    });
+
+});