Add unit test cases

jeongsoolee09 · jeongsoolee09 · commit 80c57ed8d91b · 2025-04-24T16:03:54.000-04:00
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/package-lock.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/package-lock.json
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/package.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "sap-ui5-xss",
+  "version": "1.0.0",
+  "main": "index.js"
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/ui5.yaml b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/ui5.yaml
@@ -0,0 +1,7 @@
+specVersion: '3.0'
+metadata:
+  name: sap-ui5-xss
+type: application
+framework:
+  name: SAPUI5
+  version: "1.115.0"
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/controller/app.controller.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/controller/app.controller.js
@@ -0,0 +1,22 @@
+sap.ui.define(
+  [
+    "sap/ui/core/mvc/Controller",
+    "sap/ui/model/json/JSONModel",
+  ],
+  function (Controller, JSONModel) {
+    "use strict";
+    return Controller.extend("codeql-sap-js.controller.app", {
+      onInit: function () {
+        var oData = {
+          input: null,
+          output: null,
+        };
+        var oModel = new JSONModel(oData);
+        this.getView().setModel(oModel);
+
+        var input = oModel.getProperty("/input");
+        jQuery.sap.log.debug(input); //log-injection sink
+      },
+    });
+  },
+);
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/index.html b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/index.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+
+    <meta charset="utf-8">
+    <title>SAPUI5 XSS</title>
+    <script src="https://sdk.openui5.org/resources/sap-ui-core.js" 
+        data-sap-ui-libs="sap.m"
+        data-sap-ui-onInit="module:codeql-sap-js/index" 
+        data-sap-ui-resourceroots='{
+            "codeql-sap-js": "./"
+        }'>
+        </script>
+</head>
+
+<body class="sapUiBody" id="content">
+
+</body>
+
+</html>
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/index.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/index.js
@@ -0,0 +1,11 @@
+sap.ui.define([
+    "sap/ui/core/mvc/XMLView"
+], function (XMLView) {
+    "use strict";
+    XMLView.create({
+        viewName: "codeql-sap-js.view.app"
+    }).then(function (oView) {
+        oView.placeAt("content");
+    });
+
+}); 
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/manifest.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/manifest.json
@@ -0,0 +1,5 @@
+{
+    "sap.app": {
+        "id": "sap-ui5-xss"
+    }
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/utils/LogEntriesToHttp.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/utils/LogEntriesToHttp.js
@@ -0,0 +1,15 @@
+sap.ui.define(
+  ["sap/ui/base/Object", "sap/base/Log"],
+  function (BaseObject, Log) {
+    "use strict";
+    return BaseObject.extend("codeql-sap-js.log.CustomLogListener", {
+      constructor: function () {
+        let message = Log.getLogEntries()[0].message;
+        const http = new XMLHttpRequest();
+        const url = "https://some.remote.server/location";
+        http.open("POST", url);
+        http.send(message); // js/ui5-log-injection-to-http
+      },
+    });
+  },
+);
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/view/app.view.xml b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-getLogEntries/webapp/view/app.view.xml
@@ -0,0 +1,9 @@
+<mvc:View controllerName="codeql-sap-js.controller.app"
+    xmlns="sap.m"
+    xmlns:core="sap.ui.core"
+    xmlns:mvc="sap.ui.core.mvc">
+    <Input placeholder="Enter Payload" 
+        description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;" 
+        value="{/input}" />  <!--User input source sap.m.Input.value -->
+    <core:HTML content="{/output}"/> <!--XSS sink sap.ui.core.HTML.content -->
+</mvc:View>
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/package-lock.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/package-lock.json
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/package.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "sap-ui5-xss",
+  "version": "1.0.0",
+  "main": "index.js"
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/ui5.yaml b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/ui5.yaml
@@ -0,0 +1,7 @@
+specVersion: '3.0'
+metadata:
+  name: sap-ui5-xss
+type: application
+framework:
+  name: SAPUI5
+  version: "1.115.0"
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/controller/app.controller.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/controller/app.controller.js
@@ -0,0 +1,30 @@
+sap.ui.define(
+  ["sap/ui/core/mvc/Controller", "sap/ui/model/json/JSONModel", "sap/base/Log"],
+  function (Controller, JSONModel, Log) {
+    "use strict";
+    return Controller.extend("codeql-sap-js.controller.app", {
+      onInit: function () {
+        var oData = {
+          input: null,
+          output: null,
+        };
+        var oModel = new JSONModel(oData);
+        this.getView().setModel(oModel);
+
+        var input = oModel.getProperty("/input");
+
+        /* 1. Log the remote input. */
+        Log.debug(input); //
+        /* 2. Create a JS object that implements Log.Listener on-the-fly. */
+        Log.addLogListener({
+          onLogEntry: function (oLogEntry) {
+            const http = new XMLHttpRequest();
+            const url = "https://some.remote.server/location";
+            http.open("POST", url);
+            http.send(oLogEntry.message); // js/ui5-log-injection-to-http
+          },
+        });
+      },
+    });
+  },
+);
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/index.html b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/index.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+
+    <meta charset="utf-8">
+    <title>SAPUI5 XSS</title>
+    <script src="https://sdk.openui5.org/resources/sap-ui-core.js" 
+        data-sap-ui-libs="sap.m"
+        data-sap-ui-onInit="module:codeql-sap-js/index" 
+        data-sap-ui-resourceroots='{
+            "codeql-sap-js": "./"
+        }'>
+        </script>
+</head>
+
+<body class="sapUiBody" id="content">
+
+</body>
+
+</html>
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/index.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/index.js
@@ -0,0 +1,11 @@
+sap.ui.define([
+    "sap/ui/core/mvc/XMLView"
+], function (XMLView) {
+    "use strict";
+    XMLView.create({
+        viewName: "codeql-sap-js.view.app"
+    }).then(function (oView) {
+        oView.placeAt("content");
+    });
+
+}); 
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/manifest.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/manifest.json
@@ -0,0 +1,5 @@
+{
+    "sap.app": {
+        "id": "sap-ui5-xss"
+    }
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/view/app.view.xml b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-js-object/webapp/view/app.view.xml
@@ -0,0 +1,9 @@
+<mvc:View controllerName="codeql-sap-js.controller.app"
+    xmlns="sap.m"
+    xmlns:core="sap.ui.core"
+    xmlns:mvc="sap.ui.core.mvc">
+    <Input placeholder="Enter Payload" 
+        description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;" 
+        value="{/input}" />  <!--User input source sap.m.Input.value -->
+    <core:HTML content="{/output}"/> <!--XSS sink sap.ui.core.HTML.content -->
+</mvc:View>
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/package-lock.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/package-lock.json
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/package.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "sap-ui5-xss",
+  "version": "1.0.0",
+  "main": "index.js"
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/ui5.yaml b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/ui5.yaml
@@ -0,0 +1,7 @@
+specVersion: '3.0'
+metadata:
+  name: sap-ui5-xss
+type: application
+framework:
+  name: SAPUI5
+  version: "1.115.0"
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/controller/app.controller.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/controller/app.controller.js
@@ -0,0 +1,28 @@
+sap.ui.define(
+  [
+    "sap/ui/core/mvc/Controller",
+    "sap/ui/model/json/JSONModel",
+    "sap/base/Log",
+    "codeql-sap-js/log/CustomLogListener",
+  ],
+  function (Controller, JSONModel, Log, CustomLogListener) {
+    "use strict";
+    return Controller.extend("codeql-sap-js.controller.app", {
+      onInit: function () {
+        var oData = {
+          input: null,
+          output: null,
+        };
+        var oModel = new JSONModel(oData);
+        this.getView().setModel(oModel);
+
+        var input = oModel.getProperty("/input");
+
+        /* 1. Log the remote input. */
+        Log.debug(input); //
+        /* 2. Create a JS object that implements Log.Listener on-the-fly. */
+        Log.addLogListener(CustomLogListener);
+      },
+    });
+  },
+);
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/index.html b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/index.html
@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+
+    <meta charset="utf-8">
+    <title>SAPUI5 XSS</title>
+    <script src="https://sdk.openui5.org/resources/sap-ui-core.js" 
+        data-sap-ui-libs="sap.m"
+        data-sap-ui-onInit="module:codeql-sap-js/index" 
+        data-sap-ui-resourceroots='{
+            "codeql-sap-js": "./"
+        }'>
+        </script>
+</head>
+
+<body class="sapUiBody" id="content">
+
+</body>
+
+</html>
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/index.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/index.js
@@ -0,0 +1,11 @@
+sap.ui.define([
+    "sap/ui/core/mvc/XMLView"
+], function (XMLView) {
+    "use strict";
+    XMLView.create({
+        viewName: "codeql-sap-js.view.app"
+    }).then(function (oView) {
+        oView.placeAt("content");
+    });
+
+}); 
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/manifest.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/manifest.json
@@ -0,0 +1,5 @@
+{
+    "sap.app": {
+        "id": "sap-ui5-xss"
+    }
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/utils/CustomLogListener.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/utils/CustomLogListener.js
@@ -0,0 +1,14 @@
+sap.ui.define(
+  ["sap/ui/base/Object", "sap/base/Log"],
+  function (BaseObject, Log) {
+    "use strict";
+    return BaseObject.extend("codeql-sap-js.log.CustomLogListener", {
+      onLogEntry: function (oEvent) {
+        const http = new XMLHttpRequest();
+        const url = "https://some.remote.server/location";
+        http.open("POST", url);
+        http.send(oEvent.message); // js/ui5-log-injection-to-http
+      },
+    });
+  },
+);
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/view/app.view.xml b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module-imported/webapp/view/app.view.xml
@@ -0,0 +1,9 @@
+<mvc:View controllerName="codeql-sap-js.controller.app"
+    xmlns="sap.m"
+    xmlns:core="sap.ui.core"
+    xmlns:mvc="sap.ui.core.mvc">
+    <Input placeholder="Enter Payload" 
+        description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;" 
+        value="{/input}" />  <!--User input source sap.m.Input.value -->
+    <core:HTML content="{/output}"/> <!--XSS sink sap.ui.core.HTML.content -->
+</mvc:View>
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/package-lock.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/package-lock.json
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/package.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/package.json
@@ -0,0 +1,5 @@
+{
+  "name": "sap-ui5-xss",
+  "version": "1.0.0",
+  "main": "index.js"
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/ui5.yaml b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/ui5.yaml
@@ -0,0 +1,7 @@
+specVersion: '3.0'
+metadata:
+  name: sap-ui5-xss
+type: application
+framework:
+  name: SAPUI5
+  version: "1.115.0"
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/controller/app.controller.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/controller/app.controller.js
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/index.html b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/index.html
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/index.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/index.js
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/manifest.json b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/manifest.json
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/utils/CustomLogListener.js b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/utils/CustomLogListener.js
diff --git a/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/view/app.view.xml b/javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-log-listener-sap-module/webapp/view/app.view.xml

-Original file line number
+Diff line change
@@ @@ -0,0 +1,5 @@ @@
 +{
 +    "sap.app": {
 +        "id": "sap-ui5-xss"
 +    }
 +}