Skip to content

Commit d25c721

Browse files
mbaludambaluda
authored
Merge branch 'main' into mbaluda/rc-ana-ui-main
2 parents fb9741d + a3ecebc commit d25c721

43 files changed

Lines changed: 1249 additions & 741 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/javascript.sarif.expected‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎javascript/frameworks/cap/lib/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/concepts:
5-
version: 0.0.12
5+
version: 0.0.14
66
codeql/controlflow:
7-
version: 2.0.22
7+
version: 2.0.24
88
codeql/dataflow:
9-
version: 2.0.22
9+
version: 2.0.24
1010
codeql/javascript-all:
11-
version: 2.6.18
11+
version: 2.6.20
1212
codeql/mad:
13-
version: 1.0.38
13+
version: 1.0.40
1414
codeql/regex:
15-
version: 1.0.38
15+
version: 1.0.40
1616
codeql/ssa:
17-
version: 2.0.14
17+
version: 2.0.16
1818
codeql/threat-models:
19-
version: 1.0.38
19+
version: 1.0.40
2020
codeql/tutorial:
21-
version: 1.0.38
21+
version: 1.0.40
2222
codeql/typetracking:
23-
version: 2.0.22
23+
version: 2.0.24
2424
codeql/util:
25-
version: 2.0.25
25+
version: 2.0.27
2626
codeql/xml:
27-
version: 1.0.38
27+
version: 1.0.40
2828
codeql/yaml:
29-
version: 1.0.38
29+
version: 1.0.40
3030
compiled: false

‎javascript/frameworks/cap/src/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/concepts:
5-
version: 0.0.12
5+
version: 0.0.14
66
codeql/controlflow:
7-
version: 2.0.22
7+
version: 2.0.24
88
codeql/dataflow:
9-
version: 2.0.22
9+
version: 2.0.24
1010
codeql/javascript-all:
11-
version: 2.6.18
11+
version: 2.6.20
1212
codeql/mad:
13-
version: 1.0.38
13+
version: 1.0.40
1414
codeql/regex:
15-
version: 1.0.38
15+
version: 1.0.40
1616
codeql/ssa:
17-
version: 2.0.14
17+
version: 2.0.16
1818
codeql/threat-models:
19-
version: 1.0.38
19+
version: 1.0.40
2020
codeql/tutorial:
21-
version: 1.0.38
21+
version: 1.0.40
2222
codeql/typetracking:
23-
version: 2.0.22
23+
version: 2.0.24
2424
codeql/util:
25-
version: 2.0.25
25+
version: 2.0.27
2626
codeql/xml:
27-
version: 1.0.38
27+
version: 1.0.40
2828
codeql/yaml:
29-
version: 1.0.38
29+
version: 1.0.40
3030
compiled: false

‎javascript/frameworks/cap/test/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/concepts:
5-
version: 0.0.12
5+
version: 0.0.14
66
codeql/controlflow:
7-
version: 2.0.22
7+
version: 2.0.24
88
codeql/dataflow:
9-
version: 2.0.22
9+
version: 2.0.24
1010
codeql/javascript-all:
11-
version: 2.6.18
11+
version: 2.6.20
1212
codeql/mad:
13-
version: 1.0.38
13+
version: 1.0.40
1414
codeql/regex:
15-
version: 1.0.38
15+
version: 1.0.40
1616
codeql/ssa:
17-
version: 2.0.14
17+
version: 2.0.16
1818
codeql/threat-models:
19-
version: 1.0.38
19+
version: 1.0.40
2020
codeql/tutorial:
21-
version: 1.0.38
21+
version: 1.0.40
2222
codeql/typetracking:
23-
version: 2.0.22
23+
version: 2.0.24
2424
codeql/util:
25-
version: 2.0.25
25+
version: 2.0.27
2626
codeql/xml:
27-
version: 1.0.38
27+
version: 1.0.40
2828
codeql/yaml:
29-
version: 1.0.38
29+
version: 1.0.40
3030
compiled: false

‎javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml‎

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2,29 +2,29 @@
22
lockVersion: 1.0.0
33
dependencies:
44
codeql/concepts:
5-
version: 0.0.12
5+
version: 0.0.14
66
codeql/controlflow:
7-
version: 2.0.22
7+
version: 2.0.24
88
codeql/dataflow:
9-
version: 2.0.22
9+
version: 2.0.24
1010
codeql/javascript-all:
11-
version: 2.6.18
11+
version: 2.6.20
1212
codeql/mad:
13-
version: 1.0.38
13+
version: 1.0.40
1414
codeql/regex:
15-
version: 1.0.38
15+
version: 1.0.40
1616
codeql/ssa:
17-
version: 2.0.14
17+
version: 2.0.16
1818
codeql/threat-models:
19-
version: 1.0.38
19+
version: 1.0.40
2020
codeql/tutorial:
21-
version: 1.0.38
21+
version: 1.0.40
2222
codeql/typetracking:
23-
version: 2.0.22
23+
version: 2.0.24
2424
codeql/util:
25-
version: 2.0.25
25+
version: 2.0.27
2626
codeql/xml:
27-
version: 1.0.38
27+
version: 1.0.40
2828
codeql/yaml:
29-
version: 1.0.38
29+
version: 1.0.40
3030
compiled: false

‎javascript/frameworks/ui5/ext/ui5.model.yml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,17 @@ extensions:
66
- ["SapUICoreInstance", "global", "Member[sap].Member[ui].Member[getCore].ReturnValue"]
77
- ["Control", "Control", "Instance"]
88
- ["Control", "sap/ui/core/Control", ""]
9+
- ["Control", "UI5HTMLControl", ""]
10+
- ["Control", "UI5InputControl", ""]
11+
- ["Control", "CustomControl", ""]
912
- ["Control", "global", "Member[sap].Member[ui].Member[core].Member[Control]"]
1013
- ["Controller", "Controller", "Instance"]
1114
- ["Controller", "sap/ui/core/mvc/Controller", ""]
1215
- ["Component", "sap/ui/core/mvc/Component", ""]
1316
- ["Component", "sap/ui/core/UIComponent", ""]
1417
- ["Renderer", "Control", "Member[extend].Argument[1].Member[renderer]"]
1518
- ["Renderer", "sap/ui/core/RenderManager", "Member[extend].Argument[1].Member[renderer]"]
16-
- ["Renderer", "sap/ui/core/Renderer", "Member[extend].Argument[1]"] # ?
19+
- ["Renderer", "sap/ui/core/Renderer", "Member[extend].Argument[1]"]
1720
- ["RenderManager", "RenderManager", "Instance"]
1821
- ["RenderManager", "sap/ui/core/RenderManager", ""]
1922
- ["RenderManager", "Renderer", "Parameter[0]"]
@@ -112,6 +115,7 @@ extensions:
112115
data:
113116
- ["UI5InputControl", "Member[value]", "remote"]
114117
- ["UI5InputControl", "Member[getValue].ReturnValue", "remote"]
118+
- ["UI5HTMLControl", "Member[getContent].ReturnValue", "remote"]
115119
- ["UI5CodeEditor", "Member[value]", "remote"]
116120
- ["UI5CodeEditor", "Member[getCurrentValue].ReturnValue", "remote"]
117121
- ["global", "Member[jQuery].Member[sap].Member[syncHead,syncGet,syncGetText,syncPost,syncPostText].ReturnValue", "remote"]

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll‎

Lines changed: 16 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,13 @@ private class RemoteControlHandlerParameter extends RemoteControlAPISource, Call
2727
}
2828
}
2929

30+
/**
31+
* A remote flow source representing user-provided data fetched from UI5 input controls.
32+
*
33+
* This class models data obtained from control references (such as `HTML` or `CodeEditor`)
34+
* or from handler parameters, via property reads or getter methods like `getValue()` or
35+
* `getCurrentValue()`. These represent user input that could potentially be tainted.
36+
*/
3037
private class UserDataFromRemoteControlAPISource extends RemoteFlowSource {
3138
UserDataFromRemoteControlAPISource() {
3239
exists(RemoteControlAPISource remoteControlAPISource |
@@ -143,42 +150,23 @@ class ODataServiceModel extends UI5ExternalModel {
143150
override string getSourceType() { result = "ODataServiceModel" }
144151

145152
ODataServiceModel() {
146-
exists(MethodCallNode setModelCall, CustomController controller |
147-
/*
148-
* 1. This flows from a DF node corresponding to the parent component's model
149-
* to the `this.setModel` call. e.g.
150-
*
151-
* `this.getOwnerComponent().getModel("someModelName")` as in
152-
* `this.getView().setModel(this.getOwnerComponent().getModel("someModelName"))`.
153-
*/
154-
155-
modelName = this.getArgument(0).getALocalSource().asExpr().(StringLiteral).getValue() and
153+
exists(CustomController controller |
156154
this.getCalleeName() = "getModel" and
157-
controller.getOwnerComponentRef().flowsTo(this.(MethodCallNode).getReceiver()) and
158-
this.flowsTo(setModelCall.getArgument(0)) and
159-
setModelCall = controller.getAViewReference().getAMemberCall("setModel") and
160-
/*
161-
* 2. The component's `manifest.json` declares the DataSource as being of OData type.
162-
*/
163-
155+
modelName = this.getArgument(0).getALocalSource().getStringValue() and
164156
controller.getOwnerComponent().getExternalModelDef(modelName).getDataSource() instanceof
165-
ODataDataSourceManifest
157+
ODataDataSourceManifest // A component's `manifest.json` declares the data source as being of OData type.
166158
)
167159
or
168160
/*
169-
* A constructor call to sap.ui.model.odata.v2.ODataModel or sap.ui.model.odata.v4.ODataModel.
161+
* A constructor call to `sap.ui.model.odata.v2.ODataModel` or `sap.ui.model.odata.v4.ODataModel`.
170162
*/
171163

172164
this instanceof NewNode and
173-
(
174-
exists(RequiredObject oDataModel |
175-
oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and
176-
oDataModel.getDependency() in [
177-
"sap/ui/model/odata/v2/ODataModel", "sap/ui/model/odata/v4/ODataModel"
178-
]
179-
)
180-
or
181-
this.getCalleeName() = "ODataModel"
165+
exists(RequiredObject oDataModel |
166+
oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and
167+
oDataModel.getDependency() in [
168+
"sap/ui/model/odata/v2/ODataModel", "sap/ui/model/odata/v4/ODataModel"
169+
]
182170
) and
183171
modelName = "<no name>"
184172
}

0 commit comments

Comments
 (0)