Skip to content

Commit 2cab33a

Browse files
jeongsoolee09jeongsoolee09
authored
Merge branch 'main' into mbaluda/type_sanitizer
2 parents f49d76d + e981fbd commit 2cab33a

File tree

16 files changed

+77
-56
lines changed

16 files changed

+77
-56
lines changed

‎.github/workflows/javascript.sarif.expected‎

Lines changed: 1 addition & 1 deletion
Large diffs are not rendered by default.

‎.github/workflows/run-codeql-unit-tests-javascript.yml‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -87,13 +87,20 @@ jobs:
8787
# Compile .cds files to .cds.json files.
8888
- name: Compile CAP CDS files
8989
run: |
90-
for cds_file in $(find . -type f \( -iname '*.cds' \) -print)
90+
for test_dir in $(find . -type f -name '*.expected' -exec dirname {} \;);
9191
do
92-
echo "I am compiling $cds_file"
93-
cds compile $cds_file \
94-
-2 json \
95-
-o "$cds_file.json" \
96-
--locations
92+
# The CDS compiler produces locations relative to the working directory
93+
# so we switch to the test directory before running the compiler.
94+
pushd $test_dir
95+
for cds_file in $(find . -type f \( -iname '*.cds' \) -print)
96+
do
97+
echo "I am compiling $cds_file"
98+
cds compile $cds_file \
99+
-2 json \
100+
-o "$cds_file.json" \
101+
--locations
102+
done
103+
popd
97104
done
98105
99106
- name: Run test suites
@@ -105,7 +112,7 @@ jobs:
105112
CODEQL_STDLIB_IDENT: ${{matrix.codeql_standard_library_ident}}
106113
RUNNER_TMP: ${{ runner.temp }}
107114
LGTM_INDEX_XML_MODE: all
108-
LGTM_INDEX_FILETYPES: ".json:JSON"
115+
LGTM_INDEX_FILETYPES: ".json:JSON\n.cds:JSON"
109116

110117
shell: bash
111118
run: >

‎README.md‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ jobs:
4141
- name: Perform CodeQL Analysis
4242
id: analyze
4343
uses: github/codeql-action/analyze@v3
44+
env:
45+
LGTM_INDEX_XML_MODE: all
46+
LGTM_INDEX_FILETYPES: ".json:JSON\n.cds:JSON"
4447
```
4548
Example configuration file:
4649
```yaml
@@ -50,7 +53,7 @@ packs:
5053
# Use these packs for JavaScript and TypeScript analysis
5154
javascript:
5255
- codeql/javascript-queries:codeql-suites/javascript-security-extended.qls
53-
- advanced-security/javascript-sap-async-xsjs-queries:codeql-suites/javascript-security-extended.qls
56+
- advanced-security/javascript-sap-xsjs-queries:codeql-suites/javascript-security-extended.qls
5457
- advanced-security/javascript-sap-cap-queries:codeql-suites/javascript-security-extended.qls
5558
- advanced-security/javascript-sap-ui5-queries:codeql-suites/javascript-security-extended.qls
5659

@@ -84,7 +87,7 @@ codeql database create <DB_NAME> --language=javascript
8487
codeql database analyze <DB_NAME> --format=sarif-latest --output=<OUTPUT_FILE> \
8588
--download advanced-security/javascript-sap-cap-queries \
8689
advanced-security/javascript-sap-ui5-queries \
87-
advanced-security/javascript-sap-async-xsjs-queries
90+
advanced-security/javascript-sap-xsjs-queries
8891
```
8992

9093
## License

‎extractors/cds/tools/index-files.sh‎

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ then
3636
# directory.
3737
#
3838
# We also ensure we skip node_modules, as we can end up in a recursive loop
39-
find . -type d -name node_modules -prune -false -o -type f \( -iname 'package.json' \) -exec grep -ql '@sap/cds' {} \; -execdir bash -c "grep -q \"^\$(pwd)\(/\|$\)\" \"$response_file\"" \; -execdir bash -c "echo \"Installing @sap/cds-dk into \$(pwd) to enable CDS compilation.\"" \; -execdir npm install --silent @sap/cds-dk \;
39+
find . -type d -name node_modules -prune -false -o -type f \( -iname 'package.json' \) -exec grep -ql '@sap/cds' {} \; -execdir bash -c "grep -q \"^\$(pwd)\(/\|$\)\" \"$response_file\"" \; -execdir bash -c "echo \"Installing @sap/cds-dk into \$(pwd) to enable CDS compilation.\"" \; -execdir npm install --silent @sap/cds-dk \; -execdir npm install --silent \;
4040

4141
# Use the npx command to dynamically install the cds development kit (@sap/cds-dk) package if necessary,
4242
# which then provides the cds command line tool in directories which are not covered by the package.json
@@ -52,10 +52,13 @@ echo "Processing CDS files to JSON"
5252
# the same name
5353
while IFS= read -r cds_file; do
5454
echo "Processing CDS file $cds_file to:"
55-
$cds_command compile "$cds_file" \
56-
-2 json \
57-
-o "$cds_file.json" \
58-
--locations
55+
if ! $cds_command compile "$cds_file" -2 json -o "$cds_file.json" --locations 2> "$cds_file.err"; then
56+
stderr_truncated=`grep "^\[ERROR\]" "$cds_file.err" | tail -n 4`
57+
error_message=$'Could not compile the file '"$cds_file"$'.\nReported error(s):\n```\n'"$stderr_truncated"$'\n```'
58+
echo "$error_message"
59+
# Log an error diagnostic which appears on the status page
60+
"$CODEQL_DIST/codeql" database add-diagnostic --extractor-name cds --ready-for-status-page --source-id cds/compilation-failure --source-name "Failure to compile one or more SAP CAP CDS files" --severity error --markdown-message "$error_message" --file-path "$cds_file" "$CODEQL_EXTRACTOR_CDS_WIP_DATABASE"
61+
fi
5962
done < "$response_file"
6063

6164
# Check if the JS extractor variables are set, and set them if not

‎javascript/frameworks/cap/lib/advanced_security/javascript/frameworks/cap/CDL.qll‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,11 +14,16 @@ abstract class CdlObject extends JsonObject {
1414
exists(Location loc, JsonValue locValue |
1515
loc = this.getLocation() and
1616
locValue = this.getPropValue("$location") and
17-
path =
18-
any(File f |
19-
f.getAbsolutePath()
20-
.matches("%" + locValue.getPropValue("file").getStringValue() + ".json")
21-
).getAbsolutePath().regexpReplaceAll("\\.json$", "") and
17+
// The path in the cds.json file is relative to the working directory used when running
18+
// the cds compile command. In our extractor, that's always the root of the repository,
19+
// so we can identify the sourceLocationPrefix to find the path of the root of the repo
20+
// then append the relative path
21+
exists(string sourceLocationPrefix |
22+
sourceLocationPrefix(sourceLocationPrefix) and
23+
path =
24+
sourceLocationPrefix.regexpReplaceAll("/$", "") + "/" +
25+
locValue.getPropValue("file").getStringValue()
26+
) and
2227
if
2328
not exists(locValue.getPropValue("line")) and
2429
not exists(locValue.getPropValue("col"))

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/BindingStringParser.qll‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -839,18 +839,18 @@ module BindingStringParser<BindingStringReaderSig BindingStringReader> {
839839
then
840840
exists(BindingPathComponentList tail |
841841
mkBindingPathComponentList(getNextSkippingWhitespace(nextToken), tail, last) and
842-
list = MkConstBindingPathComponentList(name, tail, first)
842+
list = MkConstBindingPathComponentList(name, tail)
843843
)
844844
else (
845-
list = MkConstBindingPathComponentList(name, MkEmptyBindingPathComponentList(), first) and
845+
list = MkConstBindingPathComponentList(name, MkEmptyBindingPathComponentList()) and
846846
last = name
847847
)
848848
)
849849
}
850850

851851
private newtype TBindingPathComponentList =
852852
MkEmptyBindingPathComponentList() or
853-
MkConstBindingPathComponentList(NameToken headToken, BindingPathComponentList tail, Token source) {
853+
MkConstBindingPathComponentList(NameToken headToken, BindingPathComponentList tail) {
854854
exists(Token nextToken | nextToken = getNextSkippingWhitespace(headToken) |
855855
if nextToken instanceof ForwardSlashToken or nextToken instanceof DotToken
856856
then mkBindingPathComponentList(getNextSkippingWhitespace(nextToken), tail, _)
@@ -863,18 +863,16 @@ module BindingStringParser<BindingStringReaderSig BindingStringReader> {
863863
this = MkEmptyBindingPathComponentList() and result = ""
864864
or
865865
exists(NameToken head, BindingPathComponentList tail |
866-
this = MkConstBindingPathComponentList(head, tail, _) and
866+
this = MkConstBindingPathComponentList(head, tail) and
867867
if tail instanceof MkEmptyBindingPathComponentList
868868
then result = head.toString()
869869
else result = head.toString() + "/" + tail.toString()
870870
)
871871
}
872872

873-
NameToken getHead() { this = MkConstBindingPathComponentList(result, _, _) }
873+
NameToken getHead() { this = MkConstBindingPathComponentList(result, _) }
874874

875-
BindingPathComponentList getTail() { this = MkConstBindingPathComponentList(_, result, _) }
876-
877-
Token getSource() { this = MkConstBindingPathComponentList(_, _, result) }
875+
BindingPathComponentList getTail() { this = MkConstBindingPathComponentList(_, result) }
878876
}
879877

880878
predicate mkAbsoluteBindingPath(Token first, BindingPath path, Token last) {

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Bindings.qll‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
import javascript
66
import advanced_security.javascript.frameworks.ui5.BindingStringParser as MakeBindingStringParser
7+
import advanced_security.javascript.frameworks.ui5.UI5View
78

89
private class ContextBindingAttribute extends XmlAttribute {
910
ContextBindingAttribute() { this.getName() = "binding" }
@@ -15,8 +16,12 @@ private class ContextBindingAttribute extends XmlAttribute {
1516
// TODO: add support for binding strings in strings such as `description: "Some {/description}"`
1617
private newtype TBindingString =
1718
TBindingStringFromLiteral(StringLiteral stringLiteral) { stringLiteral.getValue().matches("{%}") } or
18-
TBindingStringFromXmlAttribute(XmlAttribute attribute) { attribute.getValue().matches("{%}") } or
19+
TBindingStringFromXmlAttribute(XmlAttribute attribute) {
20+
attribute.getLocation().getFile() instanceof UI5View and
21+
attribute.getValue().matches("{%}")
22+
} or
1923
TBindingStringFromJsonProperty(JsonObject object, string propertyName) {
24+
object.getFile() instanceof UI5View and
2025
object.getPropStringValue(propertyName).matches("{%}")
2126
} or
2227
TBindingStringFromBindElementMethodCall(BindElementMethodCallNode bindElement) {

‎javascript/frameworks/ui5/test/lib/Bindings/Bindings.expected‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,22 @@
1-
| test.html:5:11:5:31 | XML property binding: data-value to {/input} |
2-
| test.html:8:11:8:33 | XML property binding: data-content to {/input} |
31
| test.js:10:20:10:33 | Early JavaScript property binding: value to "{/root/name}" |
42
| test.js:21:28:21:34 | JavaScript context binding: oInput to "/root" |
53
| test.js:23:38:23:43 | Late JavaScript property binding: value to "name" |
64
| test.js:27:19:33:12 | Early JavaScript property binding: value to {\\n ... } |
75
| test.js:38:48:44:9 | Late JavaScript property binding: value to {\\n ... } |
86
| test.js:48:19:48:42 | Early JavaScript property binding: text to "{/#foo ... label}" |
9-
| test.json:5:9:22:9 | JSON property binding: items to {/Base} |
10-
| test.json:11:17:16:17 | JSON property binding: value to {input} |
11-
| test.json:17:17:20:17 | JSON property binding: content to {path : /input, formatter : ".valueFormatter"} |
12-
| test.xml:2:5:2:28 | XML property binding: value to {foo} |
13-
| test.xml:3:5:3:29 | XML property binding: value to {/foo} |
14-
| test.xml:4:5:4:34 | XML property binding: value to {model>foo} |
15-
| test.xml:5:5:5:35 | XML property binding: value to {model>/foo} |
16-
| test.xml:6:5:8:29 | XML context binding: binding to {/root} |
17-
| test.xml:6:5:8:29 | XML property binding: value to {foo} |
18-
| test.xml:9:5:9:70 | XML property binding: value to {path : foo, type : "sap.ui.model.type.String"} |
19-
| test.xml:10:5:10:71 | XML property binding: value to {path : /foo, type : "sap.ui.model.type.String"} |
20-
| test.xml:11:5:11:77 | XML property binding: value to {path : model>/foo, type : "sap.ui.model.type.String"} |
21-
| test.xml:12:5:12:76 | XML property binding: value to {path : model>foo, type : "sap.ui.model.type.String"} |
22-
| test.xml:14:5:22:45 | XML property binding: value to {parts : [{path : foo}, {path : bar/baz}, {path : quux}], formatter : "some.formatter"} |
7+
| test.view.html:5:11:5:31 | XML property binding: data-value to {/input} |
8+
| test.view.html:8:11:8:33 | XML property binding: data-content to {/input} |
9+
| test.view.json:5:9:22:9 | JSON property binding: items to {/Base} |
10+
| test.view.json:11:17:16:17 | JSON property binding: value to {input} |
11+
| test.view.json:17:17:20:17 | JSON property binding: content to {path : /input, formatter : ".valueFormatter"} |
12+
| test.view.xml:2:5:2:28 | XML property binding: value to {foo} |
13+
| test.view.xml:3:5:3:29 | XML property binding: value to {/foo} |
14+
| test.view.xml:4:5:4:34 | XML property binding: value to {model>foo} |
15+
| test.view.xml:5:5:5:35 | XML property binding: value to {model>/foo} |
16+
| test.view.xml:6:5:8:29 | XML context binding: binding to {/root} |
17+
| test.view.xml:6:5:8:29 | XML property binding: value to {foo} |
18+
| test.view.xml:9:5:9:70 | XML property binding: value to {path : foo, type : "sap.ui.model.type.String"} |
19+
| test.view.xml:10:5:10:71 | XML property binding: value to {path : /foo, type : "sap.ui.model.type.String"} |
20+
| test.view.xml:11:5:11:77 | XML property binding: value to {path : model>/foo, type : "sap.ui.model.type.String"} |
21+
| test.view.xml:12:5:12:76 | XML property binding: value to {path : model>foo, type : "sap.ui.model.type.String"} |
22+
| test.view.xml:14:5:22:45 | XML property binding: value to {parts : [{path : foo}, {path : bar/baz}, {path : quux}], formatter : "some.formatter"} |

‎javascript/frameworks/ui5/test/lib/Bindings/test.html‎ renamed to ‎javascript/frameworks/ui5/test/lib/Bindings/test.view.html‎

File renamed without changes.

‎javascript/frameworks/ui5/test/lib/Bindings/test.json‎ renamed to ‎javascript/frameworks/ui5/test/lib/Bindings/test.view.json‎

File renamed without changes.

0 commit comments

Comments
 (0)