Skip to content

Commit baee7ed

Browse files
knewbury01knewbury01
authored
Merge pull request #253 from advanced-security/knewbury01/update-ui5-models
Add to ui5 model
2 parents 378d564 + 4d886fa commit baee7ed

File tree

5 files changed

+107
-10
lines changed

5 files changed

+107
-10
lines changed

‎javascript/frameworks/ui5/ext/ui5.model.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ extensions:
5656
- ["UI5InputControl", "sap/m/MaskEnabler", ""]
5757
- ["UI5InputControl", "sap/m/MaskInput", ""]
5858
- ["UI5InputControl", "sap/m/TextArea", ""]
59+
- ["UI5InputControl", "sap/m/DatePicker", ""]
5960
- ["UI5InputControl", "sap/m/ComboBoxBase", ""]
6061
- ["UI5InputControl", "sap/m/MultiInput", ""]
6162
- ["UI5InputControl", "sap/ui/webc/main/MultiInput", ""]

‎javascript/frameworks/ui5/test/models/source/UI5ViewSourceTest.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,11 @@
11
| source1.xml:5:5:7:28 | value={/input} | The binding path `/input` is a user input source. |
2+
| source1.xml:8:5:10:28 | value={/input} | The binding path `/input` is a user input source. |
3+
| source1.xml:11:5:13:28 | value={/input} | The binding path `/input` is a user input source. |
4+
| source1.xml:14:5:16:28 | value={/input} | The binding path `/input` is a user input source. |
5+
| source1.xml:17:5:19:28 | value={/input} | The binding path `/input` is a user input source. |
6+
| source1.xml:20:5:22:28 | value={/input} | The binding path `/input` is a user input source. |
7+
| source1.xml:23:5:25:28 | value={/input} | The binding path `/input` is a user input source. |
8+
| source1.xml:26:5:28:28 | value={/input} | The binding path `/input` is a user input source. |
9+
| source1.xml:29:5:31:28 | value={/input} | The binding path `/input` is a user input source. |
10+
| source1.xml:32:5:34:28 | value={/input} | The binding path `/input` is a user input source. |
11+
| source1.xml:35:5:37:28 | value={/input} | The binding path `/input` is a user input source. |

‎javascript/frameworks/ui5/test/models/source/source1.xml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,34 @@
55
<Input placeholder="Enter Payload"
66
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
77
value="{/input}" /> <!--User input source sap.m.Input.value -->
8+
<ComboBoxTextField placeholder="Enter Payload"
9+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
10+
value="{/input}" /> <!--User input source sap.m.ComboBoxTextField.value -->
11+
<MaskEnabler placeholder="Enter Payload"
12+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
13+
value="{/input}" /> <!--User input source sap.m.MaskEnabler.value -->
14+
<MaskInput placeholder="Enter Payload"
15+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
16+
value="{/input}" /> <!--User input source sap.m.MaskInput.value -->
17+
<TextArea placeholder="Enter Payload"
18+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
19+
value="{/input}" /> <!--User input source sap.m.TextArea.value -->
20+
<DatePicker placeholder="Enter Payload"
21+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
22+
value="{/input}" /> <!--User input source sap.m.DatePicker.value -->
23+
<ComboBoxBase placeholder="Enter Payload"
24+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
25+
value="{/input}" /> <!--User input source sap.m.ComboBoxBase.value -->
26+
<SearchField placeholder="Enter Payload"
27+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
28+
value="{/input}" /> <!--User input source sap.m.SearchField.value -->
29+
<MultiInput placeholder="Enter Payload"
30+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
31+
value="{/input}" /> <!--User input source sap.m.MultiInput.value -->
32+
<FeedInput placeholder="Enter Payload"
33+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
34+
value="{/input}" /> <!--User input source sap.m.FeedInput.value -->
35+
<InputBase placeholder="Enter Payload"
36+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
37+
value="{/input}" /> <!--User input source sap.m.InputBase.value -->
838
</mvc:View>

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/UI5Xss.expected‎

Lines changed: 49 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,53 @@
11
nodes
22
| webapp/controller/app.controller.js:9:17:9:27 | input: null |
3-
| webapp/view/app.view.xml:5:5:7:28 | value={/input} |
4-
| webapp/view/app.view.xml:8:5:8:36 | content={/input} |
3+
| webapp/view/app.view.xml:5:6:7:28 | value={/input} |
4+
| webapp/view/app.view.xml:8:5:9:28 | value={/input} |
5+
| webapp/view/app.view.xml:10:5:11:28 | value={/input} |
6+
| webapp/view/app.view.xml:12:5:13:28 | value={/input} |
7+
| webapp/view/app.view.xml:14:5:15:28 | value={/input} |
8+
| webapp/view/app.view.xml:16:5:17:28 | value={/input} |
9+
| webapp/view/app.view.xml:18:5:19:28 | value={/input} |
10+
| webapp/view/app.view.xml:20:5:21:28 | value={/input} |
11+
| webapp/view/app.view.xml:22:5:23:28 | value={/input} |
12+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} |
513
edges
6-
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:5:5:7:28 | value={/input} |
7-
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:8:5:8:36 | content={/input} |
8-
| webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) | webapp/view/app.view.xml:8:5:8:36 | content={/input} |
9-
| webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
10-
| webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
11-
| webapp/view/app.view.xml:8:5:8:36 | content={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
14+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:5:6:7:28 | value={/input} |
15+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:8:5:9:28 | value={/input} |
16+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:10:5:11:28 | value={/input} |
17+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:12:5:13:28 | value={/input} |
18+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:14:5:15:28 | value={/input} |
19+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:16:5:17:28 | value={/input} |
20+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:18:5:19:28 | value={/input} |
21+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:20:5:21:28 | value={/input} |
22+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:22:5:23:28 | value={/input} |
23+
| webapp/controller/app.controller.js:9:17:9:27 | input: null | webapp/view/app.view.xml:24:5:24:36 | content={/input} |
24+
| webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) | webapp/view/app.view.xml:24:5:24:36 | content={/input} |
25+
| webapp/view/app.view.xml:5:6:7:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
26+
| webapp/view/app.view.xml:5:6:7:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
27+
| webapp/view/app.view.xml:8:5:9:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
28+
| webapp/view/app.view.xml:8:5:9:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
29+
| webapp/view/app.view.xml:10:5:11:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
30+
| webapp/view/app.view.xml:10:5:11:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
31+
| webapp/view/app.view.xml:12:5:13:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
32+
| webapp/view/app.view.xml:12:5:13:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
33+
| webapp/view/app.view.xml:14:5:15:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
34+
| webapp/view/app.view.xml:14:5:15:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
35+
| webapp/view/app.view.xml:16:5:17:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
36+
| webapp/view/app.view.xml:16:5:17:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
37+
| webapp/view/app.view.xml:18:5:19:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
38+
| webapp/view/app.view.xml:18:5:19:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
39+
| webapp/view/app.view.xml:20:5:21:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
40+
| webapp/view/app.view.xml:20:5:21:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
41+
| webapp/view/app.view.xml:22:5:23:28 | value={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
42+
| webapp/view/app.view.xml:22:5:23:28 | value={/input} | webapp/controller/app.controller.js:11:26:11:45 | new JSONModel(oData) |
43+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/controller/app.controller.js:9:17:9:27 | input: null |
1244
#select
13-
| webapp/view/app.view.xml:8:5:8:36 | content={/input} | webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/view/app.view.xml:8:5:8:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:5:5:7:28 | value={/input} | user-provided value |
45+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:5:6:7:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:5:6:7:28 | value={/input} | user-provided value |
46+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:8:5:9:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:8:5:9:28 | value={/input} | user-provided value |
47+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:10:5:11:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:10:5:11:28 | value={/input} | user-provided value |
48+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:12:5:13:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:12:5:13:28 | value={/input} | user-provided value |
49+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:14:5:15:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:14:5:15:28 | value={/input} | user-provided value |
50+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:16:5:17:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:16:5:17:28 | value={/input} | user-provided value |
51+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:18:5:19:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:18:5:19:28 | value={/input} | user-provided value |
52+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:20:5:21:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:20:5:21:28 | value={/input} | user-provided value |
53+
| webapp/view/app.view.xml:24:5:24:36 | content={/input} | webapp/view/app.view.xml:22:5:23:28 | value={/input} | webapp/view/app.view.xml:24:5:24:36 | content={/input} | XSS vulnerability due to $@. | webapp/view/app.view.xml:22:5:23:28 | value={/input} | user-provided value |

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml‎

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,24 @@
22
xmlns="sap.m"
33
xmlns:core="sap.ui.core"
44
xmlns:mvc="sap.ui.core.mvc">
5-
<Input placeholder="Enter Payload"
5+
<Input placeholder="Enter Input Payload"
66
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt;"
77
value="{/input}" /> <!--User input source sap.m.Input.value -->
8+
<ComboBoxTextField placeholder="Enter ComboBoxTextField Payload"
9+
value="{/input}" /> <!--User input source sap.m.ComboBoxTextField.value -->
10+
<DatePicker placeholder="Enter DatePicker Payload"
11+
value="{/input}" /> <!--User input source sap.m.DatePicker.value -->
12+
<TextArea placeholder="Enter TextArea Payload"
13+
value="{/input}" /> <!--User input source sap.m.TextArea.value -->
14+
<ComboBoxBase placeholder="Enter ComboBoxBase Payload"
15+
value="{/input}" /> <!--User input source sap.m.ComboBoxBase.value -->
16+
<SearchField placeholder="Enter SearchField Payload"
17+
value="{/input}" /> <!--User input source sap.m.SearchField.value -->
18+
<MultiInput placeholder="Enter MultiInput Payload"
19+
value="{/input}" /> <!--User input source sap.m.MultiInput.value -->
20+
<FeedInput placeholder="Enter FeedInput Payload"
21+
value="{/input}" /> <!--User input source sap.m.FeedInput.value -->
22+
<InputBase placeholder="Enter InputBase Payload"
23+
value="{/input}" /> <!--User input source sap.m.InputBase.value -->
824
<core:HTML content="{/input}"/> <!--XSS sink sap.ui.core.HTML.content -->
925
</mvc:View>

0 commit comments

Comments
 (0)