Remove cartesian product in MkConstBindingPathComponentList

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/BindingStringParser.qll

@@ -839,18 +839,18 @@ module BindingStringParser<BindingStringReaderSig BindingStringReader> {
       then
         exists(BindingPathComponentList tail |
           mkBindingPathComponentList(getNextSkippingWhitespace(nextToken), tail, last) and
-          list = MkConstBindingPathComponentList(name, tail, first)
+          list = MkConstBindingPathComponentList(name, tail)
         )
       else (
-        list = MkConstBindingPathComponentList(name, MkEmptyBindingPathComponentList(), first) and
+        list = MkConstBindingPathComponentList(name, MkEmptyBindingPathComponentList()) and
         last = name
       )
     )
   }
 
   private newtype TBindingPathComponentList =
     MkEmptyBindingPathComponentList() or
-    MkConstBindingPathComponentList(NameToken headToken, BindingPathComponentList tail, Token source) {
+    MkConstBindingPathComponentList(NameToken headToken, BindingPathComponentList tail) {
       exists(Token nextToken | nextToken = getNextSkippingWhitespace(headToken) |
         if nextToken instanceof ForwardSlashToken or nextToken instanceof DotToken
         then mkBindingPathComponentList(getNextSkippingWhitespace(nextToken), tail, _)
@@ -863,18 +863,16 @@ module BindingStringParser<BindingStringReaderSig BindingStringReader> {
       this = MkEmptyBindingPathComponentList() and result = ""
       or
       exists(NameToken head, BindingPathComponentList tail |
-        this = MkConstBindingPathComponentList(head, tail, _) and
+        this = MkConstBindingPathComponentList(head, tail) and
         if tail instanceof MkEmptyBindingPathComponentList
         then result = head.toString()
         else result = head.toString() + "/" + tail.toString()
       )
     }
 
-    NameToken getHead() { this = MkConstBindingPathComponentList(result, _, _) }
+    NameToken getHead() { this = MkConstBindingPathComponentList(result, _) }
 
-    BindingPathComponentList getTail() { this = MkConstBindingPathComponentList(_, result, _) }
-
-    Token getSource() { this = MkConstBindingPathComponentList(_, _, result) }
+    BindingPathComponentList getTail() { this = MkConstBindingPathComponentList(_, result) }
   }
 
   predicate mkAbsoluteBindingPath(Token first, BindingPath path, Token last) {

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Bindings.qll

@@ -4,6 +4,7 @@
 
 import javascript
 import advanced_security.javascript.frameworks.ui5.BindingStringParser as MakeBindingStringParser
+import advanced_security.javascript.frameworks.ui5.UI5View
 
 private class ContextBindingAttribute extends XmlAttribute {
   ContextBindingAttribute() { this.getName() = "binding" }
@@ -15,8 +16,12 @@ private class ContextBindingAttribute extends XmlAttribute {
 // TODO: add support for binding strings in strings such as `description: "Some {/description}"`
 private newtype TBindingString =
   TBindingStringFromLiteral(StringLiteral stringLiteral) { stringLiteral.getValue().matches("{%}") } or
-  TBindingStringFromXmlAttribute(XmlAttribute attribute) { attribute.getValue().matches("{%}") } or
+  TBindingStringFromXmlAttribute(XmlAttribute attribute) {
+    attribute.getLocation().getFile() instanceof XmlView and
+    attribute.getValue().matches("{%}")
+  } or
   TBindingStringFromJsonProperty(JsonObject object, string propertyName) {
+    object.getFile() instanceof UI5View and
     object.getPropStringValue(propertyName).matches("{%}")
   } or
   TBindingStringFromBindElementMethodCall(BindElementMethodCallNode bindElement) {