Bump codeql/javascript-all and fix breaking changes

.github/workflows/run-codeql-unit-tests-javascript.yml

@@ -81,7 +81,7 @@ jobs:
         run: |
           if ! command -v cds &> /dev/null
           then
-            npm install -g @sap/cds-dk
+            npm install -g @sap/cds-dk@8.6.1
           fi
 
       # Compile .cds files to .cds.json files.

extractors/cds/tools/index-files.sh

@@ -36,7 +36,7 @@ then
     # directory.
     #
     # We also ensure we skip node_modules, as we can end up in a recursive loop
-    find . -type d -name node_modules -prune -false -o -type f \( -iname 'package.json' \) -exec grep -ql '@sap/cds' {} \; -execdir bash -c "grep -q \"^\$(pwd)\(/\|$\)\" \"$response_file\"" \; -execdir bash -c "echo \"Installing @sap/cds-dk into \$(pwd) to enable CDS compilation.\"" \; -execdir npm install --silent @sap/cds-dk \; -execdir npm install --silent \;
+    find . -type d -name node_modules -prune -false -o -type f \( -iname 'package.json' \) -exec grep -ql '@sap/cds' {} \; -execdir bash -c "grep -q \"^\$(pwd)\(/\|$\)\" \"$response_file\"" \; -execdir bash -c "echo \"Installing @sap/cds-dk into \$(pwd) to enable CDS compilation.\"" \; -execdir npm install --silent @sap/cds-dk@8.6.1 \; -execdir npm install --silent \;
 
     # Use the npx command to dynamically install the cds development kit (@sap/cds-dk) package if necessary,
     # which then provides the cds command line tool in directories which are not covered by the package.json

javascript/frameworks/cap/ext/qlpack.yml

@@ -1,6 +1,6 @@
 ---
 library: true
 name: advanced-security/javascript-sap-cap-models
-version: 0.3.0
+version: 0.4.0
 extensionTargets:
-  codeql/javascript-all: "^2.0.0"
+  codeql/javascript-all: "^2.4.0"

javascript/frameworks/cap/lib/codeql-pack.lock.yml

@@ -2,23 +2,25 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/dataflow:
-    version: 1.1.2
-  codeql/javascript-all:
     version: 2.0.0
+  codeql/javascript-all:
+    version: 2.4.0
   codeql/mad:
-    version: 1.0.8
+    version: 1.0.16
   codeql/regex:
-    version: 1.0.8
+    version: 1.0.16
   codeql/ssa:
-    version: 1.0.8
+    version: 1.0.16
+  codeql/threat-models:
+    version: 1.0.16
   codeql/tutorial:
-    version: 1.0.8
+    version: 1.0.16
   codeql/typetracking:
-    version: 1.0.8
+    version: 2.0.0
   codeql/util:
-    version: 1.0.8
+    version: 2.0.3
   codeql/xml:
-    version: 1.0.8
+    version: 1.0.16
   codeql/yaml:
-    version: 1.0.8
+    version: 1.0.16
 compiled: false

javascript/frameworks/cap/lib/qlpack.yml

@@ -1,9 +1,9 @@
 ---
 library: true
 name: advanced-security/javascript-sap-cap-all
-version: 0.3.0
+version: 0.4.0
 suites: codeql-suites
 extractor: javascript
 dependencies:
-  codeql/javascript-all: "^2.0.0"
-  advanced-security/javascript-sap-cap-models: "^0.3.0"
+  codeql/javascript-all: "^2.4.0"
+  advanced-security/javascript-sap-cap-models: "^0.4.0"

javascript/frameworks/cap/src/codeql-pack.lock.yml

@@ -2,23 +2,25 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/dataflow:
-    version: 1.1.2
-  codeql/javascript-all:
     version: 2.0.0
+  codeql/javascript-all:
+    version: 2.4.0
   codeql/mad:
-    version: 1.0.8
+    version: 1.0.16
   codeql/regex:
-    version: 1.0.8
+    version: 1.0.16
   codeql/ssa:
-    version: 1.0.8
+    version: 1.0.16
+  codeql/threat-models:
+    version: 1.0.16
   codeql/tutorial:
-    version: 1.0.8
+    version: 1.0.16
   codeql/typetracking:
-    version: 1.0.8
+    version: 2.0.0
   codeql/util:
-    version: 1.0.8
+    version: 2.0.3
   codeql/xml:
-    version: 1.0.8
+    version: 1.0.16
   codeql/yaml:
-    version: 1.0.8
+    version: 1.0.16
 compiled: false

javascript/frameworks/cap/src/qlpack.yml

@@ -1,11 +1,11 @@
 ---
 library: false
 name: advanced-security/javascript-sap-cap-queries
-version: 0.3.0
+version: 0.4.0
 suites: codeql-suites
 extractor: javascript
 dependencies:
-  codeql/javascript-all: "^2.0.0"
-  advanced-security/javascript-sap-cap-models: "^0.3.0"
-  advanced-security/javascript-sap-cap-all: "^0.3.0"
+  codeql/javascript-all: "^2.4.0"
+  advanced-security/javascript-sap-cap-models: "^0.4.0"
+  advanced-security/javascript-sap-cap-all: "^0.4.0"
 default-suite-file: codeql-suites/javascript-code-scanning.qls

javascript/frameworks/cap/test/codeql-pack.lock.yml

@@ -2,23 +2,25 @@
 lockVersion: 1.0.0
 dependencies:
   codeql/dataflow:
-    version: 1.1.2
-  codeql/javascript-all:
     version: 2.0.0
+  codeql/javascript-all:
+    version: 2.4.0
   codeql/mad:
-    version: 1.0.8
+    version: 1.0.16
   codeql/regex:
-    version: 1.0.8
+    version: 1.0.16
   codeql/ssa:
-    version: 1.0.8
+    version: 1.0.16
+  codeql/threat-models:
+    version: 1.0.16
   codeql/tutorial:
-    version: 1.0.8
+    version: 1.0.16
   codeql/typetracking:
-    version: 1.0.8
+    version: 2.0.0
   codeql/util:
-    version: 1.0.8
+    version: 2.0.3
   codeql/xml:
-    version: 1.0.8
+    version: 1.0.16
   codeql/yaml:
-    version: 1.0.8
+    version: 1.0.16
 compiled: false

javascript/frameworks/cap/test/qlpack.yml

@@ -1,9 +1,9 @@
 ---
 name: advanced-security/javascript-sap-cap-queries-tests
-version: 0.3.0
+version: 0.4.0
 extractor: javascript
 dependencies:
-  codeql/javascript-all: "^2.0.0"
-  advanced-security/javascript-sap-cap-queries: "^0.3.0"
-  advanced-security/javascript-sap-cap-models: "^0.3.0"
-  advanced-security/javascript-sap-cap-all: "^0.3.0"
+  codeql/javascript-all: "^2.4.0"
+  advanced-security/javascript-sap-cap-queries: "^0.4.0"
+  advanced-security/javascript-sap-cap-models: "^0.4.0"
+  advanced-security/javascript-sap-cap-all: "^0.4.0"

javascript/frameworks/cap/test/queries/cqlinjection/cqlinjection.expected

@@ -1,3 +1,7 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (CqlInjection.ql:14,8-27)
+WARNING: type 'Configuration' has been deprecated and may be removed in future (CqlInjection.ql:19,33-61)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (CqlInjection.ql:46,29-47)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (CqlInjection.ql:46,56-74)
 nodes
 | cqlinjection.js:7:34:7:36 | req |
 | cqlinjection.js:7:34:7:36 | req |

javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/log-injection-not-depending-on-request.expected

@@ -1,3 +1,6 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
 nodes
 edges
 #select

javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/log-injection-type-sanitized.expected

@@ -1,3 +1,6 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
 nodes
 edges
 #select

javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/log-injection-with-complete-protocol-none.expected

@@ -1,3 +1,6 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
 nodes
 edges
 #select

javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/log-injection-with-service1-protocol-none.expected

@@ -1,3 +1,6 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
 nodes
 | srv/service2.js:6:29:6:31 | msg |
 | srv/service2.js:6:29:6:31 | msg |

javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/log-injection-with-service2-protocol-none.expected

@@ -1,3 +1,6 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
 nodes
 | srv/service1.js:6:33:6:35 | req |
 | srv/service1.js:6:33:6:35 | req |

javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/log-injection-without-protocol-none.expected

@@ -1,3 +1,6 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (LogInjection.ql:14,8-27)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,43-61)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (LogInjection.ql:18,70-88)
 nodes
 | srv/service1.js:6:33:6:35 | req |
 | srv/service1.js:6:33:6:35 | req |

javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.expected

@@ -1,8 +1,12 @@
+WARNING: module 'PathGraph' has been deprecated and may be removed in future (SensitiveExposure.ql:17,8-27)
+WARNING: type 'Configuration' has been deprecated and may be removed in future (SensitiveExposure.ql:50,42-70)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (SensitiveExposure.ql:60,41-59)
+WARNING: type 'PathNode' has been deprecated and may be removed in future (SensitiveExposure.ql:60,68-86)
 nodes
 | sensitive-exposure.js:9:32:9:42 | Sample.name |
 | sensitive-exposure.js:9:32:9:42 | Sample.name |
 | sensitive-exposure.js:9:32:9:42 | Sample.name |
 edges
 | sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name |
 #select
-| sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name | Log entry depends on the $@ field which is annotated as potentially sensitive. | sensitive-exposure.cds:4:5:4:8 | {\\n      ...       } | name |
+| sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name | sensitive-exposure.js:9:32:9:42 | Sample.name | Log entry depends on the $@ field which is annotated as potentially sensitive. | sensitive-exposure.cds.json:9:17:13:9 | {\\n      ...       } | name |

javascript/frameworks/ui5/ext/qlpack.yml

@@ -1,8 +1,8 @@
 ---
 library: true
 name: advanced-security/javascript-sap-ui5-models
-version: 0.6.0
+version: 0.7.0
 extensionTargets:
-  codeql/javascript-all: "^2.0.0"
+  codeql/javascript-all: "^2.4.0"
 dataExtensions:
   - "*.model.yml"

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll

@@ -83,8 +83,8 @@ class ODataServiceModel extends UI5ExternalModel {
     this instanceof NewNode and
     (
       exists(RequiredObject oDataModel |
-        oDataModel.flowsTo(this.getCalleeNode()) and
-        oDataModel.getDependencyType() = "sap/ui/model/odata/v2/ODataModel"
+        oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and
+        oDataModel.getDependency() = "sap/ui/model/odata/v2/ODataModel"
       )
       or
       this.getCalleeName() = "ODataModel"