Skip to content

Model sap/ui/core/EventBus #258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Model sap/ui/core/EventBus #258

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fbc4be8
Add an XSS example that uses `sap/ui/core/EventBus`
jeongsoolee09 Nov 19, 2025
d7a8b30
Add the first draft of working query
jeongsoolee09 Nov 24, 2025
77c96b1
Update expected results for both jobs
jeongsoolee09 Nov 24, 2025
969c218
Regress to previous expected file to unblock check
jeongsoolee09 Nov 24, 2025
3e5255a
Expected file from Action summary
mbaluda Nov 25, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions javascript/frameworks/ui5/ext/ui5.model.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,9 @@ extensions:
- ["UI5ClientStorage", "global", "Member[jQuery].Member[sap].Member[storage]"]
- ["UI5ClientStorage", "sap/ui/core/util/File", ""]
- ["UI5ClientStorage", "global", "Member[sap].Member[ui].Member[core].Member[util].Member[File]"]
# Publishing and Subscribing to Events
- ["UI5PublishedEventData", "sap/ui/core/EventBus", "Member[getInstance].ReturnValue.Member[publish].Argument[2]"]
- ["UI5EventSubscriptionHandlerDataParameter", "sap/ui/core/EventBus", "Member[getInstance].ReturnValue.Member[subscribe].Argument[2].Parameter[2]"]

- addsTo:
pack: codeql/javascript-all
Expand Down
17 changes: 1 addition & 16 deletions javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
import javascript
import DataFlow
import advanced_security.javascript.frameworks.ui5.JsonParser
import advanced_security.javascript.frameworks.ui5.dataflow.TypeTrackers
import semmle.javascript.security.dataflow.DomBasedXssCustomizations
import advanced_security.javascript.frameworks.ui5.UI5View
import advanced_security.javascript.frameworks.ui5.UI5HTML
Expand Down Expand Up @@ -1427,19 +1428,3 @@ class PropertyMetadata extends ObjectLiteralNode {
inSameWebApp(this.getFile(), result.getFile())
}
}

module TypeTrackers {
private SourceNode hasDependency(TypeTracker t, string dependencyPath) {
t.start() and
exists(UserModule d |
d.getADependency() = dependencyPath and
result = d.getRequiredObject(dependencyPath).asSourceNode()
)
or
exists(TypeTracker t2 | result = hasDependency(t2, dependencyPath).track(t2, t))
}

SourceNode hasDependency(string dependencyPath) {
result = hasDependency(TypeTracker::end(), dependencyPath)
}
}
7 changes: 7 additions & 0 deletions ...ipt/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -366,3 +366,10 @@ class LogArgumentToListener extends DataFlow::SharedFlowStep {
logArgumentToListener(start, end)
}
}

class PublishedEventToEventSubscribedEventData extends DataFlow::SharedFlowStep {
override predicate step(DataFlow::Node start, DataFlow::Node end) {
start = ModelOutput::getATypeNode("UI5PublishedEventData").getInducingNode() and
end = ModelOutput::getATypeNode("UI5EventSubscriptionHandlerDataParameter").getInducingNode()
}
}
46 changes: 46 additions & 0 deletions .../frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/TypeTrackers.qll
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
import javascript
import DataFlow

module TypeTrackers {
private SourceNode hasDependency(TypeTracker t, string dependencyPath) {
t.start() and
exists(UserModule d |
d.getADependency() = dependencyPath and
result = d.getRequiredObject(dependencyPath).asSourceNode()
)
or
exists(TypeTracker t2 | result = hasDependency(t2, dependencyPath).track(t2, t))
}

SourceNode hasDependency(string dependencyPath) {
result = hasDependency(TypeTracker::end(), dependencyPath)
}

private MethodCallNode getOwnerComponentRef(TypeTracker t, CustomController customController) {
customController.getAThisNode() = result.getReceiver() and
result.getMethodName() = "getOwnerComponent"
or
exists(TypeTracker t2 | result = getOwnerComponentRef(t2, customController).track(t2, t))
Comment on lines +20 to +23

Check warning

Code scanning / CodeQL-Community

Var only used in one side of disjunct.

The [variable t](1) is only used in one side of disjunct.
}

/* owner component ref */

Check warning

Code scanning / CodeQL-Community

Block comment that is not QLDoc

Block comment could be QLDoc for [the below code](1).
MethodCallNode getOwnerComponentRef(CustomController customController) {
result = getOwnerComponentRef(TypeTracker::end(), customController)
}

private class ObjFieldStep extends SharedTypeTrackingStep {

Check warning

Code scanning / CodeQL-Community

Dead code

This code is never used, and it's not publicly exported.
override predicate step(DataFlow::Node start, DataFlow::Node end) {
exists(SapExtendCall sapExtendCall, ObjectLiteralNode wrappedObject, string name |
wrappedObject = sapExtendCall.getContent() and
start = getAnAlias(wrappedObject).getAPropertyWrite(name).getRhs() and
end = getAnAlias(wrappedObject).getAPropertyRead(name)
)
}
}

private DataFlow::SourceNode getAnAlias(DataFlow::SourceNode object) {

Check warning

Code scanning / CodeQL-Community

Dead code

This code is never used, and it's not publicly exported.
result = object
or
result = getAnAlias(object).getAPropertySource().(DataFlow::FunctionNode).getReceiver()
}
}
46 changes: 46 additions & 0 deletions javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/UI5Xss.expected
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,46 @@
nodes
| webapp/controller/app.controller.js:8:26:8:50 | this.ge ... Model() |
| webapp/controller/app.controller.js:9:17:9:21 | input |
| webapp/controller/app.controller.js:9:25:9:52 | oModel. ... input') |
| webapp/controller/app.controller.js:10:44:10:48 | input |
| webapp/controller/app.controller.js:18:17:18:27 | sInputValue |
| webapp/controller/app.controller.js:18:31:18:59 | oEvent. ... Value() |
| webapp/controller/app.controller.js:19:44:19:54 | sInputValue |
| webapp/controller/app.controller.js:26:17:26:21 | value |
| webapp/controller/app.controller.js:26:25:26:41 | oInput.getValue() |
| webapp/controller/app.controller.js:27:36:27:40 | value |
| webapp/controller/app.controller.js:31:17:31:27 | input: null |
| webapp/controller/app.controller.js:32:17:32:29 | output1: null |
| webapp/controller/app.controller.js:34:17:34:29 | output3: null |
| webapp/view/app.view.xml:5:5:7:28 | value={/input} |
| webapp/view/app.view.xml:9:5:9:39 | content={/output1} |
| webapp/view/app.view.xml:12:5:12:39 | content={/output2} |
| webapp/view/app.view.xml:17:5:17:39 | content={/output3} |
edges
| webapp/controller/app.controller.js:8:26:8:50 | this.ge ... Model() | webapp/controller/app.controller.js:9:25:9:52 | oModel. ... input') |
| webapp/controller/app.controller.js:9:17:9:21 | input | webapp/controller/app.controller.js:10:44:10:48 | input |
| webapp/controller/app.controller.js:9:25:9:52 | oModel. ... input') | webapp/controller/app.controller.js:9:17:9:21 | input |
| webapp/controller/app.controller.js:10:44:10:48 | input | webapp/controller/app.controller.js:8:26:8:50 | this.ge ... Model() |
| webapp/controller/app.controller.js:10:44:10:48 | input | webapp/controller/app.controller.js:32:17:32:29 | output1: null |
| webapp/controller/app.controller.js:18:17:18:27 | sInputValue | webapp/controller/app.controller.js:19:44:19:54 | sInputValue |
| webapp/controller/app.controller.js:18:31:18:59 | oEvent. ... Value() | webapp/controller/app.controller.js:18:17:18:27 | sInputValue |
| webapp/controller/app.controller.js:19:44:19:54 | sInputValue | webapp/controller/app.controller.js:34:17:34:29 | output3: null |
| webapp/controller/app.controller.js:26:17:26:21 | value | webapp/controller/app.controller.js:27:36:27:40 | value |
| webapp/controller/app.controller.js:26:25:26:41 | oInput.getValue() | webapp/controller/app.controller.js:26:17:26:21 | value |
| webapp/controller/app.controller.js:31:17:31:27 | input: null | webapp/controller/app.controller.js:9:25:9:52 | oModel. ... input') |
| webapp/controller/app.controller.js:31:17:31:27 | input: null | webapp/view/app.view.xml:5:5:7:28 | value={/input} |
| webapp/controller/app.controller.js:32:17:32:29 | output1: null | webapp/view/app.view.xml:9:5:9:39 | content={/output1} |
| webapp/controller/app.controller.js:33:17:33:29 | output2: null | webapp/view/app.view.xml:12:5:12:39 | content={/output2} |
| webapp/controller/app.controller.js:34:17:34:29 | output3: null | webapp/view/app.view.xml:17:5:17:39 | content={/output3} |
| webapp/controller/app.controller.js:36:26:36:45 | new JSONModel(oData) | webapp/view/app.view.xml:9:5:9:39 | content={/output1} |
| webapp/controller/app.controller.js:36:26:36:45 | new JSONModel(oData) | webapp/view/app.view.xml:12:5:12:39 | content={/output2} |
| webapp/controller/app.controller.js:36:26:36:45 | new JSONModel(oData) | webapp/view/app.view.xml:17:5:17:39 | content={/output3} |
| webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/controller/app.controller.js:31:17:31:27 | input: null |
| webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/controller/app.controller.js:36:26:36:45 | new JSONModel(oData) |
| webapp/view/app.view.xml:9:5:9:39 | content={/output1} | webapp/controller/app.controller.js:32:17:32:29 | output1: null |
| webapp/view/app.view.xml:12:5:12:39 | content={/output2} | webapp/controller/app.controller.js:33:17:33:29 | output2: null |
| webapp/view/app.view.xml:17:5:17:39 | content={/output3} | webapp/controller/app.controller.js:34:17:34:29 | output3: null |
#select
| webapp/controller/app.controller.js:27:36:27:40 | value | webapp/controller/app.controller.js:26:25:26:41 | oInput.getValue() | webapp/controller/app.controller.js:27:36:27:40 | value | XSS vulnerability due to $@. | webapp/controller/app.controller.js:26:25:26:41 | oInput.getValue() | user-provided value |
| webapp/view/app.view.xml:9:5:9:39 | content={/output1} | webapp/view/app.view.xml:5:5:7:28 | value={/input} | webapp/view/app.view.xml:9:5:9:39 | content={/output1} | XSS vulnerability due to $@. | webapp/view/app.view.xml:5:5:7:28 | value={/input} | user-provided value |
| webapp/view/app.view.xml:17:5:17:39 | content={/output3} | webapp/controller/app.controller.js:18:31:18:59 | oEvent. ... Value() | webapp/view/app.view.xml:17:5:17:39 | content={/output3} | XSS vulnerability due to $@. | webapp/controller/app.controller.js:18:31:18:59 | oEvent. ... Value() | user-provided value |
1 change: 1 addition & 0 deletions javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/UI5Xss.qlref
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
UI5Xss/UI5Xss.ql

Check warning

Code scanning / CodeQL-Community

Query test without inline test expectations

Query test does not use inline test expectations.
Loading
Loading