Skip to content

Commit 9311c30

Browse files
rvermeulenrvermeulen
committed
Format QL modules
1 parent 2dbaf58 commit 9311c30

File tree

3 files changed

+70
-54
lines changed

3 files changed

+70
-54
lines changed

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5.qll‎

Lines changed: 29 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ private import semmle.javascript.security.dataflow.DomBasedXssCustomizations
55
private import advanced_security.javascript.frameworks.ui5.UI5View
66

77
module UI5 {
8-
98
bindingset[this]
109
private class JsonStringReader extends string {
1110
bindingset[result]
@@ -64,17 +63,17 @@ module UI5 {
6463

6564
string toString() { result = this.getName() + ": " + this.getRoot() }
6665

67-
predicate contains(File file) {
68-
file.getParentContainer+() = getRoot()
69-
}
66+
predicate contains(File file) { file.getParentContainer+() = getRoot() }
7067
}
7168

7269
private string getAResourceRootConfig() {
7370
result = any(SapUiCoreScript script).getAttributeByName("data-sap-ui-resourceroots").getValue()
7471
}
7572

7673
class SapUiCoreScript extends HTML::ScriptElement {
77-
SapUiCoreScript() { this.getSourcePath().matches(["%/sap-ui-core.js", "%sap-ui-core-nojQuery.js"]) }
74+
SapUiCoreScript() {
75+
this.getSourcePath().matches(["%/sap-ui-core.js", "%sap-ui-core-nojQuery.js"])
76+
}
7877

7978
ResourceRoot getAResourceRoot() {
8079
result.getSource() = this.getAttributeByName("data-sap-ui-resourceroots").getValue()
@@ -88,8 +87,9 @@ module UI5 {
8887
/** A UI5 web application manifest associated with a bootstrapped UI5 web application. */
8988
class WebAppManifest extends File {
9089
WebApp webapp;
90+
9191
WebAppManifest() {
92-
this.getBaseName() = "manifest.json" and
92+
this.getBaseName() = "manifest.json" and
9393
this.getParentContainer() = webapp.getWebAppFolder()
9494
}
9595

@@ -100,34 +100,34 @@ module UI5 {
100100
class WebApp extends HTML::HtmlFile {
101101
SapUiCoreScript coreScript;
102102

103-
WebApp() {
104-
coreScript.getFile() = this
105-
}
103+
WebApp() { coreScript.getFile() = this }
106104

107-
File getAResource() {
108-
coreScript.getAResolvedResourceRoot().contains(result)
109-
}
105+
File getAResource() { coreScript.getAResolvedResourceRoot().contains(result) }
110106

111107
File getResource(string path) {
112108
getWebAppFolder().getAbsolutePath() + "/" + path = result.getAbsolutePath()
113109
}
114110

115-
Folder getWebAppFolder() {
116-
result = this.getParentContainer()
117-
}
111+
Folder getWebAppFolder() { result = this.getParentContainer() }
118112

119-
WebAppManifest getManifest() {
120-
result.getWebapp() = this
121-
}
113+
WebAppManifest getManifest() { result.getWebapp() = this }
122114

123115
File getInitialModule() {
124-
exists(string initialModuleResourcePath, string resolvedModulePath, ResolvedResourceRoot resourceRoot |
125-
initialModuleResourcePath = coreScript.getAttributeByName("data-sap-ui-onInit").getValue() and coreScript.getAResolvedResourceRoot() = resourceRoot and
126-
resolvedModulePath = initialModuleResourcePath.regexpReplaceAll("^module\\s*:\\s*", "").replaceAll(resourceRoot.getName(), resourceRoot.getRoot().getAbsolutePath()) and
116+
exists(
117+
string initialModuleResourcePath, string resolvedModulePath,
118+
ResolvedResourceRoot resourceRoot
119+
|
120+
initialModuleResourcePath = coreScript.getAttributeByName("data-sap-ui-onInit").getValue() and
121+
coreScript.getAResolvedResourceRoot() = resourceRoot and
122+
resolvedModulePath =
123+
initialModuleResourcePath
124+
.regexpReplaceAll("^module\\s*:\\s*", "")
125+
.replaceAll(resourceRoot.getName(), resourceRoot.getRoot().getAbsolutePath()) and
127126
result.getAbsolutePath() = resolvedModulePath + ".js"
128127
)
129128
}
130129
}
130+
131131
/**
132132
* https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.loader%23methods/sap.ui.loader.config
133133
*/
@@ -169,9 +169,7 @@ module UI5 {
169169
)
170170
}
171171

172-
WebApp getWebApp() {
173-
this.getFile() = result.getAResource()
174-
}
172+
WebApp getWebApp() { this.getFile() = result.getAResource() }
175173

176174
SapDefineModule getExtendingDefine() {
177175
exists(Extension baseExtension, Extension subclassExtension, SapDefineModule subclassDefine |
@@ -386,9 +384,7 @@ module UI5 {
386384
*/
387385
bindingset[path]
388386
JsonObject resolveDirectPath(string path) {
389-
exists(WebApp webApp|
390-
result.getJsonFile() = webApp.getResource(path)
391-
)
387+
exists(WebApp webApp | result.getJsonFile() = webApp.getResource(path))
392388
}
393389

394390
/**
@@ -593,14 +589,18 @@ module UI5 {
593589
result.getMethodName() = "setProperty" and
594590
result.getArgument(0).asExpr().(StringLiteral).getValue() = propName and
595591
// TODO: in same controller
596-
exists(WebApp webApp | webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile())
592+
exists(WebApp webApp |
593+
webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile()
594+
)
597595
}
598596

599597
bindingset[propName]
600598
MethodCallNode getARead(string propName) {
601599
result.getMethodName() = "get" + capitalize(propName) and
602600
// TODO: in same controller
603-
exists(WebApp webApp | webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile())
601+
exists(WebApp webApp |
602+
webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile()
603+
)
604604
}
605605
}
606606
}

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5DataFlow.qll‎

Lines changed: 22 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,9 @@ module UI5DataFlow {
1212
private predicate bidiModelControl(DataFlow::Node start, DataFlow::Node end) {
1313
exists(DataFlow::SourceNode property, Metadata metadata, UI5BoundNode node |
1414
// same project
15-
exists(WebApp webApp | webApp.getAResource() = metadata.getFile() and webApp.getAResource() = node.getFile()) and
15+
exists(WebApp webApp |
16+
webApp.getAResource() = metadata.getFile() and webApp.getAResource() = node.getFile()
17+
) and
1618
(
1719
// same control
1820
metadata.getControl().getName() = node.getBindingPath().getControlQualifiedType()
@@ -87,22 +89,25 @@ module UI5DataFlow {
8789
UI5BindingPath getBindingPath() { result = bindingPath }
8890

8991
UI5BoundNode() {
90-
exists(WebApp webApp | webApp.getAResource() = this.getFile() and
91-
webApp.getAResource() = bindingPath.getFile() |
92-
/* The relevant portion of the content of a JSONModel */
93-
exists(Property p, JsonModel model |
94-
// The property bound to an UI5View source
95-
this.(DataFlow::PropRef).getPropertyNameExpr() = p.getNameExpr() and
96-
// The binding path refers to this model
97-
bindingPath.getAbsolutePath() = model.getPathString(p)
92+
exists(WebApp webApp |
93+
webApp.getAResource() = this.getFile() and
94+
webApp.getAResource() = bindingPath.getFile()
95+
|
96+
/* The relevant portion of the content of a JSONModel */
97+
exists(Property p, JsonModel model |
98+
// The property bound to an UI5View source
99+
this.(DataFlow::PropRef).getPropertyNameExpr() = p.getNameExpr() and
100+
// The binding path refers to this model
101+
bindingPath.getAbsolutePath() = model.getPathString(p)
102+
)
103+
or
104+
/* The URI string to the JSONModel constructor call */
105+
exists(JsonModel model |
106+
this = model.getArgument(0) and
107+
this.asExpr() instanceof StringLiteral and
108+
bindingPath.getAbsolutePath() = model.getPathString()
109+
)
98110
)
99-
or
100-
/* The URI string to the JSONModel constructor call */
101-
exists(JsonModel model |
102-
this = model.getArgument(0) and
103-
this.asExpr() instanceof StringLiteral and
104-
bindingPath.getAbsolutePath() = model.getPathString()
105-
))
106111
}
107112
}
108113

@@ -112,9 +117,7 @@ module UI5DataFlow {
112117
class UI5ModelSource extends UI5DataFlow::UI5BoundNode, RemoteFlowSource {
113118
UI5ModelSource() { bindingPath = any(UI5View view).getASource() }
114119

115-
override string getSourceType() {
116-
result = "UI5 model remote flow source"
117-
}
120+
override string getSourceType() { result = "UI5 model remote flow source" }
118121
}
119122

120123
/**

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll‎

Lines changed: 19 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,9 @@ abstract class UI5BindingPath extends Locatable {
9999
result.getPropertyNameExpr() = p.getNameExpr() and
100100
this.getAbsolutePath() = model.getPathString(p) and
101101
//restrict search inside the same webapp
102-
exists(WebApp webApp | webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile())
102+
exists(WebApp webApp |
103+
webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile()
104+
)
103105
)
104106
// TODO
105107
/*
@@ -143,7 +145,9 @@ abstract class UI5View extends File {
143145
// The controller name should match
144146
result.getName() = this.getControllerName() and
145147
// The View and the Controller are in a same webapp
146-
exists(WebApp webApp | webApp.getAResource() = this and webApp.getAResource() = result.getFile())
148+
exists(WebApp webApp |
149+
webApp.getAResource() = this and webApp.getAResource() = result.getFile()
150+
)
147151
}
148152

149153
abstract UI5BindingPath getASource();
@@ -493,7 +497,10 @@ class XmlView extends UI5View, XmlFile {
493497
// or a custom control with implementation code found in the webapp
494498
exists(CustomControl control |
495499
control.getName() = element.getNamespace().getUri() + "." + element.getName() and
496-
exists(WebApp webApp | webApp.getAResource() = control.getFile() and webApp.getAResource() = element.getFile())
500+
exists(WebApp webApp |
501+
webApp.getAResource() = control.getFile() and
502+
webApp.getAResource() = element.getFile()
503+
)
497504
)
498505
)
499506
)
@@ -563,20 +570,26 @@ class XmlControl extends UI5Control instanceof XmlElement {
563570

564571
override CustomControl getDefinition() {
565572
result.getName() = this.getQualifiedType() and
566-
exists(WebApp webApp | webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile())
573+
exists(WebApp webApp |
574+
webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile()
575+
)
567576
}
568577

569578
bindingset[propName]
570579
override MethodCallNode getARead(string propName) {
571580
// TODO: in same view
572-
exists(WebApp webApp | webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile()) and
581+
exists(WebApp webApp |
582+
webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile()
583+
) and
573584
result.getMethodName() = "get" + capitalize(propName)
574585
}
575586

576587
bindingset[propName]
577588
override MethodCallNode getAWrite(string propName) {
578589
// TODO: in same view
579-
exists(WebApp webApp | webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile()) and
590+
exists(WebApp webApp |
591+
webApp.getAResource() = this.getFile() and webApp.getAResource() = result.getFile()
592+
) and
580593
result.getMethodName() = "set" + capitalize(propName)
581594
}
582595

0 commit comments

Comments
 (0)