Skip to content

Detect XSS involving server-side models and controller handler parameters #67

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 152 commits into from
Jan 26, 2024
Merged

Detect XSS involving server-side models and controller handler parameters #67

Show file tree
Hide file tree
Changes from 12 commits
Commits
Show all changes
152 commits
Select commit Hold shift + click to select a range
4c10735
Remove unneeded `private` qualifiers for imports
jeongsoolee09 Oct 21, 2023
e05674a
Make TypeTracker callers `private`
jeongsoolee09 Oct 21, 2023
537b9dc
Expose `CustomController`'s `name`
jeongsoolee09 Oct 21, 2023
84a6fc4
Add `Component`, `ManifestJson`, and `DataSource` classes
jeongsoolee09 Oct 21, 2023
af3785b
Bifurcate `UI5Model` into `Internal` and `External` models, add `ODat…
jeongsoolee09 Oct 21, 2023
7181945
Refine definition of Metadata and Extension, simplify some predicates
jeongsoolee09 Oct 21, 2023
a46bc00
Explicitly state that `accessesModel` captures accesses to `UI5Intern…
jeongsoolee09 Oct 21, 2023
3d6f9fc
Make `bindingPathCapture` public
jeongsoolee09 Oct 21, 2023
33ad5a5
Remove unnecessary comment
jeongsoolee09 Oct 21, 2023
c97eda1
Merge branch 'main' into jeongsoolee09/unknown-remote-model
jeongsoolee09 Oct 21, 2023
847d5be
Add class `ExternalModelDefinition` and debug predicates
jeongsoolee09 Oct 23, 2023
4b8deb6
Debug all new classes and predicates
jeongsoolee09 Oct 23, 2023
56c549e
Wrap `manifest.json` related defs into own module
jeongsoolee09 Oct 30, 2023
74048ec
Refine QLDoc of bindingPathCapture
jeongsoolee09 Oct 30, 2023
5321b4b
Minor formatting
jeongsoolee09 Oct 30, 2023
b759652
Capture bidirectional flow between model to which `commentText` is bo…
jeongsoolee09 Nov 1, 2023
7d38447
Merge branch 'main' into jeongsoolee09/unknown-remote-model
jeongsoolee09 Nov 21, 2023
cd89122
First round of addressing reviews
jeongsoolee09 Nov 21, 2023
3646c67
Remove unnecessary comments
jeongsoolee09 Nov 21, 2023
7bfc989
Abstract out `PropertyMetadata`
jeongsoolee09 Nov 21, 2023
f124cf5
Improve docstring and naming of symbols
jeongsoolee09 Nov 22, 2023
c60a3c7
Add QLDoc to `UI5BoundNode` and `UI5ExternalBoundNode`
jeongsoolee09 Nov 27, 2023
7ccf5dd
Initialize unit test project
jeongsoolee09 Nov 28, 2023
aaaeb88
Add more test cases where child overrides parent
jeongsoolee09 Nov 28, 2023
3926599
Merge branch 'jeongsoolee09/setModel-unit-tests' into jeongsoolee09/u…
jeongsoolee09 Nov 28, 2023
0d5b5c2
Merge branch 'main' into jeongsoolee09/unknown-remote-model
jeongsoolee09 Nov 28, 2023
e0ef1e8
Turn private imports into non-private
jeongsoolee09 Nov 29, 2023
f83a31f
Overhaul QLDocs and change some internal var name
jeongsoolee09 Nov 30, 2023
a8e46bd
Minor code formatting
jeongsoolee09 Nov 30, 2023
760389d
Add definitions to make `UI5View::UI5BindingPath.getModel` more robust
jeongsoolee09 Nov 30, 2023
5be00dd
Add location to `SapElement`
jeongsoolee09 Nov 30, 2023
f9118d4
Add abstract predicate `getControlDeclaration`
jeongsoolee09 Dec 1, 2023
2ae75d4
Update caller and suppress warning of unused paramter
jeongsoolee09 Dec 1, 2023
c9aefe1
Fix error in test case
jeongsoolee09 Dec 1, 2023
85232c8
Draft of `UI5Model UI5View::getModel()`
jeongsoolee09 Dec 1, 2023
27a010c
Fully debug `UI5Model UI5View::getModel()`
jeongsoolee09 Dec 1, 2023
fbc0ab5
Add same-webapp-condition to getModel and update call sites to it
jeongsoolee09 Dec 2, 2023
60cbee1
Add content to `setModelTest.ql`
jeongsoolee09 Dec 2, 2023
ffd2c14
Update doctstring on `UI5BindingPath.getModel`
jeongsoolee09 Dec 4, 2023
308f439
Merge branch 'rvermeulen/bindings' into jeongsoolee09/unknown-remote-…
jeongsoolee09 Dec 5, 2023
ff0ebe9
Minor formatting
jeongsoolee09 Dec 5, 2023
a3eaf33
Add docstrings for BindingPath.toSTring and add BindingPath.asString
jeongsoolee09 Dec 7, 2023
2fe24f5
Merge branch 'rvermeulen/bindings' into jeongsoolee09/unknown-remote-…
jeongsoolee09 Dec 7, 2023
4cd550e
Rename and add import path
jeongsoolee09 Dec 7, 2023
77d855c
Extend and modify existing classes
jeongsoolee09 Dec 7, 2023
013f6dc
Merge branch 'rvermeulen/bindings' into jeongsoolee09/unknown-remote-…
jeongsoolee09 Dec 7, 2023
eb2e1f8
Update callee predicate name
jeongsoolee09 Dec 7, 2023
01d0a32
Make UI5Control and UI5ControlProperty extend a newtype
jeongsoolee09 Dec 7, 2023
1d702fd
Add docstring to `TBindingTarget`
jeongsoolee09 Dec 7, 2023
8f29926
Remove for
jeongsoolee09 Dec 7, 2023
d9e1801
Fix getFile not being dispatched to bindingPath
jeongsoolee09 Dec 11, 2023
3656768
Generalize source/sink related classes to use UI5BoundNode
jeongsoolee09 Dec 11, 2023
7c32a88
Fix `getTarget()` not being dispatched to `UI5BindingPath`
jeongsoolee09 Dec 11, 2023
a05755b
Merge branch 'rvermeulen/fix-resource-root-resolve' into jeongsoolee0…
jeongsoolee09 Dec 12, 2023
1cb9b6e
Minor formatting of incoming changes
jeongsoolee09 Dec 12, 2023
f4e895f
Fix XML binding paths not being considered in `UI5BindingPath.getModel`
jeongsoolee09 Dec 12, 2023
28dafc2
Add more classes and member predicates
jeongsoolee09 Dec 12, 2023
5a08209
Prettify comments
jeongsoolee09 Dec 12, 2023
ce9f974
Add ViewReference.getABindElementCall, CustomController.getHandler
jeongsoolee09 Dec 12, 2023
4360948
Finalize draft of `UI5ExternalModelXss`
jeongsoolee09 Dec 12, 2023
9bc4e42
Remove unneeded bound variable in `exists`
jeongsoolee09 Dec 12, 2023
03914c7
Add missing file `UI5ExternalModelXss.ql`
jeongsoolee09 Dec 12, 2023
8ba25a2
Add three additional flow steps and their dependencies
jeongsoolee09 Dec 13, 2023
cc1bf03
Add additional additional flow steps
jeongsoolee09 Dec 13, 2023
8c1dfe1
Add more classes/predicates
jeongsoolee09 Dec 13, 2023
2780e15
Debug `getAMatchingSetModelCall`
jeongsoolee09 Dec 13, 2023
1432540
Cover client-side stored XSS through `window.location`
jeongsoolee09 Dec 14, 2023
88954e7
Cover XSS from event parameter to `window.location`
jeongsoolee09 Dec 14, 2023
a1cfdeb
Cover XSS from a remote source to sap.ui.core.HTML declaration
jeongsoolee09 Dec 14, 2023
044b85e
Add check for missing sanitizeContent
jeongsoolee09 Dec 14, 2023
6886293
Tidy up by editing comments and removing obsolete classes
jeongsoolee09 Dec 14, 2023
029905a
Update caller of `hasFlowPath`
jeongsoolee09 Dec 14, 2023
c13829a
Bring back bidirectional steps and handler argument node
jeongsoolee09 Dec 14, 2023
fad964d
Tidy up by removing comments and code that's been commented out
jeongsoolee09 Dec 14, 2023
d9774a2
Tidy up some more
jeongsoolee09 Dec 14, 2023
d3289ae
Cover XSS from a server-side model to an imported control
jeongsoolee09 Dec 15, 2023
fb4c9ec
Delete UI5ExternalModelXssHtml
jeongsoolee09 Dec 15, 2023
4d669f1
Remove duplicate row
jeongsoolee09 Dec 15, 2023
67274f3
Diversify source types in MaD
jeongsoolee09 Dec 15, 2023
4328c86
Stylize comments
jeongsoolee09 Dec 15, 2023
a154819
Remove unneeded commented-out code
jeongsoolee09 Dec 15, 2023
549082f
Stylize comments and remove unneeded ones
jeongsoolee09 Dec 15, 2023
e93ced2
Change the sourceModel labels back to `"remote"`
jeongsoolee09 Dec 15, 2023
04ad6d6
Clean up code
jeongsoolee09 Dec 18, 2023
0b09a4c
Promote each additional taint step into its own class
jeongsoolee09 Dec 18, 2023
fe20b98
Integrate UI5ExternalModelXss into UI5Xss
jeongsoolee09 Dec 18, 2023
549118a
Move `UI5ExternalModel` and `ODataServiceModel` to `UI5DataFlow`
jeongsoolee09 Dec 18, 2023
db29b98
Simplify import paths of UI5.qll and UI5DataFlow.qll
jeongsoolee09 Dec 18, 2023
d85cd7a
Add more cases to PropertyMetadata.getAWrite and .getARead
jeongsoolee09 Dec 19, 2023
11d9d7f
Fix import problem in UI5LogInjection
jeongsoolee09 Dec 19, 2023
8f5d15a
Remove unnecessary SKETCH comments
jeongsoolee09 Dec 19, 2023
9b6c9fb
Clean up flow labels and define binding paths as flow labels
jeongsoolee09 Dec 19, 2023
839e69d
Move remote flow sources to own module
rvermeulen Dec 20, 2023
64ac3ac
Remove flow labels
rvermeulen Dec 20, 2023
72a98a3
Move shared steps to FlowSteps module
rvermeulen Dec 20, 2023
530b3d8
Move remaining remote sources to RemoteFlowSources
rvermeulen Dec 20, 2023
a0d5bd8
Remove flow labels from steps
rvermeulen Dec 20, 2023
134361f
Move dataflow modules into dataflow dir
rvermeulen Dec 20, 2023
3b60e7d
Remove deprecated annotation to clean up test output
rvermeulen Dec 20, 2023
85fcf5b
Correct source in XSS query
rvermeulen Dec 20, 2023
67a3426
Remove label
rvermeulen Dec 20, 2023
84d2454
Remove primary source
rvermeulen Dec 20, 2023
f77d28f
Remove trailing whitespace
rvermeulen Dec 20, 2023
a606333
Fix webapp reference
rvermeulen Dec 20, 2023
d386089
Remove label from additional step
rvermeulen Dec 20, 2023
7b9eaea
Fix source definition
rvermeulen Dec 20, 2023
40d04e5
Remove unecessary import
rvermeulen Dec 20, 2023
a9418c4
Expose bound propery for Json binding path
rvermeulen Dec 21, 2023
93017cb
Base UI5 binding path on binding path and temporarily disable JS bind…
rvermeulen Dec 21, 2023
321c639
Fix formatting
rvermeulen Dec 21, 2023
bd78d01
Address failing setModelTest and add missing expected file
rvermeulen Dec 22, 2023
440b1e9
Re-add JS view and binding path
rvermeulen Dec 22, 2023
f6122ce
Merge branch 'main' into jeongsoolee09/unknown-remote-model
jeongsoolee09 Jan 9, 2024
056ef53
Remove comments, newlines, and old code
jeongsoolee09 Jan 10, 2024
b39961f
Remove more unnecessary comment
jeongsoolee09 Jan 10, 2024
6cac2be
Rename UriParameterGetMethodCall to UI5ExtRemoteSource and update doc…
jeongsoolee09 Jan 12, 2024
d1fcf30
Remove dead code, update/delete comments, formatting
jeongsoolee09 Jan 12, 2024
48b6c65
Add/modify classes/predicates to fix some unit tests
jeongsoolee09 Jan 12, 2024
9f01421
Merge `DataFlow::isAdditionalFlowStep` and `UI5XssQuery::isAdditional…
jeongsoolee09 Jan 12, 2024
5905428
Make `xss-book-example` pass
jeongsoolee09 Jan 12, 2024
ed85117
Minor comment relocation
jeongsoolee09 Jan 12, 2024
a2b71fc
Make all subclasses of `RemoteFlowSource` `private`
jeongsoolee09 Jan 12, 2024
78d1069
Update docstring and implementation of `LocalModelSetPropertyStep`
jeongsoolee09 Jan 12, 2024
9a8be34
Update docstring of `CustomMetadataPropertyStepToInternalModelContent`
jeongsoolee09 Jan 12, 2024
b0fcd77
Rename to LocalModelGetPropertyStepWithSetProperty and update docstring
jeongsoolee09 Jan 12, 2024
1a56eec
Fix xss-html-control-df
jeongsoolee09 Jan 13, 2024
94f98f6
Update `.expected` files
jeongsoolee09 Jan 13, 2024
c5730de
Fix typo in a comment
jeongsoolee09 Jan 16, 2024
7c6961c
Fix `xss-html-external-model`
jeongsoolee09 Jan 16, 2024
8f35338
Fix `xss-custom-control-jquery`
jeongsoolee09 Jan 16, 2024
d935f6d
Implement more abstract predicates for each UI5Views
jeongsoolee09 Jan 17, 2024
1bfb972
Debug `JsViewBindingPath`
jeongsoolee09 Jan 17, 2024
926cf08
Semi-fix `xss-js-control`
jeongsoolee09 Jan 17, 2024
74da4e1
Add constraints to variant `TJsonControl` and `TJsControl`
jeongsoolee09 Jan 17, 2024
fbfc592
Merge branch 'main' into jeongsoolee09/unknown-remote-model
jeongsoolee09 Jan 17, 2024
8d1c85a
Formatting and update callee predicate names
jeongsoolee09 Jan 17, 2024
77a6b8f
Fix `doSomething1`, `doSomething3`, and `doSomething4` of `xss-event-…
jeongsoolee09 Jan 17, 2024
da8ef86
Change docstring of `abstract getPropertyName`
jeongsoolee09 Jan 17, 2024
64e2b3d
Update `.expected` for UI5LogInjection
jeongsoolee09 Jan 18, 2024
237f04c
Fix the lack of location information in `xss-js-view` and `xss-json-v…
jeongsoolee09 Jan 18, 2024
4c3933d
Minor formatting
jeongsoolee09 Jan 18, 2024
c85135d
Merge branch 'main' into jeongsoolee09/unknown-remote-model
jeongsoolee09 Jan 18, 2024
f4b8aa2
Merge branch 'jeongsoolee09/unknown-remote-model' of github.com:advan…
jeongsoolee09 Jan 18, 2024
d4648d3
Fix `xss-js-view`, `xss-json-view`, and `bindingTest`
jeongsoolee09 Jan 18, 2024
0630a9b
Ignore currently broken test on `xss-event-handlers`
jeongsoolee09 Jan 18, 2024
27597ac
Fix `sourceTest`
jeongsoolee09 Jan 18, 2024
cd3bfd4
Merge branch 'main' into jeongsoolee09/unknown-remote-model
jeongsoolee09 Jan 19, 2024
939195d
Fix `pathSinkTest` in a very hacky manner
jeongsoolee09 Jan 20, 2024
0dc1718
Fix `xssSinkTest` in a very hacky manner
jeongsoolee09 Jan 20, 2024
fb5c27a
Merge branch 'main' into jeongsoolee09/unknown-remote-model
jeongsoolee09 Jan 22, 2024
149d4a5
Update javascript/frameworks/ui5/test/models/sink/xssSinkTest.ql
jeongsoolee09 Jan 26, 2024
43d4b77
Update javascript/frameworks/ui5/test/models/sink/pathSinkTest.ql
jeongsoolee09 Jan 26, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Loading