From 110f87544f63a0a4c2c3275751f38b8e1903007f Mon Sep 17 00:00:00 2001
From: Kristen Newbury <knewbury01@github.com>
Date: Tue, 28 Oct 2025 16:45:47 -0400
Subject: [PATCH] Add v4 support for ODataModel

---
 .../javascript/frameworks/ui5/RemoteFlowSources.qll         | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll
index 858697bfa..a367d919a 100644
--- a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll
+++ b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll
@@ -77,14 +77,16 @@ class ODataServiceModel extends UI5ExternalModel {
     )
     or
     /*
-     * A constructor call to sap.ui.model.odata.v2.ODataModel.
+     * A constructor call to sap.ui.model.odata.v2.ODataModel or sap.ui.model.odata.v4.ODataModel.
      */
 
     this instanceof NewNode and
     (
       exists(RequiredObject oDataModel |
         oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and
-        oDataModel.getDependency() = "sap/ui/model/odata/v2/ODataModel"
+        oDataModel.getDependency() in [
+            "sap/ui/model/odata/v2/ODataModel", "sap/ui/model/odata/v4/ODataModel"
+          ]
       )
       or
       this.getCalleeName() = "ODataModel"