Track dataflow through event handlers and their parameters #40
Conversation
merge main
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| <Button text="Press Me XSS2" press=".doSomething2(${/input})"/> | ||
| <core:HTML content="{/output2}"/> <!--XSS sink sap.ui.core.HTML.content --> | ||
| <Button text="Press Me XSS1" press=".doSomething1" /> | ||
| <core:HTML content="{/output1}" /> <!--XSS sink sap.ui.core.HTML.content --> |
Check warning
Code scanning / CodeQL
Client-side cross-site scripting
| liveChange=".doSomething3" /> | ||
| <core:HTML content="{/output3}"/> <!--XSS sink sap.ui.core.HTML.content --> | ||
| <Button text="Press Me XSS2" press=".doSomething2(${/input})" /> | ||
| <core:HTML content="{/output2}" /> <!--XSS sink sap.ui.core.HTML.content --> |
Check warning
Code scanning / CodeQL
Client-side cross-site scripting
mbaluda
changed the title
|
Tests |
| <Input placeholder="Enter Payload" | ||
| description="Try: <img src=x onerror=alert("XSS")>" | ||
| liveChange=".doSomething3" /> | ||
| <core:HTML content="{/output3}" /> <!--XSS sink sap.ui.core.HTML.content --> |
Check warning
Code scanning / CodeQL
Client-side cross-site scripting
| var oHtmlOutput = oView.byId("htmlOutput"); | ||
|
|
||
| var value = oInput.getValue() // User input source sap.m.Input#getValue | ||
| oHtmlOutput.setContent(value) // XSS sink sap.ui.core.HTML#setContent |
Check warning
Code scanning / CodeQL
Client-side cross-site scripting
|
Left some partial comments above. |
|
Submitted another batch of comments. |
There was a problem hiding this comment.
Thank you a gigaton, @mbaluda ! It's truly a magnificent work.
This PR adds support for dataflow through event handlers and their parameters, as well as a few other fixes as follows:
Support dataflow through event handlers Fix /issues/24
UI5HandlerandControlTypeInHandlerModelto model references to Controls inside the handler Javascript code (e.g.oEvent.getSource()this.getView().byId("id")) (see testsdoSomething3anddoSomething4)bindingPathCapturenow covers event handler parameters syntax like.doSomething(${/input})(limited to an infividual call with a single argument)isAdditionalFlowStepincludes edge fromUI5BindingPathto handler when passed as parameter (see testdoSomething2)isAdditionalFlowStepincludes edge fromUI5BindingPathto handler when passed as parameter (see testdoSomething2)PathGraphincludes edges through XML (js->xml->js) to show handler parameters flowVaria
typeModelsection so that types are selected as well as their instances (this is to avoid the need forInstance.MemberinsourceModelentries)RenderManagerclass andgetRenderer()predicateUnsafeHtmlXssSourceandUnsafeHtmlXssSinkclassesxss-examplefrom integration-test folder to testwriteAttributeEscapederroneously included in SinkModel #34