Skip to content

Commit ee867e9

Browse files
asgerfasgerf
authored
Merge pull request #19117 from lcartey/lcartey/support-sap-json-formats
JavaScript: Add support for indexing additional SAP related JSON files
2 parents a8b19d2 + a0c3176 commit ee867e9

7 files changed

Lines changed: 191 additions & 3 deletions

File tree

‎javascript/extractor/src/com/semmle/js/extractor/AutoBuild.java‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,9 @@
160160
* is of the form "codeql-javascript-*.json".
161161
* <li>JavaScript, JSON or YAML files whose base name starts with ".eslintrc".
162162
* <li>JSON files whose base name is ".xsaccess".
163+
* <li>JSON files whose base name is "xs-app.json".
164+
* <li>JSON files whose base name ends with ".view.json".
165+
* <li>JSON files whose base name is "manifest.json".
163166
* <li>All extension-less files.
164167
* </ul>
165168
*
@@ -394,10 +397,12 @@ private void setupFilters() {
394397
for (FileType filetype : defaultExtract)
395398
for (String extension : filetype.getExtensions()) patterns.add("**/*" + extension);
396399

397-
// include .eslintrc files, .xsaccess files, package.json files,
398-
// tsconfig.json files, and codeql-javascript-*.json files
400+
// include JSON files which are relevant to our analysis
399401
patterns.add("**/.eslintrc*");
400-
patterns.add("**/.xsaccess");
402+
patterns.add("**/.xsaccess"); // SAP XSJS
403+
patterns.add("**/xs-app.json"); // SAP XSJS
404+
patterns.add("**/*.view.json"); // SAP UI5
405+
patterns.add("**/manifest.json");
401406
patterns.add("**/package.json");
402407
patterns.add("**/tsconfig*.json");
403408
patterns.add("**/codeql-javascript-*.json");

‎javascript/extractor/tests/ui5/input/test.view.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"Type": "sap.ui.core.mvc.JSONView",
3+
"controllerName": "codeql-sap-js.controller.app",
4+
"content": [
5+
{
6+
"Type": "sap.m.Input",
7+
"placeholder": "Enter Payload",
8+
"description": "Try: <img src=x onerror=alert(\"XSS\")>",
9+
"value": "{/input}"
10+
},
11+
{
12+
"Type": "sap.ui.core.HTML",
13+
"content": "{/input}"
14+
}
15+
]
16+
}

‎javascript/extractor/tests/ui5/output/trap/test.view.json.trap‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#10000=@"/test.view.json;sourcefile"
2+
files(#10000,"/test.view.json")
3+
#10001=@"/;folder"
4+
folders(#10001,"/")
5+
containerparent(#10001,#10000)
6+
#10002=@"loc,{#10000},0,0,0,0"
7+
locations_default(#10002,#10000,0,0,0,0)
8+
hasLocation(#10000,#10002)
9+
#20000=*
10+
json(#20000,5,#10000,0,"{\n "" ... ]\n}")
11+
#20001=@"loc,{#10000},1,1,16,1"
12+
locations_default(#20001,#10000,1,1,16,1)
13+
json_locations(#20000,#20001)
14+
#20002=*
15+
json(#20002,3,#20000,0,"""sap.ui ... ONView""")
16+
#20003=@"loc,{#10000},2,13,2,38"
17+
locations_default(#20003,#10000,2,13,2,38)
18+
json_locations(#20002,#20003)
19+
json_literals("sap.ui.core.mvc.JSONView","""sap.ui.core.mvc.JSONView""",#20002)
20+
json_properties(#20000,"Type",#20002)
21+
#20004=*
22+
json(#20004,3,#20000,1,"""codeql ... er.app""")
23+
#20005=@"loc,{#10000},3,23,3,52"
24+
locations_default(#20005,#10000,3,23,3,52)
25+
json_locations(#20004,#20005)
26+
json_literals("codeql-sap-js.controller.app","""codeql-sap-js.controller.app""",#20004)
27+
json_properties(#20000,"controllerName",#20004)
28+
#20006=*
29+
json(#20006,4,#20000,2,"[\n ... }\n ]")
30+
#20007=@"loc,{#10000},4,16,15,5"
31+
locations_default(#20007,#10000,4,16,15,5)
32+
json_locations(#20006,#20007)
33+
#20008=*
34+
json(#20008,5,#20006,0,"{\n ... }")
35+
#20009=@"loc,{#10000},5,9,10,9"
36+
locations_default(#20009,#10000,5,9,10,9)
37+
json_locations(#20008,#20009)
38+
#20010=*
39+
json(#20010,3,#20008,0,"""sap.m.Input""")
40+
#20011=@"loc,{#10000},6,21,6,33"
41+
locations_default(#20011,#10000,6,21,6,33)
42+
json_locations(#20010,#20011)
43+
json_literals("sap.m.Input","""sap.m.Input""",#20010)
44+
json_properties(#20008,"Type",#20010)
45+
#20012=*
46+
json(#20012,3,#20008,1,"""Enter Payload""")
47+
#20013=@"loc,{#10000},7,28,7,42"
48+
locations_default(#20013,#10000,7,28,7,42)
49+
json_locations(#20012,#20013)
50+
json_literals("Enter Payload","""Enter Payload""",#20012)
51+
json_properties(#20008,"placeholder",#20012)
52+
#20014=*
53+
json(#20014,3,#20008,2,"""Try: < ... SS\"")>""")
54+
#20015=@"loc,{#10000},8,28,8,68"
55+
locations_default(#20015,#10000,8,28,8,68)
56+
json_locations(#20014,#20015)
57+
json_literals("Try: <img src=x onerror=alert(""XSS"")>","""Try: <img src=x onerror=alert(\""XSS\"")>""",#20014)
58+
json_properties(#20008,"description",#20014)
59+
#20016=*
60+
json(#20016,3,#20008,3,"""{/input}""")
61+
#20017=@"loc,{#10000},9,22,9,31"
62+
locations_default(#20017,#10000,9,22,9,31)
63+
json_locations(#20016,#20017)
64+
json_literals("{/input}","""{/input}""",#20016)
65+
json_properties(#20008,"value",#20016)
66+
#20018=*
67+
json(#20018,5,#20006,1,"{\n ... }")
68+
#20019=@"loc,{#10000},11,9,14,9"
69+
locations_default(#20019,#10000,11,9,14,9)
70+
json_locations(#20018,#20019)
71+
#20020=*
72+
json(#20020,3,#20018,0,"""sap.ui.core.HTML""")
73+
#20021=@"loc,{#10000},12,21,12,38"
74+
locations_default(#20021,#10000,12,21,12,38)
75+
json_locations(#20020,#20021)
76+
json_literals("sap.ui.core.HTML","""sap.ui.core.HTML""",#20020)
77+
json_properties(#20018,"Type",#20020)
78+
#20022=*
79+
json(#20022,3,#20018,1,"""{/input}""")
80+
#20023=@"loc,{#10000},13,24,13,33"
81+
locations_default(#20023,#10000,13,24,13,33)
82+
json_locations(#20022,#20023)
83+
json_literals("{/input}","""{/input}""",#20022)
84+
json_properties(#20018,"content",#20022)
85+
json_properties(#20000,"content",#20006)
86+
numlines(#10000,16,0,0)
87+
filetype(#10000,"json")

javascript/extractor/tests/xsaccess/input/.xsaccess renamed to javascript/extractor/tests/xsjs/input/.xsaccess

File renamed without changes.

‎javascript/extractor/tests/xsjs/input/xs-app.json‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
{
2+
"welcomeFile": "index.html",
3+
"authenticationMethod": "none",
4+
"routes": [
5+
{
6+
"source": "/bad/(.*)",
7+
"destination": "srv_api",
8+
"csrfProtection": false,
9+
"authenticationType": "none"
10+
}
11+
]
12+
}

javascript/extractor/tests/xsaccess/output/trap/.xsaccess.trap renamed to javascript/extractor/tests/xsjs/output/trap/.xsaccess.trap

File renamed without changes.

‎javascript/extractor/tests/xsjs/output/trap/xs-app.json.trap‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#10000=@"/xs-app.json;sourcefile"
2+
files(#10000,"/xs-app.json")
3+
#10001=@"/;folder"
4+
folders(#10001,"/")
5+
containerparent(#10001,#10000)
6+
#10002=@"loc,{#10000},0,0,0,0"
7+
locations_default(#10002,#10000,0,0,0,0)
8+
hasLocation(#10000,#10002)
9+
#20000=*
10+
json(#20000,5,#10000,0,"{\n "" ... ]\n}")
11+
#20001=@"loc,{#10000},1,1,12,1"
12+
locations_default(#20001,#10000,1,1,12,1)
13+
json_locations(#20000,#20001)
14+
#20002=*
15+
json(#20002,3,#20000,0,"""index.html""")
16+
#20003=@"loc,{#10000},2,20,2,31"
17+
locations_default(#20003,#10000,2,20,2,31)
18+
json_locations(#20002,#20003)
19+
json_literals("index.html","""index.html""",#20002)
20+
json_properties(#20000,"welcomeFile",#20002)
21+
#20004=*
22+
json(#20004,3,#20000,1,"""none""")
23+
#20005=@"loc,{#10000},3,29,3,34"
24+
locations_default(#20005,#10000,3,29,3,34)
25+
json_locations(#20004,#20005)
26+
json_literals("none","""none""",#20004)
27+
json_properties(#20000,"authenticationMethod",#20004)
28+
#20006=*
29+
json(#20006,4,#20000,2,"[\n ... }\n ]")
30+
#20007=@"loc,{#10000},4,15,11,5"
31+
locations_default(#20007,#10000,4,15,11,5)
32+
json_locations(#20006,#20007)
33+
#20008=*
34+
json(#20008,5,#20006,0,"{\n ... }")
35+
#20009=@"loc,{#10000},5,9,10,9"
36+
locations_default(#20009,#10000,5,9,10,9)
37+
json_locations(#20008,#20009)
38+
#20010=*
39+
json(#20010,3,#20008,0,"""/bad/(.*)""")
40+
#20011=@"loc,{#10000},6,23,6,33"
41+
locations_default(#20011,#10000,6,23,6,33)
42+
json_locations(#20010,#20011)
43+
json_literals("/bad/(.*)","""/bad/(.*)""",#20010)
44+
json_properties(#20008,"source",#20010)
45+
#20012=*
46+
json(#20012,3,#20008,1,"""srv_api""")
47+
#20013=@"loc,{#10000},7,28,7,36"
48+
locations_default(#20013,#10000,7,28,7,36)
49+
json_locations(#20012,#20013)
50+
json_literals("srv_api","""srv_api""",#20012)
51+
json_properties(#20008,"destination",#20012)
52+
#20014=*
53+
json(#20014,1,#20008,2,"false")
54+
#20015=@"loc,{#10000},8,31,8,35"
55+
locations_default(#20015,#10000,8,31,8,35)
56+
json_locations(#20014,#20015)
57+
json_literals("false","false",#20014)
58+
json_properties(#20008,"csrfProtection",#20014)
59+
#20016=*
60+
json(#20016,3,#20008,3,"""none""")
61+
#20017=@"loc,{#10000},9,35,9,40"
62+
locations_default(#20017,#10000,9,35,9,40)
63+
json_locations(#20016,#20017)
64+
json_literals("none","""none""",#20016)
65+
json_properties(#20008,"authenticationType",#20016)
66+
json_properties(#20000,"routes",#20006)
67+
numlines(#10000,12,0,0)
68+
filetype(#10000,"json")

0 commit comments

Comments
 (0)