Skip to content

Commit 41ac329

Browse files
committed
Fix sink test for RichTextEditor
1 parent b301afd commit 41ac329

File tree

3 files changed

+4
-4
lines changed

3 files changed

+4
-4
lines changed

javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -843,7 +843,7 @@ class UI5Control extends TUI5Control {
843843
* 'sap/ui/richttexteditor/RichTextEditor' sanitized using the property 'sanitizeValue'
844844
*/
845845
predicate isHTMLSanitized() {
846-
this.getControlTypeName() = "sap/ui/richttexteditor/RichTextEditor" and
846+
this.getControlTypeName() = "sap/ui/richtexteditor/RichTextEditor" and
847847
this.isSanitizePropertySetTo("sanitizeValue", true) and
848848
not this.isSanitizePropertySetTo("sanitizeValue", false)
849849
or
Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,2 @@
11
| sink1.xml:6:5:6:44 | content={path: '/input'} | The binding path `content={path: '/input'}` is an HTML injection sink. |
2-
| sink1.xml:7:5:7:67 | content={path: '/input'} | The binding path `content={path: '/input'}` is an HTML injection sink. |
32
| sink1.xml:8:5:8:51 | value={path: '/input'} | The binding path `value={path: '/input'}` is an HTML injection sink. |
4-
| sink1.xml:9:5:9:72 | value={path: '/input'} | The binding path `value={path: '/input'}` is an HTML injection sink. |

javascript/frameworks/ui5/test/models/sink/UI5ViewSinkTest.ql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,7 @@ import javascript
99
import advanced_security.javascript.frameworks.ui5.UI5View
1010

1111
from UI5BindingPath bp
12-
where bp = any(UI5View ui5v).getAnHtmlISink()
12+
where
13+
bp = any(UI5View ui5v).getAnHtmlISink() and
14+
not bp.getControlDeclaration().isHTMLSanitized()
1315
select bp, "The binding path `" + bp.toString() + "` is an HTML injection sink."

0 commit comments

Comments
 (0)