Skip to content

Commit 94b0b8a

Browse files
jeongsoolee09jeongsoolee09
committed
Add examples of sap.ui.getCore() and this.getOwnerComponent()
1 parent 28b78dc commit 94b0b8a

File tree

12 files changed

+287
-45
lines changed

12 files changed

+287
-45
lines changed

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/Component.js‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
sap.ui.define([
2+
"sap/ui/core/UIComponent"
3+
], function(UIComponent) {
4+
"use strict";
5+
return UIComponent.extend("codeql-sap-js.Component", {
6+
metadata: {
7+
manifest: "json"
8+
},
9+
10+
init: function() { }
11+
})
12+
})

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
sap.ui.define([
2+
"sap/ui/core/mvc/Controller",
3+
"sap/ui/model/json/JSONModel",
4+
"sap/ui/core/EventBus"
5+
], function(Controller, JSONModel, EventBus) {
6+
"use strict";
7+
return Controller.extend("codeql-sap-js.controller.App1", {
8+
/*
9+
* 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
10+
* 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
11+
* 3. XSS.controller's method `doSomething2`: set HTML's content
12+
*/
13+
onInit: function() {
14+
let oData = {
15+
input: null,
16+
output1: null
17+
};
18+
let oModel = new JSONModel(oData);
19+
this.getView().setModel(oModel);
20+
this.bus = EventBus.getInstance();
21+
this.bus.subscribe("xssChannel", "xss", this.doSomething2, this);
22+
},
23+
24+
doSomething1() {
25+
let oInput = this.getView().byId("input");
26+
let value = oInput.getValue();
27+
this.bus.publish("xssChannel", "xss", { message: value });
28+
},
29+
30+
doSomething2(channel, event, model) {
31+
let oHtmlOutput = this.getView().byId("htmlOutput");
32+
oHtmlOutput.setContent(model.message);
33+
}
34+
});
35+
});

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
sap.ui.define([
2+
"sap/ui/core/mvc/Controller",
3+
"sap/ui/model/json/JSONModel",
4+
"sap/ui/core/EventBus"
5+
], function(Controller, JSONModel, EventBus) {
6+
"use strict";
7+
return Controller.extend("codeql-sap-js.controller.App2", {
8+
/*
9+
* 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
10+
* 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
11+
* 3. XSS.controller's method `doSomething2`: set HTML's content
12+
*/
13+
onInit: function() {
14+
let oData = {
15+
input: null,
16+
output1: null
17+
};
18+
let oModel = new JSONModel(oData);
19+
this.getView().setModel(oModel);
20+
this.bus = sap.ui.getCore().getEventBus();
21+
this.bus.subscribe("xssChannel", "xss", this.doSomething2, this);
22+
},
23+
24+
doSomething1() {
25+
let oInput = this.getView().byId("input");
26+
let value = oInput.getValue();
27+
this.bus.publish("xssChannel", "xss", { message: value });
28+
},
29+
30+
doSomething2(channel, event, model) {
31+
let oHtmlOutput = this.getView().byId("htmlOutput");
32+
oHtmlOutput.setContent(model.message);
33+
}
34+
});
35+
});

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
sap.ui.define([
2+
"sap/ui/core/mvc/Controller",
3+
"sap/ui/model/json/JSONModel",
4+
"sap/ui/core/EventBus"
5+
], function(Controller, JSONModel, EventBus) {
6+
"use strict";
7+
return Controller.extend("codeql-sap-js.controller.App3", {
8+
/*
9+
* 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
10+
* 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
11+
* 3. XSS.controller's method `doSomething2`: set HTML's content
12+
*/
13+
onInit: function() {
14+
let oData = {
15+
input: null,
16+
output1: null
17+
};
18+
let oModel = new JSONModel(oData);
19+
this.getView().setModel(oModel);
20+
this.bus = this.getOwnerComponent().getEventBus();
21+
},
22+
23+
doSomething1() {
24+
let oInput = this.getView().byId("input");
25+
let value = oInput.getValue();
26+
this.bus.publish("xssChannel", "xss", { message: value });
27+
}
28+
});
29+
});

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
sap.ui.define([
2+
"sap/ui/core/mvc/Controller",
3+
"sap/ui/model/json/JSONModel",
4+
"sap/ui/core/EventBus"
5+
], function(Controller, JSONModel, EventBus) {
6+
"use strict";
7+
return Controller.extend("codeql-sap-js.controller.App4", {
8+
/*
9+
* 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
10+
* 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
11+
* 3. XSS.controller's method `doSomething2`: set HTML's content
12+
*/
13+
onInit: function() {
14+
let oData = {
15+
input: null,
16+
output1: null
17+
};
18+
let oModel = new JSONModel(oData);
19+
this.getView().setModel(oModel);
20+
this.bus = this.getOwnerComponent().getEventBus();
21+
this.bus.subscribe("xssChannel", "xss", this.doSomething2, this);
22+
},
23+
24+
doSomething2(channel, event, model) {
25+
let oHtmlOutput = this.getView().byId("htmlOutput");
26+
oHtmlOutput.setContent(model.message);
27+
}
28+
});
29+
});

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/app.controller.js‎

Lines changed: 3 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,8 @@
11
sap.ui.define([
22
"sap/ui/core/mvc/Controller",
3-
"sap/ui/model/json/JSONModel",
4-
"sap/ui/core/EventBus"
5-
], function(Controller, JSONModel, EventBus) {
3+
], function(Controller) {
64
"use strict";
7-
return Controller.extend("codeql-sap-js.controller.app", {
8-
/*
9-
* 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
10-
* 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
11-
* 3. XSS.controller's method `doSomething2`: set HTML's content
12-
*/
13-
onInit: function() {
14-
let oData = {
15-
input: null,
16-
output1: null
17-
};
18-
let oModel = new JSONModel(oData);
19-
this.getView().setModel(oModel);
20-
this.bus = EventBus.getInstance();
21-
this.bus.subscribe("xssChannel", "xss", this.doSomething2, this);
22-
},
23-
24-
doSomething1() {
25-
let oInput = this.getView().byId("input");
26-
let value = oInput.getValue();
27-
this.bus.publish("xssChannel", "xss", { message: value });
28-
},
29-
30-
doSomething2(channel, event, model) {
31-
let oHtmlOutput = this.getView().byId("htmlOutput");
32-
oHtmlOutput.setContent(model.message);
33-
}
5+
return Controller.extend("codeql-sap-js.controller.App", {
6+
onInit: function() { }
347
});
358
});

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/manifest.json‎

Lines changed: 92 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,94 @@
11
{
2-
"sap.app": {
3-
"id": "sap-ui5-xss"
2+
"_version": "0.0.1",
3+
"sap.app": {
4+
"id": "codeql-sap-js",
5+
"type": "application",
6+
"applicationVersion": {
7+
"version": "0.0.1"
8+
},
9+
"title": "{{appTitle}}",
10+
"description": "{{appDescription}}",
11+
"dataSources": {
12+
"someDataSource": {
13+
"uri": "some/path/to/dataSource",
14+
"type": "OData",
15+
"settings": {
16+
"odataVersion": "2.0"
17+
}
18+
}
419
}
5-
}
20+
},
21+
"sap.ui": {
22+
"technology": "UI5"
23+
},
24+
"sap.ui5": {
25+
"rootView": "codeql-sap-js.controller.App",
26+
"dependencies": {
27+
"minUI5Version": "1.30",
28+
"libs": {
29+
"sap.m": {},
30+
"sap.ui.layout": {}
31+
}
32+
},
33+
34+
"models": {
35+
"someRemoteModel": {
36+
"dataSource": "someDataSource",
37+
"settings": {
38+
"defaultBindingMode": "TwoWay"
39+
}
40+
}
41+
},
42+
"config": {
43+
"someDataSource": "some/path/to/dataSource"
44+
},
45+
"routing": {
46+
"config": {
47+
"routerClass": "sap.m.routing.Router",
48+
"viewType": "XML",
49+
"async": true,
50+
"viewPath": "codeql-sap-js.view"
51+
},
52+
"routes": [
53+
{
54+
"pattern": "somePattern1",
55+
"name": "someName1",
56+
"target": "someTarget1"
57+
},
58+
{
59+
"pattern": "somePattern2",
60+
"name": "someName2",
61+
"target": "someTarget2"
62+
},
63+
{
64+
"pattern": "somePattern3",
65+
"name": "someName3",
66+
"target": "someTarget3"
67+
},
68+
{
69+
"pattern": "somePattern4",
70+
"name": "someName4",
71+
"target": "someTarget4"
72+
}
73+
],
74+
"targets": {
75+
"someTarget1": {
76+
"viewName": "App1",
77+
"viewLevel": 1
78+
},
79+
"someTarget2": {
80+
"viewName": "App2",
81+
"viewLevel": 1
82+
},
83+
"someTarget3": {
84+
"viewName": "App3",
85+
"viewLevel": 1
86+
},
87+
"someTarget4": {
88+
"viewName": "App4",
89+
"viewLevel": 1
90+
}
91+
}
92+
}
93+
}
94+
}

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App1.view.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<mvc:View controllerName="codeql-sap-js.controller.App1"
2+
xmlns="sap.m"
3+
xmlns:core="sap.ui.core"
4+
xmlns:mvc="sap.ui.core.mvc">
5+
<Input id="input"
6+
placeholder="Enter Payload"
7+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt; and press a button"
8+
value="{/input}" /> <!--User input source sap.m.Input.value -->
9+
<Button text="Press me for XSS"
10+
press=".doSomething1" />
11+
<core:HTML id="htmlOutput"
12+
content="{/output1}" /> <!--XSS sink sap.ui.core.HTML.content -->
13+
</mvc:View>

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App2.view.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<mvc:View controllerName="codeql-sap-js.controller.App2"
2+
xmlns="sap.m"
3+
xmlns:core="sap.ui.core"
4+
xmlns:mvc="sap.ui.core.mvc">
5+
<Input id="input"
6+
placeholder="Enter Payload"
7+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt; and press a button"
8+
value="{/input}" /> <!--User input source sap.m.Input.value -->
9+
<Button text="Press me for XSS"
10+
press=".doSomething1" />
11+
<core:HTML id="htmlOutput"
12+
content="{/output1}" /> <!--XSS sink sap.ui.core.HTML.content -->
13+
</mvc:View>

‎javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App3.view.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<mvc:View controllerName="codeql-sap-js.controller.App3"
2+
xmlns="sap.m"
3+
xmlns:core="sap.ui.core"
4+
xmlns:mvc="sap.ui.core.mvc">
5+
<Input id="input"
6+
placeholder="Enter Payload"
7+
description="Try: &lt;img src=x onerror=alert(&quot;XSS&quot;)&gt; and press a button"
8+
value="{/input}" /> <!--User input source sap.m.Input.value -->
9+
<Button text="Press me for XSS"
10+
press=".doSomething1" />
11+
</mvc:View>

0 commit comments

Comments
 (0)