Address review

Author: mbaluda

javascript/frameworks/ui5/test/models/sink/UI5ViewSinkTest.expected

@@ -1,2 +1,3 @@
-| sink1.xml:6:5:6:44 | content={path: '/input'} | The binding path `content={path: '/input'}` is an HTML injection sink. |
-| sink1.xml:8:5:8:73 | value={path: '/input'} | The binding path `value={path: '/input'}` is an HTML injection sink. |
+| sink1.xml:7:5:7:68 | content={path: '/input'} | The binding path `content={path: '/input'}` is an HTML injection sink. |
+| sink1.xml:8:5:8:44 | content={path: '/input'} | The binding path `content={path: '/input'}` is an HTML injection sink. |
+| sink1.xml:10:5:10:73 | value={path: '/input'} | The binding path `value={path: '/input'}` is an HTML injection sink. |

javascript/frameworks/ui5/test/models/sink/sink.js

@@ -126,11 +126,11 @@ sap.ui.define(
     var value = sap.ui.core.util.File.save(code0, code1, "csv", "text/plain", code4, code5);
     var value = sap.ui.core.util.File.save(code0, code1, code2, code3, code4, code5);
 
-    var obj = new HTML({ content: code0, sanitizeContent: true }); // FP
-    var obj = new HTML({ content: code0, sanitizeContent: false });
+    var obj = new HTML({ content: code0, sanitizeContent: true }); // SAFE: Content is sanitized
+    var obj = new HTML({ content: code0, sanitizeContent: false }); // UNSAFE: Content is explicitly not sanitized
 
-    var obj = new RichTextEditor({ value: code0 });
-    var obj = new RichTextEditor({ value: code0, sanitizeValue: true }); 
-    var obj = new RichTextEditor({ value: code0, sanitizeValue: false }); // FN
+    var obj = new RichTextEditor({ value: code0 }); // SAFE: Content is sanitized by default
+    var obj = new RichTextEditor({ value: code0, sanitizeValue: true }); // SAFE: Content is sanitized
+    var obj = new RichTextEditor({ value: code0, sanitizeValue: false }); // UNSAFE: Content is explicitly not sanitized
   },
 );

javascript/frameworks/ui5/test/models/sink/sink1.xml

@@ -3,8 +3,10 @@
     xmlns:core="sap.ui.core"
     xmlns:mvc="sap.ui.core.mvc"
     xmlns:rte="sap.ui.richtexteditor">
-    <core:HTML content="{path: '/input'}"/> <!--XSS sink sap.ui.core.HTML.content -->
     <core:HTML content="{path: '/input'}" sanitizeContent="true"/> <!--sanitized XSS sink sap.ui.core.HTML.content -->
+    <core:HTML content="{path: '/input'}" sanitizeContent="false"/> <!--XSS sink sap.ui.core.HTML.content -->
+    <core:HTML content="{path: '/input'}"/> <!--XSS sink sap.ui.core.HTML.content -->
+    <rte:RichTextEditor value="{path: '/input'}" sanitizeValue="true"/> <!--sanitized XSS sink sap.ui.core.HTML.content -->
     <rte:RichTextEditor value="{path: '/input'}" sanitizeValue="false"/> <!--XSS sink sap.ui.core.HTML.content -->
-    <rte:RichTextEditor value="{path: '/input'}"/> <!--sanitized XSS sink sap.ui.core.HTML.content -->
+    <rte:RichTextEditor value="{path: '/input'}"/> <!--default sanitized XSS sink sap.ui.core.HTML.content -->
 </mvc:View>