Skip to content

Commit e61d80c

Browse files
knewbury01knewbury01
committed
Add multicombo box to ui5 webcomponents react model, falsely rm'd
1 parent 15325d6 commit e61d80c

File tree

3 files changed

+16
-6
lines changed

3 files changed

+16
-6
lines changed

‎javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/XssThroughDom.expected‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,10 @@ edges
1919
| src/App.tsx:71:10:71:22 | comboBoxValue | src/App.tsx:541:46:541:58 | comboBoxValue | provenance | |
2020
| src/App.tsx:75:31:75:56 | comboBo ... ?.value | src/App.tsx:75:31:75:62 | comboBo ... e \|\| "" | provenance | |
2121
| src/App.tsx:75:31:75:62 | comboBo ... e \|\| "" | src/App.tsx:71:10:71:22 | comboBoxValue | provenance | |
22+
| src/App.tsx:87:10:87:27 | multiComboBoxValue | src/App.tsx:87:10:87:27 | multiComboBoxValue | provenance | |
23+
| src/App.tsx:87:10:87:27 | multiComboBoxValue | src/App.tsx:542:46:542:63 | multiComboBoxValue | provenance | |
24+
| src/App.tsx:91:36:91:66 | multiCo ... ?.value | src/App.tsx:91:36:91:72 | multiCo ... e \|\| "" | provenance | |
25+
| src/App.tsx:91:36:91:72 | multiCo ... e \|\| "" | src/App.tsx:87:10:87:27 | multiComboBoxValue | provenance | |
2226
| src/App.tsx:119:10:119:24 | datePickerValue | src/App.tsx:119:10:119:24 | datePickerValue | provenance | |
2327
| src/App.tsx:119:10:119:24 | datePickerValue | src/App.tsx:544:46:544:60 | datePickerValue | provenance | |
2428
| src/App.tsx:123:33:123:60 | datePic ... ?.value | src/App.tsx:123:33:123:66 | datePic ... e \|\| "" | provenance | |
@@ -64,6 +68,10 @@ nodes
6468
| src/App.tsx:71:10:71:22 | comboBoxValue | semmle.label | comboBoxValue |
6569
| src/App.tsx:75:31:75:56 | comboBo ... ?.value | semmle.label | comboBo ... ?.value |
6670
| src/App.tsx:75:31:75:62 | comboBo ... e \|\| "" | semmle.label | comboBo ... e \|\| "" |
71+
| src/App.tsx:87:10:87:27 | multiComboBoxValue | semmle.label | multiComboBoxValue |
72+
| src/App.tsx:87:10:87:27 | multiComboBoxValue | semmle.label | multiComboBoxValue |
73+
| src/App.tsx:91:36:91:66 | multiCo ... ?.value | semmle.label | multiCo ... ?.value |
74+
| src/App.tsx:91:36:91:72 | multiCo ... e \|\| "" | semmle.label | multiCo ... e \|\| "" |
6775
| src/App.tsx:119:10:119:24 | datePickerValue | semmle.label | datePickerValue |
6876
| src/App.tsx:119:10:119:24 | datePickerValue | semmle.label | datePickerValue |
6977
| src/App.tsx:123:33:123:60 | datePic ... ?.value | semmle.label | datePic ... ?.value |
@@ -93,6 +101,7 @@ nodes
93101
| src/App.tsx:539:46:539:56 | searchValue | semmle.label | searchValue |
94102
| src/App.tsx:540:46:540:64 | shellBarSearchValue | semmle.label | shellBarSearchValue |
95103
| src/App.tsx:541:46:541:58 | comboBoxValue | semmle.label | comboBoxValue |
104+
| src/App.tsx:542:46:542:63 | multiComboBoxValue | semmle.label | multiComboBoxValue |
96105
| src/App.tsx:544:46:544:60 | datePickerValue | semmle.label | datePickerValue |
97106
| src/App.tsx:545:46:545:65 | dateRangePickerValue | semmle.label | dateRangePickerValue |
98107
| src/App.tsx:546:46:546:64 | dateTimePickerValue | semmle.label | dateTimePickerValue |
@@ -106,6 +115,7 @@ subpaths
106115
| src/App.tsx:539:46:539:56 | searchValue | src/App.tsx:43:29:43:52 | searchR ... ?.value | src/App.tsx:539:46:539:56 | searchValue | $@ is reinterpreted as HTML without escaping meta-characters. | src/App.tsx:43:29:43:52 | searchR ... ?.value | DOM text |
107116
| src/App.tsx:540:46:540:64 | shellBarSearchValue | src/App.tsx:59:37:59:68 | shellBa ... ?.value | src/App.tsx:540:46:540:64 | shellBarSearchValue | $@ is reinterpreted as HTML without escaping meta-characters. | src/App.tsx:59:37:59:68 | shellBa ... ?.value | DOM text |
108117
| src/App.tsx:541:46:541:58 | comboBoxValue | src/App.tsx:75:31:75:56 | comboBo ... ?.value | src/App.tsx:541:46:541:58 | comboBoxValue | $@ is reinterpreted as HTML without escaping meta-characters. | src/App.tsx:75:31:75:56 | comboBo ... ?.value | DOM text |
118+
| src/App.tsx:542:46:542:63 | multiComboBoxValue | src/App.tsx:91:36:91:66 | multiCo ... ?.value | src/App.tsx:542:46:542:63 | multiComboBoxValue | $@ is reinterpreted as HTML without escaping meta-characters. | src/App.tsx:91:36:91:66 | multiCo ... ?.value | DOM text |
109119
| src/App.tsx:544:46:544:60 | datePickerValue | src/App.tsx:123:33:123:60 | datePic ... ?.value | src/App.tsx:544:46:544:60 | datePickerValue | $@ is reinterpreted as HTML without escaping meta-characters. | src/App.tsx:123:33:123:60 | datePic ... ?.value | DOM text |
110120
| src/App.tsx:545:46:545:65 | dateRangePickerValue | src/App.tsx:139:38:139:70 | dateRan ... ?.value | src/App.tsx:545:46:545:65 | dateRangePickerValue | $@ is reinterpreted as HTML without escaping meta-characters. | src/App.tsx:139:38:139:70 | dateRan ... ?.value | DOM text |
111121
| src/App.tsx:546:46:546:64 | dateTimePickerValue | src/App.tsx:155:37:155:68 | dateTim ... ?.value | src/App.tsx:546:46:546:64 | dateTimePickerValue | $@ is reinterpreted as HTML without escaping meta-characters. | src/App.tsx:155:37:155:68 | dateTim ... ?.value | DOM text |

‎javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/App.tsx‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ function App() {
8888
const multiComboBoxRef = useRef<typeof MultiComboBox>(null);
8989

9090
const handleMultiComboBoxChange = useCallback(() => {
91-
setMultiComboBoxValue((msg) => multiComboBoxRef.current?.value || ""); // SAFE: Does not take unrestricted string
91+
setMultiComboBoxValue((msg) => multiComboBoxRef.current?.value || ""); // UNSAFE: Unrestricted string set as content
9292
}, [setMultiComboBoxValue]);
9393

9494
useEffect(() => {
@@ -507,7 +507,7 @@ function App() {
507507
<Search placeholder="Search" ref={searchRef} id="search-field"></Search> {/* Potentially Unsafe */}
508508
<ShellBarSearch placeholder="ShellBarSearch" ref={shellBarSearchRef} id="shellbarsearch-field"></ShellBarSearch> {/* Potentially Unsafe */}
509509
<ComboBox placeholder="ComboBox" ref={comboBoxRef} id="combobox-field"></ComboBox> {/* Potentially Unsafe */}
510-
<MultiComboBox placeholder="MultiComboBox" ref={multiComboBoxRef} id="multicombobox-field"></MultiComboBox> {/* Safe - accepts a fixed set of strings */}
510+
<MultiComboBox placeholder="MultiComboBox" ref={multiComboBoxRef} id="multicombobox-field" noValidation="true"></MultiComboBox> {/* Potentially Unsafe */}
511511
<Select ref={selectRef} id="select-field"></Select> {/* Safe - accepts a fixed set of strings */}
512512
<DatePicker placeholder="DatePicker" ref={datePickerRef} id="datepicker-field"></DatePicker> {/* Potentially Unsafe */}
513513
<DateRangePicker placeholder="DateRangePicker" ref={dateRangePickerRef} id="daterangepicker-field"></DateRangePicker> {/* Potentially Unsafe */}

‎javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Sanitizers.qll‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -15,10 +15,10 @@ class ExcludedSource extends DomBasedXss::Sanitizer {
1515
// exclude components with this name from @ui5/webcomponents-react only
1616
isRefAssignedToUI5Component(source) and
1717
source.getElement().getName() in [
18-
"MultiComboBox", "Select", "ColorPicker", "ColorPaletteItem", "CalendarDate",
19-
"FileUploader", "CheckBox", "RadioButton", "Switch", "RatingIndicator", "Slider",
20-
"ProgressIndicator", "StepInput", "DynamicDateRange", "RangeSlider", "Button",
21-
"MessageViewButton", "SegmentedButton", "SplitButton", "ToggleButton"
18+
"Select", "ColorPicker", "ColorPaletteItem", "CalendarDate", "FileUploader", "CheckBox",
19+
"RadioButton", "Switch", "RatingIndicator", "Slider", "ProgressIndicator", "StepInput",
20+
"DynamicDateRange", "RangeSlider", "Button", "MessageViewButton", "SegmentedButton",
21+
"SplitButton", "ToggleButton"
2222
] and
2323
this.(DataFlow::PropRead).getBase() = source
2424
)

0 commit comments

Comments
 (0)