Skip to content

Conversation

@knewbury01
Copy link
Contributor

@knewbury01 knewbury01 commented Dec 10, 2025

What This PR Contributes

QL models and tests for Xml Fragments that are programatically instantiated

Future Works

  • js fragments entirely
  • fragments statically associated to views (declared via <Fragment> tags and no programatic controller association (declarative views)
  • consideration for the way to express whether a fragment is instantiated or not (currently built into getControllerName in XmlFragment, but this could be replaced with a similar mechanism to the placeAt dynamic model in remote flow sources, or possibly inherently in the detection of the fragment itself (ie to say a fragment is only a fragment once it is instantiated - though may be complex when there is no controller)?

@knewbury01 knewbury01 requested a review from mbaluda December 30, 2025 17:42
<template data-controller-name="codeql-sap-js.controller.app">
<div id="fragmentContainer"></div>
<div data-sap-ui-type="sap.ui.core.HTML"
data-content="{/input}"> <!--XSS sink sap.ui.core.HTML.content -->

Check failure

Code scanning / CodeQL

UI5 Client-side cross-site scripting High test

XSS vulnerability due to
user-provided value
.
<template data-controller-name="codeql-sap-js.controller.app">
<div id="fragmentContainer"></div>
<div data-sap-ui-type="sap.ui.core.HTML"
data-content="{/input}"> <!--XSS sink sap.ui.core.HTML.content -->

Check failure

Code scanning / CodeQL

UI5 Client-side cross-site scripting High test

XSS vulnerability due to
user-provided value
.
@data-douser data-douser added enhancement New feature or request javascript Pull requests that update javascript code labels Dec 30, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants