Merge pull request advanced-security#250 from advanced-security/knewbury01/update-ODataModel

jeongsoolee09 · web-flow · commit 0e6f76e69c31 · 2025-10-30T12:38:47.000-04:00
Add v4 support for ODataModel
diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll
@@ -77,14 +77,16 @@ class ODataServiceModel extends UI5ExternalModel {
     )
     or
     /*
-     * A constructor call to sap.ui.model.odata.v2.ODataModel.
+     * A constructor call to sap.ui.model.odata.v2.ODataModel or sap.ui.model.odata.v4.ODataModel.
      */
 
     this instanceof NewNode and
     (
       exists(RequiredObject oDataModel |
         oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and
-        oDataModel.getDependency() = "sap/ui/model/odata/v2/ODataModel"
+        oDataModel.getDependency() in [
+            "sap/ui/model/odata/v2/ODataModel", "sap/ui/model/odata/v4/ODataModel"
+          ]
       )
       or
       this.getCalleeName() = "ODataModel"

Original file line number	Diff line number	Diff line change
`@@ -77,14 +77,16 @@ class ODataServiceModel extends UI5ExternalModel {`
`77`	`77`	`)`
`78`	`78`	`or`
`79`	`79`	`/*`
`80`		`- * A constructor call to sap.ui.model.odata.v2.ODataModel.`
	`80`	`+ * A constructor call to sap.ui.model.odata.v2.ODataModel or sap.ui.model.odata.v4.ODataModel.`
`81`	`81`	`*/`
`82`	`82`
`83`	`83`	`this instanceof NewNode and`
`84`	`84`	`(`
`85`	`85`	`exists(RequiredObject oDataModel \|`
`86`	`86`	`oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and`
`87`		`- oDataModel.getDependency() = "sap/ui/model/odata/v2/ODataModel"`
	`87`	`+ oDataModel.getDependency() in [`
	`88`	`+ "sap/ui/model/odata/v2/ODataModel", "sap/ui/model/odata/v4/ODataModel"`
	`89`	`+ ]`
`88`	`90`	`)`
`89`	`91`	`or`
`90`	`92`	`this.getCalleeName() = "ODataModel"`