[mbaluda]

What This PR Contributes

Reintroduces the CAP and UI5 security-analysis improvements from #456, #450, and #459, while keeping sink sharing with standard queries close to its historical behavior.

• Broader CQL injection detection in CAP applications
  • Detects user input that controls query structure, including entities, selected columns, conditions, grouping, ordering, aliases, and database hints across read and write operations.
  • Distinguishes unsafe query construction from safely bound values, including tagged templates and fixed-key object predicates.
  • Clarifies the query help: parameter binding protects values, while structural inputs need validation against allowed choices.
• Detection of sensitive CAP data written to logs
  • Tracks personal or sensitive CDS fields from query results into CAP and standard application loggers.
  • Handles query variables, projections, aliases, and collections, while excluding fields known to be non-sensitive.
• More complete UI5 model, binding, and rendering coverage
  • Tracks input through JSON and XML models declared in manifests, inferred from data sources, or assigned programmatically.
  • Supports bindings across XML, JSON, HTML, and JavaScript views, including relative paths, nested lists, static binding contexts, and fragment references.
  • Keeps model paths and owning controllers, views, components, and applications separate to avoid unrelated flows.
  • Improves detection of input reaching native jQuery HTML operations through UI5 control and element lookups, fluent chains, and callbacks.
  • Retains checks for safe output, binding modes, getter return types, and unrelated model properties.

[Copilot]

🔵 Needs a closer look

The changes require final human review because they are too complex or risky for automated approval.

No open issues 🎉

1 file not reviewed

• javascript/frameworks/ui5/test/queries/UI5Xss/xss-searchfield-jquery-html/package-lock.json: Generated file

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

One or more issues must be addressed before approval.

1 open issue

• sanitizeContent makes the stored value safe as HTML, not as JavaScript source, so it must not be… · New

1 file not reviewed

• javascript/frameworks/ui5/test/queries/UI5Xss/xss-searchfield-jquery-html/package-lock.json: Generated file

_{Review effort: Balanced}