Adds a local source for separate Control implementations.

[mbaluda]

This pull request introduces improved detection of XSS vulnerabilities in UI5 custom controls, especially when string properties are used and the control implementation is separated from the main UI5 app.

[Copilot]

Pull request overview

Updates the UI5 XSS query test expectations to account for a newly introduced “local source” representing custom control property metadata, so that XSS flows are also reported when the tainted value is modeled as coming from a custom control’s (string) property definition.

Changes:

• Added a new DomBasedXss::Source (LocalModelStringPropertySource) in UI5DataFlow.qll that maps a binding path’s target property to the corresponding custom control PropertyMetadata.
• Updated multiple UI5Xss.expected files to include the additional result path where the source is the custom control property metadata (e.g., { type: "string" }).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/UI5DataFlow.qll	Adds a new “local” source class based on custom control property metadata reached from a binding path.
javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/UI5Xss.expected	Adds an additional expected result selecting the custom control property metadata as the source.
javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/UI5Xss.expected	Same as above for renderer resolved by name.
javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/UI5Xss.expected	Same as above for indirect control inheritance case.
javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/UI5Xss.expected	Same as above for jQuery-based custom control variant.
javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/UI5Xss.expected	Same as above for API v1-style renderer access.
javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/UI5Xss.expected	Same as above for API v2-style renderer access.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

[knewbury01]

LGTM!