\n
\"/>\n\n```\nWhen the above function transforms the string, it becomes a string that results in an alert when a browser treats it as HTML.\n\n\n```html\n
\n\"/>\n\n```\n\n## References\n* jQuery: [Security fixes in jQuery 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/)\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [Types of Cross-Site](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Unsafe expansion of self-closing HTML tag\nSanitizing untrusted input for HTML meta-characters is a common technique for preventing cross-site scripting attacks. But even a sanitized input can be dangerous to use if it is modified further before a browser treats it as HTML. A seemingly innocent transformation that expands a self-closing HTML tag from `
` to `` may in fact cause cross-site scripting vulnerabilities.\n\n\n## Recommendation\nUse a well-tested sanitization library if at all possible, and avoid modifying sanitized values further before treating them as HTML.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using HTML templates that are explicit about the values they treat as HTML.\n\n\n## Example\nThe following function transforms a self-closing HTML tag to a pair of open/close tags. It does so for all non-`img` and non-`area` tags, by using a regular expression with two capture groups. The first capture group corresponds to the name of the tag, and the second capture group to the content of the tag.\n\n\n```javascript\nfunction expandSelfClosingTags(html) {\n\tvar rxhtmlTag = /<(?!img|area)(([a-z][^\\w\\/>]*)[^>]*)\\/>/gi;\n\treturn html.replace(rxhtmlTag, \"<$1>\"); // BAD\n}\n\n```\nWhile it is generally known regular expressions are ill-suited for parsing HTML, variants of this particular transformation pattern have long been considered safe.\n\nHowever, the function is not safe. As an example, consider the following string:\n\n\n```html\n
\n\"/>\n\n```\nWhen the above function transforms the string, it becomes a string that results in an alert when a browser treats it as HTML.\n\n\n```html\n
\n\"/>\n\n```\n\n## References\n* jQuery: [Security fixes in jQuery 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/)\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [Types of Cross-Site](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-079","external/cwe/cwe-116"],"description":"Using regular expressions to expand self-closing HTML\n tags may lead to cross-site scripting vulnerabilities.","id":"js/unsafe-html-expansion","kind":"problem","name":"Unsafe expansion of self-closing HTML tag","precision":"very-high","problem.severity":"warning","security-severity":"6.1"}},{"id":"js/incomplete-html-attribute-sanitization","name":"js/incomplete-html-attribute-sanitization","shortDescription":{"text":"Incomplete HTML attribute sanitization"},"fullDescription":{"text":"Writing incompletely sanitized values to HTML attribute strings can lead to a cross-site scripting vulnerability."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Incomplete HTML attribute sanitization\nSanitizing untrusted input for HTML meta-characters is a common technique for preventing cross-site scripting attacks. Usually, this is done by escaping `<`, `>`, `&` and `\"`. However, the context in which the sanitized value is used decides the characters that need to be sanitized.\n\nAs a consequence, some programs only sanitize `<` and `>` since those are the most common dangerous characters. The lack of sanitization for `\"` is problematic when an incompletely sanitized value is used as an HTML attribute in a string that later is parsed as HTML.\n\n\n## Recommendation\nSanitize all relevant HTML meta-characters when constructing HTML dynamically, and pay special attention to where the sanitized value is used.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using HTML templates that are explicit about the values they treat as HTML.\n\n\n## Example\nThe following example code writes part of an HTTP request (which is controlled by the user) to an HTML attribute of the server response. The user-controlled value is, however, not sanitized for `\"`. This leaves the website vulnerable to cross-site scripting since an attacker can use a string like `\" onclick=\"alert(42)` to inject JavaScript code into the response.\n\n\n```javascript\nvar app = require('express')();\n\napp.get('/user/:id', function(req, res) {\n\tlet id = req.params.id;\n\tid = id.replace(/<|>/g, \"\"); // BAD\n\tlet userHtml = `\n \n \n```\n\n``` javascript\nsap.ui.define([\"sap/ui/core/mvc/Controller\", \"sap/ui/model/json/JSONModel\"],\n function (Controller, JSONModel) {\n return Controller.extend(\"vulnerable.controller.app\", {\n onInit: function () {\n var oData = { input: null };\n var oModel = new JSONModel(oData);\n this.getView().setModel(oModel);\n },\n });\n },\n);\n```\n\nThe issue can be resolved by setting the `HTML` control's `sanitizeContent` attribute to true.\n\n``` xml\n\n \n```\n\n## References\n\n- OWASP: [DOM Based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS).\n- SAP UI5 Documentation: [Cross-site Scripting](https://sapui5.hana.ondemand.com/sdk/#/topic/91f0bd316f4d1014b6dd926db0e91070.html) in UI5.\n- SAP UI5 Documentation: [Prevention of Cross-site Scripting](https://sapui5.hana.ondemand.com/sdk/#/topic/4de64e2e191f4a7297d4fd2d1e233a2d.html) in UI5.\n- SAP UI5 Documentation: [API Documentation of sap.ui.core.RenderManager](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.RenderManager).\n- SAP UI5 Documentation: [Defining Control Properties](https://sapui5.hana.ondemand.com/sdk/#/topic/ac56d92162ed47ff858fdf1ce26c18c4.html).\n- SAP UI5 Documentation: [Expression Binding](https://sapui5.hana.ondemand.com/sdk/#/topic/daf6852a04b44d118963968a1239d2c0).\n- SAP UI5 API Reference: [`sap.ui.core.HTML`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.HTML%23methods/setSanitizeContent).\n- Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n- Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Client-side cross-site scripting\n\nReceiving text from the user, most notably through a control, and rendering it as HTML in another control can lead to a cross-site scripting vulnerability.\n\n## Recommendation\n\n### Preventing XSS Involving User Defined Control\n\nIf the XSS attack vector includes a user-defined control, then we can mitigate the issue by sanitizing the user-provided input in the implementation of the control:\n- Where possible, define the property type to something other than `string` or `any`. If a value should be used, then opt for the `enum` type which only allows a predefined set of strings.\n- Use escaping functions in `sap.base.security`. Relevant sanitizers include `encodeXML` and `encodeHTML`.\n- When using API with `apiVersion: 2` (Semantic Rendering), do not use `RenderManager.unsafeHtml` unless the control property `sanitizeContent` is set to `true`.\n- When using the now-deprecated older API with `RenderManager.write` or `RenderManager.writeAttribute`, use their respective counterparts `RenderManager.writeEscaped` and `RenderManager.writeAttributeEscaped` which sanitizes their rendered contents.\n\n### Preventing XSS Not Involving User Defined Control\n\nAn XSS attack vector can still exist even when no user-defined control is used. In this case, a model property or a control property act as an intermediate step when external data is passed in.\nIn this case, the UI5 application should not use the property as is, but should sanitize the contents before reading it. Such sanitization can take place in the controller or in the view declaration using expression bindings.\n\n## Example\n\n### Custom Control with Custom Rendering Method\n\nThis custom control `vulnerable.control.xss` calls `unsafeHtml` on a given `RenderManager` instance in its static renderer function. Since its `text` property is an unrestricted string type, it can point to a string with contents that can be interpreted as HTML. If it is the case, `unsafeHtml` will render the string, running a possibly embedded JavaScript code in it.\n\n```javascript\nsap.ui.define([\"sap/ui/core/Control\"], function (Control) {\n return Control.extend(\"vulnerable.control.xss\", {\n metadata: { properties: { text: { type: \"string\" } } },\n renderer: {\n apiVersion: 2,\n render: function (oRm, oControl) {\n oRm.openStart(\"div\", oControl);\n oRm.unsafeHtml(oControl.getText()); // sink\n oRm.close(\"div\");\n }\n }\n });\n})\n```\n\nThis is the same custom control without the possibility of XSS using several means of sanitization: The property `text` is enforced to a non-string type, hence disallows unrestricted strings (This is espcially applicable if the expected input is a number anyways). Also, the `sap.base.security.encodeXML` function is used to escape HTML control characters.\n\n```javascript\nsap.ui.define([\"sap/ui/core/Control\", \"sap/base/security/encodeXML\"], function (Control, encodeXML) {\n return Control.extend(\"vulnerable.control.xss\", {\n metadata: { properties: { text: { type: \"int\" } } }, // constrain the type\n renderer: {\n apiVersion: 2,\n render: function (oRm, oControl) {\n oRm.openStart(\"div\", oControl);\n oRm.unsafeHtml(encodeXML(oControl.getText()); // encode using security functions\n oRm.close(\"div\");\n }\n }\n });\n})\n```\n\n### Library Control\n\nThis example contains only library controls that are not user-defined. The untrusted user input flows from `sap.m.Input` and directly flows out via `sap.ui.core.HTML` through the model property `input` as declared in the `onInit` method of the controller.\n\n``` xml\n\n \n \n```\n\n``` javascript\nsap.ui.define([\"sap/ui/core/mvc/Controller\", \"sap/ui/model/json/JSONModel\"],\n function (Controller, JSONModel) {\n return Controller.extend(\"vulnerable.controller.app\", {\n onInit: function () {\n var oData = { input: null };\n var oModel = new JSONModel(oData);\n this.getView().setModel(oModel);\n },\n });\n },\n);\n```\n\nThe issue can be resolved by setting the `HTML` control's `sanitizeContent` attribute to true.\n\n``` xml\n\n \n```\n\n## References\n\n- OWASP: [DOM Based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS).\n- SAP UI5 Documentation: [Cross-site Scripting](https://sapui5.hana.ondemand.com/sdk/#/topic/91f0bd316f4d1014b6dd926db0e91070.html) in UI5.\n- SAP UI5 Documentation: [Prevention of Cross-site Scripting](https://sapui5.hana.ondemand.com/sdk/#/topic/4de64e2e191f4a7297d4fd2d1e233a2d.html) in UI5.\n- SAP UI5 Documentation: [API Documentation of sap.ui.core.RenderManager](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.RenderManager).\n- SAP UI5 Documentation: [Defining Control Properties](https://sapui5.hana.ondemand.com/sdk/#/topic/ac56d92162ed47ff858fdf1ce26c18c4.html).\n- SAP UI5 Documentation: [Expression Binding](https://sapui5.hana.ondemand.com/sdk/#/topic/daf6852a04b44d118963968a1239d2c0).\n- SAP UI5 API Reference: [`sap.ui.core.HTML`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.HTML%23methods/setSanitizeContent).\n- Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n- Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116"],"description":"Writing user input directly to a UI5 View allows for\n a cross-site scripting vulnerability.","id":"js/ui5-xss","kind":"path-problem","name":"UI5 Client-side cross-site scripting","precision":"high","problem.severity":"error","security-severity":"7.8"}}],"locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/ui5/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/ui5/src/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"advanced-security/javascript-sap-ui5-models","semanticVersion":"2.3.0","locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/.github/codeql/extensions/javascript/frameworks/ui5/ext/ext/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/.github/codeql/extensions/javascript/frameworks/ui5/ext/ext/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}],"properties":{"isCodeQLModelPack":true}},{"name":"codeql/javascript-all","semanticVersion":"2.6.18+28b6aa8616a393ebb45186e3ba4df004a0f3ef4e","locations":[{"uri":"file:///opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/qlpacks/codeql/javascript-all/2.6.18/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/qlpacks/codeql/javascript-all/2.6.18/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.38+28b6aa8616a393ebb45186e3ba4df004a0f3ef4e","locations":[{"uri":"file:///opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/qlpacks/codeql/threat-models/1.0.38/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/qlpacks/codeql/threat-models/1.0.38/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"advanced-security/javascript-sap-cap-queries","semanticVersion":"2.3.0+5d1908cab6860dcd1270ee4704902badb4a6c34f","rules":[{"id":"js/cap-log-injection","name":"js/cap-log-injection","shortDescription":{"text":"CAP Log injection"},"fullDescription":{"text":"Building log entries from user-controlled sources is vulnerable to insertion of forged log entries by a malicious user."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# CAP Log Injection\n\nIf unsanitized user input is written to a log entry using the CAP Node.js logging API, a malicious user may be able to forge new log entries.\n\nCAP Node.js offers a CLRF-safe logging API that should be used for application log entries that are logged as plaintext. If the entry is interpreted as HTML, then arbitrary HTML code my be included to forge log entries.\n\n## Recommendation\n\nCAP applications need to care for escaping user data that is used as input parameter for application logging. It's recommended to make use of an existing Encoder such as OWASP ESAPI.\n\n## Examples\n\nThis CAP service directly logs what the user submitted via the `req` request.\n\n``` javascript\nimport cds from '@sap/cds'\nconst { Books } = cds.entities ('sap.capire.bookshop')\n\nclass SampleVulnService extends cds.ApplicationService { init(){\n this.on ('submitOrder', async req => {\n const {book,quantity} = req.data\n const LOG = cds.log(\"nodejs\");\n LOG.info(\"test\" + book); // Log injection alert\n })\n\n return super.init()\n}}\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP CAPire Documentation: [Security Aspects](https://cap.cloud.sap/docs/guides/security/aspects#common-injection-attacks).\n","markdown":"# CAP Log Injection\n\nIf unsanitized user input is written to a log entry using the CAP Node.js logging API, a malicious user may be able to forge new log entries.\n\nCAP Node.js offers a CLRF-safe logging API that should be used for application log entries that are logged as plaintext. If the entry is interpreted as HTML, then arbitrary HTML code my be included to forge log entries.\n\n## Recommendation\n\nCAP applications need to care for escaping user data that is used as input parameter for application logging. It's recommended to make use of an existing Encoder such as OWASP ESAPI.\n\n## Examples\n\nThis CAP service directly logs what the user submitted via the `req` request.\n\n``` javascript\nimport cds from '@sap/cds'\nconst { Books } = cds.entities ('sap.capire.bookshop')\n\nclass SampleVulnService extends cds.ApplicationService { init(){\n this.on ('submitOrder', async req => {\n const {book,quantity} = req.data\n const LOG = cds.log(\"nodejs\");\n LOG.info(\"test\" + book); // Log injection alert\n })\n\n return super.init()\n}}\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP CAPire Documentation: [Security Aspects](https://cap.cloud.sap/docs/guides/security/aspects#common-injection-attacks).\n"},"properties":{"tags":["security"],"description":"Building log entries from user-controlled sources is vulnerable to\n insertion of forged log entries by a malicious user.","id":"js/cap-log-injection","kind":"path-problem","name":"CAP Log injection","precision":"medium","problem.severity":"error","security-severity":"6.1"}},{"id":"js/cap-sql-injection","name":"js/cap-sql-injection","shortDescription":{"text":"CQL query built from user-controlled sources"},"fullDescription":{"text":"Building a CQL query from user-controlled sources is vulnerable to insertion of malicious code by the user."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# CQL query built from user-controlled sources\n\nIf a database query is built from user-provided data without sufficient sanitization, a malicious user may be able to run malicious database queries.\n\n## Recommendation\n\nCAP's intrinsic data querying engine is immune with regards to SQL injections that are introduced by query parameter values that are derived from malicious user input. CQL statements are transformed into prepared statements that are executed in SQL databases such as SAP HANA. \nInjections are still possible even via CQL when the query structure (e.g. target entity, columns etc.) is based on user input.\n\n## Examples\n\nThis CAP application uses user submitted input as entity and column in a CQL query without any validation.\n\n``` javascript\nconst entity = \nconst column = \nSELECT.from(entity).columns(column)\n```\n\n## References\n\n- OWASP: [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injectionn).\n- OWASP: [SQL Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html).\n- SAP CAPire Documentation: [Security Aspects](https://cap.cloud.sap/docs/guides/security/aspects#common-injection-attacks).\n","markdown":"# CQL query built from user-controlled sources\n\nIf a database query is built from user-provided data without sufficient sanitization, a malicious user may be able to run malicious database queries.\n\n## Recommendation\n\nCAP's intrinsic data querying engine is immune with regards to SQL injections that are introduced by query parameter values that are derived from malicious user input. CQL statements are transformed into prepared statements that are executed in SQL databases such as SAP HANA. \nInjections are still possible even via CQL when the query structure (e.g. target entity, columns etc.) is based on user input.\n\n## Examples\n\nThis CAP application uses user submitted input as entity and column in a CQL query without any validation.\n\n``` javascript\nconst entity = \nconst column = \nSELECT.from(entity).columns(column)\n```\n\n## References\n\n- OWASP: [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injectionn).\n- OWASP: [SQL Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html).\n- SAP CAPire Documentation: [Security Aspects](https://cap.cloud.sap/docs/guides/security/aspects#common-injection-attacks).\n"},"properties":{"tags":["security"],"description":"Building a CQL query from user-controlled sources is vulnerable to insertion of\n malicious code by the user.","id":"js/cap-sql-injection","kind":"path-problem","name":"CQL query built from user-controlled sources","precision":"high","problem.severity":"error","security-severity":"8.8"}},{"id":"js/cap-path-injection","name":"js/cap-path-injection","shortDescription":{"text":"Use of user controlled input in CAP CDS file system utilities"},"fullDescription":{"text":"Using unchecked user controlled values can allow an attacker to affect paths constructed and accessed in the filesystem."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# CAP CDS Utils used with user-controlled sources\n\nIf a path is constructed from user-provided input without sufficient sanitization, a malicious user may be able to manipulate the contents of the filesystem without proper authorization.\n\nAdditionally if user-provided input is used to create file contents this can also result in a malicious user manipulating the filesystem in an unchecked way.\n\n## Recommendation\n\nCAP applications using CDS Utils should not use user-provided input without sanitization.\n\nThe sanitization stragety can vary depending on what types of paths are satisfactory as user-provided input. A simple approach to sanitization is to check user-provided input against an allow list. Other potential approaches include checking components of paths or normalizing them to make sure that the path does not escape the expected root folder. \n\nNormalization techniques should be carefully considered and simple naive replacement strategies will not be sufficient, for example replacing any match of a parent directory reference (`../`) in the sample `.../...//` will still result in the path `../` being used which could escape the intended directory.\n\n## Examples\n\nThis CAP service directly uses user-provided input to construct a path.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst { rm } = cds.utils\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n\n init() {\n this.on(\"send1\", async (req) => {\n let userinput = req.data\n await rm(userinput, 'db', 'data') // Path injection alert\n }\n }\n}\n```\n\nThis CAP service directly uses user-provided input to add content to a file.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst { rm } = cds.utils\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n init() {\n this.on(\"send1\", async (req) => {\n let userinput = req.data\n await write(userinput).to('db/data') // Path injection alert\n\n // GOOD: the path can not be controlled by an attacker\n let allowedDirectories = [\n 'this-is-a-safe-directory'\n ];\n if (allowedDirectories.includes(userinput)) {\n await rm(userinput) // sanitized - No Path injection alert\n }\n }\n }\n}\n```\n\n## References\n\n- OWASP 2021: [Injection](https://owasp.org/Top10/A03_2021-Injection/).\n- SAP CAP CDS Utils : [Documentation](https://cap.cloud.sap/docs/node.js/cds-utils).\n- Common Weakness Enumeration: [CWE-020](https://cwe.mitre.org/data/definitions/20.html).\n- Common Weakness Enumeration: [CWE-022](https://cwe.mitre.org/data/definitions/22.html).\n","markdown":"# CAP CDS Utils used with user-controlled sources\n\nIf a path is constructed from user-provided input without sufficient sanitization, a malicious user may be able to manipulate the contents of the filesystem without proper authorization.\n\nAdditionally if user-provided input is used to create file contents this can also result in a malicious user manipulating the filesystem in an unchecked way.\n\n## Recommendation\n\nCAP applications using CDS Utils should not use user-provided input without sanitization.\n\nThe sanitization stragety can vary depending on what types of paths are satisfactory as user-provided input. A simple approach to sanitization is to check user-provided input against an allow list. Other potential approaches include checking components of paths or normalizing them to make sure that the path does not escape the expected root folder. \n\nNormalization techniques should be carefully considered and simple naive replacement strategies will not be sufficient, for example replacing any match of a parent directory reference (`../`) in the sample `.../...//` will still result in the path `../` being used which could escape the intended directory.\n\n## Examples\n\nThis CAP service directly uses user-provided input to construct a path.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst { rm } = cds.utils\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n\n init() {\n this.on(\"send1\", async (req) => {\n let userinput = req.data\n await rm(userinput, 'db', 'data') // Path injection alert\n }\n }\n}\n```\n\nThis CAP service directly uses user-provided input to add content to a file.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst { rm } = cds.utils\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n init() {\n this.on(\"send1\", async (req) => {\n let userinput = req.data\n await write(userinput).to('db/data') // Path injection alert\n\n // GOOD: the path can not be controlled by an attacker\n let allowedDirectories = [\n 'this-is-a-safe-directory'\n ];\n if (allowedDirectories.includes(userinput)) {\n await rm(userinput) // sanitized - No Path injection alert\n }\n }\n }\n}\n```\n\n## References\n\n- OWASP 2021: [Injection](https://owasp.org/Top10/A03_2021-Injection/).\n- SAP CAP CDS Utils : [Documentation](https://cap.cloud.sap/docs/node.js/cds-utils).\n- Common Weakness Enumeration: [CWE-020](https://cwe.mitre.org/data/definitions/20.html).\n- Common Weakness Enumeration: [CWE-022](https://cwe.mitre.org/data/definitions/22.html).\n"},"properties":{"tags":["security","external/cwe/cwe-020","external/cwe/cwe-022"],"description":"Using unchecked user controlled values can allow an\n attacker to affect paths constructed and accessed in\n the filesystem.","id":"js/cap-path-injection","kind":"path-problem","name":"Use of user controlled input in CAP CDS file system utilities","precision":"medium","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/cap-non-prod-auth-strategy","name":"js/cap-non-prod-auth-strategy","shortDescription":{"text":"Non-production authentication strategy used"},"fullDescription":{"text":"Using non-production authentication strategies can lead to unwanted authentication behavior in production."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Non-Production Authentication Strategy Used without Profiles\n\nUsing a non-production authentication strategy without setting up a distinct profile for development may pose allow unintended authentication and/or authorization if the application is deployed into production.\n\n## Recommendation\n\n### Isolate the use of development-level strategies to a development profile\n\nUse separate profiles for development and deployment and select one as needed. In this way, properties including authentication strategies can be substituted by changing a single command line option: `--profile`. For example, having the following section in the application's `package.json` states that the `\"dummy\"` authentication strategy must be used while `\"xsuaa\"`, a production-grade strategy, should be used when deployed:\n\n``` json\n{\n \"requires\": {\n \"[dev]\": {\n \"auth\": \"dummy\"\n },\n \"[deploy]\": {\n \"auth\": \"xsuaa\"\n }\n }\n}\n```\n\nThe application can be now run in different modes depending on the `--profile` command line option:\n\n``` shell\n$ cds serve --profile dev # Runs the application in development profile with strategy \"dummy\"\n$ cds serve --profile deploy # Runs the application in development profile with strategy \"xsuaa\"\n```\n\n## Example\n\nThe following CAP application states that it uses `\"basic\"` authentication strategy along with mocked credentials. Using the pair of username and password, an attacker can gain access to certain assets by signing in to the application.\n\n``` json\n{\n \"cds\": {\n \"requires\": {\n \"auth\": {\n \"kind\": \"basic\",\n \"users\": {\n \"JohnDoe\": {\n \"password\": \"JohnDoesPassword\",\n \"roles\": [\"JohnDoesRole\"],\n \"attr\": {}\n },\n \"JaneDoe\": {\n \"password\": \"JaneDoesPassword\",\n \"roles\": [\"JaneDoesRole\"],\n \"attr\": {}\n }\n }\n }\n }\n }\n}\n```\n\n## References\n\n- Common Weakness Enumeration: [CWE-288](https://cwe.mitre.org/data/definitions/288.html).\n- Common Weakness Enumeration: [CWE-798](https://cwe.mitre.org/data/definitions/798.html).\n- SAP CAPire Documentation: [Authentication Strategies](https://cap.cloud.sap/docs/node.js/authentication#strategies).\n","markdown":"# Non-Production Authentication Strategy Used without Profiles\n\nUsing a non-production authentication strategy without setting up a distinct profile for development may pose allow unintended authentication and/or authorization if the application is deployed into production.\n\n## Recommendation\n\n### Isolate the use of development-level strategies to a development profile\n\nUse separate profiles for development and deployment and select one as needed. In this way, properties including authentication strategies can be substituted by changing a single command line option: `--profile`. For example, having the following section in the application's `package.json` states that the `\"dummy\"` authentication strategy must be used while `\"xsuaa\"`, a production-grade strategy, should be used when deployed:\n\n``` json\n{\n \"requires\": {\n \"[dev]\": {\n \"auth\": \"dummy\"\n },\n \"[deploy]\": {\n \"auth\": \"xsuaa\"\n }\n }\n}\n```\n\nThe application can be now run in different modes depending on the `--profile` command line option:\n\n``` shell\n$ cds serve --profile dev # Runs the application in development profile with strategy \"dummy\"\n$ cds serve --profile deploy # Runs the application in development profile with strategy \"xsuaa\"\n```\n\n## Example\n\nThe following CAP application states that it uses `\"basic\"` authentication strategy along with mocked credentials. Using the pair of username and password, an attacker can gain access to certain assets by signing in to the application.\n\n``` json\n{\n \"cds\": {\n \"requires\": {\n \"auth\": {\n \"kind\": \"basic\",\n \"users\": {\n \"JohnDoe\": {\n \"password\": \"JohnDoesPassword\",\n \"roles\": [\"JohnDoesRole\"],\n \"attr\": {}\n },\n \"JaneDoe\": {\n \"password\": \"JaneDoesPassword\",\n \"roles\": [\"JaneDoesRole\"],\n \"attr\": {}\n }\n }\n }\n }\n }\n}\n```\n\n## References\n\n- Common Weakness Enumeration: [CWE-288](https://cwe.mitre.org/data/definitions/288.html).\n- Common Weakness Enumeration: [CWE-798](https://cwe.mitre.org/data/definitions/798.html).\n- SAP CAPire Documentation: [Authentication Strategies](https://cap.cloud.sap/docs/node.js/authentication#strategies).\n"},"properties":{"tags":["security"],"description":"Using non-production authentication strategies can lead to unwanted authentication behavior in production.","id":"js/cap-non-prod-auth-strategy","kind":"problem","name":"Non-production authentication strategy used","precision":"high","problem.severity":"warning","security-severity":"6"}},{"id":"js/cap-default-user-is-privileged","name":"js/cap-default-user-is-privileged","shortDescription":{"text":"Default user is privileged"},"fullDescription":{"text":"Overriding the default user to the privileged user allows for authentication bypass."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Default User is overwritten as privileged\n\nUsers that cannot be verified as authenticated are represented as `cds.User.default` internally. Setting this property to `cds.User.Privileged` may result in providing protected assets to unauthorized users.\n\n## Recommendation\n\n### Set up a development profile that uses non-production authentication\n\nOverwriting `cds.User.default` as `cds.User.Privileged` for testing purposes is not recommended as such code may easily slip through production.\n\nInstead, set up a development profile and opt in to use a non-production strategy such as `\"basic\"`, `\"dummy\"`, or `\"mocked\"` during its use. This can be done in the file `package.json` in the root folder of the CAP application:\n\n``` json\n{\n \"requires\": {\n \"[dev]\": {\n \"auth\": \"dummy\"\n }\n }\n}\n```\n\nSetting `\"dummy\"` as the development authentication strategy has the effect of disabling `@requires` and `@restrict` annotations of CDS definitions that provides authorization. The application during development then can be run and tested with the `--profile dev` option.\n\n```shell\ncds serve --profile dev\n```\n\n## Example\n\nSetting `cds.User.default` to `cds.User.Privileged` may happen anywhere in the application. In the following example, the `server.js` file provides the top-level definition of a CAP application and overwrites the `default` user property with the `Privileged` class.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst app = require(\"express\")();\n\n/*\n * Antipattern: `cds.User.default` is overwritten to `cds.User.Privileged`\n */\ncds.User.default = cdsUser.Privileged;\n\ncds.serve(\"all\").in(app);\n```\n\n## References\n\n- SAP CAPire Documentation: [cds.User.default](https://cap.cloud.sap/docs/node.js/authentication#default-user).\n- SAP CAPire Documentation: [cds.User.Privileged](https://cap.cloud.sap/docs/node.js/authentication#privileged-user).\n- SAP CAPire Documentation: [Authentication Strategies](https://cap.cloud.sap/docs/node.js/authentication#strategies).\n- Common Weakness Enumeration: [CWE-250](https://cwe.mitre.org/data/definitions/250.html).\n","markdown":"# Default User is overwritten as privileged\n\nUsers that cannot be verified as authenticated are represented as `cds.User.default` internally. Setting this property to `cds.User.Privileged` may result in providing protected assets to unauthorized users.\n\n## Recommendation\n\n### Set up a development profile that uses non-production authentication\n\nOverwriting `cds.User.default` as `cds.User.Privileged` for testing purposes is not recommended as such code may easily slip through production.\n\nInstead, set up a development profile and opt in to use a non-production strategy such as `\"basic\"`, `\"dummy\"`, or `\"mocked\"` during its use. This can be done in the file `package.json` in the root folder of the CAP application:\n\n``` json\n{\n \"requires\": {\n \"[dev]\": {\n \"auth\": \"dummy\"\n }\n }\n}\n```\n\nSetting `\"dummy\"` as the development authentication strategy has the effect of disabling `@requires` and `@restrict` annotations of CDS definitions that provides authorization. The application during development then can be run and tested with the `--profile dev` option.\n\n```shell\ncds serve --profile dev\n```\n\n## Example\n\nSetting `cds.User.default` to `cds.User.Privileged` may happen anywhere in the application. In the following example, the `server.js` file provides the top-level definition of a CAP application and overwrites the `default` user property with the `Privileged` class.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst app = require(\"express\")();\n\n/*\n * Antipattern: `cds.User.default` is overwritten to `cds.User.Privileged`\n */\ncds.User.default = cdsUser.Privileged;\n\ncds.serve(\"all\").in(app);\n```\n\n## References\n\n- SAP CAPire Documentation: [cds.User.default](https://cap.cloud.sap/docs/node.js/authentication#default-user).\n- SAP CAPire Documentation: [cds.User.Privileged](https://cap.cloud.sap/docs/node.js/authentication#privileged-user).\n- SAP CAPire Documentation: [Authentication Strategies](https://cap.cloud.sap/docs/node.js/authentication#strategies).\n- Common Weakness Enumeration: [CWE-250](https://cwe.mitre.org/data/definitions/250.html).\n"},"properties":{"tags":["security"],"description":"Overriding the default user to the privileged user allows for authentication bypass.","id":"js/cap-default-user-is-privileged","kind":"problem","name":"Default user is privileged","precision":"high","problem.severity":"error","security-severity":"6"}},{"id":"js/cap-unnecessarily-granted-privileged-access-rights","name":"js/cap-unnecessarily-granted-privileged-access-rights","shortDescription":{"text":"Access rights to an entity is unnecessarily elevated to privileged"},"fullDescription":{"text":"An entity requiring authorization is being accessed with privileged rights."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Access rights to an entity is unnecessarily elevated to privileged\n\nThe privileged user `cds.User.Privileged` is used to access an entity that requires authorization. If the application does not verify the actual user rights, it may expose protected entities to unauthorized users.\n\nThis is especially important when the accessed entity belongs to a remote service. By default, when using a production-grade authentication strategy all CAP endpoints are authenticated. However, if the entity is outside the application, there is no guarantee that the user is authenticated in the remote service.\n\n## Recommendations\n\n### Avoid using `cds.User.Privileged` when accessing an access-controlled entity\n\nAny entity that requires authorization should be accessed within the context of the authenticated user. When using a transaction, prefer using `cds.User` as the `user` attribute of the option argument to the call of `cds.ApplicationService.tx()` in order to check the required access rights of the entity against that of the user.\n\n## Examples\n\nThe following service, named Service1 and implemented in the file service1.js, is accessing an entity that belongs to another service named Service2 and defined in the file service2.cds. The entity, Service2Entity, demands that the user have level greater than 2.\n\n### `service1.js`\n\n``` javascript\nthis.on(\"action1\", async (req) => {\n const Service2 = await cds.connect.to(\"Service2\");\n const { Service2Entity } = Service2.entities;\n return this.tx({ user: new cds.User.Privileged(\"\") }, (tx) =>\n tx.run(\n SELECT.from(Service2Entity) // Declared in service2.cds\n .where`Attribute4=${req.data.messageToPass}`,\n ),\n );\n});\n```\n\n### `service2.cds`\n\n``` cds\nservice Service2 @(path: 'service-2') {\n /* Read access only to users with access level greater than 2. */\n @(restrict: [ { grant: 'READ', to: '$user.level > 2' } ])\n entity Service2Entity {\n Attribute1 : String(100);\n Attribute2 : String(100)\n }\n}\n```\n\n## References\n\n- SAP CAPire Documentation: [cds.User.Privileged](https://cap.cloud.sap/docs/node.js/authentication#privileged-user).\n- SAP CAPire Documentation: [cds.tx()](https://cap.cloud.sap/docs/node.js/cds-tx#srv-tx-ctx).\n- Common Weakness Enumeration: [CWE-250](https://cwe.mitre.org/data/definitions/250.html).\n- Common Weakness Enumeration: [CWE-266](https://cwe.mitre.org/data/definitions/266.html).\n","markdown":"# Access rights to an entity is unnecessarily elevated to privileged\n\nThe privileged user `cds.User.Privileged` is used to access an entity that requires authorization. If the application does not verify the actual user rights, it may expose protected entities to unauthorized users.\n\nThis is especially important when the accessed entity belongs to a remote service. By default, when using a production-grade authentication strategy all CAP endpoints are authenticated. However, if the entity is outside the application, there is no guarantee that the user is authenticated in the remote service.\n\n## Recommendations\n\n### Avoid using `cds.User.Privileged` when accessing an access-controlled entity\n\nAny entity that requires authorization should be accessed within the context of the authenticated user. When using a transaction, prefer using `cds.User` as the `user` attribute of the option argument to the call of `cds.ApplicationService.tx()` in order to check the required access rights of the entity against that of the user.\n\n## Examples\n\nThe following service, named Service1 and implemented in the file service1.js, is accessing an entity that belongs to another service named Service2 and defined in the file service2.cds. The entity, Service2Entity, demands that the user have level greater than 2.\n\n### `service1.js`\n\n``` javascript\nthis.on(\"action1\", async (req) => {\n const Service2 = await cds.connect.to(\"Service2\");\n const { Service2Entity } = Service2.entities;\n return this.tx({ user: new cds.User.Privileged(\"\") }, (tx) =>\n tx.run(\n SELECT.from(Service2Entity) // Declared in service2.cds\n .where`Attribute4=${req.data.messageToPass}`,\n ),\n );\n});\n```\n\n### `service2.cds`\n\n``` cds\nservice Service2 @(path: 'service-2') {\n /* Read access only to users with access level greater than 2. */\n @(restrict: [ { grant: 'READ', to: '$user.level > 2' } ])\n entity Service2Entity {\n Attribute1 : String(100);\n Attribute2 : String(100)\n }\n}\n```\n\n## References\n\n- SAP CAPire Documentation: [cds.User.Privileged](https://cap.cloud.sap/docs/node.js/authentication#privileged-user).\n- SAP CAPire Documentation: [cds.tx()](https://cap.cloud.sap/docs/node.js/cds-tx#srv-tx-ctx).\n- Common Weakness Enumeration: [CWE-250](https://cwe.mitre.org/data/definitions/250.html).\n- Common Weakness Enumeration: [CWE-266](https://cwe.mitre.org/data/definitions/266.html).\n"},"properties":{"tags":["security"],"description":"An entity requiring authorization is being accessed with privileged rights.","id":"js/cap-unnecessarily-granted-privileged-access-rights","kind":"problem","name":"Access rights to an entity is unnecessarily elevated to privileged","precision":"high","problem.severity":"error","security-severity":"6"}},{"id":"js/cap-entity-exposed-without-authentication","name":"js/cap-entity-exposed-without-authentication","shortDescription":{"text":"Entity exposed without authentication"},"fullDescription":{"text":"Entities exposed to external protocols should require an CDS-based or JS-based access control."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# CAP Definitions Exposed without Access Controls\n\nAlthough using a production-level authentication strategy such as `jwt` ensures that all entities and services require the user to be authenticated, this does not guarantee any further authorization. Furthermore, the lack of required authentication or authorization may imply a gap in the design of the system.\n\n## Recommendation\n\n### Use CDS-based authorization\n\nCDL provides two annotations to declare access controls `@requires` and `@restrict` with the latter providing more granularity than the former. For example, to check if a request is being made by an authenticated user to the CDL entity or service, annotate it with `@requires: 'authenticated-user'`. On the other hand, if it needs to be read only via a certain group of users where the user has level greater than 2, use `@restrict: { grant: 'READ', to: 'SomeUser', where: { $user.level > 2 } }` (note the leading `$`).\n\n#### Check the original CDS entity it is derived from\n\nCDS entities may be derived from other entities by means of selection and projection. Derived definitions inherit access control conditions and optionally override them. In order to accurately determine what authorization an entity requires, the access control of the parent entity should be transitively inspected.\n\n### Enforce authorization with JavaScript\n\nAccess control may be enforced when a request handler for the relevant entity or service is registered. Both `cds.Service.before` and `cds.Service.on` may be used for enforcement. For example, to restrict writing to and updating an entity to a user satisfying certain requirements, either one of the below handler registrations may be used:\n\n``` javascript\n/**\n * Before serving a request to access SomeEntity, check if the request is coming from a user\n * with SomeRole and level greater than 3.\n */\nthis.before([\"WRITE\", \"UPDATE\"], \"SomeEntity\", (req) => {\n (req.user.is(\"SomeRole\") && req.user.attr.level > 3) || req.reject(403);\n});\n\n/**\n * On request to access SomeEntity, check if the request is coming from a user\n * with SomeRole and level greater than 3.\n */\nthis.on([\"WRITE\", \"UPDATE\"], \"SomeEntity\", (req) => {\n if (req.user.is(\"SomeRole\") && req.user.attr.level > 3) {\n /* Do something */\n } else req.reject(403);\n});\n```\n\n## Examples\n\nThe following CDS definition and its JavaScript implementation imposes no authorization on `SomeEntity`. Note that the `OriginalEntity` from which `DerivedEntity` derives from does not control the access either.\n\n### db/schema.cds\n\n``` cap-cds\nnamespace sample_namespace.sample_entities;\n\nentity OriginalEntity {\n Attribute1 : String(100);\n Attribute2 : String(100)\n}\n```\n\n### srv/service1.cds\n\n``` cap-cds\nusing { sample_namespace.sample_entities as db_schema } from '../db/schema';\n\nservice SomeService {\n entity DerivedEntity as projection on db_schema.OriginalEntity excluding { Attribute2 }\n}\n```\n\n### srv/service1.js\n\n``` javascript\n\nconst cds = require(\"@sap/cds\");\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n init() {\n this.on(\"READ\", \"SomeService\", (req) => { })\n }\n}\n```\n\n## References\n\n- SAP CAPire Documentation: [Authorization Enforcement](https://cap.cloud.sap/docs/node.js/authentication#enforcement).\n- SAP CAPire Documentation: [@restrict](https://cap.cloud.sap/docs/guides/security/authorization#restrict-annotation).\n- SAP CAPire Documentation:\n[@requires](https://cap.cloud.sap/docs/guides/security/authorization#requires).\n- SAP CAPire Documentation: [Protecting Certain Entries](https://cap.cloud.sap/docs/cds/common#protecting-certain-entries).\n- SAP CAPire Documentation: [Inheritance of Restrictions](https://cap.cloud.sap/docs/guides/security/authorization#inheritance-of-restrictions).\n- SAP CAPire Documentation: [Authentication Enforced in Production](https://cap.cloud.sap/docs/node.js/authentication#authentication-enforced-in-production).\n- Common Weakness Enumeration: [CWE-862](https://cwe.mitre.org/data/definitions/862.html).\n- Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).\n","markdown":"# CAP Definitions Exposed without Access Controls\n\nAlthough using a production-level authentication strategy such as `jwt` ensures that all entities and services require the user to be authenticated, this does not guarantee any further authorization. Furthermore, the lack of required authentication or authorization may imply a gap in the design of the system.\n\n## Recommendation\n\n### Use CDS-based authorization\n\nCDL provides two annotations to declare access controls `@requires` and `@restrict` with the latter providing more granularity than the former. For example, to check if a request is being made by an authenticated user to the CDL entity or service, annotate it with `@requires: 'authenticated-user'`. On the other hand, if it needs to be read only via a certain group of users where the user has level greater than 2, use `@restrict: { grant: 'READ', to: 'SomeUser', where: { $user.level > 2 } }` (note the leading `$`).\n\n#### Check the original CDS entity it is derived from\n\nCDS entities may be derived from other entities by means of selection and projection. Derived definitions inherit access control conditions and optionally override them. In order to accurately determine what authorization an entity requires, the access control of the parent entity should be transitively inspected.\n\n### Enforce authorization with JavaScript\n\nAccess control may be enforced when a request handler for the relevant entity or service is registered. Both `cds.Service.before` and `cds.Service.on` may be used for enforcement. For example, to restrict writing to and updating an entity to a user satisfying certain requirements, either one of the below handler registrations may be used:\n\n``` javascript\n/**\n * Before serving a request to access SomeEntity, check if the request is coming from a user\n * with SomeRole and level greater than 3.\n */\nthis.before([\"WRITE\", \"UPDATE\"], \"SomeEntity\", (req) => {\n (req.user.is(\"SomeRole\") && req.user.attr.level > 3) || req.reject(403);\n});\n\n/**\n * On request to access SomeEntity, check if the request is coming from a user\n * with SomeRole and level greater than 3.\n */\nthis.on([\"WRITE\", \"UPDATE\"], \"SomeEntity\", (req) => {\n if (req.user.is(\"SomeRole\") && req.user.attr.level > 3) {\n /* Do something */\n } else req.reject(403);\n});\n```\n\n## Examples\n\nThe following CDS definition and its JavaScript implementation imposes no authorization on `SomeEntity`. Note that the `OriginalEntity` from which `DerivedEntity` derives from does not control the access either.\n\n### db/schema.cds\n\n``` cap-cds\nnamespace sample_namespace.sample_entities;\n\nentity OriginalEntity {\n Attribute1 : String(100);\n Attribute2 : String(100)\n}\n```\n\n### srv/service1.cds\n\n``` cap-cds\nusing { sample_namespace.sample_entities as db_schema } from '../db/schema';\n\nservice SomeService {\n entity DerivedEntity as projection on db_schema.OriginalEntity excluding { Attribute2 }\n}\n```\n\n### srv/service1.js\n\n``` javascript\n\nconst cds = require(\"@sap/cds\");\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n init() {\n this.on(\"READ\", \"SomeService\", (req) => { })\n }\n}\n```\n\n## References\n\n- SAP CAPire Documentation: [Authorization Enforcement](https://cap.cloud.sap/docs/node.js/authentication#enforcement).\n- SAP CAPire Documentation: [@restrict](https://cap.cloud.sap/docs/guides/security/authorization#restrict-annotation).\n- SAP CAPire Documentation:\n[@requires](https://cap.cloud.sap/docs/guides/security/authorization#requires).\n- SAP CAPire Documentation: [Protecting Certain Entries](https://cap.cloud.sap/docs/cds/common#protecting-certain-entries).\n- SAP CAPire Documentation: [Inheritance of Restrictions](https://cap.cloud.sap/docs/guides/security/authorization#inheritance-of-restrictions).\n- SAP CAPire Documentation: [Authentication Enforced in Production](https://cap.cloud.sap/docs/node.js/authentication#authentication-enforced-in-production).\n- Common Weakness Enumeration: [CWE-862](https://cwe.mitre.org/data/definitions/862.html).\n- Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).\n"},"properties":{"tags":["security"],"description":"Entities exposed to external protocols should require an\n CDS-based or JS-based access control.","id":"js/cap-entity-exposed-without-authentication","kind":"problem","name":"Entity exposed without authentication","precision":"high","problem.severity":"warning","security-severity":"6"}},{"id":"js/cap-sensitive-log","name":"js/cap-sensitive-log","shortDescription":{"text":"Insertion of sensitive information into log files"},"fullDescription":{"text":"Writing sensitive information to log files can allow that information to be leaked to an attacker more easily."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# CAP Insertion of Sensitive Information into Log File\n\nIf sensitive information is written to a log entry using the CAP Node.js logging API, a malicious user may be able to gain access to user data.\n\nData annotated as `@PersonalData` should not be logged.\n\n## Recommendation\n\nCAP applications should not log sensitive information. Check CDS declarations for annotations before logging certain data types or fields.\n\n## Examples\n\nThis CAP service directly logs the sensitive information.\n\n```cds\nnamespace advanced_security.log_exposure.sample_entities;\n\nentity Sample {\n name : String(111);\n}\n\n// annotations for Data Privacy\nannotate Sample with\n@PersonalData : { DataSubjectRole : 'Sample', EntitySemantics : 'DataSubject' }\n{\n name @PersonalData.IsPotentiallySensitive;\n}\n```\n\n``` javascript\nimport cds from '@sap/cds'\nconst LOG = cds.log(\"logger\");\n\nconst { Sample } = cds.entities('advanced_security.log_exposure.sample_entities')\n\nclass SampleVulnService extends cds.ApplicationService {\n init() {\n LOG.info(\"Received: \", Sample.name); // CAP log exposure alert\n }\n}\n```\n\n## References\n\n- OWASP 2021: [Security Logging and Monitoring Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/).\n- OWASP: [Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- OWASP: [User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html).\n- SAP CAPire Documentation: [PersonalData Annotations](https://cap.cloud.sap/docs/guides/data-privacy/annotations).","markdown":"# CAP Insertion of Sensitive Information into Log File\n\nIf sensitive information is written to a log entry using the CAP Node.js logging API, a malicious user may be able to gain access to user data.\n\nData annotated as `@PersonalData` should not be logged.\n\n## Recommendation\n\nCAP applications should not log sensitive information. Check CDS declarations for annotations before logging certain data types or fields.\n\n## Examples\n\nThis CAP service directly logs the sensitive information.\n\n```cds\nnamespace advanced_security.log_exposure.sample_entities;\n\nentity Sample {\n name : String(111);\n}\n\n// annotations for Data Privacy\nannotate Sample with\n@PersonalData : { DataSubjectRole : 'Sample', EntitySemantics : 'DataSubject' }\n{\n name @PersonalData.IsPotentiallySensitive;\n}\n```\n\n``` javascript\nimport cds from '@sap/cds'\nconst LOG = cds.log(\"logger\");\n\nconst { Sample } = cds.entities('advanced_security.log_exposure.sample_entities')\n\nclass SampleVulnService extends cds.ApplicationService {\n init() {\n LOG.info(\"Received: \", Sample.name); // CAP log exposure alert\n }\n}\n```\n\n## References\n\n- OWASP 2021: [Security Logging and Monitoring Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/).\n- OWASP: [Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- OWASP: [User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html).\n- SAP CAPire Documentation: [PersonalData Annotations](https://cap.cloud.sap/docs/guides/data-privacy/annotations)."},"properties":{"tags":["security","external/cwe/cwe-532"],"description":"Writing sensitive information to log files can allow that\n information to be leaked to an attacker more easily.","id":"js/cap-sensitive-log","kind":"path-problem","name":"Insertion of sensitive information into log files","precision":"medium","problem.severity":"warning","security-severity":"7.5"}}],"locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/src/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"advanced-security/javascript-sap-xsjs-queries","semanticVersion":"2.3.0+5d1908cab6860dcd1270ee4704902badb4a6c34f","rules":[{"id":"js/xsjs-broken-authentication","name":"js/xsjs-broken-authentication","shortDescription":{"text":"Broken XSJS authentication"},"fullDescription":{"text":"Disabling XSJS authentication makes the application vulnerable to unauthorized access."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Authentication not enforced in HANA XS application\n\nThis HANA XS application does not enforce authentication on the requests it handles.\n\n## Overview\n\nSAP HANA XS applications are called via HTTP requests to process a connected HANA database, and this makes it critical to authenticate the sender of the request. Failing to do so allows attackers to impersonate users and gain access to underlying systems and data.\n\n## Recommendation\n\nUse the built-in SAP HANA XS authentication mechanism and session management (cookies).\n- If `XS Advanced` is used, authentication **is enabled by default**, and the `authenticationMethod` property indicates which authentication will be applied. However, avoid setting the property to something else than `none`, as doing so turns off all authentication on all routes.\n- If `XS Classic` is used, authentication is **not enabled by default**, so the `authentication` property in the application's `.xsaccess` file should be set to enable authentication. Set the value of the property according to the method you want to implement (`LogonTicket`, `Form`, or `Basic`).\n\n## Example\n\nThe fragment from an `xs-app.json` file shows the application in question having its authentication explicitly disabled.\n\n```json\n{\n \"welcomeFile\": \"index.html\",\n \"authenticationMethod\": \"none\",\n ...\n}\n```\n\n## References\n\n- SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/2040c1b7e478448cb9904c55ac06cac8.html).\n- SAP: [XS Advanced Application Router Configuration](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod), relevant to XS Advanced applications.\n- SAP: [Application-Access File Keyword Options: Authentication](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03&locale=en-US#authentication), relevant to XS Classic applications.\n- Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).\n","markdown":"# Authentication not enforced in HANA XS application\n\nThis HANA XS application does not enforce authentication on the requests it handles.\n\n## Overview\n\nSAP HANA XS applications are called via HTTP requests to process a connected HANA database, and this makes it critical to authenticate the sender of the request. Failing to do so allows attackers to impersonate users and gain access to underlying systems and data.\n\n## Recommendation\n\nUse the built-in SAP HANA XS authentication mechanism and session management (cookies).\n- If `XS Advanced` is used, authentication **is enabled by default**, and the `authenticationMethod` property indicates which authentication will be applied. However, avoid setting the property to something else than `none`, as doing so turns off all authentication on all routes.\n- If `XS Classic` is used, authentication is **not enabled by default**, so the `authentication` property in the application's `.xsaccess` file should be set to enable authentication. Set the value of the property according to the method you want to implement (`LogonTicket`, `Form`, or `Basic`).\n\n## Example\n\nThe fragment from an `xs-app.json` file shows the application in question having its authentication explicitly disabled.\n\n```json\n{\n \"welcomeFile\": \"index.html\",\n \"authenticationMethod\": \"none\",\n ...\n}\n```\n\n## References\n\n- SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/2040c1b7e478448cb9904c55ac06cac8.html).\n- SAP: [XS Advanced Application Router Configuration](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod), relevant to XS Advanced applications.\n- SAP: [Application-Access File Keyword Options: Authentication](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03&locale=en-US#authentication), relevant to XS Classic applications.\n- Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).\n"},"properties":{"tags":["security","external/cwe/cwe-306"],"description":"Disabling XSJS authentication makes the application vulnerable to unauthorized access.","id":"js/xsjs-broken-authentication","kind":"problem","name":"Broken XSJS authentication","precision":"medium","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/xsjs-reflected-xss","name":"js/xsjs-reflected-xss","shortDescription":{"text":"XSJS Reflected XSS"},"fullDescription":{"text":"Including uncontrolled value into a response body and setting it to a scriptable MIME type allows for cross-site scripting vulnerability."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Reflected Cross-site Scripting\n\nIncluding a text, received from a client browser typically through an XSJS request parameter, to be rendered as HTML in a request body may execute arbitrary JavaScript code on the client.\n\n## Recommendation\n\nThe XSJS application should always validate or sanitize the submitted string from a client before including it into a response body to be rendered in a client browser.\n\n### Validate the input string\n\nValidate the submitted input by looking for a sensitive HTML tag such as ``. The pattern may be encoded to a regular expression and matched against the input; If there is a match, then the XSJS application may decide to abort the process and instead return an HTTP code stating that the application rejected the request (e.g. `$.net.FORBIDDEN`). XSJS does not provide a function to reliably perform the above, therefore using a third-party library is recommended.\n\n### Sanitize the input string\n\n#### Server-side sanitization\n\nThe XSJS application may instead allow any user input, but sanitize it before it integrates it into the response body. This is achieved by escaping special characters that are treated as part of the HTML syntax, such as `\"`, `&`, `'`, `<`, and `>`. Since XSJS does not provide a function to escape these, using a third-party library is recommended.\n\n#### Client-side sanitization\n\nAlternatively, if SAP UI5 is used on the frontend, there are client-side escaping mechanisms such as `sap.base.security.encodeXML` and `sap.base.security.encodeHTML`. If `sap.ui.core.HTML` is used in the frontend view, consider setting its `sanitizeContent` property explicitly to `true`, since its default value is `false`.\n\n## Example\n\nThe following XSJS application sets the response body directly to a string received from a user without any validation or sanitization. The header's content type is set as an HTML document, which allows for any embedded JavaScript to be run in the request body. Note that even if `clientData` was not enclosed in a `div`, the vulnerability would still exist.\n\n``` javascript\nlet clientData = requestParameters.get(\"someParameter\");\n$.response.contentType = \"text/html\";\n$.response.setBody(\"
': 'foo'}` will generate the error `data/ should be number`, causing reflected XSS.\n\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [DOM Based XSS](https://www.owasp.org/index.php/DOM_Based_XSS).\n* OWASP [Types of Cross-Site Scripting](https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Exception text reinterpreted as HTML\nDirectly writing error messages to a webpage without sanitization allows for a cross-site scripting vulnerability if parts of the error message can be influenced by a user.\n\n\n## Recommendation\nTo guard against cross-site scripting, consider using contextual output encoding/escaping before writing user input to the page, or one of the other solutions that are mentioned in the references.\n\n\n## Example\nThe following example shows an exception being written directly to the document, and this exception can potentially be influenced by the page URL, leaving the website vulnerable to cross-site scripting.\n\n\n```javascript\nfunction setLanguageOptions() {\n var href = document.location.href,\n deflt = href.substring(href.indexOf(\"default=\")+8);\n \n try {\n var parsed = unknownParseFunction(deflt); \n } catch(e) {\n document.write(\"Had an error: \" + e + \".\");\n }\n}\n\n```\n\n## Example\nThis second example shows an input being validated using the JSON schema validator `ajv`, and in case of an error, the error message is sent directly back in the response.\n\n\n```javascript\nimport express from 'express';\nimport Ajv from 'ajv';\n\nlet app = express();\nlet ajv = new Ajv();\n\najv.addSchema({type: 'object', additionalProperties: {type: 'number'}}, 'pollData');\n\napp.post('/polldata', (req, res) => {\n if (!ajv.validate('pollData', req.body)) {\n res.send(ajv.errorsText());\n }\n});\n\n```\nThis is unsafe, because the error message can contain parts of the input. For example, the input `{'': 'foo'}` will generate the error `data/ should be number`, causing reflected XSS.\n\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [DOM Based XSS](https://www.owasp.org/index.php/DOM_Based_XSS).\n* OWASP [Types of Cross-Site Scripting](https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116"],"description":"Reinterpreting text from an exception as HTML\n can lead to a cross-site scripting vulnerability.","id":"js/xss-through-exception","kind":"path-problem","name":"Exception text reinterpreted as HTML","precision":"high","problem.severity":"warning","security-severity":"6.1"}},{"id":"js/unsafe-jquery-plugin","name":"js/unsafe-jquery-plugin","shortDescription":{"text":"Unsafe jQuery plugin"},"fullDescription":{"text":"A jQuery plugin that unintentionally constructs HTML from some of its options may be unsafe to use for clients."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Unsafe jQuery plugin\nLibrary plugins, such as those for the jQuery library, are often configurable through options provided by the clients of the plugin. Clients, however, do not know the implementation details of the plugin, so it is important to document the capabilities of each option. The documentation for the plugin options that the client is responsible for sanitizing is of particular importance. Otherwise, the plugin may write user input (for example, a URL query parameter) to a web page without properly sanitizing it first, which allows for a cross-site scripting vulnerability in the client application through dynamic HTML construction.\n\n\n## Recommendation\nDocument all options that can lead to cross-site scripting attacks, and guard against unsafe inputs where dynamic HTML construction is not intended.\n\n\n## Example\nThe following example shows a jQuery plugin that selects a DOM element, and copies its text content to another DOM element. The selection is performed by using the plugin option `sourceSelector` as a CSS selector.\n\n\n```javascript\njQuery.fn.copyText = function(options) {\n\t// BAD may evaluate `options.sourceSelector` as HTML\n\tvar source = jQuery(options.sourceSelector),\n\t text = source.text();\n\tjQuery(this).text(text);\n}\n\n```\nThis is, however, not a safe plugin, since the call to `jQuery` interprets `sourceSelector` as HTML if it is a string that starts with `<`.\n\nInstead of documenting that the client is responsible for sanitizing `sourceSelector`, the plugin can use `jQuery.find` to always interpret `sourceSelector` as a CSS selector:\n\n\n```javascript\njQuery.fn.copyText = function(options) {\n\t// GOOD may not evaluate `options.sourceSelector` as HTML\n\tvar source = jQuery.find(options.sourceSelector),\n\t text = source.text();\n\tjQuery(this).text(text);\n}\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [DOM Based XSS](https://www.owasp.org/index.php/DOM_Based_XSS).\n* OWASP [Types of Cross-Site Scripting](https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* jQuery: [Plugin creation](https://learn.jquery.com/plugins/basic-plugin-creation/).\n* Bootstrap: [XSS vulnerable bootstrap plugins](https://github.com/twbs/bootstrap/pull/27047).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Unsafe jQuery plugin\nLibrary plugins, such as those for the jQuery library, are often configurable through options provided by the clients of the plugin. Clients, however, do not know the implementation details of the plugin, so it is important to document the capabilities of each option. The documentation for the plugin options that the client is responsible for sanitizing is of particular importance. Otherwise, the plugin may write user input (for example, a URL query parameter) to a web page without properly sanitizing it first, which allows for a cross-site scripting vulnerability in the client application through dynamic HTML construction.\n\n\n## Recommendation\nDocument all options that can lead to cross-site scripting attacks, and guard against unsafe inputs where dynamic HTML construction is not intended.\n\n\n## Example\nThe following example shows a jQuery plugin that selects a DOM element, and copies its text content to another DOM element. The selection is performed by using the plugin option `sourceSelector` as a CSS selector.\n\n\n```javascript\njQuery.fn.copyText = function(options) {\n\t// BAD may evaluate `options.sourceSelector` as HTML\n\tvar source = jQuery(options.sourceSelector),\n\t text = source.text();\n\tjQuery(this).text(text);\n}\n\n```\nThis is, however, not a safe plugin, since the call to `jQuery` interprets `sourceSelector` as HTML if it is a string that starts with `<`.\n\nInstead of documenting that the client is responsible for sanitizing `sourceSelector`, the plugin can use `jQuery.find` to always interpret `sourceSelector` as a CSS selector:\n\n\n```javascript\njQuery.fn.copyText = function(options) {\n\t// GOOD may not evaluate `options.sourceSelector` as HTML\n\tvar source = jQuery.find(options.sourceSelector),\n\t text = source.text();\n\tjQuery(this).text(text);\n}\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [DOM Based XSS](https://www.owasp.org/index.php/DOM_Based_XSS).\n* OWASP [Types of Cross-Site Scripting](https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* jQuery: [Plugin creation](https://learn.jquery.com/plugins/basic-plugin-creation/).\n* Bootstrap: [XSS vulnerable bootstrap plugins](https://github.com/twbs/bootstrap/pull/27047).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116","frameworks/jquery"],"description":"A jQuery plugin that unintentionally constructs HTML from some of its options may be unsafe to use for clients.","id":"js/unsafe-jquery-plugin","kind":"path-problem","name":"Unsafe jQuery plugin","precision":"high","problem.severity":"warning","security-severity":"6.1"}},{"id":"js/xss","name":"js/xss","shortDescription":{"text":"Client-side cross-site scripting"},"fullDescription":{"text":"Writing user input directly to the DOM allows for a cross-site scripting vulnerability."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Client-side cross-site scripting\nDirectly writing user input (for example, a URL query parameter) to a webpage without properly sanitizing the input first, allows for a cross-site scripting vulnerability.\n\nThis kind of vulnerability is also called *DOM-based* cross-site scripting, to distinguish it from other types of cross-site scripting.\n\n\n## Recommendation\nTo guard against cross-site scripting, consider using contextual output encoding/escaping before writing user input to the page, or one of the other solutions that are mentioned in the references.\n\n\n## Example\nThe following example shows part of the page URL being written directly to the document, leaving the website vulnerable to cross-site scripting.\n\n\n```javascript\nfunction setLanguageOptions() {\n var href = document.location.href,\n deflt = href.substring(href.indexOf(\"default=\")+8);\n document.write(\"\");\n document.write(\"\");\n}\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [DOM Based XSS](https://www.owasp.org/index.php/DOM_Based_XSS).\n* OWASP [Types of Cross-Site Scripting](https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Client-side cross-site scripting\nDirectly writing user input (for example, a URL query parameter) to a webpage without properly sanitizing the input first, allows for a cross-site scripting vulnerability.\n\nThis kind of vulnerability is also called *DOM-based* cross-site scripting, to distinguish it from other types of cross-site scripting.\n\n\n## Recommendation\nTo guard against cross-site scripting, consider using contextual output encoding/escaping before writing user input to the page, or one of the other solutions that are mentioned in the references.\n\n\n## Example\nThe following example shows part of the page URL being written directly to the document, leaving the website vulnerable to cross-site scripting.\n\n\n```javascript\nfunction setLanguageOptions() {\n var href = document.location.href,\n deflt = href.substring(href.indexOf(\"default=\")+8);\n document.write(\"\");\n document.write(\"\");\n}\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [DOM Based XSS](https://www.owasp.org/index.php/DOM_Based_XSS).\n* OWASP [Types of Cross-Site Scripting](https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116"],"description":"Writing user input directly to the DOM allows for\n a cross-site scripting vulnerability.","id":"js/xss","kind":"path-problem","name":"Client-side cross-site scripting","precision":"high","problem.severity":"error","security-severity":"7.8"}},{"id":"js/sql-injection","name":"js/sql-injection","shortDescription":{"text":"Database query built from user-controlled sources"},"fullDescription":{"text":"Building a database query from user-controlled sources is vulnerable to insertion of malicious code by the user."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Database query built from user-controlled sources\nIf a database query (such as a SQL or NoSQL query) is built from user-provided data without sufficient sanitization, a malicious user may be able to run malicious database queries.\n\n\n## Recommendation\nMost database connector libraries offer a way of safely embedding untrusted data into a query by means of query parameters or prepared statements.\n\nFor NoSQL queries, make use of an operator like MongoDB's `$eq` to ensure that untrusted data is interpreted as a literal value and not as a query object. Alternatively, check that the untrusted data is a literal value and not a query object before using it in a query.\n\nFor SQL queries, use query parameters or prepared statements to embed untrusted data into the query string, or use a library like `sqlstring` to escape untrusted data.\n\n\n## Example\nIn the following example, assume the function `handler` is an HTTP request handler in a web application, whose parameter `req` contains the request object.\n\nThe handler constructs an SQL query string from user input and executes it as a database query using the `pg` library. The user input may contain quote characters, so this code is vulnerable to a SQL injection attack.\n\n\n```javascript\nconst app = require(\"express\")(),\n pg = require(\"pg\"),\n pool = new pg.Pool(config);\n\napp.get(\"search\", function handler(req, res) {\n // BAD: the category might have SQL special characters in it\n var query1 =\n \"SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='\" +\n req.params.category +\n \"' ORDER BY PRICE\";\n pool.query(query1, [], function(err, results) {\n // process results\n });\n});\n\n```\nTo fix this vulnerability, we can use query parameters to embed the user input into the query string. In this example, we use the API offered by the `pg` Postgres database connector library, but other libraries offer similar features. This version is immune to injection attacks.\n\n\n```javascript\nconst app = require(\"express\")(),\n pg = require(\"pg\"),\n pool = new pg.Pool(config);\n\napp.get(\"search\", function handler(req, res) {\n // GOOD: use parameters\n var query2 =\n \"SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY=$1 ORDER BY PRICE\";\n pool.query(query2, [req.params.category], function(err, results) {\n // process results\n });\n});\n\n```\nAlternatively, we can use a library like `sqlstring` to escape the user input before embedding it into the query string:\n\n\n```javascript\nconst app = require(\"express\")(),\n pg = require(\"pg\"),\n SqlString = require('sqlstring'),\n pool = new pg.Pool(config);\n\napp.get(\"search\", function handler(req, res) {\n // GOOD: the category is escaped using mysql.escape\n var query1 =\n \"SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='\" +\n SqlString.escape(req.params.category) +\n \"' ORDER BY PRICE\";\n pool.query(query1, [], function(err, results) {\n // process results\n });\n});\n\n```\n\n## Example\nIn the following example, an express handler attempts to delete a single document from a MongoDB collection. The document to be deleted is identified by its `_id` field, which is constructed from user input. The user input may contain a query object, so this code is vulnerable to a NoSQL injection attack.\n\n\n```javascript\nconst express = require(\"express\");\nconst mongoose = require(\"mongoose\");\nconst Todo = mongoose.model(\n \"Todo\",\n new mongoose.Schema({ text: { type: String } }, { timestamps: true })\n);\n\nconst app = express();\napp.use(express.json());\napp.use(express.urlencoded({ extended: false }));\n\napp.delete(\"/api/delete\", async (req, res) => {\n let id = req.body.id;\n\n await Todo.deleteOne({ _id: id }); // BAD: id might be an object with special properties\n\n res.json({ status: \"ok\" });\n});\n\n```\nTo fix this vulnerability, we can use the `$eq` operator to ensure that the user input is interpreted as a literal value and not as a query object:\n\n\n```javascript\napp.delete(\"/api/delete\", async (req, res) => {\n let id = req.body.id;\n await Todo.deleteOne({ _id: { $eq: id } }); // GOOD: using $eq operator for the comparison\n\n res.json({ status: \"ok\" });\n});\n```\nAlternatively check that the user input is a literal value and not a query object before using it:\n\n\n```javascript\napp.delete(\"/api/delete\", async (req, res) => {\n let id = req.body.id;\n if (typeof id !== \"string\") {\n res.status(400).json({ status: \"error\" });\n return;\n }\n await Todo.deleteOne({ _id: id }); // GOOD: id is guaranteed to be a string\n\n res.json({ status: \"ok\" });\n});\n\n```\n\n## References\n* Wikipedia: [SQL injection](https://en.wikipedia.org/wiki/SQL_injection).\n* MongoDB: [$eq operator](https://docs.mongodb.com/manual/reference/operator/query/eq).\n* OWASP: [NoSQL injection](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf).\n* Common Weakness Enumeration: [CWE-89](https://cwe.mitre.org/data/definitions/89.html).\n* Common Weakness Enumeration: [CWE-90](https://cwe.mitre.org/data/definitions/90.html).\n* Common Weakness Enumeration: [CWE-943](https://cwe.mitre.org/data/definitions/943.html).\n","markdown":"# Database query built from user-controlled sources\nIf a database query (such as a SQL or NoSQL query) is built from user-provided data without sufficient sanitization, a malicious user may be able to run malicious database queries.\n\n\n## Recommendation\nMost database connector libraries offer a way of safely embedding untrusted data into a query by means of query parameters or prepared statements.\n\nFor NoSQL queries, make use of an operator like MongoDB's `$eq` to ensure that untrusted data is interpreted as a literal value and not as a query object. Alternatively, check that the untrusted data is a literal value and not a query object before using it in a query.\n\nFor SQL queries, use query parameters or prepared statements to embed untrusted data into the query string, or use a library like `sqlstring` to escape untrusted data.\n\n\n## Example\nIn the following example, assume the function `handler` is an HTTP request handler in a web application, whose parameter `req` contains the request object.\n\nThe handler constructs an SQL query string from user input and executes it as a database query using the `pg` library. The user input may contain quote characters, so this code is vulnerable to a SQL injection attack.\n\n\n```javascript\nconst app = require(\"express\")(),\n pg = require(\"pg\"),\n pool = new pg.Pool(config);\n\napp.get(\"search\", function handler(req, res) {\n // BAD: the category might have SQL special characters in it\n var query1 =\n \"SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='\" +\n req.params.category +\n \"' ORDER BY PRICE\";\n pool.query(query1, [], function(err, results) {\n // process results\n });\n});\n\n```\nTo fix this vulnerability, we can use query parameters to embed the user input into the query string. In this example, we use the API offered by the `pg` Postgres database connector library, but other libraries offer similar features. This version is immune to injection attacks.\n\n\n```javascript\nconst app = require(\"express\")(),\n pg = require(\"pg\"),\n pool = new pg.Pool(config);\n\napp.get(\"search\", function handler(req, res) {\n // GOOD: use parameters\n var query2 =\n \"SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY=$1 ORDER BY PRICE\";\n pool.query(query2, [req.params.category], function(err, results) {\n // process results\n });\n});\n\n```\nAlternatively, we can use a library like `sqlstring` to escape the user input before embedding it into the query string:\n\n\n```javascript\nconst app = require(\"express\")(),\n pg = require(\"pg\"),\n SqlString = require('sqlstring'),\n pool = new pg.Pool(config);\n\napp.get(\"search\", function handler(req, res) {\n // GOOD: the category is escaped using mysql.escape\n var query1 =\n \"SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='\" +\n SqlString.escape(req.params.category) +\n \"' ORDER BY PRICE\";\n pool.query(query1, [], function(err, results) {\n // process results\n });\n});\n\n```\n\n## Example\nIn the following example, an express handler attempts to delete a single document from a MongoDB collection. The document to be deleted is identified by its `_id` field, which is constructed from user input. The user input may contain a query object, so this code is vulnerable to a NoSQL injection attack.\n\n\n```javascript\nconst express = require(\"express\");\nconst mongoose = require(\"mongoose\");\nconst Todo = mongoose.model(\n \"Todo\",\n new mongoose.Schema({ text: { type: String } }, { timestamps: true })\n);\n\nconst app = express();\napp.use(express.json());\napp.use(express.urlencoded({ extended: false }));\n\napp.delete(\"/api/delete\", async (req, res) => {\n let id = req.body.id;\n\n await Todo.deleteOne({ _id: id }); // BAD: id might be an object with special properties\n\n res.json({ status: \"ok\" });\n});\n\n```\nTo fix this vulnerability, we can use the `$eq` operator to ensure that the user input is interpreted as a literal value and not as a query object:\n\n\n```javascript\napp.delete(\"/api/delete\", async (req, res) => {\n let id = req.body.id;\n await Todo.deleteOne({ _id: { $eq: id } }); // GOOD: using $eq operator for the comparison\n\n res.json({ status: \"ok\" });\n});\n```\nAlternatively check that the user input is a literal value and not a query object before using it:\n\n\n```javascript\napp.delete(\"/api/delete\", async (req, res) => {\n let id = req.body.id;\n if (typeof id !== \"string\") {\n res.status(400).json({ status: \"error\" });\n return;\n }\n await Todo.deleteOne({ _id: id }); // GOOD: id is guaranteed to be a string\n\n res.json({ status: \"ok\" });\n});\n\n```\n\n## References\n* Wikipedia: [SQL injection](https://en.wikipedia.org/wiki/SQL_injection).\n* MongoDB: [$eq operator](https://docs.mongodb.com/manual/reference/operator/query/eq).\n* OWASP: [NoSQL injection](https://owasp.org/www-pdf-archive/GOD16-NOSQL.pdf).\n* Common Weakness Enumeration: [CWE-89](https://cwe.mitre.org/data/definitions/89.html).\n* Common Weakness Enumeration: [CWE-90](https://cwe.mitre.org/data/definitions/90.html).\n* Common Weakness Enumeration: [CWE-943](https://cwe.mitre.org/data/definitions/943.html).\n"},"properties":{"tags":["security","external/cwe/cwe-089","external/cwe/cwe-090","external/cwe/cwe-943"],"description":"Building a database query from user-controlled sources is vulnerable to insertion of\n malicious code by the user.","id":"js/sql-injection","kind":"path-problem","name":"Database query built from user-controlled sources","precision":"high","problem.severity":"error","security-severity":"8.8"}},{"id":"js/host-header-forgery-in-email-generation","name":"js/host-header-forgery-in-email-generation","shortDescription":{"text":"Host header poisoning in email generation"},"fullDescription":{"text":"Using the HTTP Host header to construct a link in an email can facilitate phishing attacks and leak password reset tokens."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Host header poisoning in email generation\nUsing the HTTP Host header to construct a link in an email can facilitate phishing attacks and leak password reset tokens. A malicious user can send an HTTP request to the targeted web site, but with a Host header that refers to his own web site. This means the emails will be sent out to potential victims, originating from a server they trust, but with links leading to a malicious web site.\n\nIf the email contains a password reset link, and should the victim click the link, the secret reset token will be leaked to the attacker. Using the leaked token, the attacker can then construct the real reset link and use it to change the victim's password.\n\n\n## Recommendation\nObtain the server's host name from a configuration file and avoid relying on the Host header.\n\n\n## Example\nThe following example uses the `req.host` to generate a password reset link. This value is derived from the Host header, and can thus be set to anything by an attacker:\n\n\n```javascript\nlet nodemailer = require('nodemailer');\nlet express = require('express');\nlet backend = require('./backend');\n\nlet app = express();\n\nlet config = JSON.parse(fs.readFileSync('config.json', 'utf8'));\n\napp.post('/resetpass', (req, res) => {\n let email = req.query.email;\n let transport = nodemailer.createTransport(config.smtp);\n let token = backend.getUserSecretResetToken(email);\n transport.sendMail({\n from: 'webmaster@example.com',\n to: email,\n subject: 'Forgot password',\n text: `Click to reset password: https://${req.host}/resettoken/${token}`,\n });\n});\n\n```\nTo ensure the link refers to the correct web site, get the host name from a configuration file:\n\n\n```javascript\nlet nodemailer = require('nodemailer');\nlet express = require('express');\nlet backend = require('./backend');\n\nlet app = express();\n\nlet config = JSON.parse(fs.readFileSync('config.json', 'utf8'));\n\napp.post('/resetpass', (req, res) => {\n let email = req.query.email;\n let transport = nodemailer.createTransport(config.smtp);\n let token = backend.getUserSecretResetToken(email);\n transport.sendMail({\n from: 'webmaster@example.com',\n to: email,\n subject: 'Forgot password',\n text: `Click to reset password: https://${config.hostname}/resettoken/${token}`,\n });\n});\n\n```\n\n## References\n* Mitre: [CWE-640: Weak Password Recovery Mechanism for Forgotten Password](https://cwe.mitre.org/data/definitions/640.html).\n* Ian Muscat: [What is a Host Header Attack?](https://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/).\n* Common Weakness Enumeration: [CWE-640](https://cwe.mitre.org/data/definitions/640.html).\n","markdown":"# Host header poisoning in email generation\nUsing the HTTP Host header to construct a link in an email can facilitate phishing attacks and leak password reset tokens. A malicious user can send an HTTP request to the targeted web site, but with a Host header that refers to his own web site. This means the emails will be sent out to potential victims, originating from a server they trust, but with links leading to a malicious web site.\n\nIf the email contains a password reset link, and should the victim click the link, the secret reset token will be leaked to the attacker. Using the leaked token, the attacker can then construct the real reset link and use it to change the victim's password.\n\n\n## Recommendation\nObtain the server's host name from a configuration file and avoid relying on the Host header.\n\n\n## Example\nThe following example uses the `req.host` to generate a password reset link. This value is derived from the Host header, and can thus be set to anything by an attacker:\n\n\n```javascript\nlet nodemailer = require('nodemailer');\nlet express = require('express');\nlet backend = require('./backend');\n\nlet app = express();\n\nlet config = JSON.parse(fs.readFileSync('config.json', 'utf8'));\n\napp.post('/resetpass', (req, res) => {\n let email = req.query.email;\n let transport = nodemailer.createTransport(config.smtp);\n let token = backend.getUserSecretResetToken(email);\n transport.sendMail({\n from: 'webmaster@example.com',\n to: email,\n subject: 'Forgot password',\n text: `Click to reset password: https://${req.host}/resettoken/${token}`,\n });\n});\n\n```\nTo ensure the link refers to the correct web site, get the host name from a configuration file:\n\n\n```javascript\nlet nodemailer = require('nodemailer');\nlet express = require('express');\nlet backend = require('./backend');\n\nlet app = express();\n\nlet config = JSON.parse(fs.readFileSync('config.json', 'utf8'));\n\napp.post('/resetpass', (req, res) => {\n let email = req.query.email;\n let transport = nodemailer.createTransport(config.smtp);\n let token = backend.getUserSecretResetToken(email);\n transport.sendMail({\n from: 'webmaster@example.com',\n to: email,\n subject: 'Forgot password',\n text: `Click to reset password: https://${config.hostname}/resettoken/${token}`,\n });\n});\n\n```\n\n## References\n* Mitre: [CWE-640: Weak Password Recovery Mechanism for Forgotten Password](https://cwe.mitre.org/data/definitions/640.html).\n* Ian Muscat: [What is a Host Header Attack?](https://www.acunetix.com/blog/articles/automated-detection-of-host-header-attacks/).\n* Common Weakness Enumeration: [CWE-640](https://cwe.mitre.org/data/definitions/640.html).\n"},"properties":{"tags":["security","external/cwe/cwe-640"],"description":"Using the HTTP Host header to construct a link in an email can facilitate phishing\n attacks and leak password reset tokens.","id":"js/host-header-forgery-in-email-generation","kind":"path-problem","name":"Host header poisoning in email generation","precision":"high","problem.severity":"error","security-severity":"9.8"}},{"id":"js/template-object-injection","name":"js/template-object-injection","shortDescription":{"text":"Template Object Injection"},"fullDescription":{"text":"Instantiating a template using a user-controlled object is vulnerable to local file read and potential remote code execution."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Template Object Injection\nDirectly using user-controlled objects as arguments to template engines might allow an attacker to do local file reads or even remote code execution.\n\n\n## Recommendation\nAvoid using user-controlled objects as arguments to a template engine. Instead, construct the object explicitly with the specific properties needed by the template.\n\n\n## Example\nIn the example below a server uses the user-controlled `profile` object to render the `index` template.\n\n\n```javascript\nvar app = require('express')();\napp.set('view engine', 'hbs');\n\napp.post('/', function (req, res, next) {\n var profile = req.body.profile;\n res.render('index', profile);\n});\n```\nHowever, if an attacker adds a `layout` property to the `profile` object then the server will load the file specified by the `layout` property, thereby allowing an attacker to do local file reads.\n\nThe fix is to have the server construct the object, and only add the properties that are needed by the template.\n\n\n```javascript\nvar app = require('express')();\napp.set('view engine', 'hbs');\n\napp.post('/', function (req, res, next) {\n var profile = req.body.profile;\n res.render('index', {\n name: profile.name,\n location: profile.location\n });\n});\n```\n\n## References\n* blog.shoebpatel.com: [The Secret Parameter, LFR, and Potential RCE in NodeJS Apps](https://blog.shoebpatel.com/2021/01/23/The-Secret-Parameter-LFR-and-Potential-RCE-in-NodeJS-Apps/).\n* cwe.mitre.org: [CWE-73: External Control of File Name or Path](https://cwe.mitre.org/data/definitions/73.html)\n* Common Weakness Enumeration: [CWE-73](https://cwe.mitre.org/data/definitions/73.html).\n* Common Weakness Enumeration: [CWE-94](https://cwe.mitre.org/data/definitions/94.html).\n","markdown":"# Template Object Injection\nDirectly using user-controlled objects as arguments to template engines might allow an attacker to do local file reads or even remote code execution.\n\n\n## Recommendation\nAvoid using user-controlled objects as arguments to a template engine. Instead, construct the object explicitly with the specific properties needed by the template.\n\n\n## Example\nIn the example below a server uses the user-controlled `profile` object to render the `index` template.\n\n\n```javascript\nvar app = require('express')();\napp.set('view engine', 'hbs');\n\napp.post('/', function (req, res, next) {\n var profile = req.body.profile;\n res.render('index', profile);\n});\n```\nHowever, if an attacker adds a `layout` property to the `profile` object then the server will load the file specified by the `layout` property, thereby allowing an attacker to do local file reads.\n\nThe fix is to have the server construct the object, and only add the properties that are needed by the template.\n\n\n```javascript\nvar app = require('express')();\napp.set('view engine', 'hbs');\n\napp.post('/', function (req, res, next) {\n var profile = req.body.profile;\n res.render('index', {\n name: profile.name,\n location: profile.location\n });\n});\n```\n\n## References\n* blog.shoebpatel.com: [The Secret Parameter, LFR, and Potential RCE in NodeJS Apps](https://blog.shoebpatel.com/2021/01/23/The-Secret-Parameter-LFR-and-Potential-RCE-in-NodeJS-Apps/).\n* cwe.mitre.org: [CWE-73: External Control of File Name or Path](https://cwe.mitre.org/data/definitions/73.html)\n* Common Weakness Enumeration: [CWE-73](https://cwe.mitre.org/data/definitions/73.html).\n* Common Weakness Enumeration: [CWE-94](https://cwe.mitre.org/data/definitions/94.html).\n"},"properties":{"tags":["security","external/cwe/cwe-073","external/cwe/cwe-094"],"description":"Instantiating a template using a user-controlled object is vulnerable to local file read and potential remote code execution.","id":"js/template-object-injection","kind":"path-problem","name":"Template Object Injection","precision":"high","problem.severity":"error","security-severity":"9.3"}},{"id":"js/zipslip","name":"js/zipslip","shortDescription":{"text":"Arbitrary file access during archive extraction (\"Zip Slip\")"},"fullDescription":{"text":"Extracting files from a malicious ZIP file, or similar type of archive, without validating that the destination file path is within the destination directory can allow an attacker to unexpectedly gain access to resources."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Arbitrary file access during archive extraction (\"Zip Slip\")\nExtracting files from a malicious zip file, or similar type of archive, is at risk of directory traversal attacks if filenames from the archive are not properly validated. archive paths.\n\nZip archives contain archive entries representing each file in the archive. These entries include a file path for the entry, but these file paths are not restricted and may contain unexpected special elements such as the directory traversal element (`..`). If these file paths are used to create a filesystem path, then a file operation may happen in an unexpected location. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.\n\nFor example, if a zip file contains a file entry `..\\sneaky-file`, and the zip file is extracted to the directory `c:\\output`, then naively combining the paths would result in an output file path of `c:\\output\\..\\sneaky-file`, which would cause the file to be written to `c:\\sneaky-file`.\n\n\n## Recommendation\nEnsure that output paths constructed from zip archive entries are validated to prevent writing files to unexpected locations.\n\nThe recommended way of writing an output file from a zip archive entry is to check that `\"..\"` does not occur in the path.\n\n\n## Example\nIn this example an archive is extracted without validating file paths. If `archive.zip` contained relative paths (for instance, if it were created by something like `zip archive.zip ../file.txt`) then executing this code could write to locations outside the destination directory.\n\n\n```javascript\nconst fs = require('fs');\nconst unzip = require('unzip');\n\nfs.createReadStream('archive.zip')\n .pipe(unzip.Parse())\n .on('entry', entry => {\n const fileName = entry.path;\n // BAD: This could write any file on the filesystem.\n entry.pipe(fs.createWriteStream(fileName));\n });\n\n```\nTo fix this vulnerability, we need to check that the path does not contain any `\"..\"` elements in it.\n\n\n```javascript\nconst fs = require('fs');\nconst unzip = require('unzip');\n\nfs.createReadStream('archive.zip')\n .pipe(unzip.Parse())\n .on('entry', entry => {\n const fileName = entry.path;\n // GOOD: ensures the path is safe to write to.\n if (fileName.indexOf('..') == -1) {\n entry.pipe(fs.createWriteStream(fileName));\n }\n else {\n console.log('skipping bad path', fileName);\n }\n });\n\n```\n\n## References\n* Snyk: [Zip Slip Vulnerability](https://snyk.io/research/zip-slip-vulnerability).\n* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).\n* Common Weakness Enumeration: [CWE-22](https://cwe.mitre.org/data/definitions/22.html).\n","markdown":"# Arbitrary file access during archive extraction (\"Zip Slip\")\nExtracting files from a malicious zip file, or similar type of archive, is at risk of directory traversal attacks if filenames from the archive are not properly validated. archive paths.\n\nZip archives contain archive entries representing each file in the archive. These entries include a file path for the entry, but these file paths are not restricted and may contain unexpected special elements such as the directory traversal element (`..`). If these file paths are used to create a filesystem path, then a file operation may happen in an unexpected location. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.\n\nFor example, if a zip file contains a file entry `..\\sneaky-file`, and the zip file is extracted to the directory `c:\\output`, then naively combining the paths would result in an output file path of `c:\\output\\..\\sneaky-file`, which would cause the file to be written to `c:\\sneaky-file`.\n\n\n## Recommendation\nEnsure that output paths constructed from zip archive entries are validated to prevent writing files to unexpected locations.\n\nThe recommended way of writing an output file from a zip archive entry is to check that `\"..\"` does not occur in the path.\n\n\n## Example\nIn this example an archive is extracted without validating file paths. If `archive.zip` contained relative paths (for instance, if it were created by something like `zip archive.zip ../file.txt`) then executing this code could write to locations outside the destination directory.\n\n\n```javascript\nconst fs = require('fs');\nconst unzip = require('unzip');\n\nfs.createReadStream('archive.zip')\n .pipe(unzip.Parse())\n .on('entry', entry => {\n const fileName = entry.path;\n // BAD: This could write any file on the filesystem.\n entry.pipe(fs.createWriteStream(fileName));\n });\n\n```\nTo fix this vulnerability, we need to check that the path does not contain any `\"..\"` elements in it.\n\n\n```javascript\nconst fs = require('fs');\nconst unzip = require('unzip');\n\nfs.createReadStream('archive.zip')\n .pipe(unzip.Parse())\n .on('entry', entry => {\n const fileName = entry.path;\n // GOOD: ensures the path is safe to write to.\n if (fileName.indexOf('..') == -1) {\n entry.pipe(fs.createWriteStream(fileName));\n }\n else {\n console.log('skipping bad path', fileName);\n }\n });\n\n```\n\n## References\n* Snyk: [Zip Slip Vulnerability](https://snyk.io/research/zip-slip-vulnerability).\n* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).\n* Common Weakness Enumeration: [CWE-22](https://cwe.mitre.org/data/definitions/22.html).\n"},"properties":{"tags":["security","external/cwe/cwe-022"],"description":"Extracting files from a malicious ZIP file, or similar type of archive, without\n validating that the destination file path is within the destination directory\n can allow an attacker to unexpectedly gain access to resources.","id":"js/zipslip","kind":"path-problem","name":"Arbitrary file access during archive extraction (\"Zip Slip\")","precision":"high","problem.severity":"error","security-severity":"7.5"}},{"id":"js/path-injection","name":"js/path-injection","shortDescription":{"text":"Uncontrolled data used in path expression"},"fullDescription":{"text":"Accessing paths influenced by users can allow an attacker to access unexpected resources."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Uncontrolled data used in path expression\nAccessing files using paths constructed from user-controlled data can allow an attacker to access unexpected resources. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.\n\n\n## Recommendation\nValidate user input before using it to construct a file path.\n\nThe validation method you should use depends on whether you want to allow the user to specify complex paths with multiple components that may span multiple folders, or only simple filenames without a path component.\n\nIn the former case, a common strategy is to make sure that the constructed file path is contained within a safe root folder. First, normalize the path using `path.resolve` or `fs.realpathSync` to remove any \"..\" segments. You should always normalize the file path since an unnormalized path that starts with the root folder can still be used to access files outside the root folder. Then, after you have normalized the path, check that the path starts with the root folder.\n\nIn the latter case, you can use a library like the `sanitize-filename` npm package to eliminate any special characters from the file path. Note that it is *not* sufficient to only remove \"../\" sequences: for example, applying this filter to \".../...//\" would still result in the string \"../\".\n\nFinally, the simplest (but most restrictive) option is to use an allow list of safe patterns and make sure that the user input matches one of these patterns.\n\n\n## Example\nIn the first (bad) example, the code reads the file name from an HTTP request, then accesses that file within a root folder. A malicious user could enter a file name containing \"../\" segments to navigate outside the root folder and access sensitive files.\n\n\n```javascript\nconst fs = require('fs'),\n http = require('http'),\n url = require('url');\n\nconst ROOT = \"/var/www/\";\n\nvar server = http.createServer(function(req, res) {\n let filePath = url.parse(req.url, true).query.path;\n\n // BAD: This function uses unsanitized input that can read any file on the file system.\n res.write(fs.readFileSync(ROOT + filePath, 'utf8'));\n});\n```\nThe second (good) example shows how to avoid access to sensitive files by sanitizing the file path. First, the code resolves the file name relative to a root folder, normalizing the path and removing any \"../\" segments in the process. Then, the code calls `fs.realpathSync` to resolve any symbolic links in the path. Finally, the code checks that the normalized path starts with the path of the root folder, ensuring the file is contained within the root folder.\n\n\n```javascript\nconst fs = require('fs'),\n http = require('http'),\n path = require('path'),\n url = require('url');\n\nconst ROOT = \"/var/www/\";\n\nvar server = http.createServer(function(req, res) {\n let filePath = url.parse(req.url, true).query.path;\n\n // GOOD: Verify that the file path is under the root directory\n filePath = fs.realpathSync(path.resolve(ROOT, filePath));\n if (!filePath.startsWith(ROOT)) {\n res.statusCode = 403;\n res.end();\n return;\n }\n res.write(fs.readFileSync(filePath, 'utf8'));\n});\n```\n\n## References\n* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).\n* npm: [sanitize-filename](https://www.npmjs.com/package/sanitize-filename) package.\n* Common Weakness Enumeration: [CWE-22](https://cwe.mitre.org/data/definitions/22.html).\n* Common Weakness Enumeration: [CWE-23](https://cwe.mitre.org/data/definitions/23.html).\n* Common Weakness Enumeration: [CWE-36](https://cwe.mitre.org/data/definitions/36.html).\n* Common Weakness Enumeration: [CWE-73](https://cwe.mitre.org/data/definitions/73.html).\n* Common Weakness Enumeration: [CWE-99](https://cwe.mitre.org/data/definitions/99.html).\n","markdown":"# Uncontrolled data used in path expression\nAccessing files using paths constructed from user-controlled data can allow an attacker to access unexpected resources. This can result in sensitive information being revealed or deleted, or an attacker being able to influence behavior by modifying unexpected files.\n\n\n## Recommendation\nValidate user input before using it to construct a file path.\n\nThe validation method you should use depends on whether you want to allow the user to specify complex paths with multiple components that may span multiple folders, or only simple filenames without a path component.\n\nIn the former case, a common strategy is to make sure that the constructed file path is contained within a safe root folder. First, normalize the path using `path.resolve` or `fs.realpathSync` to remove any \"..\" segments. You should always normalize the file path since an unnormalized path that starts with the root folder can still be used to access files outside the root folder. Then, after you have normalized the path, check that the path starts with the root folder.\n\nIn the latter case, you can use a library like the `sanitize-filename` npm package to eliminate any special characters from the file path. Note that it is *not* sufficient to only remove \"../\" sequences: for example, applying this filter to \".../...//\" would still result in the string \"../\".\n\nFinally, the simplest (but most restrictive) option is to use an allow list of safe patterns and make sure that the user input matches one of these patterns.\n\n\n## Example\nIn the first (bad) example, the code reads the file name from an HTTP request, then accesses that file within a root folder. A malicious user could enter a file name containing \"../\" segments to navigate outside the root folder and access sensitive files.\n\n\n```javascript\nconst fs = require('fs'),\n http = require('http'),\n url = require('url');\n\nconst ROOT = \"/var/www/\";\n\nvar server = http.createServer(function(req, res) {\n let filePath = url.parse(req.url, true).query.path;\n\n // BAD: This function uses unsanitized input that can read any file on the file system.\n res.write(fs.readFileSync(ROOT + filePath, 'utf8'));\n});\n```\nThe second (good) example shows how to avoid access to sensitive files by sanitizing the file path. First, the code resolves the file name relative to a root folder, normalizing the path and removing any \"../\" segments in the process. Then, the code calls `fs.realpathSync` to resolve any symbolic links in the path. Finally, the code checks that the normalized path starts with the path of the root folder, ensuring the file is contained within the root folder.\n\n\n```javascript\nconst fs = require('fs'),\n http = require('http'),\n path = require('path'),\n url = require('url');\n\nconst ROOT = \"/var/www/\";\n\nvar server = http.createServer(function(req, res) {\n let filePath = url.parse(req.url, true).query.path;\n\n // GOOD: Verify that the file path is under the root directory\n filePath = fs.realpathSync(path.resolve(ROOT, filePath));\n if (!filePath.startsWith(ROOT)) {\n res.statusCode = 403;\n res.end();\n return;\n }\n res.write(fs.readFileSync(filePath, 'utf8'));\n});\n```\n\n## References\n* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).\n* npm: [sanitize-filename](https://www.npmjs.com/package/sanitize-filename) package.\n* Common Weakness Enumeration: [CWE-22](https://cwe.mitre.org/data/definitions/22.html).\n* Common Weakness Enumeration: [CWE-23](https://cwe.mitre.org/data/definitions/23.html).\n* Common Weakness Enumeration: [CWE-36](https://cwe.mitre.org/data/definitions/36.html).\n* Common Weakness Enumeration: [CWE-73](https://cwe.mitre.org/data/definitions/73.html).\n* Common Weakness Enumeration: [CWE-99](https://cwe.mitre.org/data/definitions/99.html).\n"},"properties":{"tags":["security","external/cwe/cwe-022","external/cwe/cwe-023","external/cwe/cwe-036","external/cwe/cwe-073","external/cwe/cwe-099"],"description":"Accessing paths influenced by users can allow an attacker to access\n unexpected resources.","id":"js/path-injection","kind":"path-problem","name":"Uncontrolled data used in path expression","precision":"high","problem.severity":"error","security-severity":"7.5"}},{"id":"js/clear-text-cookie","name":"js/clear-text-cookie","shortDescription":{"text":"Clear text transmission of sensitive cookie"},"fullDescription":{"text":"Sending sensitive information in a cookie without requring SSL encryption can expose the cookie to an attacker."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Clear text transmission of sensitive cookie\nCookies that are transmitted in clear text can be intercepted by an attacker. If sensitive cookies are intercepted, the attacker can read the cookie and use it to perform actions on the user's behalf.\n\n\n## Recommendation\nAlways transmit sensitive cookies using SSL by setting the `secure` attribute on the cookie.\n\n\n## Example\nThe following example stores an authentication token in a cookie that can be transmitted in clear text.\n\n\n```javascript\nconst http = require('http');\n\nconst server = http.createServer((req, res) => {\n res.setHeader(\"Set-Cookie\", `authKey=${makeAuthkey()}`);\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('
${getUserName(id) || \"Unknown name\"}
`;\n\t// ...\n\tres.send(prefix + userHtml + suffix);\n});\n\n```\nSanitizing the user-controlled data for `\"` helps prevent the vulnerability:\n\n\n```javascript\nvar app = require('express')();\n\napp.get('/user/:id', function(req, res) {\n\tlet id = req.params.id;\n\tid = id.replace(/<|>|&|\"/g, \"\"); // GOOD\n\tlet userHtml = `${getUserName(id) || \"Unknown name\"}
`;\n\t// ...\n\tres.send(prefix + userHtml + suffix);\n});\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [Types of Cross-Site](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n","markdown":"# Incomplete HTML attribute sanitization\nSanitizing untrusted input for HTML meta-characters is a common technique for preventing cross-site scripting attacks. Usually, this is done by escaping `<`, `>`, `&` and `\"`. However, the context in which the sanitized value is used decides the characters that need to be sanitized.\n\nAs a consequence, some programs only sanitize `<` and `>` since those are the most common dangerous characters. The lack of sanitization for `\"` is problematic when an incompletely sanitized value is used as an HTML attribute in a string that later is parsed as HTML.\n\n\n## Recommendation\nSanitize all relevant HTML meta-characters when constructing HTML dynamically, and pay special attention to where the sanitized value is used.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using HTML templates that are explicit about the values they treat as HTML.\n\n\n## Example\nThe following example code writes part of an HTTP request (which is controlled by the user) to an HTML attribute of the server response. The user-controlled value is, however, not sanitized for `\"`. This leaves the website vulnerable to cross-site scripting since an attacker can use a string like `\" onclick=\"alert(42)` to inject JavaScript code into the response.\n\n\n```javascript\nvar app = require('express')();\n\napp.get('/user/:id', function(req, res) {\n\tlet id = req.params.id;\n\tid = id.replace(/<|>/g, \"\"); // BAD\n\tlet userHtml = `${getUserName(id) || \"Unknown name\"}
`;\n\t// ...\n\tres.send(prefix + userHtml + suffix);\n});\n\n```\nSanitizing the user-controlled data for `\"` helps prevent the vulnerability:\n\n\n```javascript\nvar app = require('express')();\n\napp.get('/user/:id', function(req, res) {\n\tlet id = req.params.id;\n\tid = id.replace(/<|>|&|\"/g, \"\"); // GOOD\n\tlet userHtml = `${getUserName(id) || \"Unknown name\"}
`;\n\t// ...\n\tres.send(prefix + userHtml + suffix);\n});\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [Types of Cross-Site](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116","external/cwe/cwe-020"],"description":"Writing incompletely sanitized values to HTML\n attribute strings can lead to a cross-site\n scripting vulnerability.","id":"js/incomplete-html-attribute-sanitization","kind":"path-problem","name":"Incomplete HTML attribute sanitization","precision":"high","problem.severity":"warning","security-severity":"6.1"}},{"id":"js/incomplete-multi-character-sanitization","name":"js/incomplete-multi-character-sanitization","shortDescription":{"text":"Incomplete multi-character sanitization"},"fullDescription":{"text":"A sanitizer that removes a sequence of characters may reintroduce the dangerous sequence."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Incomplete multi-character sanitization\nSanitizing untrusted input is a common technique for preventing injection attacks and other security vulnerabilities. Regular expressions are often used to perform this sanitization. However, when the regular expression matches multiple consecutive characters, replacing it just once can result in the unsafe text reappearing in the sanitized input.\n\nAttackers can exploit this issue by crafting inputs that, when sanitized with an ineffective regular expression, still contain malicious code or content. This can lead to code execution, data exposure, or other vulnerabilities.\n\n\n## Recommendation\nTo prevent this issue, it is highly recommended to use a well-tested sanitization library whenever possible. These libraries are more likely to handle corner cases and ensure effective sanitization.\n\nIf a library is not an option, you can consider alternative strategies to fix the issue. For example, applying the regular expression replacement repeatedly until no more replacements can be performed, or rewriting the regular expression to match single characters instead of the entire unsafe text.\n\n\n## Example\nConsider the following JavaScript code that aims to remove all HTML comment start and end tags:\n\n```javascript\n\nstr.replace(/\n```\n```javascript\nvar input = oModel.getProperty(\"/input\");\njQuery.sap.log.debug(input); // user input is logged as is\n```\n2. A second component sends log entries to a remote URL without further validation.\n```javascript\nconst http = new XMLHttpRequest();\nconst url = \"https://some.remote.server/location\";\nhttp.open(\"POST\", url);\nhttp.send(Log.getLogEntries()[0].message); // log entry is forwarded to a remote URL\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP UI5 Documentation: [namespace `sap/base/Log`](https://sapui5.hana.ondemand.com/sdk/#api/module:sap/base/Log).\n","markdown":"# UI5 Log injection in outbound network request\n\nSending user-controlled log data to a remote URL without further validation may lead to uncontrolled information exposure and to injection vulnerabilities. It may be an indication of malicious backdoor code that has been implanted into an otherwise trusted code base.\n\nUI5 applications can retrieve logs for further processing using `sap/base/Log.getLogEntries`, define custom listeners using `sap/base/Log.addLogListener` or directly display logs using the `sap/ui/vk/Notifications` control.\n\nThis query identifies instances where log entries from user input are forwarded to a remote URL. \n\n## Recommendation\n\nAvoid processing log entries that originate from user-controlled sources. Ensure that any log data is properly sanitized.\n\n## Example\n\nThe following example demonstrates a vulnerable code snippet:\n\n1. The UI5 application logs what the user submitted via the `sap.m.Input` control.\n```xml\n \n```\n```javascript\nvar input = oModel.getProperty(\"/input\");\njQuery.sap.log.debug(input); // user input is logged as is\n```\n2. A second component sends log entries to a remote URL without further validation.\n```javascript\nconst http = new XMLHttpRequest();\nconst url = \"https://some.remote.server/location\";\nhttp.open(\"POST\", url);\nhttp.send(Log.getLogEntries()[0].message); // log entry is forwarded to a remote URL\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP UI5 Documentation: [namespace `sap/base/Log`](https://sapui5.hana.ondemand.com/sdk/#api/module:sap/base/Log).\n"},"properties":{"tags":["security","external/cwe/cwe-117"],"description":"Building log entries from user-controlled sources is vulnerable to\n insertion of forged log entries by a malicious user.","id":"js/ui5-log-injection-to-http","kind":"path-problem","name":"UI5 Log injection in outbound network request","precision":"medium","problem.severity":"warning","security-severity":"6.5"}},{"id":"js/ui5-unsafe-log-access","name":"js/ui5-unsafe-log-access","shortDescription":{"text":"Access to user-controlled UI5 Logs"},"fullDescription":{"text":"Log entries from user-controlled sources should not be further processed."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Access to user-controlled UI5 Logs\n\nProcessing user-controlled log entries can lead to injection vulnerabilities, where an attacker can manipulate user input to affect the application excution.\n\nUI5 applications can retrieve logs for further processing using `sap/base/Log.getLogEntries`, define custom listeners using `sap/base/Log.addLogListener` or directly display logs using the `sap/ui/vk/Notifications` control.\n\nThis query identifies instances where user-controlled log entries are accessed in a UI5 application. \n\n## Recommendation\n\nAvoid accessing log entries that originate from user-controlled sources. Ensure that any log data is properly sanitized.\n\n## Example\n\nThe following example demonstrates a vulnerable code snippet:\n\n1. The UI5 application logs what the user submitted via the `sap.m.Input` control.\n```xml\n \n```\n```javascript\nvar input = oModel.getProperty(\"/input\");\njQuery.sap.log.debug(input); // user input is logged as is\n```\n2. A second component retrieves log entries to further process them.\n```javascript\nlet message = Log.getLogEntries()[0].message; //access to user controlled logs\ndo_smth(message);\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP UI5 Documentation: [namespace `sap/base/Log`](https://sapui5.hana.ondemand.com/sdk/#api/module:sap/base/Log).\n","markdown":"# Access to user-controlled UI5 Logs\n\nProcessing user-controlled log entries can lead to injection vulnerabilities, where an attacker can manipulate user input to affect the application excution.\n\nUI5 applications can retrieve logs for further processing using `sap/base/Log.getLogEntries`, define custom listeners using `sap/base/Log.addLogListener` or directly display logs using the `sap/ui/vk/Notifications` control.\n\nThis query identifies instances where user-controlled log entries are accessed in a UI5 application. \n\n## Recommendation\n\nAvoid accessing log entries that originate from user-controlled sources. Ensure that any log data is properly sanitized.\n\n## Example\n\nThe following example demonstrates a vulnerable code snippet:\n\n1. The UI5 application logs what the user submitted via the `sap.m.Input` control.\n```xml\n \n```\n```javascript\nvar input = oModel.getProperty(\"/input\");\njQuery.sap.log.debug(input); // user input is logged as is\n```\n2. A second component retrieves log entries to further process them.\n```javascript\nlet message = Log.getLogEntries()[0].message; //access to user controlled logs\ndo_smth(message);\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP UI5 Documentation: [namespace `sap/base/Log`](https://sapui5.hana.ondemand.com/sdk/#api/module:sap/base/Log).\n"},"properties":{"tags":["security","external/cwe/cwe-117"],"description":"Log entries from user-controlled sources should not be further processed.","id":"js/ui5-unsafe-log-access","kind":"path-problem","name":"Access to user-controlled UI5 Logs","precision":"medium","problem.severity":"warning","security-severity":"5"}},{"id":"js/ui5-formula-injection","name":"js/ui5-formula-injection","shortDescription":{"text":"UI5 Formula Injection"},"fullDescription":{"text":"Saving data from an uncontrolled remote source using filesystem or local storage leads to disclosure of sensitive information or forgery of entry."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Formula injection\n\nUI5 applications that save local data, fetched from an uncontrolled remote source, into a CSV file format using generic APIs such as [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save) are vulnerable to formula injection, or CSV injection.\n\n## Recommendation\n\n### Escape the leading special characters\n\nCSV cells containing leading special characters such as an equal sign (`=`) may be interpreted as spreadsheet formulas. To prevent them from being interpreted these prefixes should be escaped by surrounding the prefixes with single quotes in order to keep them as literal strings.\n\n### Use a dedicated API function\n\nManual construction of a CSV file using string concatenation is prone to mistakes that can lead to security issues. Instead, a dedicated library function should be used. For example, if the target being exported is a [`sap.m.Table`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.m.Table) and the resulting file is to intended to be opened using a spreadsheet program anyways, then using one of the API functions provided by [`sap.ui.export.Spreadsheet`](https://sapui5.hana.ondemand.com/#/entity/sap.ui.export.Spreadsheet) is the preferred method of achieving the same exporting functionality.\n\n## Example\n\nThe following controller is exporting a CSV file obtained from an event parameter by surrounding it in a pair of semicolons (`;`) as CSV separators.\n\n``` javascript\nsap.ui.define([\n \"sap/ui/core/Controller\",\n \"sap/ui/core/util/File\"\n ], function(Controller, File) {\n return Controller.extend(\"vulnerable.controller.app\", {\n onSomeEvent: function(oEvent) {\n let response = oEvent.getProperty(\"someProperty\").someField;\n let csvRow = \";\" + response + \";\";\n File.save(csvRow, \"someFile\", \"csv\", \"text/csv\", \"utf-8\");\n }\n });\n });\n```\n\n## References\n\n- OWASP: [CSV Injection](https://owasp.org/www-community/attacks/CSV_Injection).\n- Common Weakness Enumeration: [CWE-1236](https://cwe.mitre.org/data/definitions/1236.html).\n- SAP UI5 API Reference: [`sap.ui.export.Spreadsheet`](https://sapui5.hana.ondemand.com/#/entity/sap.ui.export.Spreadsheet).\n- SAP UI5 API Reference: [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save).\n","markdown":"# Formula injection\n\nUI5 applications that save local data, fetched from an uncontrolled remote source, into a CSV file format using generic APIs such as [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save) are vulnerable to formula injection, or CSV injection.\n\n## Recommendation\n\n### Escape the leading special characters\n\nCSV cells containing leading special characters such as an equal sign (`=`) may be interpreted as spreadsheet formulas. To prevent them from being interpreted these prefixes should be escaped by surrounding the prefixes with single quotes in order to keep them as literal strings.\n\n### Use a dedicated API function\n\nManual construction of a CSV file using string concatenation is prone to mistakes that can lead to security issues. Instead, a dedicated library function should be used. For example, if the target being exported is a [`sap.m.Table`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.m.Table) and the resulting file is to intended to be opened using a spreadsheet program anyways, then using one of the API functions provided by [`sap.ui.export.Spreadsheet`](https://sapui5.hana.ondemand.com/#/entity/sap.ui.export.Spreadsheet) is the preferred method of achieving the same exporting functionality.\n\n## Example\n\nThe following controller is exporting a CSV file obtained from an event parameter by surrounding it in a pair of semicolons (`;`) as CSV separators.\n\n``` javascript\nsap.ui.define([\n \"sap/ui/core/Controller\",\n \"sap/ui/core/util/File\"\n ], function(Controller, File) {\n return Controller.extend(\"vulnerable.controller.app\", {\n onSomeEvent: function(oEvent) {\n let response = oEvent.getProperty(\"someProperty\").someField;\n let csvRow = \";\" + response + \";\";\n File.save(csvRow, \"someFile\", \"csv\", \"text/csv\", \"utf-8\");\n }\n });\n });\n```\n\n## References\n\n- OWASP: [CSV Injection](https://owasp.org/www-community/attacks/CSV_Injection).\n- Common Weakness Enumeration: [CWE-1236](https://cwe.mitre.org/data/definitions/1236.html).\n- SAP UI5 API Reference: [`sap.ui.export.Spreadsheet`](https://sapui5.hana.ondemand.com/#/entity/sap.ui.export.Spreadsheet).\n- SAP UI5 API Reference: [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save).\n"},"properties":{"tags":["security","external/cwe/cwe-1236"],"description":"Saving data from an uncontrolled remote source using filesystem or local storage\n leads to disclosure of sensitive information or forgery of entry.","id":"js/ui5-formula-injection","kind":"path-problem","name":"UI5 Formula Injection","precision":"medium","problem.severity":"error","security-severity":"7.8"}},{"id":"js/ui5-xss","name":"js/ui5-xss","shortDescription":{"text":"UI5 Client-side cross-site scripting"},"fullDescription":{"text":"Writing user input directly to a UI5 View allows for a cross-site scripting vulnerability."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Client-side cross-site scripting\n\nReceiving text from the user, most notably through a control, and rendering it as HTML in another control can lead to a cross-site scripting vulnerability.\n\n## Recommendation\n\n### Preventing XSS Involving User Defined Control\n\nIf the XSS attack vector includes a user-defined control, then we can mitigate the issue by sanitizing the user-provided input in the implementation of the control:\n- Where possible, define the property type to something other than `string` or `any`. If a value should be used, then opt for the `enum` type which only allows a predefined set of strings.\n- Use escaping functions in `sap.base.security`. Relevant sanitizers include `encodeXML` and `encodeHTML`.\n- When using API with `apiVersion: 2` (Semantic Rendering), do not use `RenderManager.unsafeHtml` unless the control property `sanitizeContent` is set to `true`.\n- When using the now-deprecated older API with `RenderManager.write` or `RenderManager.writeAttribute`, use their respective counterparts `RenderManager.writeEscaped` and `RenderManager.writeAttributeEscaped` which sanitizes their rendered contents.\n\n### Preventing XSS Not Involving User Defined Control\n\nAn XSS attack vector can still exist even when no user-defined control is used. In this case, a model property or a control property act as an intermediate step when external data is passed in.\nIn this case, the UI5 application should not use the property as is, but should sanitize the contents before reading it. Such sanitization can take place in the controller or in the view declaration using expression bindings.\n\n## Example\n\n### Custom Control with Custom Rendering Method\n\nThis custom control `vulnerable.control.xss` calls `unsafeHtml` on a given `RenderManager` instance in its static renderer function. Since its `text` property is an unrestricted string type, it can point to a string with contents that can be interpreted as HTML. If it is the case, `unsafeHtml` will render the string, running a possibly embedded JavaScript code in it.\n\n```javascript\nsap.ui.define([\"sap/ui/core/Control\"], function (Control) {\n return Control.extend(\"vulnerable.control.xss\", {\n metadata: { properties: { text: { type: \"string\" } } },\n renderer: {\n apiVersion: 2,\n render: function (oRm, oControl) {\n oRm.openStart(\"div\", oControl);\n oRm.unsafeHtml(oControl.getText()); // sink\n oRm.close(\"div\");\n }\n }\n });\n})\n```\n\nThis is the same custom control without the possibility of XSS using several means of sanitization: The property `text` is enforced to a non-string type, hence disallows unrestricted strings (This is espcially applicable if the expected input is a number anyways). Also, the `sap.base.security.encodeXML` function is used to escape HTML control characters.\n\n```javascript\nsap.ui.define([\"sap/ui/core/Control\", \"sap/base/security/encodeXML\"], function (Control, encodeXML) {\n return Control.extend(\"vulnerable.control.xss\", {\n metadata: { properties: { text: { type: \"int\" } } }, // constrain the type\n renderer: {\n apiVersion: 2,\n render: function (oRm, oControl) {\n oRm.openStart(\"div\", oControl);\n oRm.unsafeHtml(encodeXML(oControl.getText()); // encode using security functions\n oRm.close(\"div\");\n }\n }\n });\n})\n```\n\n### Library Control\n\nThis example contains only library controls that are not user-defined. The untrusted user input flows from `sap.m.Input` and directly flows out via `sap.ui.core.HTML` through the model property `input` as declared in the `onInit` method of the controller.\n\n``` xml\n\" + clientData + \"
\");\n$.response.status = $.net.http.OK;\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Cross-Site Scripting\n](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/0e1c9fff826a4583be715386578fffc7.html).\n* OWASP: [Types of Cross-site Scripting](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* OWASP: [Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n\n","markdown":"# Reflected Cross-site Scripting\n\nIncluding a text, received from a client browser typically through an XSJS request parameter, to be rendered as HTML in a request body may execute arbitrary JavaScript code on the client.\n\n## Recommendation\n\nThe XSJS application should always validate or sanitize the submitted string from a client before including it into a response body to be rendered in a client browser.\n\n### Validate the input string\n\nValidate the submitted input by looking for a sensitive HTML tag such as ``. The pattern may be encoded to a regular expression and matched against the input; If there is a match, then the XSJS application may decide to abort the process and instead return an HTTP code stating that the application rejected the request (e.g. `$.net.FORBIDDEN`). XSJS does not provide a function to reliably perform the above, therefore using a third-party library is recommended.\n\n### Sanitize the input string\n\n#### Server-side sanitization\n\nThe XSJS application may instead allow any user input, but sanitize it before it integrates it into the response body. This is achieved by escaping special characters that are treated as part of the HTML syntax, such as `\"`, `&`, `'`, `<`, and `>`. Since XSJS does not provide a function to escape these, using a third-party library is recommended.\n\n#### Client-side sanitization\n\nAlternatively, if SAP UI5 is used on the frontend, there are client-side escaping mechanisms such as `sap.base.security.encodeXML` and `sap.base.security.encodeHTML`. If `sap.ui.core.HTML` is used in the frontend view, consider setting its `sanitizeContent` property explicitly to `true`, since its default value is `false`.\n\n## Example\n\nThe following XSJS application sets the response body directly to a string received from a user without any validation or sanitization. The header's content type is set as an HTML document, which allows for any embedded JavaScript to be run in the request body. Note that even if `clientData` was not enclosed in a `div`, the vulnerability would still exist.\n\n``` javascript\nlet clientData = requestParameters.get(\"someParameter\");\n$.response.contentType = \"text/html\";\n$.response.setBody(\"\" + clientData + \"
\");\n$.response.status = $.net.http.OK;\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Cross-Site Scripting\n](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/0e1c9fff826a4583be715386578fffc7.html).\n* OWASP: [Types of Cross-site Scripting](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* OWASP: [Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n\n"},"properties":{"tags":["security"],"description":"Including uncontrolled value into a response body and setting it to\n a scriptable MIME type allows for cross-site scripting vulnerability.","id":"js/xsjs-reflected-xss","kind":"path-problem","name":"XSJS Reflected XSS","precision":"medium","problem.severity":"error","security-severity":"7.8"}},{"id":"js/xsjs-url-redirect","name":"js/xsjs-url-redirect","shortDescription":{"text":"XSJS URL Redirect"},"fullDescription":{"text":"Setting the `location` response header to an uncontrolled value allows for redirection to an arbitrary URL."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# URL Redirect\n\nAn HTTP response sent by an XSJS server whose value of the `location` header is dependent on a user input can redirect the client to an arbitrary location on the web by a malicious actor. For example, the redirected URL may point to a carefully imitated webpage of a genuine one, thus may lure a victim to submit its sign-in credentials.\n\n## Recommendation\n\nAvoid setting the entirety of URL or the domain part of it, which is obtained in any way from an external user, to the `location` header value, to keep redirection within the organization's domain. The URL to redirect the user to may be safely restricted by following one or more of the below strategies.\n\n### Redirect to a URL from an internal allow-list\n\nSelect the URL from a predefined allow-list that is kept internal. It may be shared across organizations, but should be kept confidential to any external actors.\n\n### Hardcode the domain part of the URL\n\nIf the URL to redirect the user to needs to be dependent upon a remote value, consider parameterizing only the request parameter portion and hardcode the rest of it, including the domain part. This way the redirection is kept within the organization.\n\n### Use a server-side template engine\n\nThere can be a single URL to which all redirection of the same type can happen where the redirected page can be customized to the customer with the help from a template engine. The details of the page can be filled from the server-side, not the client side through a request parameter. This way the URL does not need to be parameterized in any way while also filling the need for a customized redirect page.\n\n## Example\n\nThe following XSJS application sets the entire value of the location of its response to some URL retrieved from a request parameter.\n\n``` javascript\nlet someParameterValue = requestParameters.get(\"someParameter\");\n$.response.status = $.net.http.OK;\n$.response.headers.set(\"location\", someParameterValue);\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Invalid Redirection](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/8c5ec75c27f543cb8b4c65c337b285ae.html).\n* Mozilla: [Location](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Location).\n* OWASP: [XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-601](https://cwe.mitre.org/data/definitions/601.html).\n* SAP XSJS Documentation: [$.web.WebRequest](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.web.WebRequest.html).\n* SAP XSJS Documentation: [$.web.WebResponse](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.web.WebResponse.html).\n","markdown":"# URL Redirect\n\nAn HTTP response sent by an XSJS server whose value of the `location` header is dependent on a user input can redirect the client to an arbitrary location on the web by a malicious actor. For example, the redirected URL may point to a carefully imitated webpage of a genuine one, thus may lure a victim to submit its sign-in credentials.\n\n## Recommendation\n\nAvoid setting the entirety of URL or the domain part of it, which is obtained in any way from an external user, to the `location` header value, to keep redirection within the organization's domain. The URL to redirect the user to may be safely restricted by following one or more of the below strategies.\n\n### Redirect to a URL from an internal allow-list\n\nSelect the URL from a predefined allow-list that is kept internal. It may be shared across organizations, but should be kept confidential to any external actors.\n\n### Hardcode the domain part of the URL\n\nIf the URL to redirect the user to needs to be dependent upon a remote value, consider parameterizing only the request parameter portion and hardcode the rest of it, including the domain part. This way the redirection is kept within the organization.\n\n### Use a server-side template engine\n\nThere can be a single URL to which all redirection of the same type can happen where the redirected page can be customized to the customer with the help from a template engine. The details of the page can be filled from the server-side, not the client side through a request parameter. This way the URL does not need to be parameterized in any way while also filling the need for a customized redirect page.\n\n## Example\n\nThe following XSJS application sets the entire value of the location of its response to some URL retrieved from a request parameter.\n\n``` javascript\nlet someParameterValue = requestParameters.get(\"someParameter\");\n$.response.status = $.net.http.OK;\n$.response.headers.set(\"location\", someParameterValue);\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Invalid Redirection](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/8c5ec75c27f543cb8b4c65c337b285ae.html).\n* Mozilla: [Location](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Location).\n* OWASP: [XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-601](https://cwe.mitre.org/data/definitions/601.html).\n* SAP XSJS Documentation: [$.web.WebRequest](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.web.WebRequest.html).\n* SAP XSJS Documentation: [$.web.WebResponse](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.web.WebResponse.html).\n"},"properties":{"tags":["security"],"description":"Setting the `location` response header to an uncontrolled value\n allows for redirection to an arbitrary URL.","id":"js/xsjs-url-redirect","kind":"path-problem","name":"XSJS URL Redirect","precision":"medium","problem.severity":"error","security-severity":"6.1"}},{"id":"js/xsjs-sql-injection","name":"js/xsjs-sql-injection","shortDescription":{"text":"XSJS SQL injection"},"fullDescription":{"text":"Directly concatenating an uncontrolled value with an SQL query allows for an SQL injection vulnerability."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# SQL Injection\n\nParameterizing an SQL statement in an unsafe way by directly concatenating the parameter to the statement body may allow arbitrary SQL code fragments to be included to the statement, resulting in possibly destructive behavior.\n\n## Recommendation\n\n### Use XSJS APIs that prepares SQL statements\n\nThere are two versions of API to communicate with SAP HANA, and both APIs provide means of preparing SQL statements that not only facilitates code reuse but also protects the parameterize statement from SQL injections.\n\nThese functions take as first argument an SQL string with placeholders represented as a question mark surrounded with parentheses (`(?)`), and the rest of the arguments consist of JavaScript expressions whose values are filled into the position of the respective placeholders.\n\n#### Using the older API (`$.db`)\n\nIf you are using the older API that belongs to `$.db`, consider replacing string concatentation with `$.db.executeQuery`. For example, the following XSJS application substitutes the value of `someParameterValue1` and `someParameterValue2` into the position of the first and second placeholder positions, respectively.\n\n``` javascript\nlet query = \"INSERT INTO (?) (COL1) VALUES (?)\";\n\nlet dbConnection = $.db.getConnection();\ndbConnection.executeQuery(query, someParameterValue1, someParameterValue2);\n```\n\n#### Using the newer API (`$.hdb`)\n\nIf you are using the newer API that belongs to `$.hdb`, consider replacing string concatentation with `$.hdb.Connection.prepareStatement` followed by `$.db.PreparedStatement.executeUpdate`. For example, the following XSJS application substitues the value of `someParameterValue1` and `someParameterValue2` into the position of the first and second placeholder positions, respectively. After preparation, the application executes the prepared statement and then commits it to the SAP HANA database.\n\n``` javascript\nlet query = \"INSERT INTO (?) (COL1) VALUES (?)\";\nlet dbConnection = $.db.getConnection();\nlet preparedStatement = dbConnection.prepareStatement(query, someParameterValue1, someParameterValue2);\npreparedStatement.executeUpdate();\ndbConnection.commit();\n```\n\n## Example\n\nEach of the following XSJS applications directly concatenates the values of two request paremeters with fragments of an SQL query and executes it.\n\n#### Using the older API (`$.db`)\n\n``` javascript\nlet someParameterValue1 = JSON.parse(requestParameters.get(\"someParameter1\"));\nlet someParameterValue2 = JSON.parse(requestParameters.get(\"someParameter2\"));\nlet query = \"INSERT INTO \" + someParameterValue1 + \".ENTITY (COL1) VALUES (\" + someParameterValue2 + \")\";\n\nlet dbConnection = $.db.getConnection();\nlet preparedStatement = dbConnection.prepareStatement(query);\npreparedStatement.executeUpdate();\ndbConnection.commit();\n```\n\n#### Using the newer API (`$.hdb`)\n\n``` javascript\nlet someParameterValue1 = JSON.parse(requestParameters.get(\"someParameter1\"));\nlet someParameterValue2 = JSON.parse(requestParameters.get(\"someParameter2\"));\nlet query = \"INSERT INTO \" + someParameterValue1 + \" (COL1) VALUES (\" + someParameterValue2 + \")\";\n\nlet dbConnection = $.db.getConnection();\ndbConnection.executeQuery(query);\ndbConnection.commit();\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Injection Flaws\n](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/3e9a0491d2af4b908081fbbee12bc8ba.html).\n* OWASP: [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection).\n* Common Weakness Enumeration: [CWE-89](https://cwe.mitre.org/data/definitions/89.html).\n* Common Weakness Enumeration: [CWE-943](https://cwe.mitre.org/data/definitions/943.html).\n","markdown":"# SQL Injection\n\nParameterizing an SQL statement in an unsafe way by directly concatenating the parameter to the statement body may allow arbitrary SQL code fragments to be included to the statement, resulting in possibly destructive behavior.\n\n## Recommendation\n\n### Use XSJS APIs that prepares SQL statements\n\nThere are two versions of API to communicate with SAP HANA, and both APIs provide means of preparing SQL statements that not only facilitates code reuse but also protects the parameterize statement from SQL injections.\n\nThese functions take as first argument an SQL string with placeholders represented as a question mark surrounded with parentheses (`(?)`), and the rest of the arguments consist of JavaScript expressions whose values are filled into the position of the respective placeholders.\n\n#### Using the older API (`$.db`)\n\nIf you are using the older API that belongs to `$.db`, consider replacing string concatentation with `$.db.executeQuery`. For example, the following XSJS application substitutes the value of `someParameterValue1` and `someParameterValue2` into the position of the first and second placeholder positions, respectively.\n\n``` javascript\nlet query = \"INSERT INTO (?) (COL1) VALUES (?)\";\n\nlet dbConnection = $.db.getConnection();\ndbConnection.executeQuery(query, someParameterValue1, someParameterValue2);\n```\n\n#### Using the newer API (`$.hdb`)\n\nIf you are using the newer API that belongs to `$.hdb`, consider replacing string concatentation with `$.hdb.Connection.prepareStatement` followed by `$.db.PreparedStatement.executeUpdate`. For example, the following XSJS application substitues the value of `someParameterValue1` and `someParameterValue2` into the position of the first and second placeholder positions, respectively. After preparation, the application executes the prepared statement and then commits it to the SAP HANA database.\n\n``` javascript\nlet query = \"INSERT INTO (?) (COL1) VALUES (?)\";\nlet dbConnection = $.db.getConnection();\nlet preparedStatement = dbConnection.prepareStatement(query, someParameterValue1, someParameterValue2);\npreparedStatement.executeUpdate();\ndbConnection.commit();\n```\n\n## Example\n\nEach of the following XSJS applications directly concatenates the values of two request paremeters with fragments of an SQL query and executes it.\n\n#### Using the older API (`$.db`)\n\n``` javascript\nlet someParameterValue1 = JSON.parse(requestParameters.get(\"someParameter1\"));\nlet someParameterValue2 = JSON.parse(requestParameters.get(\"someParameter2\"));\nlet query = \"INSERT INTO \" + someParameterValue1 + \".ENTITY (COL1) VALUES (\" + someParameterValue2 + \")\";\n\nlet dbConnection = $.db.getConnection();\nlet preparedStatement = dbConnection.prepareStatement(query);\npreparedStatement.executeUpdate();\ndbConnection.commit();\n```\n\n#### Using the newer API (`$.hdb`)\n\n``` javascript\nlet someParameterValue1 = JSON.parse(requestParameters.get(\"someParameter1\"));\nlet someParameterValue2 = JSON.parse(requestParameters.get(\"someParameter2\"));\nlet query = \"INSERT INTO \" + someParameterValue1 + \" (COL1) VALUES (\" + someParameterValue2 + \")\";\n\nlet dbConnection = $.db.getConnection();\ndbConnection.executeQuery(query);\ndbConnection.commit();\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Injection Flaws\n](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/3e9a0491d2af4b908081fbbee12bc8ba.html).\n* OWASP: [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection).\n* Common Weakness Enumeration: [CWE-89](https://cwe.mitre.org/data/definitions/89.html).\n* Common Weakness Enumeration: [CWE-943](https://cwe.mitre.org/data/definitions/943.html).\n"},"properties":{"tags":["security"],"description":"Directly concatenating an uncontrolled value with an SQL query allows\n for an SQL injection vulnerability.","id":"js/xsjs-sql-injection","kind":"path-problem","name":"XSJS SQL injection","precision":"medium","problem.severity":"error","security-severity":"8.8"}},{"id":"js/xsjs-zip-slip","name":"js/xsjs-zip-slip","shortDescription":{"text":"XSJS Zip Slip"},"fullDescription":{"text":"Saving an entry of a zip archive into a file with its stated path allows for a path traversal and writing to an arbitrary location."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Zip Slip\n\nA zip archive received from a remote location may contain arbitrary paths which, when translated to an absolute path, may escape the directory where it is extracted. Such paths may include one or more `../` to traverse the directory tree upwards to write to an arbitrary location, such as the root directory (`/`) or a sensitive path like `/usr/local/`. A sophisticated attack may also attempt to overwrite an existing file by making the filename identical as that of the target file.\n\n## Recommendation\n\nValidate the path of each zip entry before writing them to a file. Several different tactics may be used to prevent the path traversal by one or more of `../` occuring in a zip entry's path.\n\n### Check if the path string contains `../`\n\nA naive but effective way to validate the path of a zip entry is to check if its path, converted to string, contains any occurrences of `../`. If a path does have one, then it can be suspected that the creator of the zip archive is attempting a path traversal attack.\n\n### Resolve the path and check if the target directory is its prefix \n\nA more sophisticated way is to use a JavaScript library function that can be used to check if a substring is a prefix of a string. For example, the following XSJS application uses `String.indexOf(substring)` to check if the name of the directory is indeed the directory resolved by `path.join(prefix, suffix)`. If the absolute path obtained by the `join` function does not start with the target folder's name, the `entryPath` contains bits such as `../` that traverses the path.\n\n``` javascript\nvar zipArchive = new $.util.Zip(requestBody.asArrayBuffer());\nvar targetFolderName = \"unzipped\";\n\nfor (var entryPath in zipArchive) {\n var targetFilePath = require(\"path\").join(targetFolderName, entryPath)\n if (targetFilePath.indexOf(targetFolderName) === 0) {\n require(\"fs\").createWriteStream(targetFilePath).write(zip[entryPath]);\n }\n}\n```\n\n### Example\n\nThis XSJS application simply appends the path of each entry to a target directory name and a separator then saves it to a file with the concatenated path, thereby skipping any validation on it.\n\n``` javascript\nvar zipArchive = new $.util.Zip(requestBody.asArrayBuffer());\nvar targetFolderName = \"unzipped\";\n\nfor (var entryPath in zipArchive) {\n var targetFilePath = targetFolderName + \"/\" + entryPath;\n require(\"fs\").createWriteStream(targetFilePath).write(zip[entryPath]);\n}\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).\n* SAP XSJS Documentation: [$.util.Zip](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.util.Zip.html).\n* Common Weakness Enumeration: [CWE-23](https://cwe.mitre.org/data/definitions/23.html).\n* Common Weakness Enumeration: [CWE-59](https://cwe.mitre.org/data/definitions/59.html).\n","markdown":"# Zip Slip\n\nA zip archive received from a remote location may contain arbitrary paths which, when translated to an absolute path, may escape the directory where it is extracted. Such paths may include one or more `../` to traverse the directory tree upwards to write to an arbitrary location, such as the root directory (`/`) or a sensitive path like `/usr/local/`. A sophisticated attack may also attempt to overwrite an existing file by making the filename identical as that of the target file.\n\n## Recommendation\n\nValidate the path of each zip entry before writing them to a file. Several different tactics may be used to prevent the path traversal by one or more of `../` occuring in a zip entry's path.\n\n### Check if the path string contains `../`\n\nA naive but effective way to validate the path of a zip entry is to check if its path, converted to string, contains any occurrences of `../`. If a path does have one, then it can be suspected that the creator of the zip archive is attempting a path traversal attack.\n\n### Resolve the path and check if the target directory is its prefix \n\nA more sophisticated way is to use a JavaScript library function that can be used to check if a substring is a prefix of a string. For example, the following XSJS application uses `String.indexOf(substring)` to check if the name of the directory is indeed the directory resolved by `path.join(prefix, suffix)`. If the absolute path obtained by the `join` function does not start with the target folder's name, the `entryPath` contains bits such as `../` that traverses the path.\n\n``` javascript\nvar zipArchive = new $.util.Zip(requestBody.asArrayBuffer());\nvar targetFolderName = \"unzipped\";\n\nfor (var entryPath in zipArchive) {\n var targetFilePath = require(\"path\").join(targetFolderName, entryPath)\n if (targetFilePath.indexOf(targetFolderName) === 0) {\n require(\"fs\").createWriteStream(targetFilePath).write(zip[entryPath]);\n }\n}\n```\n\n### Example\n\nThis XSJS application simply appends the path of each entry to a target directory name and a separator then saves it to a file with the concatenated path, thereby skipping any validation on it.\n\n``` javascript\nvar zipArchive = new $.util.Zip(requestBody.asArrayBuffer());\nvar targetFolderName = \"unzipped\";\n\nfor (var entryPath in zipArchive) {\n var targetFilePath = targetFolderName + \"/\" + entryPath;\n require(\"fs\").createWriteStream(targetFilePath).write(zip[entryPath]);\n}\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).\n* SAP XSJS Documentation: [$.util.Zip](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.util.Zip.html).\n* Common Weakness Enumeration: [CWE-23](https://cwe.mitre.org/data/definitions/23.html).\n* Common Weakness Enumeration: [CWE-59](https://cwe.mitre.org/data/definitions/59.html).\n"},"properties":{"tags":["security"],"description":"Saving an entry of a zip archive into a file with its stated path\n allows for a path traversal and writing to an arbitrary location.","id":"js/xsjs-zip-slip","kind":"path-problem","name":"XSJS Zip Slip","precision":"medium","problem.severity":"error","security-severity":"7.5"}},{"id":"js/xsjs-disabled-csrf-protection","name":"js/xsjs-disabled-csrf-protection","shortDescription":{"text":"Disabled XSJS CSRF protection"},"fullDescription":{"text":"Disabling CSRF protection makes the application vulnerable to a Cross-Site Request Forgery (CSRF) attack."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# CSRF protection disabled in HANA XS application\n\nThis XS application is not protected against CSRF (cross-site request forgery) because it either disables the protection or fails to enable the protection explicitly.\n\n## Overview\n\nA web server that receives a request from a client without verifying that it was intentionally sent might be vulnerable to Cross Site Request Forgery (CSRF). An attacker can trick a client into making an unintended request to the web server that will be treated as an authentic request. This can be done via a URL, image load, `XMLHttpRequest`, etc. and can result in exposure of data or unintended code execution.\n\n## Recommendation\n\nSAP’s recommendation is to use CSRF protection for any request that could be processed by a browser client by normal users.\n- If `XS Advanced` is used, CSRF protection is configured with the `\"csrfProtection\"` property of `xs-app.json`. It is **enabled by default and should not be disabled.**\n- If `XS Classic` is used, CSRF protection is configured with the `\"prevent_xsrf\"` property of `.xsaccess`. It is **disabled by default and should be enabled explicitly.**\n\n## Example\n\nThe following `xs-app.json` fragment disables CSRF protection of the application it configures.\n\n```json\n\"routes\": [\n {\n \"source\": \"/bad/(.*)\",\n \"destination\": \"srv_api\",\n \"csrfProtection\": false,\n ...\n },\n ...\n]\n```\n\n## References\n\n- SAP: [XS Advanced Application Router Configuration Syntax](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03#loioa9fc5c220d744180850996e2f5d34d6c__section_N101F7_N10016_N10001), relavant to XS Classic applications.\n- SAP: [Application-Access File Keyword Options, prevent_xsrf](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod), relevant to XS Advanced applications.\n- SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/e8a6bc904c0c48a182288604f467e84a.html).\n- Common Weakness Enumeration: [CWE-352](https://cwe.mitre.org/data/definitions/352.html).\n- OWASP: [Cross-Site Request Forgery (CSRF)](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)).\n","markdown":"# CSRF protection disabled in HANA XS application\n\nThis XS application is not protected against CSRF (cross-site request forgery) because it either disables the protection or fails to enable the protection explicitly.\n\n## Overview\n\nA web server that receives a request from a client without verifying that it was intentionally sent might be vulnerable to Cross Site Request Forgery (CSRF). An attacker can trick a client into making an unintended request to the web server that will be treated as an authentic request. This can be done via a URL, image load, `XMLHttpRequest`, etc. and can result in exposure of data or unintended code execution.\n\n## Recommendation\n\nSAP’s recommendation is to use CSRF protection for any request that could be processed by a browser client by normal users.\n- If `XS Advanced` is used, CSRF protection is configured with the `\"csrfProtection\"` property of `xs-app.json`. It is **enabled by default and should not be disabled.**\n- If `XS Classic` is used, CSRF protection is configured with the `\"prevent_xsrf\"` property of `.xsaccess`. It is **disabled by default and should be enabled explicitly.**\n\n## Example\n\nThe following `xs-app.json` fragment disables CSRF protection of the application it configures.\n\n```json\n\"routes\": [\n {\n \"source\": \"/bad/(.*)\",\n \"destination\": \"srv_api\",\n \"csrfProtection\": false,\n ...\n },\n ...\n]\n```\n\n## References\n\n- SAP: [XS Advanced Application Router Configuration Syntax](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03#loioa9fc5c220d744180850996e2f5d34d6c__section_N101F7_N10016_N10001), relavant to XS Classic applications.\n- SAP: [Application-Access File Keyword Options, prevent_xsrf](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod), relevant to XS Advanced applications.\n- SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/e8a6bc904c0c48a182288604f467e84a.html).\n- Common Weakness Enumeration: [CWE-352](https://cwe.mitre.org/data/definitions/352.html).\n- OWASP: [Cross-Site Request Forgery (CSRF)](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)).\n"},"properties":{"tags":["security","external/cwe/cwe-352"],"description":"Disabling CSRF protection makes the application vulnerable to a Cross-Site Request Forgery (CSRF) attack.","id":"js/xsjs-disabled-csrf-protection","kind":"problem","name":"Disabled XSJS CSRF protection","precision":"high","problem.severity":"error","security-severity":"8.8"}}],"locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/xsjs/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/xsjs/src/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"advanced-security/javascript-sap-xsjs-models","semanticVersion":"2.3.0","locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/.github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/.github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}],"properties":{"isCodeQLModelPack":true}}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/codeStyles/codeStyleConfig.xml","uriBaseId":"%SRCROOT%","index":4}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-419af57a6ca03c33e081f24fe025fd9562eb8de8ad926dd10c59ce86d3bfee92/node_modules/@sap/cds-dk/node_modules/xml-js/bin/test.xml","uriBaseId":"%SRCROOT%","index":5}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/inspectionProfiles/Project_Default.xml","uriBaseId":"%SRCROOT%","index":6}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/codeStyles/Project.xml","uriBaseId":"%SRCROOT%","index":7}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/vcs.xml","uriBaseId":"%SRCROOT%","index":8}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/modules.xml","uriBaseId":"%SRCROOT%","index":9}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/xml-js/bin/test.xml","uriBaseId":"%SRCROOT%","index":10}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/codeql-config.yaml","uriBaseId":"%SRCROOT%","index":11}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":12}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":13}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":14}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/ui5.model.yml","uriBaseId":"%SRCROOT%","index":15}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":16}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/xsjs.model.yml","uriBaseId":"%SRCROOT%","index":17}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/additional-sources.model.yml","uriBaseId":"%SRCROOT%","index":18}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":19}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":20}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/cds-extractor-dist-bundle.yml","uriBaseId":"%SRCROOT%","index":21}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/code_scanning.yml","uriBaseId":"%SRCROOT%","index":22}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/codeql-ql.yml","uriBaseId":"%SRCROOT%","index":23}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/run-codeql-unit-tests-javascript.yml","uriBaseId":"%SRCROOT%","index":24}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/update-codeql.yml","uriBaseId":"%SRCROOT%","index":25}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"cds-extractor-marker.js","uriBaseId":"%SRCROOT%","index":26}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"codeql-workspace.yml","uriBaseId":"%SRCROOT%","index":27}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/codeql-extractor.yml","uriBaseId":"%SRCROOT%","index":28}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/.prettierrc.js","uriBaseId":"%SRCROOT%","index":29}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/cds-extractor.ts","uriBaseId":"%SRCROOT%","index":30}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/esbuild.config.mjs","uriBaseId":"%SRCROOT%","index":31}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/eslint.config.mjs","uriBaseId":"%SRCROOT%","index":32}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/dist/cds-extractor.bundle.js","uriBaseId":"%SRCROOT%","index":33}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/jest.config.js","uriBaseId":"%SRCROOT%","index":34}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/package-lock.json","uriBaseId":"%SRCROOT%","index":35}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/package.json","uriBaseId":"%SRCROOT%","index":36}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/command.ts","uriBaseId":"%SRCROOT%","index":37}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/compile.ts","uriBaseId":"%SRCROOT%","index":38}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/graph.ts","uriBaseId":"%SRCROOT%","index":39}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/index.ts","uriBaseId":"%SRCROOT%","index":40}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/project.ts","uriBaseId":"%SRCROOT%","index":41}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/retry.ts","uriBaseId":"%SRCROOT%","index":42}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/types.ts","uriBaseId":"%SRCROOT%","index":43}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/validator.ts","uriBaseId":"%SRCROOT%","index":44}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/version.ts","uriBaseId":"%SRCROOT%","index":45}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/functions.ts","uriBaseId":"%SRCROOT%","index":46}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/graph.ts","uriBaseId":"%SRCROOT%","index":47}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/index.ts","uriBaseId":"%SRCROOT%","index":48}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/types.ts","uriBaseId":"%SRCROOT%","index":49}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/codeql.ts","uriBaseId":"%SRCROOT%","index":50}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/constants.ts","uriBaseId":"%SRCROOT%","index":51}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/diagnostics.ts","uriBaseId":"%SRCROOT%","index":52}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/environment.ts","uriBaseId":"%SRCROOT%","index":53}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/filesystem.ts","uriBaseId":"%SRCROOT%","index":54}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/cdsExtractorLog.ts","uriBaseId":"%SRCROOT%","index":55}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/index.ts","uriBaseId":"%SRCROOT%","index":56}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/statusReport.ts","uriBaseId":"%SRCROOT%","index":57}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/types.ts","uriBaseId":"%SRCROOT%","index":58}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/cacheInstaller.ts","uriBaseId":"%SRCROOT%","index":59}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/index.ts","uriBaseId":"%SRCROOT%","index":60}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/projectInstaller.ts","uriBaseId":"%SRCROOT%","index":61}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/types.ts","uriBaseId":"%SRCROOT%","index":62}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/versionResolver.ts","uriBaseId":"%SRCROOT%","index":63}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/utils.ts","uriBaseId":"%SRCROOT%","index":64}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/cds-extractor.test.ts","uriBaseId":"%SRCROOT%","index":65}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/jest.setup.ts","uriBaseId":"%SRCROOT%","index":66}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/command.test.ts","uriBaseId":"%SRCROOT%","index":67}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/compile.test.ts","uriBaseId":"%SRCROOT%","index":68}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/graph.test.ts","uriBaseId":"%SRCROOT%","index":69}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/index.test.ts","uriBaseId":"%SRCROOT%","index":70}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/project.test.ts","uriBaseId":"%SRCROOT%","index":71}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/retry.test.ts","uriBaseId":"%SRCROOT%","index":72}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/validator.test.ts","uriBaseId":"%SRCROOT%","index":73}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/version.test.ts","uriBaseId":"%SRCROOT%","index":74}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/build-graph.test.ts","uriBaseId":"%SRCROOT%","index":75}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/files-to-compile.test.ts","uriBaseId":"%SRCROOT%","index":76}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/monorepo-support.test.ts","uriBaseId":"%SRCROOT%","index":77}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/project-aware-compilation.test.ts","uriBaseId":"%SRCROOT%","index":78}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/self-parser.test.ts","uriBaseId":"%SRCROOT%","index":79}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/subdirectory-detection.test.ts","uriBaseId":"%SRCROOT%","index":80}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/codeql.test.ts","uriBaseId":"%SRCROOT%","index":81}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/diagnostics.test.ts","uriBaseId":"%SRCROOT%","index":82}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/environment.test.ts","uriBaseId":"%SRCROOT%","index":83}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/filesystem.test.ts","uriBaseId":"%SRCROOT%","index":84}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/cdsExtractorLog.test.ts","uriBaseId":"%SRCROOT%","index":85}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/performanceTrackingIntegration.test.ts","uriBaseId":"%SRCROOT%","index":86}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/statusReport.test.ts","uriBaseId":"%SRCROOT%","index":87}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/types.test.ts","uriBaseId":"%SRCROOT%","index":88}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/cacheInstaller.test.ts","uriBaseId":"%SRCROOT%","index":89}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/index.test.ts","uriBaseId":"%SRCROOT%","index":90}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/projectInstaller.test.ts","uriBaseId":"%SRCROOT%","index":91}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/types.test.ts","uriBaseId":"%SRCROOT%","index":92}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/versionResolver.test.ts","uriBaseId":"%SRCROOT%","index":93}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/utils.test.ts","uriBaseId":"%SRCROOT%","index":94}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/tsconfig.json","uriBaseId":"%SRCROOT%","index":95}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/validate-bundle.js","uriBaseId":"%SRCROOT%","index":96}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":97}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":98}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":99}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":100}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":101}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":102}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":103}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":104}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":105}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":106}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/package.json","uriBaseId":"%SRCROOT%","index":107}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/server.js","uriBaseId":"%SRCROOT%","index":108}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":109}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":110}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":111}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":112}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds","uriBaseId":"%SRCROOT%","index":113}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.js","uriBaseId":"%SRCROOT%","index":114}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":115}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/package.json","uriBaseId":"%SRCROOT%","index":116}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/server.js","uriBaseId":"%SRCROOT%","index":117}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":118}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":119}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":120}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":121}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":122}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds","uriBaseId":"%SRCROOT%","index":123}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/model.cds.json","uriBaseId":"%SRCROOT%","index":124}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/package.json","uriBaseId":"%SRCROOT%","index":125}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/server.js","uriBaseId":"%SRCROOT%","index":126}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds","uriBaseId":"%SRCROOT%","index":127}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.js","uriBaseId":"%SRCROOT%","index":128}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds","uriBaseId":"%SRCROOT%","index":129}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.js","uriBaseId":"%SRCROOT%","index":130}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":131}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":132}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/package.json","uriBaseId":"%SRCROOT%","index":133}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/server.js","uriBaseId":"%SRCROOT%","index":134}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":135}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":136}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":137}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":138}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds","uriBaseId":"%SRCROOT%","index":139}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/model.cds.json","uriBaseId":"%SRCROOT%","index":140}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/package.json","uriBaseId":"%SRCROOT%","index":141}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/server.js","uriBaseId":"%SRCROOT%","index":142}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds","uriBaseId":"%SRCROOT%","index":143}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.js","uriBaseId":"%SRCROOT%","index":144}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds","uriBaseId":"%SRCROOT%","index":145}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.js","uriBaseId":"%SRCROOT%","index":146}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/model.cds.json","uriBaseId":"%SRCROOT%","index":147}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds","uriBaseId":"%SRCROOT%","index":148}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/server.js","uriBaseId":"%SRCROOT%","index":149}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package.json","uriBaseId":"%SRCROOT%","index":150}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":151}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/privileged-user.js","uriBaseId":"%SRCROOT%","index":152}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":154}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package-lock.json","uriBaseId":"%SRCROOT%","index":155}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":157}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":158}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/server.js","uriBaseId":"%SRCROOT%","index":160}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":161}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":162}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":163}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":164}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":165}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":166}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/server.js","uriBaseId":"%SRCROOT%","index":167}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":168}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json","uriBaseId":"%SRCROOT%","index":169}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":170}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":171}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":172}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":173}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":174}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json","uriBaseId":"%SRCROOT%","index":175}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/server.js","uriBaseId":"%SRCROOT%","index":176}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":177}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":178}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":179}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":180}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds","uriBaseId":"%SRCROOT%","index":181}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/model.cds.json","uriBaseId":"%SRCROOT%","index":182}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/package.json","uriBaseId":"%SRCROOT%","index":183}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/server.js","uriBaseId":"%SRCROOT%","index":184}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds","uriBaseId":"%SRCROOT%","index":185}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds","uriBaseId":"%SRCROOT%","index":186}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds","uriBaseId":"%SRCROOT%","index":187}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/model.cds.json","uriBaseId":"%SRCROOT%","index":188}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/package.json","uriBaseId":"%SRCROOT%","index":189}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/server.js","uriBaseId":"%SRCROOT%","index":190}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.js","uriBaseId":"%SRCROOT%","index":191}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds","uriBaseId":"%SRCROOT%","index":192}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds","uriBaseId":"%SRCROOT%","index":193}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.js","uriBaseId":"%SRCROOT%","index":194}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.js","uriBaseId":"%SRCROOT%","index":195}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds","uriBaseId":"%SRCROOT%","index":196}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/package.json","uriBaseId":"%SRCROOT%","index":197}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/server.js","uriBaseId":"%SRCROOT%","index":198}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.js","uriBaseId":"%SRCROOT%","index":200}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/model.cds.json","uriBaseId":"%SRCROOT%","index":201}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":202}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":203}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":204}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":205}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":206}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":207}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":208}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":209}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":210}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":211}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":212}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":213}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":214}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":215}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":216}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":218}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":219}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":220}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":221}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":222}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":224}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":226}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":227}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":228}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":229}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":230}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":234}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/model.cds.json","uriBaseId":"%SRCROOT%","index":235}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.js","uriBaseId":"%SRCROOT%","index":236}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds","uriBaseId":"%SRCROOT%","index":237}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.js","uriBaseId":"%SRCROOT%","index":238}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":239}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":240}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":241}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":242}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/BindingStringParser/test.js","uriBaseId":"%SRCROOT%","index":243}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":244}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.js","uriBaseId":"%SRCROOT%","index":245}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.json","uriBaseId":"%SRCROOT%","index":246}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.xml","uriBaseId":"%SRCROOT%","index":247}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.html","uriBaseId":"%SRCROOT%","index":248}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/JsonParser/test.js","uriBaseId":"%SRCROOT%","index":249}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/attachDisplay_detachDisplay/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":250}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/binding_path/binding1.xml","uriBaseId":"%SRCROOT%","index":251}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/binding_path/bindingComposite.xml","uriBaseId":"%SRCROOT%","index":252}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/dynamic_write_to_html_content/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":253}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/multiple_models/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":254}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/property_getter_setter/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":255}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/sink/sink1.xml","uriBaseId":"%SRCROOT%","index":256}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":257}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/source/source1.xml","uriBaseId":"%SRCROOT%","index":258}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/index.html","uriBaseId":"%SRCROOT%","index":259}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":260}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":261}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/index.html","uriBaseId":"%SRCROOT%","index":262}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-deny-all/index.html","uriBaseId":"%SRCROOT%","index":263}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-deny-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":264}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":265}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":266}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":267}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":268}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":269}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":270}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":271}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":272}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":273}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":274}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":275}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":276}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":278}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":279}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":280}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":281}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":282}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":283}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":284}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":285}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":286}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":287}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":288}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":289}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":291}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":292}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":293}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":294}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":295}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":296}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":297}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":298}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":299}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":300}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":301}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":302}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":303}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":304}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":305}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":306}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":307}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":308}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/package-lock.json","uriBaseId":"%SRCROOT%","index":309}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/package.json","uriBaseId":"%SRCROOT%","index":310}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.html","uriBaseId":"%SRCROOT%","index":312}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.js","uriBaseId":"%SRCROOT%","index":313}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/ui5.yaml","uriBaseId":"%SRCROOT%","index":314}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":315}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":316}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":317}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/package-lock.json","uriBaseId":"%SRCROOT%","index":318}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/package.json","uriBaseId":"%SRCROOT%","index":319}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/ui5.yaml","uriBaseId":"%SRCROOT%","index":321}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.html","uriBaseId":"%SRCROOT%","index":322}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.js","uriBaseId":"%SRCROOT%","index":323}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":324}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/package-lock.json","uriBaseId":"%SRCROOT%","index":326}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/package.json","uriBaseId":"%SRCROOT%","index":327}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/ui5.yaml","uriBaseId":"%SRCROOT%","index":328}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.html","uriBaseId":"%SRCROOT%","index":330}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.js","uriBaseId":"%SRCROOT%","index":331}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":332}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":333}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":334}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/package-lock.json","uriBaseId":"%SRCROOT%","index":335}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/package.json","uriBaseId":"%SRCROOT%","index":336}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":337}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/ui5.yaml","uriBaseId":"%SRCROOT%","index":338}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.html","uriBaseId":"%SRCROOT%","index":339}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.js","uriBaseId":"%SRCROOT%","index":340}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":341}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":342}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":343}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/package-lock.json","uriBaseId":"%SRCROOT%","index":344}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/package.json","uriBaseId":"%SRCROOT%","index":345}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/ui5.yaml","uriBaseId":"%SRCROOT%","index":346}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.html","uriBaseId":"%SRCROOT%","index":348}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.js","uriBaseId":"%SRCROOT%","index":349}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":350}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/package-lock.json","uriBaseId":"%SRCROOT%","index":352}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/package.json","uriBaseId":"%SRCROOT%","index":353}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/ui5.yaml","uriBaseId":"%SRCROOT%","index":354}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.html","uriBaseId":"%SRCROOT%","index":356}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.js","uriBaseId":"%SRCROOT%","index":357}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":358}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":362}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":363}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":364}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":365}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":366}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":367}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":368}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":369}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":370}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":371}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":372}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":373}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":374}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":375}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":376}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":377}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":378}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":379}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":381}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":382}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":383}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":384}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":385}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":386}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":387}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":388}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":389}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":390}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":391}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":392}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":393}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":394}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/.eslintrc.json","uriBaseId":"%SRCROOT%","index":396}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/package.json","uriBaseId":"%SRCROOT%","index":397}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/package-lock.json","uriBaseId":"%SRCROOT%","index":398}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/ui5.yaml","uriBaseId":"%SRCROOT%","index":399}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/Component.js","uriBaseId":"%SRCROOT%","index":400}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/index.html","uriBaseId":"%SRCROOT%","index":403}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":404}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/model/todoitems.json","uriBaseId":"%SRCROOT%","index":405}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/AllJourneys.js","uriBaseId":"%SRCROOT%","index":406}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/FilterJourney.js","uriBaseId":"%SRCROOT%","index":407}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/SearchJourney.js","uriBaseId":"%SRCROOT%","index":408}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/TodoListJourney.js","uriBaseId":"%SRCROOT%","index":409}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/arrangements/Startup.js","uriBaseId":"%SRCROOT%","index":410}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.html","uriBaseId":"%SRCROOT%","index":411}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.js","uriBaseId":"%SRCROOT%","index":412}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.html","uriBaseId":"%SRCROOT%","index":413}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":414}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/pages/App.js","uriBaseId":"%SRCROOT%","index":415}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/AllTests.js","uriBaseId":"%SRCROOT%","index":416}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/controller/App.controller.js","uriBaseId":"%SRCROOT%","index":417}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.html","uriBaseId":"%SRCROOT%","index":418}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.js","uriBaseId":"%SRCROOT%","index":419}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/util/Helper.js","uriBaseId":"%SRCROOT%","index":420}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":421}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/package-lock.json","uriBaseId":"%SRCROOT%","index":422}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/package.json","uriBaseId":"%SRCROOT%","index":423}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/ui5.yaml","uriBaseId":"%SRCROOT%","index":424}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":426}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.html","uriBaseId":"%SRCROOT%","index":427}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.js","uriBaseId":"%SRCROOT%","index":428}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":429}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/package-lock.json","uriBaseId":"%SRCROOT%","index":431}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/package.json","uriBaseId":"%SRCROOT%","index":432}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":433}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/ui5.yaml","uriBaseId":"%SRCROOT%","index":434}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":435}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.html","uriBaseId":"%SRCROOT%","index":436}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.js","uriBaseId":"%SRCROOT%","index":437}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":438}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/package-lock.json","uriBaseId":"%SRCROOT%","index":440}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/package.json","uriBaseId":"%SRCROOT%","index":441}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/ui5.yaml","uriBaseId":"%SRCROOT%","index":442}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":443}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":444}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.html","uriBaseId":"%SRCROOT%","index":445}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.js","uriBaseId":"%SRCROOT%","index":446}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":447}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":449}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":450}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":451}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":452}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":453}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":454}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":455}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":456}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":457}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":458}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":459}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":460}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":461}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":462}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":463}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":464}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":465}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":466}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/package-lock.json","uriBaseId":"%SRCROOT%","index":467}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/ui5.yaml","uriBaseId":"%SRCROOT%","index":468}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/package.json","uriBaseId":"%SRCROOT%","index":469}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.html","uriBaseId":"%SRCROOT%","index":470}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.js","uriBaseId":"%SRCROOT%","index":471}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":472}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/package-lock.json","uriBaseId":"%SRCROOT%","index":475}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/package.json","uriBaseId":"%SRCROOT%","index":476}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":477}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":478}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":479}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":480}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":481}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":483}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":484}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":485}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":487}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":488}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":489}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/package-lock.json","uriBaseId":"%SRCROOT%","index":491}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/package.json","uriBaseId":"%SRCROOT%","index":492}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/ui5.yaml","uriBaseId":"%SRCROOT%","index":493}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":494}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.js","uriBaseId":"%SRCROOT%","index":495}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":496}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":497}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/package-lock.json","uriBaseId":"%SRCROOT%","index":498}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/package.json","uriBaseId":"%SRCROOT%","index":499}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/ui5.yaml","uriBaseId":"%SRCROOT%","index":500}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":501}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/model.json","uriBaseId":"%SRCROOT%","index":502}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.html","uriBaseId":"%SRCROOT%","index":503}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.js","uriBaseId":"%SRCROOT%","index":504}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.html","uriBaseId":"%SRCROOT%","index":505}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":506}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/package-lock.json","uriBaseId":"%SRCROOT%","index":508}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/package.json","uriBaseId":"%SRCROOT%","index":509}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":510}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":511}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":512}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":513}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":514}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":515}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/package-lock.json","uriBaseId":"%SRCROOT%","index":516}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/package.json","uriBaseId":"%SRCROOT%","index":517}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":518}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":519}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssBase.js","uriBaseId":"%SRCROOT%","index":520}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":521}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":522}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":523}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":524}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":525}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/package-lock.json","uriBaseId":"%SRCROOT%","index":526}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":527}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/package.json","uriBaseId":"%SRCROOT%","index":528}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":529}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":530}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":531}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":532}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":533}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":534}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/package-lock.json","uriBaseId":"%SRCROOT%","index":535}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/package.json","uriBaseId":"%SRCROOT%","index":536}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":537}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":538}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":539}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":540}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":541}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":542}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/package-lock.json","uriBaseId":"%SRCROOT%","index":543}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/package.json","uriBaseId":"%SRCROOT%","index":544}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/ui5.yaml","uriBaseId":"%SRCROOT%","index":545}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":546}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":547}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":548}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.html","uriBaseId":"%SRCROOT%","index":549}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.js","uriBaseId":"%SRCROOT%","index":550}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":551}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":552}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/package-lock.json","uriBaseId":"%SRCROOT%","index":553}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/package.json","uriBaseId":"%SRCROOT%","index":554}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/ui5.yaml","uriBaseId":"%SRCROOT%","index":555}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":556}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":557}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":558}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.html","uriBaseId":"%SRCROOT%","index":559}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.js","uriBaseId":"%SRCROOT%","index":560}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":561}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/package-lock.json","uriBaseId":"%SRCROOT%","index":562}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":563}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/package.json","uriBaseId":"%SRCROOT%","index":564}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":565}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":566}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":567}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":568}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":569}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":571}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":572}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/.eslintrc.json","uriBaseId":"%SRCROOT%","index":573}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package-lock.json","uriBaseId":"%SRCROOT%","index":574}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package.json","uriBaseId":"%SRCROOT%","index":575}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/public/index.html","uriBaseId":"%SRCROOT%","index":576}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/App.tsx","uriBaseId":"%SRCROOT%","index":577}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/index.tsx","uriBaseId":"%SRCROOT%","index":578}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":579}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":580}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":581}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":582}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":583}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":584}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/.xsaccess","uriBaseId":"%SRCROOT%","index":585}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess","uriBaseId":"%SRCROOT%","index":586}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/missing_auth/.xsaccess","uriBaseId":"%SRCROOT%","index":587}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/service.xsjs","uriBaseId":"%SRCROOT%","index":588}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":589}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":594}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/qlpack.yml","uriBaseId":"%SRCROOT%","index":595}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"qlt.conf.json","uriBaseId":"%SRCROOT%","index":596}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":105},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":109},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":111},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds","uriBaseId":"%SRCROOT%","index":113},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":115},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":118},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":122},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds","uriBaseId":"%SRCROOT%","index":123},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds","uriBaseId":"%SRCROOT%","index":127},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds","uriBaseId":"%SRCROOT%","index":129},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":131},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":135},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":137},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds","uriBaseId":"%SRCROOT%","index":139},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds","uriBaseId":"%SRCROOT%","index":143},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds","uriBaseId":"%SRCROOT%","index":145},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds","uriBaseId":"%SRCROOT%","index":148},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":151},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":157},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":161},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":162},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":165},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":168},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":171},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":173},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":177},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":179},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds","uriBaseId":"%SRCROOT%","index":181},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds","uriBaseId":"%SRCROOT%","index":185},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds","uriBaseId":"%SRCROOT%","index":186},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds","uriBaseId":"%SRCROOT%","index":187},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds","uriBaseId":"%SRCROOT%","index":192},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds","uriBaseId":"%SRCROOT%","index":193},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds","uriBaseId":"%SRCROOT%","index":196},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":202},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":206},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":207},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":210},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":214},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":216},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":218},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":222},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":224},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":226},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":230},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds","uriBaseId":"%SRCROOT%","index":237},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/Component.js","uriBaseId":"%SRCROOT%","index":400}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":110}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.js","uriBaseId":"%SRCROOT%","index":238}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":286}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/server.js","uriBaseId":"%SRCROOT%","index":198}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/SearchJourney.js","uriBaseId":"%SRCROOT%","index":408}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/server.js","uriBaseId":"%SRCROOT%","index":149}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/server.js","uriBaseId":"%SRCROOT%","index":176}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":546}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/FilterJourney.js","uriBaseId":"%SRCROOT%","index":407}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/esbuild.config.mjs","uriBaseId":"%SRCROOT%","index":31}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":444}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":215}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":180}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":385}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":461}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":435}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":333}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssBase.js","uriBaseId":"%SRCROOT%","index":520}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":163}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":532}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":293}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":530}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":566}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":375}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":538}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/arrangements/Startup.js","uriBaseId":"%SRCROOT%","index":410}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/pages/App.js","uriBaseId":"%SRCROOT%","index":415}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/server.js","uriBaseId":"%SRCROOT%","index":190}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/eslint.config.mjs","uriBaseId":"%SRCROOT%","index":32}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":548}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":208}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":342}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":556}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.js","uriBaseId":"%SRCROOT%","index":560}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":170}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.js","uriBaseId":"%SRCROOT%","index":128}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":317}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":297}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.js","uriBaseId":"%SRCROOT%","index":437}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.js","uriBaseId":"%SRCROOT%","index":245}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":306}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":501}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":278}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/TodoListJourney.js","uriBaseId":"%SRCROOT%","index":409}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":229}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.js","uriBaseId":"%SRCROOT%","index":340}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":136}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":367}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":527}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.js","uriBaseId":"%SRCROOT%","index":144}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/JsonParser/test.js","uriBaseId":"%SRCROOT%","index":249}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":112}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":271}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":521}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.js","uriBaseId":"%SRCROOT%","index":357}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":478}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":221}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":522}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":494}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":519}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":302}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":164}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":558}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":480}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/server.js","uriBaseId":"%SRCROOT%","index":108}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":534}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.js","uriBaseId":"%SRCROOT%","index":195}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/server.js","uriBaseId":"%SRCROOT%","index":167}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":172}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/server.js","uriBaseId":"%SRCROOT%","index":184}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":414}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":269}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":488}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":513}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.js","uriBaseId":"%SRCROOT%","index":146}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.js","uriBaseId":"%SRCROOT%","index":495}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.js","uriBaseId":"%SRCROOT%","index":313}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":295}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.js","uriBaseId":"%SRCROOT%","index":504}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":540}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":373}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":209}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":547}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":462}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":511}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.js","uriBaseId":"%SRCROOT%","index":236}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/.prettierrc.js","uriBaseId":"%SRCROOT%","index":29}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.js","uriBaseId":"%SRCROOT%","index":331}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":213}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/validate-bundle.js","uriBaseId":"%SRCROOT%","index":96}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.js","uriBaseId":"%SRCROOT%","index":550}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.js","uriBaseId":"%SRCROOT%","index":200}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/server.js","uriBaseId":"%SRCROOT%","index":160}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":121}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/AllTests.js","uriBaseId":"%SRCROOT%","index":416}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":372}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":178}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":288}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":390}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/server.js","uriBaseId":"%SRCROOT%","index":117}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":457}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/jest.config.js","uriBaseId":"%SRCROOT%","index":34}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":337}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":138}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.js","uriBaseId":"%SRCROOT%","index":349}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":268}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/util/Helper.js","uriBaseId":"%SRCROOT%","index":420}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":119}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.js","uriBaseId":"%SRCROOT%","index":446}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/privileged-user.js","uriBaseId":"%SRCROOT%","index":152}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.js","uriBaseId":"%SRCROOT%","index":114}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":280}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":454}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":365}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":451}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/server.js","uriBaseId":"%SRCROOT%","index":126}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":205}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.js","uriBaseId":"%SRCROOT%","index":428}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.js","uriBaseId":"%SRCROOT%","index":323}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":568}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":433}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/BindingStringParser/test.js","uriBaseId":"%SRCROOT%","index":243}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":443}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/controller/App.controller.js","uriBaseId":"%SRCROOT%","index":417}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.js","uriBaseId":"%SRCROOT%","index":419}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":464}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.js","uriBaseId":"%SRCROOT%","index":471}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.js","uriBaseId":"%SRCROOT%","index":194}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":393}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":557}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.js","uriBaseId":"%SRCROOT%","index":191}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":382}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":426}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/dist/cds-extractor.bundle.js","uriBaseId":"%SRCROOT%","index":33}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/AllJourneys.js","uriBaseId":"%SRCROOT%","index":406}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/server.js","uriBaseId":"%SRCROOT%","index":134}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.js","uriBaseId":"%SRCROOT%","index":412}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.js","uriBaseId":"%SRCROOT%","index":130}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":304}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/server.js","uriBaseId":"%SRCROOT%","index":142}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/cds-extractor-dist-bundle.yml","uriBaseId":"%SRCROOT%","index":21}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/codeql-ql.yml","uriBaseId":"%SRCROOT%","index":23}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/run-codeql-unit-tests-javascript.yml","uriBaseId":"%SRCROOT%","index":24}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/update-codeql.yml","uriBaseId":"%SRCROOT%","index":25}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/code_scanning.yml","uriBaseId":"%SRCROOT%","index":22}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/projectInstaller.ts","uriBaseId":"%SRCROOT%","index":61}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/files-to-compile.test.ts","uriBaseId":"%SRCROOT%","index":76}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/graph.ts","uriBaseId":"%SRCROOT%","index":39}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/projectInstaller.test.ts","uriBaseId":"%SRCROOT%","index":91}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/compile.test.ts","uriBaseId":"%SRCROOT%","index":68}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/cds-extractor.test.ts","uriBaseId":"%SRCROOT%","index":65}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/graph.ts","uriBaseId":"%SRCROOT%","index":47}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/project.ts","uriBaseId":"%SRCROOT%","index":41}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/cds-extractor.ts","uriBaseId":"%SRCROOT%","index":30}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/index.ts","uriBaseId":"%SRCROOT%","index":56}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/command.ts","uriBaseId":"%SRCROOT%","index":37}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/diagnostics.ts","uriBaseId":"%SRCROOT%","index":52}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/index.test.ts","uriBaseId":"%SRCROOT%","index":70}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/statusReport.ts","uriBaseId":"%SRCROOT%","index":57}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/App.tsx","uriBaseId":"%SRCROOT%","index":577}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/cacheInstaller.test.ts","uriBaseId":"%SRCROOT%","index":89}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/validator.ts","uriBaseId":"%SRCROOT%","index":44}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/types.test.ts","uriBaseId":"%SRCROOT%","index":88}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/index.test.ts","uriBaseId":"%SRCROOT%","index":90}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/statusReport.test.ts","uriBaseId":"%SRCROOT%","index":87}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/types.ts","uriBaseId":"%SRCROOT%","index":58}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/index.tsx","uriBaseId":"%SRCROOT%","index":578}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/codeql.ts","uriBaseId":"%SRCROOT%","index":50}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/index.ts","uriBaseId":"%SRCROOT%","index":60}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/version.test.ts","uriBaseId":"%SRCROOT%","index":74}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/cdsExtractorLog.ts","uriBaseId":"%SRCROOT%","index":55}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/command.test.ts","uriBaseId":"%SRCROOT%","index":67}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/constants.ts","uriBaseId":"%SRCROOT%","index":51}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/performanceTrackingIntegration.test.ts","uriBaseId":"%SRCROOT%","index":86}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/types.ts","uriBaseId":"%SRCROOT%","index":62}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/validator.test.ts","uriBaseId":"%SRCROOT%","index":73}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/monorepo-support.test.ts","uriBaseId":"%SRCROOT%","index":77}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/build-graph.test.ts","uriBaseId":"%SRCROOT%","index":75}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/utils.ts","uriBaseId":"%SRCROOT%","index":64}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/types.ts","uriBaseId":"%SRCROOT%","index":49}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/compile.ts","uriBaseId":"%SRCROOT%","index":38}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/project-aware-compilation.test.ts","uriBaseId":"%SRCROOT%","index":78}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/index.ts","uriBaseId":"%SRCROOT%","index":48}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/subdirectory-detection.test.ts","uriBaseId":"%SRCROOT%","index":80}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/retry.test.ts","uriBaseId":"%SRCROOT%","index":72}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/jest.setup.ts","uriBaseId":"%SRCROOT%","index":66}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/cdsExtractorLog.test.ts","uriBaseId":"%SRCROOT%","index":85}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/diagnostics.test.ts","uriBaseId":"%SRCROOT%","index":82}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/retry.ts","uriBaseId":"%SRCROOT%","index":42}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/utils.test.ts","uriBaseId":"%SRCROOT%","index":94}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/types.ts","uriBaseId":"%SRCROOT%","index":43}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/index.ts","uriBaseId":"%SRCROOT%","index":40}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/project.test.ts","uriBaseId":"%SRCROOT%","index":71}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/graph.test.ts","uriBaseId":"%SRCROOT%","index":69}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/self-parser.test.ts","uriBaseId":"%SRCROOT%","index":79}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/environment.test.ts","uriBaseId":"%SRCROOT%","index":83}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/versionResolver.test.ts","uriBaseId":"%SRCROOT%","index":93}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/environment.ts","uriBaseId":"%SRCROOT%","index":53}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/version.ts","uriBaseId":"%SRCROOT%","index":45}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/versionResolver.ts","uriBaseId":"%SRCROOT%","index":63}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/types.test.ts","uriBaseId":"%SRCROOT%","index":92}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/cacheInstaller.ts","uriBaseId":"%SRCROOT%","index":59}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/functions.ts","uriBaseId":"%SRCROOT%","index":46}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/filesystem.ts","uriBaseId":"%SRCROOT%","index":54}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/codeql.test.ts","uriBaseId":"%SRCROOT%","index":81}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/filesystem.test.ts","uriBaseId":"%SRCROOT%","index":84}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/CreateTestsFromYaml.py","uriBaseId":"%SRCROOT%","index":598}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/python","index":3},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":"On the Linux (amd64; 6.11.0-1018-azure) platform.","markdown":"On the Linux (amd64; 6.11.0-1018-azure) platform."},"level":"none","timeUtc":"2025-12-11T23:27:46.068256569Z","descriptor":{"id":"cli/platform","index":4},"properties":{"attributes":{"arch":"amd64","name":"Linux","version":"6.11.0-1018-azure"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2025-12-11T23:27:39.385Z","descriptor":{"id":"codeql-action/bundle-download-telemetry","index":5},"properties":{"attributes":{"combinedDurationMs":29915,"compressionMethod":"gzip","downloadDurationMs":19628,"extractionDurationMs":10287,"streamExtraction":false,"toolsUrl":"https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.23.8/codeql-bundle-linux64.tar.gz"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2}},{"location":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/codeStyles/codeStyleConfig.xml","uriBaseId":"%SRCROOT%","index":4}},{"location":{"uri":".cds-extractor-cache/cds-419af57a6ca03c33e081f24fe025fd9562eb8de8ad926dd10c59ce86d3bfee92/node_modules/@sap/cds-dk/node_modules/xml-js/bin/test.xml","uriBaseId":"%SRCROOT%","index":5}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/inspectionProfiles/Project_Default.xml","uriBaseId":"%SRCROOT%","index":6}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/codeStyles/Project.xml","uriBaseId":"%SRCROOT%","index":7}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/vcs.xml","uriBaseId":"%SRCROOT%","index":8}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/modules.xml","uriBaseId":"%SRCROOT%","index":9}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/xml-js/bin/test.xml","uriBaseId":"%SRCROOT%","index":10}},{"location":{"uri":".github/codeql/codeql-config.yaml","uriBaseId":"%SRCROOT%","index":11}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":12}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":13}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":14}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/ui5.model.yml","uriBaseId":"%SRCROOT%","index":15}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":16}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/xsjs.model.yml","uriBaseId":"%SRCROOT%","index":17}},{"location":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/additional-sources.model.yml","uriBaseId":"%SRCROOT%","index":18}},{"location":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":19}},{"location":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":20}},{"location":{"uri":".github/workflows/cds-extractor-dist-bundle.yml","uriBaseId":"%SRCROOT%","index":21}},{"location":{"uri":".github/workflows/code_scanning.yml","uriBaseId":"%SRCROOT%","index":22}},{"location":{"uri":".github/workflows/codeql-ql.yml","uriBaseId":"%SRCROOT%","index":23}},{"location":{"uri":".github/workflows/run-codeql-unit-tests-javascript.yml","uriBaseId":"%SRCROOT%","index":24}},{"location":{"uri":".github/workflows/update-codeql.yml","uriBaseId":"%SRCROOT%","index":25}},{"location":{"uri":"cds-extractor-marker.js","uriBaseId":"%SRCROOT%","index":26}},{"location":{"uri":"codeql-workspace.yml","uriBaseId":"%SRCROOT%","index":27}},{"location":{"uri":"extractors/cds/codeql-extractor.yml","uriBaseId":"%SRCROOT%","index":28}},{"location":{"uri":"extractors/cds/tools/.prettierrc.js","uriBaseId":"%SRCROOT%","index":29}},{"location":{"uri":"extractors/cds/tools/cds-extractor.ts","uriBaseId":"%SRCROOT%","index":30}},{"location":{"uri":"extractors/cds/tools/esbuild.config.mjs","uriBaseId":"%SRCROOT%","index":31}},{"location":{"uri":"extractors/cds/tools/eslint.config.mjs","uriBaseId":"%SRCROOT%","index":32}},{"location":{"uri":"extractors/cds/tools/dist/cds-extractor.bundle.js","uriBaseId":"%SRCROOT%","index":33}},{"location":{"uri":"extractors/cds/tools/jest.config.js","uriBaseId":"%SRCROOT%","index":34}},{"location":{"uri":"extractors/cds/tools/package-lock.json","uriBaseId":"%SRCROOT%","index":35}},{"location":{"uri":"extractors/cds/tools/package.json","uriBaseId":"%SRCROOT%","index":36}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/command.ts","uriBaseId":"%SRCROOT%","index":37}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/compile.ts","uriBaseId":"%SRCROOT%","index":38}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/graph.ts","uriBaseId":"%SRCROOT%","index":39}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/index.ts","uriBaseId":"%SRCROOT%","index":40}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/project.ts","uriBaseId":"%SRCROOT%","index":41}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/retry.ts","uriBaseId":"%SRCROOT%","index":42}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/types.ts","uriBaseId":"%SRCROOT%","index":43}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/validator.ts","uriBaseId":"%SRCROOT%","index":44}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/version.ts","uriBaseId":"%SRCROOT%","index":45}},{"location":{"uri":"extractors/cds/tools/src/cds/parser/functions.ts","uriBaseId":"%SRCROOT%","index":46}},{"location":{"uri":"extractors/cds/tools/src/cds/parser/graph.ts","uriBaseId":"%SRCROOT%","index":47}},{"location":{"uri":"extractors/cds/tools/src/cds/parser/index.ts","uriBaseId":"%SRCROOT%","index":48}},{"location":{"uri":"extractors/cds/tools/src/cds/parser/types.ts","uriBaseId":"%SRCROOT%","index":49}},{"location":{"uri":"extractors/cds/tools/src/codeql.ts","uriBaseId":"%SRCROOT%","index":50}},{"location":{"uri":"extractors/cds/tools/src/constants.ts","uriBaseId":"%SRCROOT%","index":51}},{"location":{"uri":"extractors/cds/tools/src/diagnostics.ts","uriBaseId":"%SRCROOT%","index":52}},{"location":{"uri":"extractors/cds/tools/src/environment.ts","uriBaseId":"%SRCROOT%","index":53}},{"location":{"uri":"extractors/cds/tools/src/filesystem.ts","uriBaseId":"%SRCROOT%","index":54}},{"location":{"uri":"extractors/cds/tools/src/logging/cdsExtractorLog.ts","uriBaseId":"%SRCROOT%","index":55}},{"location":{"uri":"extractors/cds/tools/src/logging/index.ts","uriBaseId":"%SRCROOT%","index":56}},{"location":{"uri":"extractors/cds/tools/src/logging/statusReport.ts","uriBaseId":"%SRCROOT%","index":57}},{"location":{"uri":"extractors/cds/tools/src/logging/types.ts","uriBaseId":"%SRCROOT%","index":58}},{"location":{"uri":"extractors/cds/tools/src/packageManager/cacheInstaller.ts","uriBaseId":"%SRCROOT%","index":59}},{"location":{"uri":"extractors/cds/tools/src/packageManager/index.ts","uriBaseId":"%SRCROOT%","index":60}},{"location":{"uri":"extractors/cds/tools/src/packageManager/projectInstaller.ts","uriBaseId":"%SRCROOT%","index":61}},{"location":{"uri":"extractors/cds/tools/src/packageManager/types.ts","uriBaseId":"%SRCROOT%","index":62}},{"location":{"uri":"extractors/cds/tools/src/packageManager/versionResolver.ts","uriBaseId":"%SRCROOT%","index":63}},{"location":{"uri":"extractors/cds/tools/src/utils.ts","uriBaseId":"%SRCROOT%","index":64}},{"location":{"uri":"extractors/cds/tools/test/cds-extractor.test.ts","uriBaseId":"%SRCROOT%","index":65}},{"location":{"uri":"extractors/cds/tools/test/jest.setup.ts","uriBaseId":"%SRCROOT%","index":66}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/command.test.ts","uriBaseId":"%SRCROOT%","index":67}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/compile.test.ts","uriBaseId":"%SRCROOT%","index":68}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/graph.test.ts","uriBaseId":"%SRCROOT%","index":69}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/index.test.ts","uriBaseId":"%SRCROOT%","index":70}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/project.test.ts","uriBaseId":"%SRCROOT%","index":71}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/retry.test.ts","uriBaseId":"%SRCROOT%","index":72}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/validator.test.ts","uriBaseId":"%SRCROOT%","index":73}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/version.test.ts","uriBaseId":"%SRCROOT%","index":74}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/build-graph.test.ts","uriBaseId":"%SRCROOT%","index":75}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/files-to-compile.test.ts","uriBaseId":"%SRCROOT%","index":76}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/monorepo-support.test.ts","uriBaseId":"%SRCROOT%","index":77}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/project-aware-compilation.test.ts","uriBaseId":"%SRCROOT%","index":78}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/self-parser.test.ts","uriBaseId":"%SRCROOT%","index":79}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/subdirectory-detection.test.ts","uriBaseId":"%SRCROOT%","index":80}},{"location":{"uri":"extractors/cds/tools/test/src/codeql.test.ts","uriBaseId":"%SRCROOT%","index":81}},{"location":{"uri":"extractors/cds/tools/test/src/diagnostics.test.ts","uriBaseId":"%SRCROOT%","index":82}},{"location":{"uri":"extractors/cds/tools/test/src/environment.test.ts","uriBaseId":"%SRCROOT%","index":83}},{"location":{"uri":"extractors/cds/tools/test/src/filesystem.test.ts","uriBaseId":"%SRCROOT%","index":84}},{"location":{"uri":"extractors/cds/tools/test/src/logging/cdsExtractorLog.test.ts","uriBaseId":"%SRCROOT%","index":85}},{"location":{"uri":"extractors/cds/tools/test/src/logging/performanceTrackingIntegration.test.ts","uriBaseId":"%SRCROOT%","index":86}},{"location":{"uri":"extractors/cds/tools/test/src/logging/statusReport.test.ts","uriBaseId":"%SRCROOT%","index":87}},{"location":{"uri":"extractors/cds/tools/test/src/logging/types.test.ts","uriBaseId":"%SRCROOT%","index":88}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/cacheInstaller.test.ts","uriBaseId":"%SRCROOT%","index":89}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/index.test.ts","uriBaseId":"%SRCROOT%","index":90}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/projectInstaller.test.ts","uriBaseId":"%SRCROOT%","index":91}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/types.test.ts","uriBaseId":"%SRCROOT%","index":92}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/versionResolver.test.ts","uriBaseId":"%SRCROOT%","index":93}},{"location":{"uri":"extractors/cds/tools/test/src/utils.test.ts","uriBaseId":"%SRCROOT%","index":94}},{"location":{"uri":"extractors/cds/tools/tsconfig.json","uriBaseId":"%SRCROOT%","index":95}},{"location":{"uri":"extractors/cds/tools/validate-bundle.js","uriBaseId":"%SRCROOT%","index":96}},{"location":{"uri":"javascript/frameworks/cap/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":97}},{"location":{"uri":"javascript/frameworks/cap/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":98}},{"location":{"uri":"javascript/frameworks/cap/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":99}},{"location":{"uri":"javascript/frameworks/cap/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":100}},{"location":{"uri":"javascript/frameworks/cap/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":101}},{"location":{"uri":"javascript/frameworks/cap/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":102}},{"location":{"uri":"javascript/frameworks/cap/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":103}},{"location":{"uri":"javascript/frameworks/cap/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":104}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":105}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":106}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/package.json","uriBaseId":"%SRCROOT%","index":107}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/server.js","uriBaseId":"%SRCROOT%","index":108}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":109}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":110}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":111}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":112}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds","uriBaseId":"%SRCROOT%","index":113}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.js","uriBaseId":"%SRCROOT%","index":114}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":115}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/package.json","uriBaseId":"%SRCROOT%","index":116}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/server.js","uriBaseId":"%SRCROOT%","index":117}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":118}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":119}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":120}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":121}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":122}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds","uriBaseId":"%SRCROOT%","index":123}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/model.cds.json","uriBaseId":"%SRCROOT%","index":124}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/package.json","uriBaseId":"%SRCROOT%","index":125}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/server.js","uriBaseId":"%SRCROOT%","index":126}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds","uriBaseId":"%SRCROOT%","index":127}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.js","uriBaseId":"%SRCROOT%","index":128}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds","uriBaseId":"%SRCROOT%","index":129}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.js","uriBaseId":"%SRCROOT%","index":130}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":131}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":132}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/package.json","uriBaseId":"%SRCROOT%","index":133}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/server.js","uriBaseId":"%SRCROOT%","index":134}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":135}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":136}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":137}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":138}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds","uriBaseId":"%SRCROOT%","index":139}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/model.cds.json","uriBaseId":"%SRCROOT%","index":140}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/package.json","uriBaseId":"%SRCROOT%","index":141}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/server.js","uriBaseId":"%SRCROOT%","index":142}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds","uriBaseId":"%SRCROOT%","index":143}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.js","uriBaseId":"%SRCROOT%","index":144}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds","uriBaseId":"%SRCROOT%","index":145}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.js","uriBaseId":"%SRCROOT%","index":146}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/model.cds.json","uriBaseId":"%SRCROOT%","index":147}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds","uriBaseId":"%SRCROOT%","index":148}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/server.js","uriBaseId":"%SRCROOT%","index":149}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package.json","uriBaseId":"%SRCROOT%","index":150}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":151}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/privileged-user.js","uriBaseId":"%SRCROOT%","index":152}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":154}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package-lock.json","uriBaseId":"%SRCROOT%","index":155}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":157}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":158}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/server.js","uriBaseId":"%SRCROOT%","index":160}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":161}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":162}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":163}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":164}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":165}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":166}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/server.js","uriBaseId":"%SRCROOT%","index":167}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":168}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json","uriBaseId":"%SRCROOT%","index":169}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":170}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":171}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":172}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":173}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":174}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json","uriBaseId":"%SRCROOT%","index":175}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/server.js","uriBaseId":"%SRCROOT%","index":176}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":177}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":178}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":179}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":180}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds","uriBaseId":"%SRCROOT%","index":181}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/model.cds.json","uriBaseId":"%SRCROOT%","index":182}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/package.json","uriBaseId":"%SRCROOT%","index":183}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/server.js","uriBaseId":"%SRCROOT%","index":184}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds","uriBaseId":"%SRCROOT%","index":185}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds","uriBaseId":"%SRCROOT%","index":186}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds","uriBaseId":"%SRCROOT%","index":187}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/model.cds.json","uriBaseId":"%SRCROOT%","index":188}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/package.json","uriBaseId":"%SRCROOT%","index":189}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/server.js","uriBaseId":"%SRCROOT%","index":190}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.js","uriBaseId":"%SRCROOT%","index":191}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds","uriBaseId":"%SRCROOT%","index":192}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds","uriBaseId":"%SRCROOT%","index":193}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.js","uriBaseId":"%SRCROOT%","index":194}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.js","uriBaseId":"%SRCROOT%","index":195}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds","uriBaseId":"%SRCROOT%","index":196}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/package.json","uriBaseId":"%SRCROOT%","index":197}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/server.js","uriBaseId":"%SRCROOT%","index":198}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.js","uriBaseId":"%SRCROOT%","index":200}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/model.cds.json","uriBaseId":"%SRCROOT%","index":201}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":202}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":203}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":204}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":205}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":206}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":207}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":208}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":209}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":210}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":211}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":212}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":213}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":214}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":215}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":216}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":218}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":219}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":220}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":221}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":222}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":224}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":226}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":227}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":228}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":229}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":230}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232}},{"location":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":234}},{"location":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/model.cds.json","uriBaseId":"%SRCROOT%","index":235}},{"location":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.js","uriBaseId":"%SRCROOT%","index":236}},{"location":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds","uriBaseId":"%SRCROOT%","index":237}},{"location":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.js","uriBaseId":"%SRCROOT%","index":238}},{"location":{"uri":"javascript/frameworks/ui5/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":239}},{"location":{"uri":"javascript/frameworks/ui5/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":240}},{"location":{"uri":"javascript/frameworks/ui5/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":241}},{"location":{"uri":"javascript/frameworks/ui5/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":242}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/BindingStringParser/test.js","uriBaseId":"%SRCROOT%","index":243}},{"location":{"uri":"javascript/frameworks/ui5/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":244}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.js","uriBaseId":"%SRCROOT%","index":245}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.json","uriBaseId":"%SRCROOT%","index":246}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.xml","uriBaseId":"%SRCROOT%","index":247}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.html","uriBaseId":"%SRCROOT%","index":248}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/JsonParser/test.js","uriBaseId":"%SRCROOT%","index":249}},{"location":{"uri":"javascript/frameworks/ui5/test/models/attachDisplay_detachDisplay/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":250}},{"location":{"uri":"javascript/frameworks/ui5/test/models/binding_path/binding1.xml","uriBaseId":"%SRCROOT%","index":251}},{"location":{"uri":"javascript/frameworks/ui5/test/models/binding_path/bindingComposite.xml","uriBaseId":"%SRCROOT%","index":252}},{"location":{"uri":"javascript/frameworks/ui5/test/models/dynamic_write_to_html_content/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":253}},{"location":{"uri":"javascript/frameworks/ui5/test/models/multiple_models/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":254}},{"location":{"uri":"javascript/frameworks/ui5/test/models/property_getter_setter/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":255}},{"location":{"uri":"javascript/frameworks/ui5/test/models/sink/sink1.xml","uriBaseId":"%SRCROOT%","index":256}},{"location":{"uri":"javascript/frameworks/ui5/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":257}},{"location":{"uri":"javascript/frameworks/ui5/test/models/source/source1.xml","uriBaseId":"%SRCROOT%","index":258}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/index.html","uriBaseId":"%SRCROOT%","index":259}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":260}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":261}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/index.html","uriBaseId":"%SRCROOT%","index":262}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-deny-all/index.html","uriBaseId":"%SRCROOT%","index":263}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-deny-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":264}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":265}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":266}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":267}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":268}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":269}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":270}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":271}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":272}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":273}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":274}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":275}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":276}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":278}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":279}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":280}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":281}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":282}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":283}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":284}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":285}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":286}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":287}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":288}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":289}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":291}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":292}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":293}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":294}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":295}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":296}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":297}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":298}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":299}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":300}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":301}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":302}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":303}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":304}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":305}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":306}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":307}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":308}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/package-lock.json","uriBaseId":"%SRCROOT%","index":309}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/package.json","uriBaseId":"%SRCROOT%","index":310}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.html","uriBaseId":"%SRCROOT%","index":312}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.js","uriBaseId":"%SRCROOT%","index":313}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/ui5.yaml","uriBaseId":"%SRCROOT%","index":314}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":315}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":316}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":317}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/package-lock.json","uriBaseId":"%SRCROOT%","index":318}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/package.json","uriBaseId":"%SRCROOT%","index":319}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/ui5.yaml","uriBaseId":"%SRCROOT%","index":321}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.html","uriBaseId":"%SRCROOT%","index":322}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.js","uriBaseId":"%SRCROOT%","index":323}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":324}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/package-lock.json","uriBaseId":"%SRCROOT%","index":326}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/package.json","uriBaseId":"%SRCROOT%","index":327}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/ui5.yaml","uriBaseId":"%SRCROOT%","index":328}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.html","uriBaseId":"%SRCROOT%","index":330}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.js","uriBaseId":"%SRCROOT%","index":331}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":332}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":333}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":334}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/package-lock.json","uriBaseId":"%SRCROOT%","index":335}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/package.json","uriBaseId":"%SRCROOT%","index":336}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":337}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/ui5.yaml","uriBaseId":"%SRCROOT%","index":338}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.html","uriBaseId":"%SRCROOT%","index":339}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.js","uriBaseId":"%SRCROOT%","index":340}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":341}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":342}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":343}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/package-lock.json","uriBaseId":"%SRCROOT%","index":344}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/package.json","uriBaseId":"%SRCROOT%","index":345}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/ui5.yaml","uriBaseId":"%SRCROOT%","index":346}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.html","uriBaseId":"%SRCROOT%","index":348}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.js","uriBaseId":"%SRCROOT%","index":349}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":350}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/package-lock.json","uriBaseId":"%SRCROOT%","index":352}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/package.json","uriBaseId":"%SRCROOT%","index":353}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/ui5.yaml","uriBaseId":"%SRCROOT%","index":354}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.html","uriBaseId":"%SRCROOT%","index":356}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.js","uriBaseId":"%SRCROOT%","index":357}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":358}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":362}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":363}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":364}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":365}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":366}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":367}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":368}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":369}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":370}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":371}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":372}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":373}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":374}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":375}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":376}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":377}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":378}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":379}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":381}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":382}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":383}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":384}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":385}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":386}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":387}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":388}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":389}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":390}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":391}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":392}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":393}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":394}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/.eslintrc.json","uriBaseId":"%SRCROOT%","index":396}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/package.json","uriBaseId":"%SRCROOT%","index":397}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/package-lock.json","uriBaseId":"%SRCROOT%","index":398}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/ui5.yaml","uriBaseId":"%SRCROOT%","index":399}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/Component.js","uriBaseId":"%SRCROOT%","index":400}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/index.html","uriBaseId":"%SRCROOT%","index":403}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":404}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/model/todoitems.json","uriBaseId":"%SRCROOT%","index":405}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/AllJourneys.js","uriBaseId":"%SRCROOT%","index":406}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/FilterJourney.js","uriBaseId":"%SRCROOT%","index":407}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/SearchJourney.js","uriBaseId":"%SRCROOT%","index":408}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/TodoListJourney.js","uriBaseId":"%SRCROOT%","index":409}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/arrangements/Startup.js","uriBaseId":"%SRCROOT%","index":410}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.html","uriBaseId":"%SRCROOT%","index":411}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.js","uriBaseId":"%SRCROOT%","index":412}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.html","uriBaseId":"%SRCROOT%","index":413}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":414}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/pages/App.js","uriBaseId":"%SRCROOT%","index":415}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/AllTests.js","uriBaseId":"%SRCROOT%","index":416}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/controller/App.controller.js","uriBaseId":"%SRCROOT%","index":417}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.html","uriBaseId":"%SRCROOT%","index":418}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.js","uriBaseId":"%SRCROOT%","index":419}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/util/Helper.js","uriBaseId":"%SRCROOT%","index":420}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":421}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/package-lock.json","uriBaseId":"%SRCROOT%","index":422}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/package.json","uriBaseId":"%SRCROOT%","index":423}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/ui5.yaml","uriBaseId":"%SRCROOT%","index":424}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":426}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.html","uriBaseId":"%SRCROOT%","index":427}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.js","uriBaseId":"%SRCROOT%","index":428}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":429}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/package-lock.json","uriBaseId":"%SRCROOT%","index":431}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/package.json","uriBaseId":"%SRCROOT%","index":432}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":433}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/ui5.yaml","uriBaseId":"%SRCROOT%","index":434}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":435}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.html","uriBaseId":"%SRCROOT%","index":436}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.js","uriBaseId":"%SRCROOT%","index":437}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":438}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/package-lock.json","uriBaseId":"%SRCROOT%","index":440}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/package.json","uriBaseId":"%SRCROOT%","index":441}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/ui5.yaml","uriBaseId":"%SRCROOT%","index":442}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":443}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":444}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.html","uriBaseId":"%SRCROOT%","index":445}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.js","uriBaseId":"%SRCROOT%","index":446}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":447}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":449}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":450}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":451}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":452}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":453}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":454}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":455}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":456}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":457}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":458}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":459}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":460}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":461}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":462}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":463}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":464}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":465}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":466}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/package-lock.json","uriBaseId":"%SRCROOT%","index":467}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/ui5.yaml","uriBaseId":"%SRCROOT%","index":468}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/package.json","uriBaseId":"%SRCROOT%","index":469}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.html","uriBaseId":"%SRCROOT%","index":470}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.js","uriBaseId":"%SRCROOT%","index":471}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":472}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/package-lock.json","uriBaseId":"%SRCROOT%","index":475}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/package.json","uriBaseId":"%SRCROOT%","index":476}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":477}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":478}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":479}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":480}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":481}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":483}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":484}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":485}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":487}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":488}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":489}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/package-lock.json","uriBaseId":"%SRCROOT%","index":491}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/package.json","uriBaseId":"%SRCROOT%","index":492}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/ui5.yaml","uriBaseId":"%SRCROOT%","index":493}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":494}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.js","uriBaseId":"%SRCROOT%","index":495}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":496}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":497}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/package-lock.json","uriBaseId":"%SRCROOT%","index":498}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/package.json","uriBaseId":"%SRCROOT%","index":499}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/ui5.yaml","uriBaseId":"%SRCROOT%","index":500}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":501}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/model.json","uriBaseId":"%SRCROOT%","index":502}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.html","uriBaseId":"%SRCROOT%","index":503}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.js","uriBaseId":"%SRCROOT%","index":504}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.html","uriBaseId":"%SRCROOT%","index":505}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":506}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/package-lock.json","uriBaseId":"%SRCROOT%","index":508}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/package.json","uriBaseId":"%SRCROOT%","index":509}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":510}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":511}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":512}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":513}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":514}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":515}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/package-lock.json","uriBaseId":"%SRCROOT%","index":516}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/package.json","uriBaseId":"%SRCROOT%","index":517}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":518}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":519}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssBase.js","uriBaseId":"%SRCROOT%","index":520}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":521}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":522}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":523}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":524}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":525}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/package-lock.json","uriBaseId":"%SRCROOT%","index":526}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":527}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/package.json","uriBaseId":"%SRCROOT%","index":528}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":529}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":530}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":531}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":532}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":533}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":534}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/package-lock.json","uriBaseId":"%SRCROOT%","index":535}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/package.json","uriBaseId":"%SRCROOT%","index":536}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":537}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":538}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":539}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":540}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":541}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":542}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/package-lock.json","uriBaseId":"%SRCROOT%","index":543}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/package.json","uriBaseId":"%SRCROOT%","index":544}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/ui5.yaml","uriBaseId":"%SRCROOT%","index":545}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":546}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":547}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":548}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.html","uriBaseId":"%SRCROOT%","index":549}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.js","uriBaseId":"%SRCROOT%","index":550}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":551}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":552}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/package-lock.json","uriBaseId":"%SRCROOT%","index":553}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/package.json","uriBaseId":"%SRCROOT%","index":554}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/ui5.yaml","uriBaseId":"%SRCROOT%","index":555}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":556}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":557}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":558}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.html","uriBaseId":"%SRCROOT%","index":559}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.js","uriBaseId":"%SRCROOT%","index":560}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":561}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/package-lock.json","uriBaseId":"%SRCROOT%","index":562}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":563}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/package.json","uriBaseId":"%SRCROOT%","index":564}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":565}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":566}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":567}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":568}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":569}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":571}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":572}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/.eslintrc.json","uriBaseId":"%SRCROOT%","index":573}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package-lock.json","uriBaseId":"%SRCROOT%","index":574}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package.json","uriBaseId":"%SRCROOT%","index":575}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/public/index.html","uriBaseId":"%SRCROOT%","index":576}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/App.tsx","uriBaseId":"%SRCROOT%","index":577}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/index.tsx","uriBaseId":"%SRCROOT%","index":578}},{"location":{"uri":"javascript/frameworks/xsjs/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":579}},{"location":{"uri":"javascript/frameworks/xsjs/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":580}},{"location":{"uri":"javascript/frameworks/xsjs/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":581}},{"location":{"uri":"javascript/frameworks/xsjs/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":582}},{"location":{"uri":"javascript/frameworks/xsjs/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":583}},{"location":{"uri":"javascript/frameworks/xsjs/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":584}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/.xsaccess","uriBaseId":"%SRCROOT%","index":585}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess","uriBaseId":"%SRCROOT%","index":586}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/missing_auth/.xsaccess","uriBaseId":"%SRCROOT%","index":587}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/service.xsjs","uriBaseId":"%SRCROOT%","index":588}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":589}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593}},{"location":{"uri":"javascript/heuristic-models/tests/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":594}},{"location":{"uri":"javascript/heuristic-models/tests/qlpack.yml","uriBaseId":"%SRCROOT%","index":595}},{"location":{"uri":"qlt.conf.json","uriBaseId":"%SRCROOT%","index":596}},{"location":{"uri":"file:/opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/javascript/tools/data/externs/web/window.js","index":597}},{"location":{"uri":"scripts/CreateTestsFromYaml.py","uriBaseId":"%SRCROOT%","index":598}}],"results":[{"ruleId":"js/missing-rate-limiting","rule":{"id":"js/missing-rate-limiting","index":10,"toolComponent":{"index":1}},"message":{"text":"This route handler performs [a database access](1), but is not rate-limited."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":781,"startColumn":23,"endLine":784,"endColumn":6}}}],"partialFingerprints":{"primaryLocationLineHash":"ac6d3bdd3d52ea9b:1","primaryLocationStartColumnFingerprint":"18"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":7,"endLine":783,"endColumn":9}},"message":{"text":"a database access"}}]},{"ruleId":"js/xss","rule":{"id":"js/xss","index":33,"toolComponent":{"index":1}},"message":{"text":"Cross-site scripting vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":4,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"6311a9ed7e4091a4:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"jQuery. ... param\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":4,"startColumn":20,"endColumn":25}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}}}]},{"ruleId":"js/xss","rule":{"id":"js/xss","index":33,"toolComponent":{"index":1}},"message":{"text":"Cross-site scripting vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":11,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"8e517fc6fdf32a1a:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":11,"startColumn":20,"endColumn":25}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/xss","rule":{"id":"js/xss","index":33,"toolComponent":{"index":1}},"message":{"text":"Cross-site scripting vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":19,"startColumn":20,"endColumn":26}}}],"partialFingerprints":{"primaryLocationLineHash":"c51cf11a085c01f4:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":39,"endColumn":44}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":18,"endColumn":45}},"message":{"text":"jQuery. ... (value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":9,"endColumn":15}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":19,"startColumn":20,"endColumn":26}},"message":{"text":"value1"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/xss","rule":{"id":"js/xss","index":33,"toolComponent":{"index":1}},"message":{"text":"Cross-site scripting vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":27,"startColumn":20,"endColumn":26}}}],"partialFingerprints":{"primaryLocationLineHash":"e309bf8540256a05:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":26,"startColumn":39,"endColumn":44}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":26,"startColumn":18,"endColumn":45}},"message":{"text":"jQuery. ... (value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":26,"startColumn":9,"endColumn":15}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":27,"startColumn":20,"endColumn":26}},"message":{"text":"value1"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/sql-injection","rule":{"id":"js/sql-injection","index":34,"toolComponent":{"index":1}},"message":{"text":"This query string depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"e7f0d59b4cbe0ccc:1","primaryLocationStartColumnFingerprint":"11"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}},"message":{"text":"user-provided value"}}]},{"ruleId":"js/log-injection","rule":{"id":"js/log-injection","index":99,"toolComponent":{"index":1}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":7,"startColumn":18,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"be9a18716e55d497:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}},"message":{"text":"jQuery. ... param\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":7,"startColumn":34,"endColumn":39}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":7,"startColumn":18,"endColumn":41}},"message":{"text":"`[INFO] ... value}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}}}]},{"ruleId":"js/log-injection","rule":{"id":"js/log-injection","index":99,"toolComponent":{"index":1}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":15,"startColumn":18,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"be9a18716e55d497:2","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}},"message":{"text":"req.url"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":13,"endColumn":37}},"message":{"text":"url.par ... , true)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":9,"endColumn":10}},"message":{"text":"q"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":14,"startColumn":17,"endColumn":18}},"message":{"text":"q"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":14,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":15,"startColumn":34,"endColumn":39}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":15,"startColumn":18,"endColumn":41}},"message":{"text":"`[INFO] ... value}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}}}]},{"ruleId":"js/log-injection","rule":{"id":"js/log-injection","index":99,"toolComponent":{"index":1}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":24,"startColumn":18,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"e197b363f9dc3962:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}},"message":{"text":"req.url"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":13,"endColumn":37}},"message":{"text":"url.par ... , true)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":9,"endColumn":10}},"message":{"text":"q"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":22,"startColumn":17,"endColumn":18}},"message":{"text":"q"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":22,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":23,"startColumn":39,"endColumn":44}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":23,"startColumn":18,"endColumn":45}},"message":{"text":"jQuery. ... (value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":23,"startColumn":9,"endColumn":15}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":24,"startColumn":34,"endColumn":40}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":24,"startColumn":18,"endColumn":42}},"message":{"text":"`[INFO] ... alue1}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}}}]},{"ruleId":"js/log-injection","rule":{"id":"js/log-injection","index":99,"toolComponent":{"index":1}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3},"region":{"startLine":5,"startColumn":17,"endColumn":33}}}],"partialFingerprints":{"primaryLocationLineHash":"45280b24f3d81287:1","primaryLocationStartColumnFingerprint":"12"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3},"region":{"startLine":5,"startColumn":17,"endColumn":33}},"message":{"text":"user-provided value"}}]},{"ruleId":"js/ui5-path-injection","rule":{"id":"js/ui5-path-injection","index":0,"toolComponent":{"index":4}},"message":{"text":"The path of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":372},"region":{"startLine":17,"startColumn":43,"endColumn":61}}}],"partialFingerprints":{"primaryLocationLineHash":"68e5ff83e2198ff5:1","primaryLocationStartColumnFingerprint":"26"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":377},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":373},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":372},"region":{"startLine":8,"startColumn":23,"endColumn":38}},"message":{"text":"{ type: \"int\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":372},"region":{"startLine":17,"startColumn":43,"endColumn":61}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":377},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":377},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-path-injection","rule":{"id":"js/ui5-path-injection","index":0,"toolComponent":{"index":4}},"message":{"text":"The path of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":23,"startColumn":43,"endColumn":55}}}],"partialFingerprints":{"primaryLocationLineHash":"b79de9dff4d8f842:1","primaryLocationStartColumnFingerprint":"26"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":386},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":9,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":15,"startColumn":29,"endColumn":47}},"message":{"text":"oControl.getText()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":15,"startColumn":21,"endColumn":26}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":17,"startColumn":53,"endColumn":58}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":17,"startColumn":46,"endColumn":59}},"message":{"text":"String(value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":17,"startColumn":36,"endColumn":60}},"message":{"text":"encodeX ... value))"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":17,"startColumn":21,"endColumn":33}},"message":{"text":"xssSanitized"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":380},"region":{"startLine":23,"startColumn":43,"endColumn":55}},"message":{"text":"xssSanitized"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":386},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":386},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-path-injection","rule":{"id":"js/ui5-path-injection","index":0,"toolComponent":{"index":4}},"message":{"text":"The path of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":390},"region":{"startLine":16,"startColumn":39,"endColumn":67}}}],"partialFingerprints":{"primaryLocationLineHash":"de27f6d546a116e8:1","primaryLocationStartColumnFingerprint":"26"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":390},"region":{"startLine":10,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":390},"region":{"startLine":16,"startColumn":39,"endColumn":67}},"message":{"text":"oModel. ... input')"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-clickjacking","rule":{"id":"js/ui5-clickjacking","index":1,"toolComponent":{"index":4}},"message":{"text":"Possible clickjacking vulnerability due to missing frame options."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/index.html","uriBaseId":"%SRCROOT%","index":262},"region":{"startLine":2,"endColumn":16}}}],"partialFingerprints":{"primaryLocationLineHash":"7fe81114896a63c:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/ui5-clickjacking","rule":{"id":"js/ui5-clickjacking","index":1,"toolComponent":{"index":4}},"message":{"text":"Possible clickjacking vulnerability due to missing frame options."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/index.html","uriBaseId":"%SRCROOT%","index":403},"region":{"startLine":2,"endColumn":16}}}],"partialFingerprints":{"primaryLocationLineHash":"df700c15dad274b2:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/ui5-clickjacking","rule":{"id":"js/ui5-clickjacking","index":1,"toolComponent":{"index":4}},"message":{"text":"Possible clickjacking vulnerability due to window\\[ ... onfig\"\\] being set to `allow`."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/index.html","uriBaseId":"%SRCROOT%","index":259},"region":{"startLine":9,"startColumn":9,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"6152b8f74a1abdf5:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/ui5-clickjacking","rule":{"id":"js/ui5-clickjacking","index":1,"toolComponent":{"index":4}},"message":{"text":"Possible clickjacking vulnerability due to data-sap-ui-frameOptions=allow being set to `allow`."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/index.html","uriBaseId":"%SRCROOT%","index":259},"region":{"startLine":28,"startColumn":34,"endColumn":66}}}],"partialFingerprints":{"primaryLocationLineHash":"b01bd23ca3666824:1","primaryLocationStartColumnFingerprint":"25"}},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":11,"startColumn":19,"endColumn":26}}}],"partialFingerprints":{"primaryLocationLineHash":"83472515fe67207a:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":7,"startColumn":23,"endColumn":42}},"message":{"text":"Log.getLogEntries()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":7,"startColumn":13,"endColumn":20}},"message":{"text":"message"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":11,"startColumn":19,"endColumn":26}},"message":{"text":"message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":24,"startColumn":23,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"de5157ed7a614f91:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":8,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":14,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":14,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":17,"startColumn":19,"endColumn":24}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":20,"startColumn":33,"endColumn":42}},"message":{"text":"oLogEntry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":24,"startColumn":23,"endColumn":32}},"message":{"text":"oLogEntry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":24,"startColumn":23,"endColumn":40}},"message":{"text":"oLogEntry.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":13,"startColumn":19,"endColumn":36}}}],"partialFingerprints":{"primaryLocationLineHash":"d67a8ded95b9934b:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":334},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":9,"startColumn":29,"endColumn":38}},"message":{"text":"oLogEntry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":13,"startColumn":19,"endColumn":28}},"message":{"text":"oLogEntry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":13,"startColumn":19,"endColumn":36}},"message":{"text":"oLogEntry.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":334},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":334},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":13,"startColumn":19,"endColumn":33}}}],"partialFingerprints":{"primaryLocationLineHash":"84768bf2b1d6e5a5:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":9,"startColumn":29,"endColumn":35}},"message":{"text":"oEvent"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":13,"startColumn":19,"endColumn":25}},"message":{"text":"oEvent"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":13,"startColumn":19,"endColumn":33}},"message":{"text":"oEvent.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":11,"startColumn":19,"endColumn":26}}}],"partialFingerprints":{"primaryLocationLineHash":"83472515fe67207a:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":7,"startColumn":23,"endColumn":42}},"message":{"text":"Log.getLogEntries()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":7,"startColumn":13,"endColumn":20}},"message":{"text":"message"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":11,"startColumn":19,"endColumn":26}},"message":{"text":"message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351},"region":{"startLine":5,"startColumn":9,"endLine":24,"endColumn":10}}}],"partialFingerprints":{"primaryLocationLineHash":"fad475448f62563d:1","primaryLocationStartColumnFingerprint":"-139"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351},"region":{"startLine":6,"startColumn":5,"endLine":8,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":15,"startColumn":25,"endColumn":53}},"message":{"text":"oModel. ... input')"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":15,"startColumn":17,"endColumn":22}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":17,"startColumn":34,"endColumn":39}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351},"region":{"startLine":6,"startColumn":5,"endLine":8,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351},"region":{"startLine":6,"startColumn":5,"endLine":8,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":17,"startColumn":34,"endColumn":39}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":7,"startColumn":23,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"20e0edf06769f248:1","primaryLocationStartColumnFingerprint":"14"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":311},"region":{"startLine":18,"startColumn":30,"endColumn":35}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":20,"startColumn":33,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"eb64edf724fde59e:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":8,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":14,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":14,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":17,"startColumn":19,"endColumn":24}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":320},"region":{"startLine":17,"startColumn":19,"endColumn":24}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":9,"startColumn":29,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"eb64edf724fde59e:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":334},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":334},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":334},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":18,"startColumn":30,"endColumn":35}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":9,"startColumn":29,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"e10e4681e4f3a5f2:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":7,"startColumn":23,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"20e0edf06769f248:1","primaryLocationStartColumnFingerprint":"14"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}}}]},{"ruleId":"js/ui5-formula-injection","rule":{"id":"js/ui5-formula-injection","index":4,"toolComponent":{"index":4}},"message":{"text":"The content of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":268},"region":{"startLine":17,"startColumn":27,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"41899ff1a967017d:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":273},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":269},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":268},"region":{"startLine":8,"startColumn":23,"endColumn":38}},"message":{"text":"{ type: \"int\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":268},"region":{"startLine":17,"startColumn":27,"endColumn":45}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":273},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":273},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-formula-injection","rule":{"id":"js/ui5-formula-injection","index":4,"toolComponent":{"index":4}},"message":{"text":"The content of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":23,"startColumn":27,"endColumn":39}}}],"partialFingerprints":{"primaryLocationLineHash":"9afa5fd07ee36af6:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":282},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":278},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":9,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":15,"startColumn":29,"endColumn":47}},"message":{"text":"oControl.getText()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":15,"startColumn":21,"endColumn":26}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":17,"startColumn":53,"endColumn":58}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":17,"startColumn":46,"endColumn":59}},"message":{"text":"String(value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":17,"startColumn":36,"endColumn":60}},"message":{"text":"encodeX ... value))"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":17,"startColumn":21,"endColumn":33}},"message":{"text":"xssSanitized"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":23,"startColumn":27,"endColumn":39}},"message":{"text":"xssSanitized"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":282},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":282},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-formula-injection","rule":{"id":"js/ui5-formula-injection","index":4,"toolComponent":{"index":4}},"message":{"text":"The content of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":286},"region":{"startLine":16,"startColumn":23,"endColumn":51}}}],"partialFingerprints":{"primaryLocationLineHash":"e701acdf85af03b4:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":286},"region":{"startLine":10,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":286},"region":{"startLine":16,"startColumn":23,"endColumn":51}},"message":{"text":"oModel. ... input')"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":16,"startColumn":31,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"3bb21c52eb38cf8:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":9,"startColumn":29,"endColumn":35}},"message":{"text":"oEvent"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":16,"startColumn":31,"endColumn":37}},"message":{"text":"oEvent"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":16,"startColumn":31,"endColumn":45}},"message":{"text":"oEvent.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":5,"startColumn":27,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"92dbc37bdafc7694:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"jQuery. ... param\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":5,"startColumn":27,"endColumn":32}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":12,"startColumn":27,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"faa1832c387d2ee5:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":12,"startColumn":27,"endColumn":32}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":20,"startColumn":27,"endColumn":33}}}],"partialFingerprints":{"primaryLocationLineHash":"8291f53a2e235d15:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":39,"endColumn":44}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":18,"endColumn":45}},"message":{"text":"jQuery. ... (value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":9,"endColumn":15}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":20,"startColumn":27,"endColumn":33}},"message":{"text":"value1"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402},"region":{"startLine":132,"startColumn":7,"endLine":134,"endColumn":16}}}],"partialFingerprints":{"primaryLocationLineHash":"63ace7b071639814:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":23,"startColumn":25,"endColumn":48}},"message":{"text":"oSearch ... Value()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":23,"startColumn":11,"endColumn":22}},"message":{"text":"searchValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":27,"startColumn":34,"endColumn":45}},"message":{"text":"searchValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402},"region":{"startLine":17,"startColumn":13,"endColumn":31}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402},"region":{"startLine":133,"startColumn":8,"endColumn":27}},"message":{"text":"oControl.getTitle()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402},"region":{"startLine":132,"startColumn":7,"endLine":134,"endColumn":16}},"message":{"text":"\"T ...
\""}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":23,"startColumn":25,"endColumn":48}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":23,"startColumn":25,"endColumn":48}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425},"region":{"startLine":14,"startColumn":23,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"fc87b07640e9d85:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":426},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425},"region":{"startLine":7,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425},"region":{"startLine":14,"startColumn":23,"endColumn":41}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":433},"region":{"startLine":14,"startColumn":32,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"352d5eac262ae765:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":435},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":433},"region":{"startLine":7,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":433},"region":{"startLine":14,"startColumn":32,"endColumn":50}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":443},"region":{"startLine":14,"startColumn":28,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"352d5ec8b0c3bb0d:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":444},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":443},"region":{"startLine":7,"startColumn":19,"endColumn":37}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":443},"region":{"startLine":14,"startColumn":28,"endColumn":46}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":27,"startColumn":36,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"8ceecee7055f4fa2:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":26,"startColumn":25,"endColumn":42}},"message":{"text":"oInput.getValue()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":26,"startColumn":17,"endColumn":22}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":27,"startColumn":36,"endColumn":41}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":26,"startColumn":25,"endColumn":42}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":26,"startColumn":25,"endColumn":42}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":521},"region":{"startLine":8,"startColumn":28,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"353ad97f4bff4eae:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":525},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":522},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssBase.js","uriBaseId":"%SRCROOT%","index":520},"region":{"startLine":5,"startColumn":15,"endColumn":33}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":521},"region":{"startLine":8,"startColumn":28,"endColumn":46}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":525},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":525},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":546},"region":{"startLine":8,"startColumn":28,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"353ad97f4bff4eae:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":552},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":548},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":547},"region":{"startLine":7,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":546},"region":{"startLine":8,"startColumn":28,"endColumn":46}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":552},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":552},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":556},"region":{"startLine":8,"startColumn":28,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"353ad97f4bff4eae:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":563},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":557},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":558},"region":{"startLine":7,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":556},"region":{"startLine":8,"startColumn":28,"endColumn":46}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":563},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":563},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":534},"region":{"startLine":21,"startColumn":22,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"93df5ec84a8a106e:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":534},"region":{"startLine":18,"startColumn":20,"endColumn":30}},"message":{"text":"/input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":530},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":534},"region":{"startLine":21,"startColumn":22,"endColumn":32}},"message":{"text":"/input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":534},"region":{"startLine":18,"startColumn":20,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":534},"region":{"startLine":18,"startColumn":20,"endColumn":30}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":8,"startColumn":5,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"74b35e217af6aa05:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":286},"region":{"startLine":10,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":8,"startColumn":5,"endColumn":50}},"message":{"text":"content={/input}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473},"region":{"startLine":9,"startColumn":5,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"9caa0f252fbe2993:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":31,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":9,"startColumn":25,"endColumn":53}},"message":{"text":"oModel. ... input')"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":9,"startColumn":17,"endColumn":22}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":10,"startColumn":44,"endColumn":49}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":32,"startColumn":17,"endColumn":30}},"message":{"text":"output1: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473},"region":{"startLine":9,"startColumn":5,"endColumn":40}},"message":{"text":"content={/output1}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473},"region":{"startLine":17,"startColumn":5,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"2963bbd458e69924:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":18,"startColumn":31,"endColumn":60}},"message":{"text":"oEvent. ... Value()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":18,"startColumn":17,"endColumn":28}},"message":{"text":"sInputValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":19,"startColumn":44,"endColumn":55}},"message":{"text":"sInputValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":34,"startColumn":17,"endColumn":30}},"message":{"text":"output3: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":473},"region":{"startLine":17,"startColumn":5,"endColumn":40}},"message":{"text":"content={/output3}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":18,"startColumn":31,"endColumn":60}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":18,"startColumn":31,"endColumn":60}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":30,"startColumn":5,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"711f70e4b3e36d36:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":27,"startColumn":5,"endLine":29,"endColumn":30}},"message":{"text":"value={/input0}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":478},"region":{"startLine":9,"startColumn":17,"endColumn":29}},"message":{"text":"input0: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":30,"startColumn":5,"endColumn":38}},"message":{"text":"content={/input0}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":27,"startColumn":5,"endLine":29,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":27,"startColumn":5,"endLine":29,"endColumn":30}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":45,"startColumn":5,"endColumn":60}}}],"partialFingerprints":{"primaryLocationLineHash":"8d13cc83b72acee:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":42,"startColumn":5,"endLine":44,"endColumn":30}},"message":{"text":"value={/input3}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":478},"region":{"startLine":12,"startColumn":17,"endColumn":29}},"message":{"text":"input3: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":45,"startColumn":5,"endColumn":60}},"message":{"text":"content={/input3}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":42,"startColumn":5,"endLine":44,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":42,"startColumn":5,"endLine":44,"endColumn":30}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":50,"startColumn":5,"endColumn":82}}}],"partialFingerprints":{"primaryLocationLineHash":"4698f735d8a1f320:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":47,"startColumn":5,"endLine":49,"endColumn":30}},"message":{"text":"value={/input4}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":478},"region":{"startLine":13,"startColumn":17,"endColumn":29}},"message":{"text":"input4: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":50,"startColumn":5,"endColumn":82}},"message":{"text":"content={/input4}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":47,"startColumn":5,"endLine":49,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":47,"startColumn":5,"endLine":49,"endColumn":30}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":58,"startColumn":5,"endColumn":66}}}],"partialFingerprints":{"primaryLocationLineHash":"bb503c8d5e14583a:1","primaryLocationStartColumnFingerprint":"0"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":58,"startColumn":5,"endColumn":66}},"message":{"text":"user-provided value"}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490},"region":{"startLine":8,"startColumn":5,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"1406455ac263a2d9:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486},"region":{"startLine":12,"startColumn":26,"endColumn":46}},"message":{"text":"new JSONModel(oData)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490},"region":{"startLine":8,"startColumn":5,"endColumn":38}},"message":{"text":"content={/output}"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486},"region":{"startLine":15,"startColumn":25,"endColumn":53}},"message":{"text":"oModel. ... input')"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486},"region":{"startLine":15,"startColumn":17,"endColumn":22}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486},"region":{"startLine":16,"startColumn":43,"endColumn":48}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":486},"region":{"startLine":10,"startColumn":17,"endColumn":29}},"message":{"text":"output: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490},"region":{"startLine":8,"startColumn":5,"endColumn":38}},"message":{"text":"content={/output}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":490},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":8,"startColumn":5,"endColumn":37}}}],"partialFingerprints":{"primaryLocationLineHash":"97b29ed20ac04ff0:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":501},"region":{"startLine":8,"startColumn":40,"endColumn":63}},"message":{"text":"\"contro ... l.json\""}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":8,"startColumn":5,"endColumn":37}},"message":{"text":"content={/input}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":515},"region":{"startLine":8,"startColumn":11,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"5edd24be658b61a4:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":515},"region":{"startLine":5,"startColumn":11,"endColumn":32}},"message":{"text":"data-value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":511},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":515},"region":{"startLine":8,"startColumn":11,"endColumn":34}},"message":{"text":"data-content={/input}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":515},"region":{"startLine":5,"startColumn":11,"endColumn":32}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":515},"region":{"startLine":5,"startColumn":11,"endColumn":32}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1).\nXSS vulnerability due to [user-provided value](2)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":22,"startColumn":5,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"6e0d8f690e30e24a:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":8,"startColumn":5,"endLine":10,"endColumn":27}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":566},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":22,"startColumn":5,"endColumn":38}},"message":{"text":"content={/input}"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":15,"startColumn":5,"endLine":18,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":566},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":22,"startColumn":5,"endColumn":38}},"message":{"text":"content={/input}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":8,"startColumn":5,"endLine":10,"endColumn":27}},"message":{"text":"user-provided value"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":15,"startColumn":5,"endLine":18,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":8,"startColumn":5,"endLine":10,"endColumn":27}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":570},"region":{"startLine":15,"startColumn":5,"endLine":18,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":542},"region":{"startLine":13,"startColumn":15,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"91ab068baa94c999:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":542},"region":{"startLine":9,"startColumn":13,"endColumn":23}},"message":{"text":"\"value\": \"{/input}\""}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":538},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":542},"region":{"startLine":13,"startColumn":15,"endColumn":25}},"message":{"text":"\"content\": \"{/input}\""}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":542},"region":{"startLine":9,"startColumn":13,"endColumn":23}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":542},"region":{"startLine":9,"startColumn":13,"endColumn":23}}}]},{"ruleId":"js/cap-log-injection","rule":{"id":"js/cap-log-injection","index":0,"toolComponent":{"index":8}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":9,"startColumn":32,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"7c291d40b7c61d4f:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":35,"endColumn":43}},"message":{"text":"msg.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":15,"endColumn":32}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":17,"endColumn":30}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":9,"startColumn":32,"endColumn":45}},"message":{"text":"messageToPass"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":35,"endColumn":43}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":35,"endColumn":43}}}]},{"ruleId":"js/cap-log-injection","rule":{"id":"js/cap-log-injection","index":0,"toolComponent":{"index":8}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":9,"startColumn":32,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"7c291d40b7c61d4f:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":39,"endColumn":47}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":19,"endColumn":36}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":21,"endColumn":34}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":9,"startColumn":38,"endColumn":51}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":9,"startColumn":36,"endColumn":53}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":6,"startColumn":29,"endColumn":32}},"message":{"text":"msg"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":7,"startColumn":35,"endColumn":38}},"message":{"text":"msg"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":7,"startColumn":15,"endColumn":32}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":7,"startColumn":17,"endColumn":30}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":9,"startColumn":32,"endColumn":45}},"message":{"text":"messageToPass"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":39,"endColumn":47}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":39,"endColumn":47}}}]},{"ruleId":"js/cap-log-injection","rule":{"id":"js/cap-log-injection","index":0,"toolComponent":{"index":8}},"message":{"text":"Log entry depends on a [user-provided value](1).\nLog entry depends on a [user-provided value](2)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":9,"startColumn":32,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"7c291d40b7c61d4f:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":39,"endColumn":47}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":19,"endColumn":36}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":21,"endColumn":34}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":9,"startColumn":38,"endColumn":51}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":9,"startColumn":36,"endColumn":53}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":6,"startColumn":29,"endColumn":32}},"message":{"text":"msg"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":7,"startColumn":35,"endColumn":38}},"message":{"text":"msg"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":7,"startColumn":15,"endColumn":32}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":7,"startColumn":17,"endColumn":30}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":9,"startColumn":32,"endColumn":45}},"message":{"text":"messageToPass"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":7,"startColumn":35,"endColumn":43}},"message":{"text":"msg.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":7,"startColumn":15,"endColumn":32}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":7,"startColumn":17,"endColumn":30}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":9,"startColumn":32,"endColumn":45}},"message":{"text":"messageToPass"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":39,"endColumn":47}},"message":{"text":"user-provided value"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":7,"startColumn":35,"endColumn":43}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":39,"endColumn":47}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":7,"startColumn":35,"endColumn":43}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":15,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"77d560033d30e171:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":48,"endColumn":58}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":15,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"8ebfcdb6d8e3226a:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":20,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":20,"startColumn":48,"endColumn":58}},"message":{"text":"`ID=` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":20,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":20,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"d00fe3143fd387fc:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":26,"startColumn":54,"endColumn":56}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":26,"startColumn":48,"endColumn":58}},"message":{"text":"`ID=${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":26,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":26,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":38,"startColumn":7,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"29bf643a411d8976:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":38,"startColumn":42,"endColumn":44}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":38,"startColumn":33,"endColumn":44}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":38,"startColumn":33,"endColumn":44}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":43,"startColumn":7,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"ef21b26f64e7e417:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":43,"startColumn":42,"endColumn":44}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":43,"startColumn":33,"endColumn":44}},"message":{"text":"`ID =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":43,"startColumn":33,"endColumn":44}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":48,"startColumn":7,"endColumn":44}}}],"partialFingerprints":{"primaryLocationLineHash":"9d03b555ff929ea0:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":48,"startColumn":39,"endColumn":41}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":48,"startColumn":33,"endColumn":43}},"message":{"text":"`ID=${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":48,"startColumn":33,"endColumn":43}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":7,"endColumn":78}}}],"partialFingerprints":{"primaryLocationLineHash":"b7f3fae4cc5d3224:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":49,"endColumn":55}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":33,"endColumn":55}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":75,"endColumn":77}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":63,"endColumn":77}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":33,"endColumn":55}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":63,"endColumn":77}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":7,"endColumn":78}}}],"partialFingerprints":{"primaryLocationLineHash":"6a3ab8595760f6c0:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":49,"endColumn":55}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":33,"endColumn":55}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":75,"endColumn":77}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":63,"endColumn":77}},"message":{"text":"`col1 = ` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":33,"endColumn":55}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":63,"endColumn":77}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":7,"endColumn":78}}}],"partialFingerprints":{"primaryLocationLineHash":"342691d0eacbdb40:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":49,"endColumn":55}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":33,"endColumn":55}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":73,"endColumn":75}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":63,"endColumn":77}},"message":{"text":"`col1 = ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":33,"endColumn":55}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":63,"endColumn":77}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":88,"startColumn":7,"endColumn":76}}}],"partialFingerprints":{"primaryLocationLineHash":"e84c1b8cf5608a54:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":88,"startColumn":49,"endColumn":55}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":88,"startColumn":33,"endColumn":55}},"message":{"text":"\"col1 = ... amount"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":88,"startColumn":33,"endColumn":55}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":123,"startColumn":7,"endColumn":47}}}],"partialFingerprints":{"primaryLocationLineHash":"c8e83fb2aff22206:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":123,"startColumn":44,"endColumn":46}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":123,"startColumn":35,"endColumn":46}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":123,"startColumn":35,"endColumn":46}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":128,"startColumn":7,"endColumn":47}}}],"partialFingerprints":{"primaryLocationLineHash":"980ed798eb9fd08f:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":128,"startColumn":44,"endColumn":46}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":128,"startColumn":35,"endColumn":46}},"message":{"text":"`ID =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":128,"startColumn":35,"endColumn":46}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":133,"startColumn":7,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"580b744db9ff8fbe:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":133,"startColumn":43,"endColumn":45}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":133,"startColumn":35,"endColumn":47}},"message":{"text":"`ID = ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":133,"startColumn":35,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":13,"endColumn":58}}}],"partialFingerprints":{"primaryLocationLineHash":"d28f5758e8f2b020:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":55,"endColumn":57}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":47,"endColumn":57}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":13,"endColumn":58}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":7,"endColumn":58}},"message":{"text":"await S ... \" + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":7,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":13,"endColumn":58}}}],"partialFingerprints":{"primaryLocationLineHash":"39e9cbf3cbd9ae3c:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":55,"endColumn":57}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":47,"endColumn":57}},"message":{"text":"`ID=` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":13,"endColumn":58}},"message":{"text":"SELECT. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":7,"endColumn":58}},"message":{"text":"await S ... ` + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":7,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":13,"endColumn":58}}}],"partialFingerprints":{"primaryLocationLineHash":"b86271478f0d53f6:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":53,"endColumn":55}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":47,"endColumn":57}},"message":{"text":"`ID=${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":13,"endColumn":58}},"message":{"text":"SELECT. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":7,"endColumn":58}},"message":{"text":"await S ... ${id}`)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":7,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":13,"endColumn":88}}}],"partialFingerprints":{"primaryLocationLineHash":"12cb305ba21e438f:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":66,"endColumn":68}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":47,"endColumn":68}},"message":{"text":"\"col1 = ... \" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":13,"endColumn":88}},"message":{"text":"UPDATE. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":7,"endColumn":88}},"message":{"text":"await U ... \" + id)"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":85,"endColumn":87}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":76,"endColumn":87}},"message":{"text":"\"ID =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":13,"endColumn":88}},"message":{"text":"UPDATE. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":7,"endColumn":88}},"message":{"text":"await U ... \" + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":7,"endColumn":88}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":13,"endColumn":88}}}],"partialFingerprints":{"primaryLocationLineHash":"16a5323b901d361b:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":66,"endColumn":68}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":47,"endColumn":68}},"message":{"text":"\"col1 = ... \" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":13,"endColumn":88}},"message":{"text":"UPDATE. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":7,"endColumn":88}},"message":{"text":"await U ... ` + id)"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":85,"endColumn":87}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":76,"endColumn":87}},"message":{"text":"`ID =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":13,"endColumn":88}},"message":{"text":"UPDATE. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":7,"endColumn":88}},"message":{"text":"await U ... ` + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":7,"endColumn":88}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":13,"endColumn":89}}}],"partialFingerprints":{"primaryLocationLineHash":"ec3b26f51764a997:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":66,"endColumn":68}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":47,"endColumn":68}},"message":{"text":"\"col1 = ... \" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":13,"endColumn":89}},"message":{"text":"UPDATE. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":7,"endColumn":89}},"message":{"text":"await U ... ${id}`)"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":84,"endColumn":86}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":76,"endColumn":88}},"message":{"text":"`ID = ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":13,"endColumn":89}},"message":{"text":"UPDATE. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":7,"endColumn":89}},"message":{"text":"await U ... ${id}`)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":7,"endColumn":89}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":13,"endColumn":87}}}],"partialFingerprints":{"primaryLocationLineHash":"1ab4a8658ea07927:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":66,"endColumn":68}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":47,"endColumn":68}},"message":{"text":"\"col1 = ... \" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":13,"endColumn":87}},"message":{"text":"UPDATE. ... ${id}`"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":7,"endColumn":87}},"message":{"text":"await U ... ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":7,"endColumn":87}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":13,"endColumn":59}}}],"partialFingerprints":{"primaryLocationLineHash":"c191f9b82574b477:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":47,"endColumn":58}},"message":{"text":"\"ID =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":13,"endColumn":59}},"message":{"text":"DELETE. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":7,"endColumn":59}},"message":{"text":"await D ... \" + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":7,"endColumn":59}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":13,"endColumn":59}}}],"partialFingerprints":{"primaryLocationLineHash":"28ec6e53085bb293:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":47,"endColumn":58}},"message":{"text":"`ID =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":13,"endColumn":59}},"message":{"text":"DELETE. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":7,"endColumn":59}},"message":{"text":"await D ... ` + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":7,"endColumn":59}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":13,"endColumn":60}}}],"partialFingerprints":{"primaryLocationLineHash":"a76513a6cb8f584d:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":55,"endColumn":57}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":47,"endColumn":59}},"message":{"text":"`ID = ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":13,"endColumn":60}},"message":{"text":"DELETE. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":7,"endColumn":60}},"message":{"text":"await D ... ${id}`)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":7,"endColumn":60}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":254,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"e396e28dff49f821:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":253,"startColumn":63,"endColumn":65}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":253,"startColumn":55,"endColumn":65}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":253,"startColumn":21,"endColumn":66}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":253,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":254,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":259,"startColumn":7,"endColumn":53}}}],"partialFingerprints":{"primaryLocationLineHash":"4710d78c10aa291b:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":259,"startColumn":50,"endColumn":52}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":259,"startColumn":41,"endColumn":52}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":259,"startColumn":41,"endColumn":52}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":7,"endColumn":86}}}],"partialFingerprints":{"primaryLocationLineHash":"6f850daa3f58c276:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":57,"endColumn":63}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":41,"endColumn":63}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":83,"endColumn":85}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":71,"endColumn":85}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":41,"endColumn":63}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":71,"endColumn":85}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":284,"startColumn":7,"endColumn":55}}}],"partialFingerprints":{"primaryLocationLineHash":"b9f8b15603ad6b38:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":284,"startColumn":52,"endColumn":54}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":284,"startColumn":43,"endColumn":54}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":284,"startColumn":43,"endColumn":54}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":292,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"d576c66caddc969a:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":291,"startColumn":63,"endColumn":65}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":291,"startColumn":55,"endColumn":65}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":291,"startColumn":21,"endColumn":66}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":291,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":292,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":298,"startColumn":7,"endColumn":57}}}],"partialFingerprints":{"primaryLocationLineHash":"3b0cd005704d307:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":298,"startColumn":54,"endColumn":56}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":298,"startColumn":45,"endColumn":56}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":298,"startColumn":45,"endColumn":56}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":7,"endColumn":90}}}],"partialFingerprints":{"primaryLocationLineHash":"a2422d95f31b0028:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":61,"endColumn":67}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":45,"endColumn":67}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":87,"endColumn":89}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":75,"endColumn":89}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":45,"endColumn":67}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":75,"endColumn":89}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":328,"startColumn":7,"endColumn":59}}}],"partialFingerprints":{"primaryLocationLineHash":"53b68a547e06f5f5:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":328,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":328,"startColumn":47,"endColumn":58}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":328,"startColumn":47,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":336,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"ef4fafb0cb633d3e:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":335,"startColumn":72,"endColumn":74}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":335,"startColumn":28,"endColumn":74}},"message":{"text":"\"SELECT ... =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":335,"startColumn":21,"endColumn":75}},"message":{"text":"cds.ql( ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":335,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":336,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":343,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"70bf4adf3ece4680:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":342,"startColumn":72,"endColumn":74}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":342,"startColumn":28,"endColumn":74}},"message":{"text":"`SELECT ... =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":342,"startColumn":21,"endColumn":75}},"message":{"text":"cds.ql( ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":342,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":343,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":350,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"b17718767883cb21:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":349,"startColumn":71,"endColumn":73}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":349,"startColumn":28,"endColumn":75}},"message":{"text":"`SELECT ... ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":349,"startColumn":21,"endColumn":76}},"message":{"text":"cds.ql( ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":349,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":350,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":364,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"a684f52297f0c4e5:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":363,"startColumn":72,"endColumn":74}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":363,"startColumn":35,"endColumn":74}},"message":{"text":"\"SELECT ... =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":363,"startColumn":21,"endColumn":75}},"message":{"text":"cds.par ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":363,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":364,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":370,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"d550e0002cd278da:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":369,"startColumn":72,"endColumn":74}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":369,"startColumn":35,"endColumn":74}},"message":{"text":"`SELECT ... =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":369,"startColumn":21,"endColumn":75}},"message":{"text":"cds.par ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":369,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":370,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":376,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"6a27aa8587353580:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":375,"startColumn":71,"endColumn":73}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":375,"startColumn":35,"endColumn":75}},"message":{"text":"`SELECT ... ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":375,"startColumn":21,"endColumn":76}},"message":{"text":"cds.par ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":375,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":376,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":389,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"69fde7291c8fc74e:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":388,"startColumn":62,"endColumn":64}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":388,"startColumn":25,"endColumn":64}},"message":{"text":"\"SELECT ... =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":388,"startColumn":21,"endColumn":65}},"message":{"text":"CQL(\"SE ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":388,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":389,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":395,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"98c9d206b1717b43:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":394,"startColumn":62,"endColumn":64}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":394,"startColumn":25,"endColumn":64}},"message":{"text":"`SELECT ... =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":394,"startColumn":21,"endColumn":65}},"message":{"text":"CQL(`SE ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":394,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":395,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":401,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"d013e7d9793c061d:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":400,"startColumn":61,"endColumn":63}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":400,"startColumn":25,"endColumn":65}},"message":{"text":"`SELECT ... ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":400,"startColumn":21,"endColumn":66}},"message":{"text":"CQL(`SE ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":400,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":401,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":415,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"3fb9a1da0acd43ae:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":414,"startColumn":58,"endColumn":60}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":414,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":415,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":422,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"80716f714482c84f:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":421,"startColumn":58,"endColumn":60}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":421,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":422,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":429,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"442267e255b8b54f:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":428,"startColumn":57,"endColumn":59}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":428,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":429,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":438,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"9e2cec8d31f74921:1","primaryLocationStartColumnFingerprint":"7"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":436,"startColumn":63,"endColumn":65}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":436,"startColumn":55,"endColumn":65}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":436,"startColumn":21,"endColumn":66}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":436,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":438,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":446,"startColumn":9,"endColumn":53}}}],"partialFingerprints":{"primaryLocationLineHash":"73ba3ff2097c8fd1:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":446,"startColumn":50,"endColumn":52}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":446,"startColumn":41,"endColumn":52}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":446,"startColumn":41,"endColumn":52}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":9,"endColumn":86}}}],"partialFingerprints":{"primaryLocationLineHash":"b6b098d76a485f57:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":57,"endColumn":63}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":41,"endColumn":63}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":83,"endColumn":85}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":71,"endColumn":85}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":41,"endColumn":63}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":71,"endColumn":85}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":486,"startColumn":9,"endColumn":55}}}],"partialFingerprints":{"primaryLocationLineHash":"930f7b78e736551b:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":486,"startColumn":52,"endColumn":54}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":486,"startColumn":43,"endColumn":54}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":486,"startColumn":43,"endColumn":54}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":495,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"cd8266cd9539b760:1","primaryLocationStartColumnFingerprint":"7"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":493,"startColumn":63,"endColumn":65}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":493,"startColumn":55,"endColumn":65}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":493,"startColumn":21,"endColumn":66}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":493,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":495,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":502,"startColumn":9,"endColumn":53}}}],"partialFingerprints":{"primaryLocationLineHash":"5298b55f76bd7434:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":502,"startColumn":50,"endColumn":52}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":502,"startColumn":41,"endColumn":52}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":502,"startColumn":41,"endColumn":52}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":9,"endColumn":86}}}],"partialFingerprints":{"primaryLocationLineHash":"f72e0c4e0d3cd372:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":57,"endColumn":63}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":41,"endColumn":63}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":83,"endColumn":85}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":71,"endColumn":85}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":41,"endColumn":63}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":71,"endColumn":85}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":537,"startColumn":9,"endColumn":55}}}],"partialFingerprints":{"primaryLocationLineHash":"d38ceeef8a2ac936:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":537,"startColumn":52,"endColumn":54}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":537,"startColumn":43,"endColumn":54}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":537,"startColumn":43,"endColumn":54}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":546,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"e46cd48130ebf859:1","primaryLocationStartColumnFingerprint":"7"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":544,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":544,"startColumn":48,"endColumn":58}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":544,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":544,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":546,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":553,"startColumn":9,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"ecbeb50b953c6892:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":553,"startColumn":43,"endColumn":45}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":553,"startColumn":34,"endColumn":45}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":553,"startColumn":34,"endColumn":45}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":9,"endColumn":79}}}],"partialFingerprints":{"primaryLocationLineHash":"558b998facd3da37:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":50,"endColumn":56}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":34,"endColumn":56}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":76,"endColumn":78}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":64,"endColumn":78}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":34,"endColumn":56}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":64,"endColumn":78}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":588,"startColumn":9,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"91becd2fa07cdcc9:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":588,"startColumn":45,"endColumn":47}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":588,"startColumn":36,"endColumn":47}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":588,"startColumn":36,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":597,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"fb574234cc9e3952:1","primaryLocationStartColumnFingerprint":"7"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":595,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":595,"startColumn":48,"endColumn":58}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":595,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":595,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":597,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":604,"startColumn":9,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"ecbeb50b995e8367:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":604,"startColumn":43,"endColumn":45}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":604,"startColumn":34,"endColumn":45}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":604,"startColumn":34,"endColumn":45}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":9,"endColumn":79}}}],"partialFingerprints":{"primaryLocationLineHash":"558b998facd3da37:2","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":50,"endColumn":56}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":34,"endColumn":56}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":76,"endColumn":78}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":64,"endColumn":78}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":34,"endColumn":56}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":64,"endColumn":78}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":639,"startColumn":9,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"91becd2fa09975ba:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":639,"startColumn":45,"endColumn":47}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":639,"startColumn":36,"endColumn":47}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":639,"startColumn":36,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":647,"startColumn":18,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"1e42917dcc40a599:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":646,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":646,"startColumn":48,"endColumn":58}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":646,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":646,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":647,"startColumn":18,"endColumn":23}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":653,"startColumn":18,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"e6651c34faab8e22:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":652,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":652,"startColumn":48,"endColumn":58}},"message":{"text":"`ID=` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":652,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":652,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":653,"startColumn":18,"endColumn":23}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":659,"startColumn":18,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"35109df28cbbc5c:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":658,"startColumn":54,"endColumn":56}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":658,"startColumn":48,"endColumn":58}},"message":{"text":"`ID=${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":658,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":658,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":659,"startColumn":18,"endColumn":23}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":670,"startColumn":7,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"efbe9cdee9ed72b8:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":670,"startColumn":45,"endColumn":47}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":670,"startColumn":36,"endColumn":47}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":670,"startColumn":36,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":675,"startColumn":7,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"3a884df2f960d319:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":675,"startColumn":45,"endColumn":47}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":675,"startColumn":36,"endColumn":47}},"message":{"text":"`ID =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":675,"startColumn":36,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":680,"startColumn":7,"endColumn":47}}}],"partialFingerprints":{"primaryLocationLineHash":"693c1ad544283ec3:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":680,"startColumn":42,"endColumn":44}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":680,"startColumn":36,"endColumn":46}},"message":{"text":"`ID=${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":680,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":7,"endColumn":81}}}],"partialFingerprints":{"primaryLocationLineHash":"737ffeac7015e49f:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":52,"endColumn":58}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":36,"endColumn":58}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":78,"endColumn":80}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":66,"endColumn":80}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":36,"endColumn":58}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":66,"endColumn":80}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":7,"endColumn":80}}}],"partialFingerprints":{"primaryLocationLineHash":"68fb2832260c17eb:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":52,"endColumn":58}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":36,"endColumn":58}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":77,"endColumn":79}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":66,"endColumn":79}},"message":{"text":"`col1 =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":36,"endColumn":58}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":66,"endColumn":79}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":7,"endColumn":81}}}],"partialFingerprints":{"primaryLocationLineHash":"c05bb3983bd0ec24:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":52,"endColumn":58}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":36,"endColumn":58}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":76,"endColumn":78}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":66,"endColumn":80}},"message":{"text":"`col1 = ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":36,"endColumn":58}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":66,"endColumn":80}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":720,"startColumn":7,"endColumn":79}}}],"partialFingerprints":{"primaryLocationLineHash":"a5013b756880128f:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":720,"startColumn":52,"endColumn":58}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":720,"startColumn":36,"endColumn":58}},"message":{"text":"\"col1 = ... amount"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":720,"startColumn":36,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":755,"startColumn":7,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"aa17f3fb0e89ad00:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":755,"startColumn":47,"endColumn":49}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":755,"startColumn":38,"endColumn":49}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":755,"startColumn":38,"endColumn":49}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":760,"startColumn":7,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"52425ca44df0fb9c:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":760,"startColumn":47,"endColumn":49}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":760,"startColumn":38,"endColumn":49}},"message":{"text":"`ID =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":760,"startColumn":38,"endColumn":49}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":765,"startColumn":7,"endColumn":51}}}],"partialFingerprints":{"primaryLocationLineHash":"abfa3b0ed80d2aef:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":765,"startColumn":46,"endColumn":48}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":765,"startColumn":38,"endColumn":50}},"message":{"text":"`ID = ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":765,"startColumn":38,"endColumn":50}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":22,"startColumn":36,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"d2d019c78ead4486:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":12,"startColumn":38,"endColumn":52}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":12,"startColumn":28,"endColumn":53}},"message":{"text":"decodeU ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":12,"startColumn":19,"endColumn":25}},"message":{"text":"taint1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":22,"startColumn":36,"endColumn":42}},"message":{"text":"taint1"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":24,"startColumn":40,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"808bce90854ae867:1","primaryLocationStartColumnFingerprint":"27"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":14,"startColumn":47,"endColumn":61}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":14,"startColumn":28,"endColumn":62}},"message":{"text":"decodeU ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":14,"startColumn":19,"endColumn":25}},"message":{"text":"taint2"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":24,"startColumn":40,"endColumn":46}},"message":{"text":"taint2"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":26,"startColumn":34,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"afb5d6b9785b49d5:1","primaryLocationStartColumnFingerprint":"21"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":16,"startColumn":34,"endColumn":48}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":16,"startColumn":28,"endColumn":49}},"message":{"text":"local(u ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":16,"startColumn":19,"endColumn":25}},"message":{"text":"taint3"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":26,"startColumn":34,"endColumn":40}},"message":{"text":"taint3"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":28,"startColumn":34,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"bb2ecd3739649840:1","primaryLocationStartColumnFingerprint":"21"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":18,"startColumn":34,"endColumn":48}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":18,"startColumn":28,"endColumn":49}},"message":{"text":"isdir(u ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":18,"startColumn":19,"endColumn":25}},"message":{"text":"taint4"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":28,"startColumn":34,"endColumn":40}},"message":{"text":"taint4"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":30,"startColumn":40,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"63e729e91fdc10d2:1","primaryLocationStartColumnFingerprint":"27"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":20,"startColumn":35,"endColumn":49}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":20,"startColumn":28,"endColumn":50}},"message":{"text":"isfile( ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":20,"startColumn":19,"endColumn":25}},"message":{"text":"taint5"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":30,"startColumn":40,"endColumn":46}},"message":{"text":"taint5"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":31,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"84f3986f7255c726:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":31,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":33,"startColumn":38,"endColumn":47}}}],"partialFingerprints":{"primaryLocationLineHash":"7f1379ebf3dd2fef:1","primaryLocationStartColumnFingerprint":"25"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":33,"startColumn":38,"endColumn":47}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file read."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":34,"startColumn":24,"endColumn":33}}}],"partialFingerprints":{"primaryLocationLineHash":"45cd294f7937b77e:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":34,"startColumn":24,"endColumn":33}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":36,"startColumn":44,"endColumn":53}}}],"partialFingerprints":{"primaryLocationLineHash":"15c5f129eb53b929:1","primaryLocationStartColumnFingerprint":"31"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":36,"startColumn":44,"endColumn":53}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in tainted data being written to a file."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":37,"startColumn":25,"endColumn":37}}}],"partialFingerprints":{"primaryLocationLineHash":"f976670d2acc6fb9:1","primaryLocationStartColumnFingerprint":"12"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":9,"startColumn":34,"endColumn":45}},"message":{"text":"req.headers"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":9,"startColumn":19,"endColumn":31}},"message":{"text":"userinputtwo"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":37,"startColumn":25,"endColumn":37}},"message":{"text":"userinputtwo"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":9,"startColumn":34,"endColumn":45}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":38,"startColumn":25,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"7608589b7693ec5e:1","primaryLocationStartColumnFingerprint":"12"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":38,"startColumn":25,"endColumn":34}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":40,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"9efda1281fa0866d:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":40,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":41,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"66f493d838c437b1:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":41,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":43,"startColumn":25,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"8f73a0930e234a4e:1","primaryLocationStartColumnFingerprint":"12"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":43,"startColumn":25,"endColumn":34}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":44,"startColumn":25,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"d6c22993642b7f91:1","primaryLocationStartColumnFingerprint":"12"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":44,"startColumn":25,"endColumn":34}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":46,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"a8a6e2d6350921ee:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":46,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":47,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"434bdd8f18e7c7d:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":47,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":49,"startColumn":22,"endColumn":31}}}],"partialFingerprints":{"primaryLocationLineHash":"8ecbfdc82d65a76d:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":49,"startColumn":22,"endColumn":31}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":50,"startColumn":22,"endColumn":31}}}],"partialFingerprints":{"primaryLocationLineHash":"62c405a97e577740:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":50,"startColumn":22,"endColumn":31}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-non-prod-auth-strategy","rule":{"id":"js/cap-non-prod-auth-strategy","index":3,"toolComponent":{"index":8}},"message":{"text":"Current authentication strategy contains [credentials of mocked users](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159},"region":{"startLine":17,"startColumn":18,"endLine":32,"endColumn":10}}}],"partialFingerprints":{"primaryLocationLineHash":"189356aa691178ee:1","primaryLocationStartColumnFingerprint":"9"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159},"region":{"startLine":17,"startColumn":18,"endLine":32,"endColumn":10}},"message":{"text":"credentials of mocked users"}}]},{"ruleId":"js/cap-non-prod-auth-strategy","rule":{"id":"js/cap-non-prod-auth-strategy","index":3,"toolComponent":{"index":8}},"message":{"text":"Non-production authentication strategy [basic](1) is used."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159},"region":{"startLine":16,"startColumn":17,"endColumn":24}}}],"partialFingerprints":{"primaryLocationLineHash":"8ec70b5c261c793b:1","primaryLocationStartColumnFingerprint":"8"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159},"region":{"startLine":16,"startColumn":17,"endColumn":24}},"message":{"text":"basic"}}]},{"ruleId":"js/cap-non-prod-auth-strategy","rule":{"id":"js/cap-non-prod-auth-strategy","index":3,"toolComponent":{"index":8}},"message":{"text":"Non-production authentication strategy [dummy](1) is used."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json","uriBaseId":"%SRCROOT%","index":169},"region":{"startLine":15,"startColumn":15,"endColumn":22}}}],"partialFingerprints":{"primaryLocationLineHash":"2a27bf058be4572:1","primaryLocationStartColumnFingerprint":"8"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json","uriBaseId":"%SRCROOT%","index":169},"region":{"startLine":15,"startColumn":15,"endColumn":22}},"message":{"text":"dummy"}}]},{"ruleId":"js/cap-non-prod-auth-strategy","rule":{"id":"js/cap-non-prod-auth-strategy","index":3,"toolComponent":{"index":8}},"message":{"text":"Non-production authentication strategy [mocked](1) is used."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json","uriBaseId":"%SRCROOT%","index":175},"region":{"startLine":21,"startColumn":15,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"2af5230c91e6a4cd:1","primaryLocationStartColumnFingerprint":"8"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json","uriBaseId":"%SRCROOT%","index":175},"region":{"startLine":21,"startColumn":15,"endColumn":23}},"message":{"text":"mocked"}}]},{"ruleId":"js/cap-default-user-is-privileged","rule":{"id":"js/cap-default-user-is-privileged","index":4,"toolComponent":{"index":8}},"message":{"text":"The default user is being overridden to a privileged user."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/server.js","uriBaseId":"%SRCROOT%","index":142},"region":{"startLine":8,"endColumn":37}}}],"partialFingerprints":{"primaryLocationLineHash":"b6ec748aef5ccec4:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/cap-default-user-is-privileged","rule":{"id":"js/cap-default-user-is-privileged","index":4,"toolComponent":{"index":8}},"message":{"text":"The default user is being overridden to a privileged user."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.js","uriBaseId":"%SRCROOT%","index":144},"region":{"startLine":14,"startColumn":7,"endColumn":43}}}],"partialFingerprints":{"primaryLocationLineHash":"2c0c554bf5b5f7d:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/cap-default-user-is-privileged","rule":{"id":"js/cap-default-user-is-privileged","index":4,"toolComponent":{"index":8}},"message":{"text":"The default user is being overridden to a privileged user."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.js","uriBaseId":"%SRCROOT%","index":146},"region":{"startLine":12,"startColumn":5,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"ee143e9aad9c9a16:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":18,"startColumn":24,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"62915c8622048073:1","primaryLocationStartColumnFingerprint":"11"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156},"region":{"startLine":18,"startColumn":21,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"383e73b4014710f9:1","primaryLocationStartColumnFingerprint":"12"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156},"region":{"startLine":35,"startColumn":21,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"383e73b4014710f9:2","primaryLocationStartColumnFingerprint":"12"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":33,"startColumn":24,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"8c5c989d244a1f09:1","primaryLocationStartColumnFingerprint":"11"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":50,"startColumn":25,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"faab9436420ec8fd:1","primaryLocationStartColumnFingerprint":"12"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":67,"startColumn":25,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"8eb12b95cf4128eb:1","primaryLocationStartColumnFingerprint":"12"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that may require authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":83,"startColumn":24,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"9343d25bdd5ba748:1","primaryLocationStartColumnFingerprint":"11"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS entity `Service1.Service1Entity1` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":151},"region":{"startLine":6,"startColumn":10,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"3984db8d11cdcda4:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service1.send2` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":151},"region":{"startLine":18,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"28b66b32406f07ba:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service1.send3` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":151},"region":{"startLine":23,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"a5382f0f9fda534:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service1.send4` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":151},"region":{"startLine":28,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"ebf09aafb38c42ae:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service1.send5` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":151},"region":{"startLine":33,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"65cd9b8a9955401b:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS entity `Service2.Service2Entity1` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":6,"startColumn":10,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"b02237ac8be3c990:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service2.send1` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":13,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"d2bdf8ef231dddd1:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS service `Service` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199},"region":{"startLine":3,"startColumn":9,"endColumn":16}}}],"partialFingerprints":{"primaryLocationLineHash":"a2294454385cb916:1","primaryLocationStartColumnFingerprint":"8"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS entity `Service.ServiceEntity` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199},"region":{"startLine":5,"startColumn":10,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"d5a18811944e0c6:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service.send` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199},"region":{"startLine":8,"startColumn":10,"endColumn":14}}}],"partialFingerprints":{"primaryLocationLineHash":"e6b459744cc3d70d:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-sensitive-log","rule":{"id":"js/cap-sensitive-log","index":7,"toolComponent":{"index":8}},"message":{"text":"Log entry depends on the [name](1) field which is annotated as potentially sensitive."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.js","uriBaseId":"%SRCROOT%","index":238},"region":{"startLine":9,"startColumn":32,"endColumn":43}}}],"partialFingerprints":{"primaryLocationLineHash":"c2d27f652a20308e:1","primaryLocationStartColumnFingerprint":"23"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds","uriBaseId":"%SRCROOT%","index":237},"region":{"startLine":4,"startColumn":5,"endColumn":9}},"message":{"text":"name"}}]},{"ruleId":"js/xsjs-broken-authentication","rule":{"id":"js/xsjs-broken-authentication","index":0,"toolComponent":{"index":9}},"message":{"text":"Authentication should not be disabled."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess","uriBaseId":"%SRCROOT%","index":586},"region":{"startLine":3,"startColumn":23,"endColumn":27}}}],"partialFingerprints":{"primaryLocationLineHash":"a900cae7399fb257:1","primaryLocationStartColumnFingerprint":"18"}},{"ruleId":"js/xsjs-broken-authentication","rule":{"id":"js/xsjs-broken-authentication","index":0,"toolComponent":{"index":9}},"message":{"text":"Authentication is missing from the configuration."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/missing_auth/.xsaccess","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":1,"endLine":4,"endColumn":2}}}],"partialFingerprints":{"primaryLocationLineHash":"b57c6bae252883be:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/xsjs-broken-authentication","rule":{"id":"js/xsjs-broken-authentication","index":0,"toolComponent":{"index":9}},"message":{"text":"Authentication should not be disabled."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":589},"region":{"startLine":3,"startColumn":29,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"7c987b52e21935f7:1","primaryLocationStartColumnFingerprint":"24"}},{"ruleId":"js/xsjs-broken-authentication","rule":{"id":"js/xsjs-broken-authentication","index":0,"toolComponent":{"index":9}},"message":{"text":"Authentication should not be disabled."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":589},"region":{"startLine":15,"startColumn":35,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"f2aa90ab66c52c3c:1","primaryLocationStartColumnFingerprint":"22"}},{"ruleId":"js/xsjs-reflected-xss","rule":{"id":"js/xsjs-reflected-xss","index":1,"toolComponent":{"index":9}},"message":{"text":"Reflected XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":13,"startColumn":22,"endColumn":66}}}],"partialFingerprints":{"primaryLocationLineHash":"a31830db0e0a3d3c:1","primaryLocationStartColumnFingerprint":"19"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":11,"startColumn":29,"endColumn":68}},"message":{"text":"request ... eter1\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":11,"startColumn":7,"endColumn":26}},"message":{"text":"someParameterValue1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":13,"startColumn":46,"endColumn":65}},"message":{"text":"someParameterValue1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":3,"startColumn":34,"endColumn":51}},"message":{"text":"requestParameters"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":4,"startColumn":20,"endColumn":37}},"message":{"text":"requestParameters"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":4,"startColumn":10,"endColumn":48}},"message":{"text":"\"\" ...
\""}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":13,"startColumn":22,"endColumn":66}},"message":{"text":"request ... Value1)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":11,"startColumn":29,"endColumn":68}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":11,"startColumn":29,"endColumn":68}}}]},{"ruleId":"js/xsjs-url-redirect","rule":{"id":"js/xsjs-url-redirect","index":2,"toolComponent":{"index":9}},"message":{"text":"[This URL](1) depends on a [user-provided value](2)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":9,"startColumn":38,"endColumn":56}}}],"partialFingerprints":{"primaryLocationLineHash":"f02e3e17e12824b3:1","primaryLocationStartColumnFingerprint":"35"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":7,"startColumn":28,"endColumn":66}},"message":{"text":"request ... meter\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":7,"startColumn":7,"endColumn":25}},"message":{"text":"someParameterValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":9,"startColumn":38,"endColumn":56}},"message":{"text":"someParameterValue"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":9,"startColumn":38,"endColumn":56}},"message":{"text":"This URL"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":7,"startColumn":28,"endColumn":66}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":7,"startColumn":28,"endColumn":66}}}]},{"ruleId":"js/xsjs-sql-injection","rule":{"id":"js/xsjs-sql-injection","index":3,"toolComponent":{"index":9}},"message":{"text":"This query depends on a [user-provided value](1).\nThis query depends on a [user-provided value](2)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":13,"startColumn":57,"endColumn":62}}}],"partialFingerprints":{"primaryLocationLineHash":"65aa43aa4e46559c:1","primaryLocationStartColumnFingerprint":"54"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":8,"startColumn":40,"endColumn":79}},"message":{"text":"request ... eter1\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":8,"startColumn":29,"endColumn":80}},"message":{"text":"JSON.pa ... ter1\"))"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":8,"startColumn":7,"endColumn":26}},"message":{"text":"someParameterValue1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":10,"startColumn":32,"endColumn":51}},"message":{"text":"someParameterValue1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":10,"startColumn":7,"endColumn":12}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":13,"startColumn":57,"endColumn":62}},"message":{"text":"query"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":9,"startColumn":40,"endColumn":79}},"message":{"text":"request ... eter2\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":9,"startColumn":29,"endColumn":80}},"message":{"text":"JSON.pa ... ter2\"))"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":9,"startColumn":7,"endColumn":26}},"message":{"text":"someParameterValue2"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":10,"startColumn":82,"endColumn":101}},"message":{"text":"someParameterValue2"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":10,"startColumn":7,"endColumn":12}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":13,"startColumn":57,"endColumn":62}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":8,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":9,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":8,"startColumn":40,"endColumn":79}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":9,"startColumn":40,"endColumn":79}}}]},{"ruleId":"js/xsjs-zip-slip","rule":{"id":"js/xsjs-zip-slip","index":4,"toolComponent":{"index":9}},"message":{"text":"The path of [this zip file](1) being saved depends on a [user-provided value](2).\nThe path of [this zip file](1) being saved depends on a [user-provided value](3).\nThe path of [this zip file](1) being saved depends on a [user-provided value](4).\nThe path of [this zip file](1) being saved depends on a [user-provided value](5).\nThe path of [this zip file](1) being saved depends on a [user-provided value](6).\nThe path of [this zip file](1) being saved depends on a [user-provided value](7).\nThe path of [this zip file](1) being saved depends on a [user-provided value](8).\nThe path of [this zip file](1) being saved depends on a [user-provided value](9).\nThe path of [this zip file](1) being saved depends on a [user-provided value](10).\nThe path of [this zip file](1) being saved depends on a [user-provided value](11).\nThe path of [this zip file](1) being saved depends on a [user-provided value](12).\nThe path of [this zip file](1) being saved depends on a [user-provided value](13).\nThe path of [this zip file](1) being saved depends on a [user-provided value](14).\nThe path of [this zip file](1) being saved depends on a [user-provided value](15).\nThe path of [this zip file](1) being saved depends on a [user-provided value](16).\nThe path of [this zip file](1) being saved depends on a [user-provided value](17).\nThe path of [this zip file](1) being saved depends on a [user-provided value](18).\nThe path of [this zip file](1) being saved depends on a [user-provided value](19).\nThe path of [this zip file](1) being saved depends on a [user-provided value](20).\nThe path of [this zip file](1) being saved depends on a [user-provided value](21).\nThe path of [this zip file](1) being saved depends on a [user-provided value](22).\nThe path of [this zip file](1) being saved depends on a [user-provided value](23).\nThe path of [this zip file](1) being saved depends on a [user-provided value](24).\nThe path of [this zip file](1) being saved depends on a [user-provided value](25).\nThe path of [this zip file](1) being saved depends on a [user-provided value](26).\nThe path of [this zip file](1) being saved depends on a [user-provided value](27).\nThe path of [this zip file](1) being saved depends on a [user-provided value](28).\nThe path of [this zip file](1) being saved depends on a [user-provided value](29).\nThe path of [this zip file](1) being saved depends on a [user-provided value](30).\nThe path of [this zip file](1) being saved depends on a [user-provided value](31).\nThe path of [this zip file](1) being saved depends on a [user-provided value](32).\nThe path of [this zip file](1) being saved depends on a [user-provided value](33).\nThe path of [this zip file](1) being saved depends on a [user-provided value](34).\nThe path of [this zip file](1) being saved depends on a [user-provided value](35).\nThe path of [this zip file](1) being saved depends on a [user-provided value](36).\nThe path of [this zip file](1) being saved depends on a [user-provided value](37).\nThe path of [this zip file](1) being saved depends on a [user-provided value](38).\nThe path of [this zip file](1) being saved depends on a [user-provided value](39).\nThe path of [this zip file](1) being saved depends on a [user-provided value](40).\nThe path of [this zip file](1) being saved depends on a [user-provided value](41).\nThe path of [this zip file](1) being saved depends on a [user-provided value](42).\nThe path of [this zip file](1) being saved depends on a [user-provided value](43)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":12,"startColumn":37,"endColumn":51}}}],"partialFingerprints":{"primaryLocationLineHash":"54d432c04bb48c9c:1","primaryLocationStartColumnFingerprint":"32"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}},"message":{"text":"jQuery. ... param\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":7,"startColumn":20,"endColumn":63}},"message":{"text":"new $.u ... ffer())"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":7,"startColumn":7,"endColumn":17}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":10,"startColumn":25,"endColumn":35}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":65,"endColumn":74}},"message":{"text":"entryPath"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":26,"endColumn":75}},"message":{"text":"require ... ryPath)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":9,"endColumn":23}},"message":{"text":"targetFilePath"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"targetFilePath"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}},"message":{"text":"req.url"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":7,"startColumn":20,"endColumn":63}},"message":{"text":"new $.u ... ffer())"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":7,"startColumn":7,"endColumn":17}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":10,"startColumn":25,"endColumn":35}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":65,"endColumn":74}},"message":{"text":"entryPath"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":26,"endColumn":75}},"message":{"text":"require ... ryPath)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":9,"endColumn":23}},"message":{"text":"targetFilePath"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"targetFilePath"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}},"message":{"text":"req.url"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":7,"startColumn":20,"endColumn":63}},"message":{"text":"new $.u ... ffer())"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":7,"startColumn":7,"endColumn":17}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":10,"startColumn":25,"endColumn":35}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":65,"endColumn":74}},"message":{"text":"entryPath"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":26,"endColumn":75}},"message":{"text":"require ... ryPath)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":9,"endColumn":23}},"message":{"text":"targetFilePath"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"targetFilePath"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}},"message":{"text":"req2.params.category"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":7,"startColumn":20,"endColumn":63}},"message":{"text":"new $.u ... ffer())"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":7,"startColumn":7,"endColumn":17}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":10,"startColumn":25,"endColumn":35}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":65,"endColumn":74}},"message":{"text":"entryPath"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":26,"endColumn":75}},"message":{"text":"require ... ryPath)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":11,"startColumn":9,"endColumn":23}},"message":{"text":"targetFilePath"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"targetFilePath"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"this zip file"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"id":3,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}},"message":{"text":"user-provided value"}},{"id":4,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}},"message":{"text":"user-provided value"}},{"id":5,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}},"message":{"text":"user-provided value"}},{"id":6,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"id":7,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"id":8,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":34}},"message":{"text":"user-provided value"}},{"id":9,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"id":10,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":34}},"message":{"text":"user-provided value"}},{"id":11,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"id":12,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":34}},"message":{"text":"user-provided value"}},{"id":13,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":414},"region":{"startLine":6,"startColumn":18,"endColumn":26}},"message":{"text":"user-provided value"}},{"id":14,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":414},"region":{"startLine":6,"startColumn":49,"endColumn":57}},"message":{"text":"user-provided value"}},{"id":15,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":11,"startColumn":29,"endColumn":68}},"message":{"text":"user-provided value"}},{"id":16,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":11,"startColumn":29,"endColumn":50}},"message":{"text":"user-provided value"}},{"id":17,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":21,"startColumn":29,"endColumn":68}},"message":{"text":"user-provided value"}},{"id":18,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":21,"startColumn":29,"endColumn":50}},"message":{"text":"user-provided value"}},{"id":19,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":31,"startColumn":29,"endColumn":68}},"message":{"text":"user-provided value"}},{"id":20,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":590},"region":{"startLine":31,"startColumn":29,"endColumn":50}},"message":{"text":"user-provided value"}},{"id":21,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":8,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":22,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":8,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":23,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":9,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":24,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":9,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":25,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":23,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":26,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":23,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":27,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":24,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":28,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":24,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":29,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":37,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":30,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":37,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":31,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":38,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":32,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":38,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":33,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":52,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":34,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":52,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":35,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":53,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":36,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":591},"region":{"startLine":53,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":37,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":7,"startColumn":28,"endColumn":66}},"message":{"text":"user-provided value"}},{"id":38,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":7,"startColumn":28,"endColumn":49}},"message":{"text":"user-provided value"}},{"id":39,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":16,"startColumn":28,"endColumn":66}},"message":{"text":"user-provided value"}},{"id":40,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":592},"region":{"startLine":16,"startColumn":28,"endColumn":49}},"message":{"text":"user-provided value"}},{"id":41,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":593},"region":{"startLine":1,"startColumn":19,"endColumn":33}},"message":{"text":"user-provided value"}},{"id":42,"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3},"region":{"startLine":5,"startColumn":17,"endColumn":33}},"message":{"text":"user-provided value"}},{"id":43,"physicalLocation":{"artifactLocation":{"uri":"file:/opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/javascript/tools/data/externs/web/window.js","index":597},"region":{"startLine":56,"startColumn":5,"endColumn":13}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}}}]},{"ruleId":"js/xsjs-disabled-csrf-protection","rule":{"id":"js/xsjs-disabled-csrf-protection","index":5,"toolComponent":{"index":9}},"message":{"text":"CSRF protection is missing from the configuration."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess","uriBaseId":"%SRCROOT%","index":586},"region":{"startLine":1,"endLine":4,"endColumn":2}}}],"partialFingerprints":{"primaryLocationLineHash":"c1675fd626f895bf:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/xsjs-disabled-csrf-protection","rule":{"id":"js/xsjs-disabled-csrf-protection","index":5,"toolComponent":{"index":9}},"message":{"text":"CSRF protection should not be disabled."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":589},"region":{"startLine":14,"startColumn":31,"endColumn":36}}}],"partialFingerprints":{"primaryLocationLineHash":"c66a379bed25dd74:1","primaryLocationStartColumnFingerprint":"18"}}],"newlineSequences":["\r\n","\n","
","
"],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest","metricResults":[{"rule":{"id":"js/summary/lines-of-user-code","index":100,"toolComponent":{"index":1}},"ruleId":"js/summary/lines-of-user-code","value":17874,"baseline":11847},{"rule":{"id":"js/summary/lines-of-code","index":101,"toolComponent":{"index":1}},"ruleId":"js/summary/lines-of-code","value":26289}],"codeqlConfigSummary":{"disableDefaultQueries":false,"queries":[{"type":"builtinSuite","uses":"security-extended"},{"type":"localQuery","uses":"./javascript/frameworks/ui5/src/codeql-suites/javascript-security-extended.qls"},{"type":"localQuery","uses":"./javascript/frameworks/cap/src/codeql-suites/javascript-security-extended.qls"},{"type":"localQuery","uses":"./javascript/frameworks/xsjs/src/codeql-suites/javascript-security-extended.qls"}]},"jobRunUuid":"eeb2c78c-450f-4874-b5c9-5a44bb171ffc"}}]}
\ No newline at end of file
+{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"CodeQL","organization":"GitHub","semanticVersion":"2.23.8","notifications":[{"id":"cli/expected-extracted-files/javascript","name":"cli/expected-extracted-files/javascript","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"],"languageDisplayName":"JavaScript"}},{"id":"cli/expected-extracted-files/actions","name":"cli/expected-extracted-files/actions","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"],"languageDisplayName":"GitHub Actions"}},{"id":"cli/expected-extracted-files/typescript","name":"cli/expected-extracted-files/typescript","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"],"languageDisplayName":"TypeScript"}},{"id":"cli/expected-extracted-files/python","name":"cli/expected-extracted-files/python","shortDescription":{"text":"Expected extracted files"},"fullDescription":{"text":"Files appearing in the source archive that are expected to be extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["expected-extracted-files","telemetry"],"languageDisplayName":"Python"}},{"id":"cli/platform","name":"cli/platform","shortDescription":{"text":"Platform"},"fullDescription":{"text":"Platform"},"defaultConfiguration":{"enabled":true}},{"id":"codeql-action/bundle-download-telemetry","name":"codeql-action/bundle-download-telemetry","shortDescription":{"text":"CodeQL bundle download telemetry"},"fullDescription":{"text":"CodeQL bundle download telemetry"},"defaultConfiguration":{"enabled":true}}],"rules":[]},"extensions":[{"name":"generated/extension-pack","semanticVersion":"0.0.0","locations":[{"uri":"file:///home/runner/work/_temp/codeql-database/javascript/temp/extension-pack/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/_temp/codeql-database/javascript/temp/extension-pack/codeql-pack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}],"properties":{"isCodeQLModelPack":true}},{"name":"codeql/javascript-queries","semanticVersion":"2.2.3+28b6aa8616a393ebb45186e3ba4df004a0f3ef4e","notifications":[{"id":"js/diagnostics/successfully-extracted-files","name":"js/diagnostics/successfully-extracted-files","shortDescription":{"text":"Extracted files"},"fullDescription":{"text":"Lists all files in the source code directory that were extracted."},"defaultConfiguration":{"enabled":true},"properties":{"tags":["successfully-extracted-files"],"description":"Lists all files in the source code directory that were extracted.","id":"js/diagnostics/successfully-extracted-files","kind":"diagnostic","name":"Extracted files"}},{"id":"js/diagnostics/extraction-errors","name":"js/diagnostics/extraction-errors","shortDescription":{"text":"Extraction errors"},"fullDescription":{"text":"List all extraction errors for files in the source code directory."},"defaultConfiguration":{"enabled":true},"properties":{"description":"List all extraction errors for files in the source code directory.","id":"js/diagnostics/extraction-errors","kind":"diagnostic","name":"Extraction errors"}}],"rules":[{"id":"js/clear-text-logging","name":"js/clear-text-logging","shortDescription":{"text":"Clear-text logging of sensitive information"},"fullDescription":{"text":"Logging sensitive information without encryption or hashing can expose it to an attacker."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Clear-text logging of sensitive information\nIf sensitive data is written to a log entry it could be exposed to an attacker who gains access to the logs.\n\nPotential attackers can obtain sensitive user data when the log output is displayed. Additionally that data may expose system information such as full path names, system information, and sometimes usernames and passwords.\n\n\n## Recommendation\nSensitive data should not be logged.\n\n\n## Example\nIn the example the entire process environment is logged using \\`console.info\\`. Regular users of the production deployed application should not have access to this much information about the environment configuration.\n\n\n```javascript\n// BAD: Logging cleartext sensitive data\nconsole.info(`[INFO] Environment: ${JSON.stringify(process.env)}`);\n\n```\nIn the second example the data that is logged is not sensitive.\n\n\n```javascript\nlet not_sensitive_data = { a: 1, b : 2} \n// GOOD: it is fine to log data that is not sensitive\nconsole.info(`[INFO] Some object contains: ${JSON.stringify(not_sensitive_data)}`);\n```\n\n## References\n* OWASP: [Insertion of Sensitive Information into Log File](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/).\n* Common Weakness Enumeration: [CWE-312](https://cwe.mitre.org/data/definitions/312.html).\n* Common Weakness Enumeration: [CWE-359](https://cwe.mitre.org/data/definitions/359.html).\n* Common Weakness Enumeration: [CWE-532](https://cwe.mitre.org/data/definitions/532.html).\n","markdown":"# Clear-text logging of sensitive information\nIf sensitive data is written to a log entry it could be exposed to an attacker who gains access to the logs.\n\nPotential attackers can obtain sensitive user data when the log output is displayed. Additionally that data may expose system information such as full path names, system information, and sometimes usernames and passwords.\n\n\n## Recommendation\nSensitive data should not be logged.\n\n\n## Example\nIn the example the entire process environment is logged using \\`console.info\\`. Regular users of the production deployed application should not have access to this much information about the environment configuration.\n\n\n```javascript\n// BAD: Logging cleartext sensitive data\nconsole.info(`[INFO] Environment: ${JSON.stringify(process.env)}`);\n\n```\nIn the second example the data that is logged is not sensitive.\n\n\n```javascript\nlet not_sensitive_data = { a: 1, b : 2} \n// GOOD: it is fine to log data that is not sensitive\nconsole.info(`[INFO] Some object contains: ${JSON.stringify(not_sensitive_data)}`);\n```\n\n## References\n* OWASP: [Insertion of Sensitive Information into Log File](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/).\n* Common Weakness Enumeration: [CWE-312](https://cwe.mitre.org/data/definitions/312.html).\n* Common Weakness Enumeration: [CWE-359](https://cwe.mitre.org/data/definitions/359.html).\n* Common Weakness Enumeration: [CWE-532](https://cwe.mitre.org/data/definitions/532.html).\n"},"properties":{"tags":["security","external/cwe/cwe-312","external/cwe/cwe-359","external/cwe/cwe-532"],"description":"Logging sensitive information without encryption or hashing can\n expose it to an attacker.","id":"js/clear-text-logging","kind":"path-problem","name":"Clear-text logging of sensitive information","precision":"high","problem.severity":"error","security-severity":"7.5"}},{"id":"js/clear-text-storage-of-sensitive-data","name":"js/clear-text-storage-of-sensitive-data","shortDescription":{"text":"Clear text storage of sensitive information"},"fullDescription":{"text":"Sensitive information stored without encryption or hashing can expose it to an attacker."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Clear text storage of sensitive information\nSensitive information that is stored unencrypted is accessible to an attacker who gains access to the storage. This is particularly important for cookies, which are stored on the machine of the end-user.\n\n\n## Recommendation\nEnsure that sensitive information is always encrypted before being stored. If possible, avoid placing sensitive information in cookies altogether. Instead, prefer storing, in the cookie, a key that can be used to look up the sensitive information.\n\nIn general, decrypt sensitive information only at the point where it is necessary for it to be used in cleartext.\n\nBe aware that external processes often store the `standard out` and `standard error` streams of the application, causing logged sensitive information to be stored as well.\n\n\n## Example\nThe following example code stores user credentials (in this case, their password) in a cookie in plain text:\n\n\n```javascript\nvar express = require('express');\n\nvar app = express();\napp.get('/remember-password', function (req, res) {\n let pw = req.param(\"current_password\");\n // BAD: Setting a cookie value with cleartext sensitive data.\n res.cookie(\"password\", pw);\n});\n\n```\nInstead, the credentials should be encrypted, for instance by using the Node.js `crypto` module:\n\n\n```javascript\nvar express = require('express');\nvar crypto = require('crypto'),\n password = getPassword();\n\nfunction encrypt(text){\n var cipher = crypto.createCipher('aes-256-ctr', password);\n return cipher.update(text, 'utf8', 'hex') + cipher.final('hex');\n}\n\nvar app = express();\napp.get('/remember-password', function (req, res) {\n let pw = req.param(\"current_password\");\n // GOOD: Encoding the value before setting it.\n res.cookie(\"password\", encrypt(pw));\n});\n\n```\n\n## References\n* M. Dowd, J. McDonald and J. Schuhm, *The Art of Software Security Assessment*, 1st Edition, Chapter 2 - 'Common Vulnerabilities of Encryption', p. 43. Addison Wesley, 2006.\n* M. Howard and D. LeBlanc, *Writing Secure Code*, 2nd Edition, Chapter 9 - 'Protecting Secret Data', p. 299. Microsoft, 2002.\n* Common Weakness Enumeration: [CWE-312](https://cwe.mitre.org/data/definitions/312.html).\n* Common Weakness Enumeration: [CWE-315](https://cwe.mitre.org/data/definitions/315.html).\n* Common Weakness Enumeration: [CWE-359](https://cwe.mitre.org/data/definitions/359.html).\n","markdown":"# Clear text storage of sensitive information\nSensitive information that is stored unencrypted is accessible to an attacker who gains access to the storage. This is particularly important for cookies, which are stored on the machine of the end-user.\n\n\n## Recommendation\nEnsure that sensitive information is always encrypted before being stored. If possible, avoid placing sensitive information in cookies altogether. Instead, prefer storing, in the cookie, a key that can be used to look up the sensitive information.\n\nIn general, decrypt sensitive information only at the point where it is necessary for it to be used in cleartext.\n\nBe aware that external processes often store the `standard out` and `standard error` streams of the application, causing logged sensitive information to be stored as well.\n\n\n## Example\nThe following example code stores user credentials (in this case, their password) in a cookie in plain text:\n\n\n```javascript\nvar express = require('express');\n\nvar app = express();\napp.get('/remember-password', function (req, res) {\n let pw = req.param(\"current_password\");\n // BAD: Setting a cookie value with cleartext sensitive data.\n res.cookie(\"password\", pw);\n});\n\n```\nInstead, the credentials should be encrypted, for instance by using the Node.js `crypto` module:\n\n\n```javascript\nvar express = require('express');\nvar crypto = require('crypto'),\n password = getPassword();\n\nfunction encrypt(text){\n var cipher = crypto.createCipher('aes-256-ctr', password);\n return cipher.update(text, 'utf8', 'hex') + cipher.final('hex');\n}\n\nvar app = express();\napp.get('/remember-password', function (req, res) {\n let pw = req.param(\"current_password\");\n // GOOD: Encoding the value before setting it.\n res.cookie(\"password\", encrypt(pw));\n});\n\n```\n\n## References\n* M. Dowd, J. McDonald and J. Schuhm, *The Art of Software Security Assessment*, 1st Edition, Chapter 2 - 'Common Vulnerabilities of Encryption', p. 43. Addison Wesley, 2006.\n* M. Howard and D. LeBlanc, *Writing Secure Code*, 2nd Edition, Chapter 9 - 'Protecting Secret Data', p. 299. Microsoft, 2002.\n* Common Weakness Enumeration: [CWE-312](https://cwe.mitre.org/data/definitions/312.html).\n* Common Weakness Enumeration: [CWE-315](https://cwe.mitre.org/data/definitions/315.html).\n* Common Weakness Enumeration: [CWE-359](https://cwe.mitre.org/data/definitions/359.html).\n"},"properties":{"tags":["security","external/cwe/cwe-312","external/cwe/cwe-315","external/cwe/cwe-359"],"description":"Sensitive information stored without encryption or hashing can expose it to an\n attacker.","id":"js/clear-text-storage-of-sensitive-data","kind":"path-problem","name":"Clear text storage of sensitive information","precision":"high","problem.severity":"error","security-severity":"7.5"}},{"id":"js/build-artifact-leak","name":"js/build-artifact-leak","shortDescription":{"text":"Storage of sensitive information in build artifact"},"fullDescription":{"text":"Including sensitive information in a build artifact can expose it to an attacker."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Storage of sensitive information in build artifact\nSensitive information included in a build artifact can allow an attacker to access the sensitive information if the artifact is published.\n\n\n## Recommendation\nOnly store information that is meant to be publicly available in a build artifact.\n\n\n## Example\nThe following example creates a `webpack` configuration that inserts all environment variables from the host into the build artifact:\n\n\n```javascript\nconst webpack = require(\"webpack\");\n\nmodule.exports = [{\n plugins: [\n new webpack.DefinePlugin({\n \"process.env\": JSON.stringify(process.env)\n })\n ]\n}];\n```\nThe environment variables might include API keys or other sensitive information, and the build-system should instead insert only the environment variables that are supposed to be public.\n\nThe issue has been fixed below, where only the `DEBUG` environment variable is inserted into the artifact.\n\n\n```javascript\nconst webpack = require(\"webpack\");\n\nmodule.exports = [{\n plugins: [\n new webpack.DefinePlugin({\n 'process.env': JSON.stringify({ DEBUG: process.env.DEBUG })\n })\n ]\n}];\n\n```\n\n## References\n* webpack: [DefinePlugin API](https://webpack.js.org/plugins/define-plugin/).\n* Common Weakness Enumeration: [CWE-312](https://cwe.mitre.org/data/definitions/312.html).\n* Common Weakness Enumeration: [CWE-315](https://cwe.mitre.org/data/definitions/315.html).\n* Common Weakness Enumeration: [CWE-359](https://cwe.mitre.org/data/definitions/359.html).\n","markdown":"# Storage of sensitive information in build artifact\nSensitive information included in a build artifact can allow an attacker to access the sensitive information if the artifact is published.\n\n\n## Recommendation\nOnly store information that is meant to be publicly available in a build artifact.\n\n\n## Example\nThe following example creates a `webpack` configuration that inserts all environment variables from the host into the build artifact:\n\n\n```javascript\nconst webpack = require(\"webpack\");\n\nmodule.exports = [{\n plugins: [\n new webpack.DefinePlugin({\n \"process.env\": JSON.stringify(process.env)\n })\n ]\n}];\n```\nThe environment variables might include API keys or other sensitive information, and the build-system should instead insert only the environment variables that are supposed to be public.\n\nThe issue has been fixed below, where only the `DEBUG` environment variable is inserted into the artifact.\n\n\n```javascript\nconst webpack = require(\"webpack\");\n\nmodule.exports = [{\n plugins: [\n new webpack.DefinePlugin({\n 'process.env': JSON.stringify({ DEBUG: process.env.DEBUG })\n })\n ]\n}];\n\n```\n\n## References\n* webpack: [DefinePlugin API](https://webpack.js.org/plugins/define-plugin/).\n* Common Weakness Enumeration: [CWE-312](https://cwe.mitre.org/data/definitions/312.html).\n* Common Weakness Enumeration: [CWE-315](https://cwe.mitre.org/data/definitions/315.html).\n* Common Weakness Enumeration: [CWE-359](https://cwe.mitre.org/data/definitions/359.html).\n"},"properties":{"tags":["security","external/cwe/cwe-312","external/cwe/cwe-315","external/cwe/cwe-359"],"description":"Including sensitive information in a build artifact can\n expose it to an attacker.","id":"js/build-artifact-leak","kind":"path-problem","name":"Storage of sensitive information in build artifact","precision":"high","problem.severity":"error","security-severity":"7.5"}},{"id":"js/incorrect-suffix-check","name":"js/incorrect-suffix-check","shortDescription":{"text":"Incorrect suffix check"},"fullDescription":{"text":"Using indexOf to implement endsWith functionality is error-prone if the -1 case is not explicitly handled."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Incorrect suffix check\nThe `indexOf` and `lastIndexOf` methods are sometimes used to check if a substring occurs at a certain position in a string. However, if the returned index is compared to an expression that might evaluate to -1, the check may pass in some cases where the substring was not found at all.\n\nSpecifically, this can easily happen when implementing `endsWith` using `indexOf`.\n\n\n## Recommendation\nUse `String.prototype.endsWith` if it is available. Otherwise, explicitly handle the -1 case, either by checking the relative lengths of the strings, or by checking if the returned index is -1.\n\n\n## Example\nThe following example uses `lastIndexOf` to determine if the string `x` ends with the string `y`:\n\n\n```javascript\nfunction endsWith(x, y) {\n return x.lastIndexOf(y) === x.length - y.length;\n}\n\n```\nHowever, if `y` is one character longer than `x`, the right-hand side `x.length - y.length` becomes -1, which then equals the return value of `lastIndexOf`. This will make the test pass, even though `x` does not end with `y`.\n\nTo avoid this, explicitly check for the -1 case:\n\n\n```javascript\nfunction endsWith(x, y) {\n let index = x.lastIndexOf(y);\n return index !== -1 && index === x.length - y.length;\n}\n\n```\n\n## References\n* MDN: [String.prototype.endsWith](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith)\n* MDN: [String.prototype.indexOf](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/indexOf)\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n","markdown":"# Incorrect suffix check\nThe `indexOf` and `lastIndexOf` methods are sometimes used to check if a substring occurs at a certain position in a string. However, if the returned index is compared to an expression that might evaluate to -1, the check may pass in some cases where the substring was not found at all.\n\nSpecifically, this can easily happen when implementing `endsWith` using `indexOf`.\n\n\n## Recommendation\nUse `String.prototype.endsWith` if it is available. Otherwise, explicitly handle the -1 case, either by checking the relative lengths of the strings, or by checking if the returned index is -1.\n\n\n## Example\nThe following example uses `lastIndexOf` to determine if the string `x` ends with the string `y`:\n\n\n```javascript\nfunction endsWith(x, y) {\n return x.lastIndexOf(y) === x.length - y.length;\n}\n\n```\nHowever, if `y` is one character longer than `x`, the right-hand side `x.length - y.length` becomes -1, which then equals the return value of `lastIndexOf`. This will make the test pass, even though `x` does not end with `y`.\n\nTo avoid this, explicitly check for the -1 case:\n\n\n```javascript\nfunction endsWith(x, y) {\n let index = x.lastIndexOf(y);\n return index !== -1 && index === x.length - y.length;\n}\n\n```\n\n## References\n* MDN: [String.prototype.endsWith](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/endsWith)\n* MDN: [String.prototype.indexOf](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String/indexOf)\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n"},"properties":{"tags":["security","correctness","external/cwe/cwe-020"],"description":"Using indexOf to implement endsWith functionality is error-prone if the -1 case is not explicitly handled.","id":"js/incorrect-suffix-check","kind":"problem","name":"Incorrect suffix check","precision":"high","problem.severity":"error","security-severity":"7.8"}},{"id":"js/incomplete-url-substring-sanitization","name":"js/incomplete-url-substring-sanitization","shortDescription":{"text":"Incomplete URL substring sanitization"},"fullDescription":{"text":"Security checks on the substrings of an unparsed URL are often vulnerable to bypassing."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Incomplete URL substring sanitization\nSanitizing untrusted URLs is an important technique for preventing attacks such as request forgeries and malicious redirections. Usually, this is done by checking that the host of a URL is in a set of allowed hosts.\n\nHowever, treating the URL as a string and checking if one of the allowed hosts is a substring of the URL is very prone to errors. Malicious URLs can bypass such security checks by embedding one of the allowed hosts in an unexpected location.\n\nEven if the substring check is not used in a security-critical context, the incomplete check may still cause undesirable behaviors when the check succeeds accidentally.\n\n\n## Recommendation\nParse a URL before performing a check on its host value, and ensure that the check handles arbitrary subdomain sequences correctly.\n\n\n## Example\nThe following example code checks that a URL redirection will reach the `example.com` domain, or one of its subdomains, and not some malicious site.\n\n\n```javascript\napp.get('/some/path', function(req, res) {\n let url = req.param(\"url\");\n // BAD: the host of `url` may be controlled by an attacker\n if (url.includes(\"example.com\")) {\n res.redirect(url);\n }\n});\n\n```\nThe substring check is, however, easy to bypass. For example by embedding `example.com` in the path component: `http://evil-example.net/example.com`, or in the query string component: `http://evil-example.net/?x=example.com`. Address these shortcomings by checking the host of the parsed URL instead:\n\n\n```javascript\napp.get('/some/path', function(req, res) {\n let url = req.param(\"url\"),\n host = urlLib.parse(url).host;\n // BAD: the host of `url` may be controlled by an attacker\n if (host.includes(\"example.com\")) {\n res.redirect(url);\n }\n});\n\n```\nThis is still not a sufficient check as the following URLs bypass it: `http://evil-example.com` `http://example.com.evil-example.net`. Instead, use an explicit whitelist of allowed hosts to make the redirect secure:\n\n\n```javascript\napp.get('/some/path', function(req, res) {\n let url = req.param('url'),\n host = urlLib.parse(url).host;\n // GOOD: the host of `url` can not be controlled by an attacker\n let allowedHosts = [\n 'example.com',\n 'beta.example.com',\n 'www.example.com'\n ];\n if (allowedHosts.includes(host)) {\n res.redirect(url);\n }\n});\n\n```\n\n## References\n* OWASP: [SSRF](https://www.owasp.org/index.php/Server_Side_Request_Forgery)\n* OWASP: [XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n","markdown":"# Incomplete URL substring sanitization\nSanitizing untrusted URLs is an important technique for preventing attacks such as request forgeries and malicious redirections. Usually, this is done by checking that the host of a URL is in a set of allowed hosts.\n\nHowever, treating the URL as a string and checking if one of the allowed hosts is a substring of the URL is very prone to errors. Malicious URLs can bypass such security checks by embedding one of the allowed hosts in an unexpected location.\n\nEven if the substring check is not used in a security-critical context, the incomplete check may still cause undesirable behaviors when the check succeeds accidentally.\n\n\n## Recommendation\nParse a URL before performing a check on its host value, and ensure that the check handles arbitrary subdomain sequences correctly.\n\n\n## Example\nThe following example code checks that a URL redirection will reach the `example.com` domain, or one of its subdomains, and not some malicious site.\n\n\n```javascript\napp.get('/some/path', function(req, res) {\n let url = req.param(\"url\");\n // BAD: the host of `url` may be controlled by an attacker\n if (url.includes(\"example.com\")) {\n res.redirect(url);\n }\n});\n\n```\nThe substring check is, however, easy to bypass. For example by embedding `example.com` in the path component: `http://evil-example.net/example.com`, or in the query string component: `http://evil-example.net/?x=example.com`. Address these shortcomings by checking the host of the parsed URL instead:\n\n\n```javascript\napp.get('/some/path', function(req, res) {\n let url = req.param(\"url\"),\n host = urlLib.parse(url).host;\n // BAD: the host of `url` may be controlled by an attacker\n if (host.includes(\"example.com\")) {\n res.redirect(url);\n }\n});\n\n```\nThis is still not a sufficient check as the following URLs bypass it: `http://evil-example.com` `http://example.com.evil-example.net`. Instead, use an explicit whitelist of allowed hosts to make the redirect secure:\n\n\n```javascript\napp.get('/some/path', function(req, res) {\n let url = req.param('url'),\n host = urlLib.parse(url).host;\n // GOOD: the host of `url` can not be controlled by an attacker\n let allowedHosts = [\n 'example.com',\n 'beta.example.com',\n 'www.example.com'\n ];\n if (allowedHosts.includes(host)) {\n res.redirect(url);\n }\n});\n\n```\n\n## References\n* OWASP: [SSRF](https://www.owasp.org/index.php/Server_Side_Request_Forgery)\n* OWASP: [XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-020"],"description":"Security checks on the substrings of an unparsed URL are often vulnerable to bypassing.","id":"js/incomplete-url-substring-sanitization","kind":"problem","name":"Incomplete URL substring sanitization","precision":"high","problem.severity":"warning","security-severity":"7.8"}},{"id":"js/incomplete-hostname-regexp","name":"js/incomplete-hostname-regexp","shortDescription":{"text":"Incomplete regular expression for hostnames"},"fullDescription":{"text":"Matching a URL or hostname against a regular expression that contains an unescaped dot as part of the hostname might match more hostnames than expected."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Incomplete regular expression for hostnames\nSanitizing untrusted URLs is an important technique for preventing attacks such as request forgeries and malicious redirections. Often, this is done by checking that the host of a URL is in a set of allowed hosts.\n\nIf a regular expression implements such a check, it is easy to accidentally make the check too permissive by not escaping the `.` meta-characters appropriately. Even if the check is not used in a security-critical context, the incomplete check may still cause undesirable behaviors when it accidentally succeeds.\n\n\n## Recommendation\nEscape all meta-characters appropriately when constructing regular expressions for security checks, and pay special attention to the `.` meta-character.\n\n\n## Example\nThe following example code checks that a URL redirection will reach the `example.com` domain, or one of its subdomains.\n\n\n```javascript\napp.get('/some/path', function(req, res) {\n let url = req.param('url'),\n host = urlLib.parse(url).host;\n // BAD: the host of `url` may be controlled by an attacker\n let regex = /^((www|beta).)?example.com/;\n if (host.match(regex)) {\n res.redirect(url);\n }\n});\n\n```\nThe check is however easy to bypass because the unescaped `.` allows for any character before `example.com`, effectively allowing the redirect to go to an attacker-controlled domain such as `wwwXexample.com`.\n\nAddress this vulnerability by escaping `.` appropriately: `let regex = /^((www|beta)\\.)?example\\.com/`.\n\n\n## References\n* MDN: [Regular Expressions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions)\n* OWASP: [SSRF](https://www.owasp.org/index.php/Server_Side_Request_Forgery)\n* OWASP: [XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n","markdown":"# Incomplete regular expression for hostnames\nSanitizing untrusted URLs is an important technique for preventing attacks such as request forgeries and malicious redirections. Often, this is done by checking that the host of a URL is in a set of allowed hosts.\n\nIf a regular expression implements such a check, it is easy to accidentally make the check too permissive by not escaping the `.` meta-characters appropriately. Even if the check is not used in a security-critical context, the incomplete check may still cause undesirable behaviors when it accidentally succeeds.\n\n\n## Recommendation\nEscape all meta-characters appropriately when constructing regular expressions for security checks, and pay special attention to the `.` meta-character.\n\n\n## Example\nThe following example code checks that a URL redirection will reach the `example.com` domain, or one of its subdomains.\n\n\n```javascript\napp.get('/some/path', function(req, res) {\n let url = req.param('url'),\n host = urlLib.parse(url).host;\n // BAD: the host of `url` may be controlled by an attacker\n let regex = /^((www|beta).)?example.com/;\n if (host.match(regex)) {\n res.redirect(url);\n }\n});\n\n```\nThe check is however easy to bypass because the unescaped `.` allows for any character before `example.com`, effectively allowing the redirect to go to an attacker-controlled domain such as `wwwXexample.com`.\n\nAddress this vulnerability by escaping `.` appropriately: `let regex = /^((www|beta)\\.)?example\\.com/`.\n\n\n## References\n* MDN: [Regular Expressions](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions)\n* OWASP: [SSRF](https://www.owasp.org/index.php/Server_Side_Request_Forgery)\n* OWASP: [XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-020"],"description":"Matching a URL or hostname against a regular expression that contains an unescaped dot as part of the hostname might match more hostnames than expected.","id":"js/incomplete-hostname-regexp","kind":"problem","name":"Incomplete regular expression for hostnames","precision":"high","problem.severity":"warning","security-severity":"7.8"}},{"id":"js/incomplete-url-scheme-check","name":"js/incomplete-url-scheme-check","shortDescription":{"text":"Incomplete URL scheme check"},"fullDescription":{"text":"Checking for the \"javascript:\" URL scheme without also checking for \"vbscript:\" and \"data:\" suggests a logic error or even a security vulnerability."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Incomplete URL scheme check\nURLs starting with `javascript:` can be used to encode JavaScript code to be executed when the URL is visited. While this is a powerful mechanism for creating feature-rich and responsive web applications, it is also a potential security risk: if the URL comes from an untrusted source, it might contain harmful JavaScript code. For this reason, many frameworks and libraries first check the URL scheme of any untrusted URL, and reject URLs with the `javascript:` scheme.\n\nHowever, the `data:` and `vbscript:` schemes can be used to represent executable code in a very similar way, so any validation logic that checks against `javascript:`, but not against `data:` and `vbscript:`, is likely to be insufficient.\n\n\n## Recommendation\nAdd checks covering both `data:` and `vbscript:`.\n\n\n## Example\nThe following function validates a (presumably untrusted) URL `url`. If it starts with `javascript:` (case-insensitive and potentially preceded by whitespace), the harmless placeholder URL `about:blank` is returned to prevent code injection; otherwise `url` itself is returned.\n\n\n```javascript\nfunction sanitizeUrl(url) {\n let u = decodeURI(url).trim().toLowerCase();\n if (u.startsWith(\"javascript:\"))\n return \"about:blank\";\n return url;\n}\n\n```\nWhile this check provides partial projection, it should be extended to cover `data:` and `vbscript:` as well:\n\n\n```javascript\nfunction sanitizeUrl(url) {\n let u = decodeURI(url).trim().toLowerCase();\n if (u.startsWith(\"javascript:\") || u.startsWith(\"data:\") || u.startsWith(\"vbscript:\"))\n return \"about:blank\";\n return url;\n}\n\n```\n\n## References\n* WHATWG: [URL schemes](https://wiki.whatwg.org/wiki/URL_schemes).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n* Common Weakness Enumeration: [CWE-184](https://cwe.mitre.org/data/definitions/184.html).\n","markdown":"# Incomplete URL scheme check\nURLs starting with `javascript:` can be used to encode JavaScript code to be executed when the URL is visited. While this is a powerful mechanism for creating feature-rich and responsive web applications, it is also a potential security risk: if the URL comes from an untrusted source, it might contain harmful JavaScript code. For this reason, many frameworks and libraries first check the URL scheme of any untrusted URL, and reject URLs with the `javascript:` scheme.\n\nHowever, the `data:` and `vbscript:` schemes can be used to represent executable code in a very similar way, so any validation logic that checks against `javascript:`, but not against `data:` and `vbscript:`, is likely to be insufficient.\n\n\n## Recommendation\nAdd checks covering both `data:` and `vbscript:`.\n\n\n## Example\nThe following function validates a (presumably untrusted) URL `url`. If it starts with `javascript:` (case-insensitive and potentially preceded by whitespace), the harmless placeholder URL `about:blank` is returned to prevent code injection; otherwise `url` itself is returned.\n\n\n```javascript\nfunction sanitizeUrl(url) {\n let u = decodeURI(url).trim().toLowerCase();\n if (u.startsWith(\"javascript:\"))\n return \"about:blank\";\n return url;\n}\n\n```\nWhile this check provides partial projection, it should be extended to cover `data:` and `vbscript:` as well:\n\n\n```javascript\nfunction sanitizeUrl(url) {\n let u = decodeURI(url).trim().toLowerCase();\n if (u.startsWith(\"javascript:\") || u.startsWith(\"data:\") || u.startsWith(\"vbscript:\"))\n return \"about:blank\";\n return url;\n}\n\n```\n\n## References\n* WHATWG: [URL schemes](https://wiki.whatwg.org/wiki/URL_schemes).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n* Common Weakness Enumeration: [CWE-184](https://cwe.mitre.org/data/definitions/184.html).\n"},"properties":{"tags":["security","correctness","external/cwe/cwe-020","external/cwe/cwe-184"],"description":"Checking for the \"javascript:\" URL scheme without also checking for \"vbscript:\"\n and \"data:\" suggests a logic error or even a security vulnerability.","id":"js/incomplete-url-scheme-check","kind":"problem","name":"Incomplete URL scheme check","precision":"high","problem.severity":"warning","security-severity":"7.8"}},{"id":"js/overly-large-range","name":"js/overly-large-range","shortDescription":{"text":"Overly permissive regular expression range"},"fullDescription":{"text":"Overly permissive regular expression ranges match a wider range of characters than intended. This may allow an attacker to bypass a filter or sanitizer."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Overly permissive regular expression range\nIt's easy to write a regular expression range that matches a wider range of characters than you intended. For example, `/[a-zA-z]/` matches all lowercase and all uppercase letters, as you would expect, but it also matches the characters: `` [ \\ ] ^ _ ` ``.\n\nAnother common problem is failing to escape the dash character in a regular expression. An unescaped dash is interpreted as part of a range. For example, in the character class `[a-zA-Z0-9%=.,-_]` the last character range matches the 55 characters between `,` and `_` (both included), which overlaps with the range `[0-9]` and is clearly not intended by the writer.\n\n\n## Recommendation\nAvoid any confusion about which characters are included in the range by writing unambiguous regular expressions. Always check that character ranges match only the expected characters.\n\n\n## Example\nThe following example code is intended to check whether a string is a valid 6 digit hex color.\n\n```javascript\n\nfunction isValidHexColor(color) {\n return /^#[0-9a-fA-f]{6}$/i.test(color);\n}\n\n```\nHowever, the `A-f` range is overly large and matches every uppercase character. It would parse a \"color\" like `#XXYYZZ` as valid.\n\nThe fix is to use an uppercase `A-F` range instead.\n\n```javascript\n\nfunction isValidHexColor(color) {\n return /^#[0-9A-F]{6}$/i.test(color);\n}\n\n```\n\n## References\n* GitHub Advisory Database: [CVE-2021-42740: Improper Neutralization of Special Elements used in a Command in Shell-quote](https://github.com/advisories/GHSA-g4rg-993r-mgx7)\n* wh0.github.io: [Exploiting CVE-2021-42740](https://wh0.github.io/2021/10/28/shell-quote-rce-exploiting.html)\n* Yosuke Ota: [no-obscure-range](https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-obscure-range.html)\n* Paul Boyd: [The regex \\[,-.\\]](https://pboyd.io/posts/comma-dash-dot/)\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n","markdown":"# Overly permissive regular expression range\nIt's easy to write a regular expression range that matches a wider range of characters than you intended. For example, `/[a-zA-z]/` matches all lowercase and all uppercase letters, as you would expect, but it also matches the characters: `` [ \\ ] ^ _ ` ``.\n\nAnother common problem is failing to escape the dash character in a regular expression. An unescaped dash is interpreted as part of a range. For example, in the character class `[a-zA-Z0-9%=.,-_]` the last character range matches the 55 characters between `,` and `_` (both included), which overlaps with the range `[0-9]` and is clearly not intended by the writer.\n\n\n## Recommendation\nAvoid any confusion about which characters are included in the range by writing unambiguous regular expressions. Always check that character ranges match only the expected characters.\n\n\n## Example\nThe following example code is intended to check whether a string is a valid 6 digit hex color.\n\n```javascript\n\nfunction isValidHexColor(color) {\n return /^#[0-9a-fA-f]{6}$/i.test(color);\n}\n\n```\nHowever, the `A-f` range is overly large and matches every uppercase character. It would parse a \"color\" like `#XXYYZZ` as valid.\n\nThe fix is to use an uppercase `A-F` range instead.\n\n```javascript\n\nfunction isValidHexColor(color) {\n return /^#[0-9A-F]{6}$/i.test(color);\n}\n\n```\n\n## References\n* GitHub Advisory Database: [CVE-2021-42740: Improper Neutralization of Special Elements used in a Command in Shell-quote](https://github.com/advisories/GHSA-g4rg-993r-mgx7)\n* wh0.github.io: [Exploiting CVE-2021-42740](https://wh0.github.io/2021/10/28/shell-quote-rce-exploiting.html)\n* Yosuke Ota: [no-obscure-range](https://ota-meshi.github.io/eslint-plugin-regexp/rules/no-obscure-range.html)\n* Paul Boyd: [The regex \\[,-.\\]](https://pboyd.io/posts/comma-dash-dot/)\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-020"],"description":"Overly permissive regular expression ranges match a wider range of characters than intended.\n This may allow an attacker to bypass a filter or sanitizer.","id":"js/overly-large-range","kind":"problem","name":"Overly permissive regular expression range","precision":"high","problem.severity":"warning","security-severity":"4.0"}},{"id":"js/useless-regexp-character-escape","name":"js/useless-regexp-character-escape","shortDescription":{"text":"Useless regular-expression character escape"},"fullDescription":{"text":"Prepending a backslash to an ordinary character in a string does not have any effect, and may make regular expressions constructed from this string behave unexpectedly."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Useless regular-expression character escape\nWhen a character in a string literal or regular expression literal is preceded by a backslash, it is interpreted as part of an escape sequence. For example, the escape sequence `\\n` in a string literal corresponds to a single `newline` character, and not the `\\` and `n` characters. However, not all characters change meaning when used in an escape sequence. In this case, the backslash just makes the character appear to mean something else, and the backslash actually has no effect. For example, the escape sequence `\\k` in a string literal just means `k`. Such superfluous escape sequences are usually benign, and do not change the behavior of the program.\n\nThe set of characters that change meaning when in escape sequences is different for regular expression literals and string literals. This can be problematic when a regular expression literal is turned into a regular expression that is built from one or more string literals. The problem occurs when a regular expression escape sequence loses its special meaning in a string literal.\n\n\n## Recommendation\nEnsure that the right amount of backslashes is used when escaping characters in strings, template literals and regular expressions. Pay special attention to the number of backslashes when rewriting a regular expression as a string literal.\n\n\n## Example\nThe following example code checks that a string is `\"my-marker\"`, possibly surrounded by white space:\n\n\n```javascript\nlet regex = new RegExp('(^\\s*)my-marker(\\s*$)'),\n isMyMarkerText = regex.test(text);\n\n```\nHowever, the check does not work properly for white space as the two `\\s` occurrences are semantically equivalent to just `s`, meaning that the check will succeed for strings like `\"smy-markers\"` instead of `\" my-marker \"`. Address these shortcomings by either using a regular expression literal (`/(^\\s*)my-marker(\\s*$)/`), or by adding extra backslashes (`'(^\\\\s*)my-marker(\\\\s*$)'`).\n\n\n## References\n* MDN: [Regular expression escape notation](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping)\n* MDN: [String escape notation](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String#Escape_notation)\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n","markdown":"# Useless regular-expression character escape\nWhen a character in a string literal or regular expression literal is preceded by a backslash, it is interpreted as part of an escape sequence. For example, the escape sequence `\\n` in a string literal corresponds to a single `newline` character, and not the `\\` and `n` characters. However, not all characters change meaning when used in an escape sequence. In this case, the backslash just makes the character appear to mean something else, and the backslash actually has no effect. For example, the escape sequence `\\k` in a string literal just means `k`. Such superfluous escape sequences are usually benign, and do not change the behavior of the program.\n\nThe set of characters that change meaning when in escape sequences is different for regular expression literals and string literals. This can be problematic when a regular expression literal is turned into a regular expression that is built from one or more string literals. The problem occurs when a regular expression escape sequence loses its special meaning in a string literal.\n\n\n## Recommendation\nEnsure that the right amount of backslashes is used when escaping characters in strings, template literals and regular expressions. Pay special attention to the number of backslashes when rewriting a regular expression as a string literal.\n\n\n## Example\nThe following example code checks that a string is `\"my-marker\"`, possibly surrounded by white space:\n\n\n```javascript\nlet regex = new RegExp('(^\\s*)my-marker(\\s*$)'),\n isMyMarkerText = regex.test(text);\n\n```\nHowever, the check does not work properly for white space as the two `\\s` occurrences are semantically equivalent to just `s`, meaning that the check will succeed for strings like `\"smy-markers\"` instead of `\" my-marker \"`. Address these shortcomings by either using a regular expression literal (`/(^\\s*)my-marker(\\s*$)/`), or by adding extra backslashes (`'(^\\\\s*)my-marker(\\\\s*$)'`).\n\n\n## References\n* MDN: [Regular expression escape notation](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping)\n* MDN: [String escape notation](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/String#Escape_notation)\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-020"],"description":"Prepending a backslash to an ordinary character in a string\n does not have any effect, and may make regular expressions constructed from this string\n behave unexpectedly.","id":"js/useless-regexp-character-escape","kind":"problem","name":"Useless regular-expression character escape","precision":"high","problem.severity":"error","security-severity":"7.8"}},{"id":"js/resource-exhaustion","name":"js/resource-exhaustion","shortDescription":{"text":"Resource exhaustion"},"fullDescription":{"text":"Allocating objects or timers with user-controlled sizes or durations can cause resource exhaustion."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Resource exhaustion\nApplications are constrained by how many resources they can make use of. Failing to respect these constraints may cause the application to be unresponsive or crash. It is therefore problematic if attackers can control the sizes or lifetimes of allocated objects.\n\n\n## Recommendation\nEnsure that attackers can not control object sizes and their lifetimes. If object sizes and lifetimes must be controlled by external parties, ensure you restrict the object sizes and lifetimes so that they are within acceptable ranges.\n\n\n## Example\nThe following example allocates a buffer with a user-controlled size.\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar size = parseInt(url.parse(req.url, true).query.size);\n\n\tlet buffer = Buffer.alloc(size); // BAD\n\n\t// ... use the buffer\n});\n```\nThis is problematic since an attacker can choose a size that makes the application run out of memory. Even worse, in older versions of Node.js, this could leak confidential memory. To prevent such attacks, limit the buffer size:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar size = parseInt(url.parse(req.url, true).query.size);\n\n\tif (size > 1024) {\n\t\tres.statusCode = 400;\n\t\tres.end(\"Bad request.\");\n\t\treturn;\n\t}\n\n\tlet buffer = Buffer.alloc(size); // GOOD\n\n\t// ... use the buffer\n});\n```\n\n## Example\nAs another example, consider an application that allocates an array with a user-controlled size, and then fills it with values:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar size = parseInt(url.parse(req.url, true).query.size);\n\n\tlet dogs = new Array(size).fill(\"dog\"); // BAD\n\n\t// ... use the dog\n});\n```\nThe allocation of the array itself is not problematic since arrays are allocated sparsely, but the subsequent filling of the array will take a long time, causing the application to be unresponsive, or even run out of memory. Again, a limit on the size will prevent the attack:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar size = parseInt(url.parse(req.url, true).query.size);\n\n\tif (size > 1024) {\n\t\tres.statusCode = 400;\n\t\tres.end(\"Bad request.\");\n\t\treturn;\n\t}\n\n\tlet dogs = new Array(size).fill(\"dog\"); // GOOD\n\n\t// ... use the dogs\n});\n```\n\n## Example\nFinally, the following example lets a user choose a delay after which a function is executed:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar delay = parseInt(url.parse(req.url, true).query.delay);\n\n\tsetTimeout(f, delay); // BAD\n\n});\n\n```\nThis is problematic because a large delay essentially makes the application wait indefinitely before executing the function. Repeated registrations of such delays will therefore use up all of the memory in the application. A limit on the delay will prevent the attack:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar delay = parseInt(url.parse(req.url, true).query.delay);\n\n\tif (delay > 1000) {\n\t\tres.statusCode = 400;\n\t\tres.end(\"Bad request.\");\n\t\treturn;\n\t}\n\n\tsetTimeout(f, delay); // GOOD\n\n});\n\n```\n\n## References\n* Wikipedia: [Denial-of-service attack](https://en.wikipedia.org/wiki/Denial-of-service_attack).\n* Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).\n* Common Weakness Enumeration: [CWE-770](https://cwe.mitre.org/data/definitions/770.html).\n","markdown":"# Resource exhaustion\nApplications are constrained by how many resources they can make use of. Failing to respect these constraints may cause the application to be unresponsive or crash. It is therefore problematic if attackers can control the sizes or lifetimes of allocated objects.\n\n\n## Recommendation\nEnsure that attackers can not control object sizes and their lifetimes. If object sizes and lifetimes must be controlled by external parties, ensure you restrict the object sizes and lifetimes so that they are within acceptable ranges.\n\n\n## Example\nThe following example allocates a buffer with a user-controlled size.\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar size = parseInt(url.parse(req.url, true).query.size);\n\n\tlet buffer = Buffer.alloc(size); // BAD\n\n\t// ... use the buffer\n});\n```\nThis is problematic since an attacker can choose a size that makes the application run out of memory. Even worse, in older versions of Node.js, this could leak confidential memory. To prevent such attacks, limit the buffer size:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar size = parseInt(url.parse(req.url, true).query.size);\n\n\tif (size > 1024) {\n\t\tres.statusCode = 400;\n\t\tres.end(\"Bad request.\");\n\t\treturn;\n\t}\n\n\tlet buffer = Buffer.alloc(size); // GOOD\n\n\t// ... use the buffer\n});\n```\n\n## Example\nAs another example, consider an application that allocates an array with a user-controlled size, and then fills it with values:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar size = parseInt(url.parse(req.url, true).query.size);\n\n\tlet dogs = new Array(size).fill(\"dog\"); // BAD\n\n\t// ... use the dog\n});\n```\nThe allocation of the array itself is not problematic since arrays are allocated sparsely, but the subsequent filling of the array will take a long time, causing the application to be unresponsive, or even run out of memory. Again, a limit on the size will prevent the attack:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar size = parseInt(url.parse(req.url, true).query.size);\n\n\tif (size > 1024) {\n\t\tres.statusCode = 400;\n\t\tres.end(\"Bad request.\");\n\t\treturn;\n\t}\n\n\tlet dogs = new Array(size).fill(\"dog\"); // GOOD\n\n\t// ... use the dogs\n});\n```\n\n## Example\nFinally, the following example lets a user choose a delay after which a function is executed:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar delay = parseInt(url.parse(req.url, true).query.delay);\n\n\tsetTimeout(f, delay); // BAD\n\n});\n\n```\nThis is problematic because a large delay essentially makes the application wait indefinitely before executing the function. Repeated registrations of such delays will therefore use up all of the memory in the application. A limit on the delay will prevent the attack:\n\n\n```javascript\nvar http = require(\"http\"),\n url = require(\"url\");\n\nvar server = http.createServer(function(req, res) {\n\tvar delay = parseInt(url.parse(req.url, true).query.delay);\n\n\tif (delay > 1000) {\n\t\tres.statusCode = 400;\n\t\tres.end(\"Bad request.\");\n\t\treturn;\n\t}\n\n\tsetTimeout(f, delay); // GOOD\n\n});\n\n```\n\n## References\n* Wikipedia: [Denial-of-service attack](https://en.wikipedia.org/wiki/Denial-of-service_attack).\n* Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).\n* Common Weakness Enumeration: [CWE-770](https://cwe.mitre.org/data/definitions/770.html).\n"},"properties":{"tags":["security","external/cwe/cwe-400","external/cwe/cwe-770"],"description":"Allocating objects or timers with user-controlled\n sizes or durations can cause resource exhaustion.","id":"js/resource-exhaustion","kind":"path-problem","name":"Resource exhaustion","precision":"high","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/missing-rate-limiting","name":"js/missing-rate-limiting","shortDescription":{"text":"Missing rate limiting"},"fullDescription":{"text":"An HTTP request handler that performs expensive operations without restricting the rate at which operations can be carried out is vulnerable to denial-of-service attacks."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Missing rate limiting\nHTTP request handlers should not perform expensive operations such as accessing the file system, executing an operating system command or interacting with a database without limiting the rate at which requests are accepted. Otherwise, the application becomes vulnerable to denial-of-service attacks where an attacker can cause the application to crash or become unresponsive by issuing a large number of requests at the same time.\n\n\n## Recommendation\nA rate-limiting middleware should be used to prevent such attacks.\n\n\n## Example\nThe following example shows an Express application that serves static files without rate limiting:\n\n\n```javascript\nvar express = require('express');\nvar app = express();\n\napp.get('/:path', function(req, res) {\n let path = req.params.path;\n if (isValidPath(path))\n res.sendFile(path);\n});\n\n```\nTo prevent denial-of-service attacks, the `express-rate-limit` package can be used:\n\n\n```javascript\nvar express = require('express');\nvar app = express();\n\n// set up rate limiter: maximum of five requests per minute\nvar RateLimit = require('express-rate-limit');\nvar limiter = RateLimit({\n windowMs: 15 * 60 * 1000, // 15 minutes\n max: 100, // max 100 requests per windowMs\n});\n\n// apply rate limiter to all requests\napp.use(limiter);\n\napp.get('/:path', function(req, res) {\n let path = req.params.path;\n if (isValidPath(path))\n res.sendFile(path);\n});\n\n```\n\n## References\n* OWASP: [Denial of Service Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html).\n* Wikipedia: [Denial-of-service attack](https://en.wikipedia.org/wiki/Denial-of-service_attack).\n* NPM: [express-rate-limit](https://www.npmjs.com/package/express-rate-limit).\n* Common Weakness Enumeration: [CWE-770](https://cwe.mitre.org/data/definitions/770.html).\n* Common Weakness Enumeration: [CWE-307](https://cwe.mitre.org/data/definitions/307.html).\n* Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).\n","markdown":"# Missing rate limiting\nHTTP request handlers should not perform expensive operations such as accessing the file system, executing an operating system command or interacting with a database without limiting the rate at which requests are accepted. Otherwise, the application becomes vulnerable to denial-of-service attacks where an attacker can cause the application to crash or become unresponsive by issuing a large number of requests at the same time.\n\n\n## Recommendation\nA rate-limiting middleware should be used to prevent such attacks.\n\n\n## Example\nThe following example shows an Express application that serves static files without rate limiting:\n\n\n```javascript\nvar express = require('express');\nvar app = express();\n\napp.get('/:path', function(req, res) {\n let path = req.params.path;\n if (isValidPath(path))\n res.sendFile(path);\n});\n\n```\nTo prevent denial-of-service attacks, the `express-rate-limit` package can be used:\n\n\n```javascript\nvar express = require('express');\nvar app = express();\n\n// set up rate limiter: maximum of five requests per minute\nvar RateLimit = require('express-rate-limit');\nvar limiter = RateLimit({\n windowMs: 15 * 60 * 1000, // 15 minutes\n max: 100, // max 100 requests per windowMs\n});\n\n// apply rate limiter to all requests\napp.use(limiter);\n\napp.get('/:path', function(req, res) {\n let path = req.params.path;\n if (isValidPath(path))\n res.sendFile(path);\n});\n\n```\n\n## References\n* OWASP: [Denial of Service Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Denial_of_Service_Cheat_Sheet.html).\n* Wikipedia: [Denial-of-service attack](https://en.wikipedia.org/wiki/Denial-of-service_attack).\n* NPM: [express-rate-limit](https://www.npmjs.com/package/express-rate-limit).\n* Common Weakness Enumeration: [CWE-770](https://cwe.mitre.org/data/definitions/770.html).\n* Common Weakness Enumeration: [CWE-307](https://cwe.mitre.org/data/definitions/307.html).\n* Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).\n"},"properties":{"tags":["security","external/cwe/cwe-770","external/cwe/cwe-307","external/cwe/cwe-400"],"description":"An HTTP request handler that performs expensive operations without\n restricting the rate at which operations can be carried out is vulnerable\n to denial-of-service attacks.","id":"js/missing-rate-limiting","kind":"problem","name":"Missing rate limiting","precision":"high","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/xml-bomb","name":"js/xml-bomb","shortDescription":{"text":"XML internal entity expansion"},"fullDescription":{"text":"Parsing user input as an XML document with arbitrary internal entity expansion is vulnerable to denial-of-service attacks."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# XML internal entity expansion\nParsing untrusted XML files with a weakly configured XML parser may be vulnerable to denial-of-service (DoS) attacks exploiting uncontrolled internal entity expansion.\n\nIn XML, so-called *internal entities* are a mechanism for introducing an abbreviation for a piece of text or part of a document. When a parser that has been configured to expand entities encounters a reference to an internal entity, it replaces the entity by the data it represents. The replacement text may itself contain other entity references, which are expanded recursively. This means that entity expansion can increase document size dramatically.\n\nIf untrusted XML is parsed with entity expansion enabled, a malicious attacker could submit a document that contains very deeply nested entity definitions, causing the parser to take a very long time or use large amounts of memory. This is sometimes called an *XML bomb* attack.\n\n\n## Recommendation\nThe safest way to prevent XML bomb attacks is to disable entity expansion when parsing untrusted data. How this is done depends on the library being used. Note that some libraries, such as recent versions of `libxmljs` (though not its SAX parser API), disable entity expansion by default, so unless you have explicitly enabled entity expansion, no further action is needed.\n\n\n## Example\nThe following example uses the XML parser provided by the `node-expat` package to parse a string `xmlSrc`. If that string is from an untrusted source, this code may be vulnerable to a DoS attack, since `node-expat` expands internal entities by default:\n\n\n```javascript\nconst app = require(\"express\")(),\n expat = require(\"node-expat\");\n\napp.post(\"upload\", (req, res) => {\n let xmlSrc = req.body,\n parser = new expat.Parser();\n parser.on(\"startElement\", handleStart);\n parser.on(\"text\", handleText);\n parser.write(xmlSrc);\n});\n\n```\nAt the time of writing, `node-expat` does not provide a way of controlling entity expansion, but the example could be rewritten to use the `sax` package instead, which only expands standard entities such as `&`:\n\n\n```javascript\nconst app = require(\"express\")(),\n sax = require(\"sax\");\n\napp.post(\"upload\", (req, res) => {\n let xmlSrc = req.body,\n parser = sax.parser(true);\n parser.onopentag = handleStart;\n parser.ontext = handleText;\n parser.write(xmlSrc);\n});\n\n```\n\n## References\n* Wikipedia: [Billion Laughs](https://en.wikipedia.org/wiki/Billion_laughs).\n* Bryan Sullivan: [Security Briefs - XML Denial of Service Attacks and Defenses](https://msdn.microsoft.com/en-us/magazine/ee335713.aspx).\n* Common Weakness Enumeration: [CWE-776](https://cwe.mitre.org/data/definitions/776.html).\n* Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).\n","markdown":"# XML internal entity expansion\nParsing untrusted XML files with a weakly configured XML parser may be vulnerable to denial-of-service (DoS) attacks exploiting uncontrolled internal entity expansion.\n\nIn XML, so-called *internal entities* are a mechanism for introducing an abbreviation for a piece of text or part of a document. When a parser that has been configured to expand entities encounters a reference to an internal entity, it replaces the entity by the data it represents. The replacement text may itself contain other entity references, which are expanded recursively. This means that entity expansion can increase document size dramatically.\n\nIf untrusted XML is parsed with entity expansion enabled, a malicious attacker could submit a document that contains very deeply nested entity definitions, causing the parser to take a very long time or use large amounts of memory. This is sometimes called an *XML bomb* attack.\n\n\n## Recommendation\nThe safest way to prevent XML bomb attacks is to disable entity expansion when parsing untrusted data. How this is done depends on the library being used. Note that some libraries, such as recent versions of `libxmljs` (though not its SAX parser API), disable entity expansion by default, so unless you have explicitly enabled entity expansion, no further action is needed.\n\n\n## Example\nThe following example uses the XML parser provided by the `node-expat` package to parse a string `xmlSrc`. If that string is from an untrusted source, this code may be vulnerable to a DoS attack, since `node-expat` expands internal entities by default:\n\n\n```javascript\nconst app = require(\"express\")(),\n expat = require(\"node-expat\");\n\napp.post(\"upload\", (req, res) => {\n let xmlSrc = req.body,\n parser = new expat.Parser();\n parser.on(\"startElement\", handleStart);\n parser.on(\"text\", handleText);\n parser.write(xmlSrc);\n});\n\n```\nAt the time of writing, `node-expat` does not provide a way of controlling entity expansion, but the example could be rewritten to use the `sax` package instead, which only expands standard entities such as `&`:\n\n\n```javascript\nconst app = require(\"express\")(),\n sax = require(\"sax\");\n\napp.post(\"upload\", (req, res) => {\n let xmlSrc = req.body,\n parser = sax.parser(true);\n parser.onopentag = handleStart;\n parser.ontext = handleText;\n parser.write(xmlSrc);\n});\n\n```\n\n## References\n* Wikipedia: [Billion Laughs](https://en.wikipedia.org/wiki/Billion_laughs).\n* Bryan Sullivan: [Security Briefs - XML Denial of Service Attacks and Defenses](https://msdn.microsoft.com/en-us/magazine/ee335713.aspx).\n* Common Weakness Enumeration: [CWE-776](https://cwe.mitre.org/data/definitions/776.html).\n* Common Weakness Enumeration: [CWE-400](https://cwe.mitre.org/data/definitions/400.html).\n"},"properties":{"tags":["security","external/cwe/cwe-776","external/cwe/cwe-400"],"description":"Parsing user input as an XML document with arbitrary internal\n entity expansion is vulnerable to denial-of-service attacks.","id":"js/xml-bomb","kind":"path-problem","name":"XML internal entity expansion","precision":"high","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/cross-window-information-leak","name":"js/cross-window-information-leak","shortDescription":{"text":"Cross-window communication with unrestricted target origin"},"fullDescription":{"text":"When sending sensitive information to another window using `postMessage`, the origin of the target window should be restricted to avoid unintentional information leaks."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Cross-window communication with unrestricted target origin\nThe `window.postMessage` method allows different windows or iframes to communicate directly, even if they were loaded from different origins, circumventing the usual same-origin policy.\n\nThe sender of the message can restrict the origin of the receiver by specifying a target origin. If the receiver window does not come from this origin, the message is not sent.\n\nAlternatively, the sender can specify a target origin of `'*'`, which means that any origin is acceptable and the message is always sent.\n\nThis feature should not be used if the message being sent contains sensitive data such as user credentials: the target window may have been loaded from a malicious site, to which the data would then become available.\n\n\n## Recommendation\nIf possible, specify a target origin when using `window.postMessage`. Alternatively, encrypt the sensitive data before sending it to prevent an unauthorized receiver from accessing it.\n\n\n## Example\nThe following example code sends user credentials (in this case, their user name) to `window.parent` without checking its origin. If a malicious site loads the page containing this code into an iframe it would be able to gain access to the user name.\n\n\n```javascript\nwindow.parent.postMessage(userName, '*');\n\n```\nTo prevent this from happening, the origin of the target window should be restricted, as in this example:\n\n\n```javascript\nwindow.parent.postMessage(userName, 'https://github.com');\n\n```\n\n## References\n* Mozilla Developer Network: [Window.postMessage](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage).\n* Mozilla Developer Network: [Same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy).\n* Common Weakness Enumeration: [CWE-201](https://cwe.mitre.org/data/definitions/201.html).\n* Common Weakness Enumeration: [CWE-359](https://cwe.mitre.org/data/definitions/359.html).\n","markdown":"# Cross-window communication with unrestricted target origin\nThe `window.postMessage` method allows different windows or iframes to communicate directly, even if they were loaded from different origins, circumventing the usual same-origin policy.\n\nThe sender of the message can restrict the origin of the receiver by specifying a target origin. If the receiver window does not come from this origin, the message is not sent.\n\nAlternatively, the sender can specify a target origin of `'*'`, which means that any origin is acceptable and the message is always sent.\n\nThis feature should not be used if the message being sent contains sensitive data such as user credentials: the target window may have been loaded from a malicious site, to which the data would then become available.\n\n\n## Recommendation\nIf possible, specify a target origin when using `window.postMessage`. Alternatively, encrypt the sensitive data before sending it to prevent an unauthorized receiver from accessing it.\n\n\n## Example\nThe following example code sends user credentials (in this case, their user name) to `window.parent` without checking its origin. If a malicious site loads the page containing this code into an iframe it would be able to gain access to the user name.\n\n\n```javascript\nwindow.parent.postMessage(userName, '*');\n\n```\nTo prevent this from happening, the origin of the target window should be restricted, as in this example:\n\n\n```javascript\nwindow.parent.postMessage(userName, 'https://github.com');\n\n```\n\n## References\n* Mozilla Developer Network: [Window.postMessage](https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage).\n* Mozilla Developer Network: [Same-origin policy](https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy).\n* Common Weakness Enumeration: [CWE-201](https://cwe.mitre.org/data/definitions/201.html).\n* Common Weakness Enumeration: [CWE-359](https://cwe.mitre.org/data/definitions/359.html).\n"},"properties":{"tags":["security","external/cwe/cwe-201","external/cwe/cwe-359"],"description":"When sending sensitive information to another window using `postMessage`,\n the origin of the target window should be restricted to avoid unintentional\n information leaks.","id":"js/cross-window-information-leak","kind":"path-problem","name":"Cross-window communication with unrestricted target origin","precision":"high","problem.severity":"error","security-severity":"4.3"}},{"id":"js/insufficient-key-size","name":"js/insufficient-key-size","shortDescription":{"text":"Use of a weak cryptographic key"},"fullDescription":{"text":"Using a weak cryptographic key can allow an attacker to compromise security."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Use of a weak cryptographic key\nModern encryption relies on it being computationally infeasible to break the cipher and decode a message without the key. As computational power increases, the ability to break ciphers grows and keys need to become larger.\n\n\n## Recommendation\nAn encryption key should be at least 2048-bit long when using RSA encryption, and 128-bit long when using symmetric encryption.\n\n\n## References\n* Wikipedia: [RSA](https://en.wikipedia.org/wiki/RSA_(cryptosystem)).\n* Wikipedia: [AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard).\n* NodeJS: [Crypto](https://nodejs.org/api/crypto.html).\n* NIST: [ Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf).\n* Wikipedia: [Key size](https://en.wikipedia.org/wiki/Key_size)\n* Common Weakness Enumeration: [CWE-326](https://cwe.mitre.org/data/definitions/326.html).\n","markdown":"# Use of a weak cryptographic key\nModern encryption relies on it being computationally infeasible to break the cipher and decode a message without the key. As computational power increases, the ability to break ciphers grows and keys need to become larger.\n\n\n## Recommendation\nAn encryption key should be at least 2048-bit long when using RSA encryption, and 128-bit long when using symmetric encryption.\n\n\n## References\n* Wikipedia: [RSA](https://en.wikipedia.org/wiki/RSA_(cryptosystem)).\n* Wikipedia: [AES](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard).\n* NodeJS: [Crypto](https://nodejs.org/api/crypto.html).\n* NIST: [ Recommendation for Transitioning the Use of Cryptographic Algorithms and Key Lengths](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-131Ar1.pdf).\n* Wikipedia: [Key size](https://en.wikipedia.org/wiki/Key_size)\n* Common Weakness Enumeration: [CWE-326](https://cwe.mitre.org/data/definitions/326.html).\n"},"properties":{"tags":["security","external/cwe/cwe-326"],"description":"Using a weak cryptographic key can allow an attacker to compromise security.","id":"js/insufficient-key-size","kind":"problem","name":"Use of a weak cryptographic key","precision":"high","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/insufficient-password-hash","name":"js/insufficient-password-hash","shortDescription":{"text":"Use of password hash with insufficient computational effort"},"fullDescription":{"text":"Creating a hash of a password with low computational effort makes the hash vulnerable to password cracking attacks."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Use of password hash with insufficient computational effort\nStoring cryptographic hashes of passwords is standard security practice, but it is equally important to select the right hashing scheme. If an attacker obtains the hashed passwords of an application, the password hashing scheme should still prevent the attacker from easily obtaining the original cleartext passwords.\n\nA good password hashing scheme requires a computation that cannot be done efficiently. Standard hashing schemes, such as `md5` or `sha1`, are efficiently computable, and are therefore not suitable for password hashing.\n\n\n## Recommendation\nUse a secure password hashing scheme such as `bcrypt`, `scrypt`, `PBKDF2`, or `Argon2`.\n\n\n## Example\nIn the example below, the `md5` algorithm computes the hash of a password.\n\n\n```javascript\nconst crypto = require(\"crypto\");\nfunction hashPassword(password) {\n var hasher = crypto.createHash('md5');\n var hashed = hasher.update(password).digest(\"hex\"); // BAD\n return hashed;\n}\n\n```\nThis is not secure, since the password can be efficiently cracked by an attacker that obtains the hash. A more secure scheme is to hash the password with the `bcrypt` algorithm:\n\n\n```javascript\nconst bcrypt = require(\"bcrypt\");\nfunction hashPassword(password, salt) {\n var hashed = bcrypt.hashSync(password, salt); // GOOD\n return hashed;\n}\n\n```\n\n## References\n* OWASP: [Password storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-916](https://cwe.mitre.org/data/definitions/916.html).\n","markdown":"# Use of password hash with insufficient computational effort\nStoring cryptographic hashes of passwords is standard security practice, but it is equally important to select the right hashing scheme. If an attacker obtains the hashed passwords of an application, the password hashing scheme should still prevent the attacker from easily obtaining the original cleartext passwords.\n\nA good password hashing scheme requires a computation that cannot be done efficiently. Standard hashing schemes, such as `md5` or `sha1`, are efficiently computable, and are therefore not suitable for password hashing.\n\n\n## Recommendation\nUse a secure password hashing scheme such as `bcrypt`, `scrypt`, `PBKDF2`, or `Argon2`.\n\n\n## Example\nIn the example below, the `md5` algorithm computes the hash of a password.\n\n\n```javascript\nconst crypto = require(\"crypto\");\nfunction hashPassword(password) {\n var hasher = crypto.createHash('md5');\n var hashed = hasher.update(password).digest(\"hex\"); // BAD\n return hashed;\n}\n\n```\nThis is not secure, since the password can be efficiently cracked by an attacker that obtains the hash. A more secure scheme is to hash the password with the `bcrypt` algorithm:\n\n\n```javascript\nconst bcrypt = require(\"bcrypt\");\nfunction hashPassword(password, salt) {\n var hashed = bcrypt.hashSync(password, salt); // GOOD\n return hashed;\n}\n\n```\n\n## References\n* OWASP: [Password storage](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-916](https://cwe.mitre.org/data/definitions/916.html).\n"},"properties":{"tags":["security","external/cwe/cwe-916"],"description":"Creating a hash of a password with low computational effort makes the hash vulnerable to password cracking attacks.","id":"js/insufficient-password-hash","kind":"path-problem","name":"Use of password hash with insufficient computational effort","precision":"high","problem.severity":"warning","security-severity":"8.1"}},{"id":"js/insecure-randomness","name":"js/insecure-randomness","shortDescription":{"text":"Insecure randomness"},"fullDescription":{"text":"Using a cryptographically weak pseudo-random number generator to generate a security-sensitive value may allow an attacker to predict what value will be generated."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Insecure randomness\nUsing a cryptographically weak pseudo-random number generator to generate a security-sensitive value, such as a password, makes it easier for an attacker to predict the value.\n\nPseudo-random number generators generate a sequence of numbers that only approximates the properties of random numbers. The sequence is not truly random because it is completely determined by a relatively small set of initial values, the seed. If the random number generator is cryptographically weak, then this sequence may be easily predictable through outside observations.\n\n\n## Recommendation\nUse a cryptographically secure pseudo-random number generator if the output is to be used in a security-sensitive context. As a rule of thumb, a value should be considered \"security-sensitive\" if predicting it would allow the attacker to perform an action that they would otherwise be unable to perform. For example, if an attacker could predict the random password generated for a new user, they would be able to log in as that new user.\n\nFor JavaScript on the NodeJS platform, `crypto.getRandomBytes` provides a cryptographically secure pseudo-random byte generator. Note that the conversion from bytes to numbers can introduce bias that breaks the security.\n\nFor JavaScript in the browser, `crypto.getRandomValues` provides a cryptographically secure pseudo-random number generator.\n\n\n## Example\nThe following examples show different ways of generating a password.\n\nIn the first case, we generate a fresh password by appending a random integer to the end of a static string. The random number generator used (`Math.random`) is not cryptographically secure, so it may be possible for an attacker to predict the generated password.\n\n\n```javascript\nfunction insecurePassword() {\n // BAD: the random suffix is not cryptographically secure\n var suffix = Math.random();\n var password = \"myPassword\" + suffix;\n return password;\n}\n\n```\nIn the second example, a cryptographically secure random number generator is used for the same purpose. In this case, it is much harder to predict the generated integers.\n\n\n```javascript\nfunction securePassword() {\n // GOOD: the random suffix is cryptographically secure\n var suffix = window.crypto.getRandomValues(new Uint32Array(1))[0];\n var password = \"myPassword\" + suffix;\n \n // GOOD: if a random value between 0 and 1 is desired\n var secret = window.crypto.getRandomValues(new Uint32Array(1))[0] * Math.pow(2,-32);\n}\n\n```\n\n## References\n* Wikipedia: [Pseudo-random number generator](http://en.wikipedia.org/wiki/Pseudorandom_number_generator).\n* Mozilla Developer Network: [Crypto: getRandomValues()](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues).\n* NodeJS: [crypto.randomBytes](https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback)\n* Common Weakness Enumeration: [CWE-338](https://cwe.mitre.org/data/definitions/338.html).\n","markdown":"# Insecure randomness\nUsing a cryptographically weak pseudo-random number generator to generate a security-sensitive value, such as a password, makes it easier for an attacker to predict the value.\n\nPseudo-random number generators generate a sequence of numbers that only approximates the properties of random numbers. The sequence is not truly random because it is completely determined by a relatively small set of initial values, the seed. If the random number generator is cryptographically weak, then this sequence may be easily predictable through outside observations.\n\n\n## Recommendation\nUse a cryptographically secure pseudo-random number generator if the output is to be used in a security-sensitive context. As a rule of thumb, a value should be considered \"security-sensitive\" if predicting it would allow the attacker to perform an action that they would otherwise be unable to perform. For example, if an attacker could predict the random password generated for a new user, they would be able to log in as that new user.\n\nFor JavaScript on the NodeJS platform, `crypto.getRandomBytes` provides a cryptographically secure pseudo-random byte generator. Note that the conversion from bytes to numbers can introduce bias that breaks the security.\n\nFor JavaScript in the browser, `crypto.getRandomValues` provides a cryptographically secure pseudo-random number generator.\n\n\n## Example\nThe following examples show different ways of generating a password.\n\nIn the first case, we generate a fresh password by appending a random integer to the end of a static string. The random number generator used (`Math.random`) is not cryptographically secure, so it may be possible for an attacker to predict the generated password.\n\n\n```javascript\nfunction insecurePassword() {\n // BAD: the random suffix is not cryptographically secure\n var suffix = Math.random();\n var password = \"myPassword\" + suffix;\n return password;\n}\n\n```\nIn the second example, a cryptographically secure random number generator is used for the same purpose. In this case, it is much harder to predict the generated integers.\n\n\n```javascript\nfunction securePassword() {\n // GOOD: the random suffix is cryptographically secure\n var suffix = window.crypto.getRandomValues(new Uint32Array(1))[0];\n var password = \"myPassword\" + suffix;\n \n // GOOD: if a random value between 0 and 1 is desired\n var secret = window.crypto.getRandomValues(new Uint32Array(1))[0] * Math.pow(2,-32);\n}\n\n```\n\n## References\n* Wikipedia: [Pseudo-random number generator](http://en.wikipedia.org/wiki/Pseudorandom_number_generator).\n* Mozilla Developer Network: [Crypto: getRandomValues()](https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getRandomValues).\n* NodeJS: [crypto.randomBytes](https://nodejs.org/api/crypto.html#crypto_crypto_randombytes_size_callback)\n* Common Weakness Enumeration: [CWE-338](https://cwe.mitre.org/data/definitions/338.html).\n"},"properties":{"tags":["security","external/cwe/cwe-338"],"description":"Using a cryptographically weak pseudo-random number generator to generate a\n security-sensitive value may allow an attacker to predict what value will\n be generated.","id":"js/insecure-randomness","kind":"path-problem","name":"Insecure randomness","precision":"high","problem.severity":"warning","security-severity":"7.8"}},{"id":"js/server-side-unvalidated-url-redirection","name":"js/server-side-unvalidated-url-redirection","shortDescription":{"text":"Server-side URL redirect"},"fullDescription":{"text":"Server-side URL redirection based on unvalidated user input may cause redirection to malicious web sites."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Server-side URL redirect\nDirectly incorporating user input into a URL redirect request without validating the input can facilitate phishing attacks. In these attacks, unsuspecting users can be redirected to a malicious site that looks very similar to the real site they intend to visit, but which is controlled by the attacker.\n\n\n## Recommendation\nTo guard against untrusted URL redirection, it is advisable to avoid putting user input directly into a redirect URL. Instead, maintain a list of authorized redirects on the server; then choose from that list based on the user input provided.\n\nIf this is not possible, then the user input should be validated in some other way, for example, by verifying that the target URL is on the same host as the current page.\n\n\n## Example\nThe following example shows an HTTP request parameter being used directly in a URL redirect without validating the input, which facilitates phishing attacks:\n\n\n```javascript\nconst app = require(\"express\")();\n\napp.get(\"/redirect\", function (req, res) {\n // BAD: a request parameter is incorporated without validation into a URL redirect\n res.redirect(req.query[\"target\"]);\n});\n\n```\nOne way to remedy the problem is to validate the user input against a known fixed string before doing the redirection:\n\n\n```javascript\nconst app = require(\"express\")();\n\nconst VALID_REDIRECT = \"http://cwe.mitre.org/data/definitions/601.html\";\n\napp.get(\"/redirect\", function (req, res) {\n // GOOD: the request parameter is validated against a known fixed string\n let target = req.query[\"target\"];\n if (VALID_REDIRECT === target) {\n res.redirect(target);\n } else {\n res.redirect(\"/\");\n }\n});\n\n```\nAlternatively, we can check that the target URL does not redirect to a different host by parsing it relative to a base URL with a known host and verifying that the host stays the same:\n\n\n```javascript\nconst app = require(\"express\")();\n\nfunction isLocalUrl(path) {\n try {\n return (\n // TODO: consider substituting your own domain for example.com\n new URL(path, \"https://example.com\").origin === \"https://example.com\"\n );\n } catch (e) {\n return false;\n }\n}\n\napp.get(\"/redirect\", function (req, res) {\n // GOOD: check that we don't redirect to a different host\n let target = req.query[\"target\"];\n if (isLocalUrl(target)) {\n res.redirect(target);\n } else {\n res.redirect(\"/\");\n }\n});\n\n```\nNote that as written, the above code will allow redirects to URLs on `example.com`, which is harmless but perhaps not intended. You can substitute your own domain (if known) for `example.com` to prevent this.\n\n\n## References\n* OWASP: [ XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-601](https://cwe.mitre.org/data/definitions/601.html).\n","markdown":"# Server-side URL redirect\nDirectly incorporating user input into a URL redirect request without validating the input can facilitate phishing attacks. In these attacks, unsuspecting users can be redirected to a malicious site that looks very similar to the real site they intend to visit, but which is controlled by the attacker.\n\n\n## Recommendation\nTo guard against untrusted URL redirection, it is advisable to avoid putting user input directly into a redirect URL. Instead, maintain a list of authorized redirects on the server; then choose from that list based on the user input provided.\n\nIf this is not possible, then the user input should be validated in some other way, for example, by verifying that the target URL is on the same host as the current page.\n\n\n## Example\nThe following example shows an HTTP request parameter being used directly in a URL redirect without validating the input, which facilitates phishing attacks:\n\n\n```javascript\nconst app = require(\"express\")();\n\napp.get(\"/redirect\", function (req, res) {\n // BAD: a request parameter is incorporated without validation into a URL redirect\n res.redirect(req.query[\"target\"]);\n});\n\n```\nOne way to remedy the problem is to validate the user input against a known fixed string before doing the redirection:\n\n\n```javascript\nconst app = require(\"express\")();\n\nconst VALID_REDIRECT = \"http://cwe.mitre.org/data/definitions/601.html\";\n\napp.get(\"/redirect\", function (req, res) {\n // GOOD: the request parameter is validated against a known fixed string\n let target = req.query[\"target\"];\n if (VALID_REDIRECT === target) {\n res.redirect(target);\n } else {\n res.redirect(\"/\");\n }\n});\n\n```\nAlternatively, we can check that the target URL does not redirect to a different host by parsing it relative to a base URL with a known host and verifying that the host stays the same:\n\n\n```javascript\nconst app = require(\"express\")();\n\nfunction isLocalUrl(path) {\n try {\n return (\n // TODO: consider substituting your own domain for example.com\n new URL(path, \"https://example.com\").origin === \"https://example.com\"\n );\n } catch (e) {\n return false;\n }\n}\n\napp.get(\"/redirect\", function (req, res) {\n // GOOD: check that we don't redirect to a different host\n let target = req.query[\"target\"];\n if (isLocalUrl(target)) {\n res.redirect(target);\n } else {\n res.redirect(\"/\");\n }\n});\n\n```\nNote that as written, the above code will allow redirects to URLs on `example.com`, which is harmless but perhaps not intended. You can substitute your own domain (if known) for `example.com` to prevent this.\n\n\n## References\n* OWASP: [ XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-601](https://cwe.mitre.org/data/definitions/601.html).\n"},"properties":{"tags":["security","external/cwe/cwe-601"],"description":"Server-side URL redirection based on unvalidated user input\n may cause redirection to malicious web sites.","id":"js/server-side-unvalidated-url-redirection","kind":"path-problem","name":"Server-side URL redirect","precision":"high","problem.severity":"warning","security-severity":"6.1"}},{"id":"js/client-side-unvalidated-url-redirection","name":"js/client-side-unvalidated-url-redirection","shortDescription":{"text":"Client-side URL redirect"},"fullDescription":{"text":"Client-side URL redirection based on unvalidated user input may cause redirection to malicious web sites."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Client-side URL redirect\nRedirecting to a URL that is constructed from parts of the DOM that may be controlled by an attacker can facilitate phishing attacks. In these attacks, unsuspecting users can be redirected to a malicious site that looks very similar to the real site they intend to visit, but which is controlled by the attacker.\n\n\n## Recommendation\nTo guard against untrusted URL redirection, it is advisable to avoid putting user input directly into a redirect URL. Instead, maintain a list of authorized redirects on the server; then choose from that list based on the user input provided.\n\n\n## Example\nThe following example uses a regular expression to extract a query parameter from the document URL, and then uses it to construct a new URL to redirect to without any further validation. This may allow an attacker to craft a link that redirects from a trusted website to some arbitrary website of their choosing, which facilitates phishing attacks:\n\n\n```javascript\nwindow.location = /.*redirect=([^&]*).*/.exec(document.location.href)[1];\n\n```\n\n## References\n* OWASP: [ XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-601](https://cwe.mitre.org/data/definitions/601.html).\n","markdown":"# Client-side URL redirect\nRedirecting to a URL that is constructed from parts of the DOM that may be controlled by an attacker can facilitate phishing attacks. In these attacks, unsuspecting users can be redirected to a malicious site that looks very similar to the real site they intend to visit, but which is controlled by the attacker.\n\n\n## Recommendation\nTo guard against untrusted URL redirection, it is advisable to avoid putting user input directly into a redirect URL. Instead, maintain a list of authorized redirects on the server; then choose from that list based on the user input provided.\n\n\n## Example\nThe following example uses a regular expression to extract a query parameter from the document URL, and then uses it to construct a new URL to redirect to without any further validation. This may allow an attacker to craft a link that redirects from a trusted website to some arbitrary website of their choosing, which facilitates phishing attacks:\n\n\n```javascript\nwindow.location = /.*redirect=([^&]*).*/.exec(document.location.href)[1];\n\n```\n\n## References\n* OWASP: [ XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-601](https://cwe.mitre.org/data/definitions/601.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116","external/cwe/cwe-601"],"description":"Client-side URL redirection based on unvalidated user input\n may cause redirection to malicious web sites.","id":"js/client-side-unvalidated-url-redirection","kind":"path-problem","name":"Client-side URL redirect","precision":"high","problem.severity":"error","security-severity":"6.1"}},{"id":"js/insecure-download","name":"js/insecure-download","shortDescription":{"text":"Download of sensitive file through insecure connection"},"fullDescription":{"text":"Downloading executables and other sensitive files over an insecure connection opens up for potential man-in-the-middle attacks."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Download of sensitive file through insecure connection\nDownloading executables or other sensitive files over an unencrypted connection can leave a server open to man-in-the-middle attacks (MITM). Such an attack can allow an attacker to insert arbitrary content into the downloaded file, and in the worst case, allow the attacker to execute arbitrary code on the vulnerable system.\n\n\n## Recommendation\nUse a secure transfer protocol when downloading executables or other sensitive files.\n\n\n## Example\nIn this example, a server downloads a shell script from a remote URL using the `node-fetch` library, and then executes this shell script.\n\n\n```javascript\nconst fetch = require(\"node-fetch\");\nconst cp = require(\"child_process\");\n\nfetch('http://mydownload.example.org/myscript.sh')\n .then(res => res.text())\n .then(script => cp.execSync(script));\n```\nThe HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded shell script with arbitrary code, which gives the attacker complete control over the system.\n\nThe issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.\n\n\n```javascript\nconst fetch = require(\"node-fetch\");\nconst cp = require(\"child_process\");\n\nfetch('https://mydownload.example.org/myscript.sh')\n .then(res => res.text())\n .then(script => cp.execSync(script));\n```\n\n## References\n* Wikipedia: [Man-in-the-middle attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)\n* Common Weakness Enumeration: [CWE-829](https://cwe.mitre.org/data/definitions/829.html).\n","markdown":"# Download of sensitive file through insecure connection\nDownloading executables or other sensitive files over an unencrypted connection can leave a server open to man-in-the-middle attacks (MITM). Such an attack can allow an attacker to insert arbitrary content into the downloaded file, and in the worst case, allow the attacker to execute arbitrary code on the vulnerable system.\n\n\n## Recommendation\nUse a secure transfer protocol when downloading executables or other sensitive files.\n\n\n## Example\nIn this example, a server downloads a shell script from a remote URL using the `node-fetch` library, and then executes this shell script.\n\n\n```javascript\nconst fetch = require(\"node-fetch\");\nconst cp = require(\"child_process\");\n\nfetch('http://mydownload.example.org/myscript.sh')\n .then(res => res.text())\n .then(script => cp.execSync(script));\n```\nThe HTTP protocol is vulnerable to MITM, and thus an attacker could potentially replace the downloaded shell script with arbitrary code, which gives the attacker complete control over the system.\n\nThe issue has been fixed in the example below by replacing the HTTP protocol with the HTTPS protocol.\n\n\n```javascript\nconst fetch = require(\"node-fetch\");\nconst cp = require(\"child_process\");\n\nfetch('https://mydownload.example.org/myscript.sh')\n .then(res => res.text())\n .then(script => cp.execSync(script));\n```\n\n## References\n* Wikipedia: [Man-in-the-middle attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)\n* Common Weakness Enumeration: [CWE-829](https://cwe.mitre.org/data/definitions/829.html).\n"},"properties":{"tags":["security","external/cwe/cwe-829"],"description":"Downloading executables and other sensitive files over an insecure connection\n opens up for potential man-in-the-middle attacks.","id":"js/insecure-download","kind":"path-problem","name":"Download of sensitive file through insecure connection","precision":"high","problem.severity":"error","security-severity":"8.1"}},{"id":"js/shell-command-injection-from-environment","name":"js/shell-command-injection-from-environment","shortDescription":{"text":"Shell command built from environment values"},"fullDescription":{"text":"Building a shell command string with values from the enclosing environment may cause subtle bugs or vulnerabilities."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Shell command built from environment values\nDynamically constructing a shell command with values from the local environment, such as file paths, may inadvertently change the meaning of the shell command. Such changes can occur when an environment value contains characters that the shell interprets in a special way, for instance quotes and spaces. This can result in the shell command misbehaving, or even allowing a malicious user to execute arbitrary commands on the system.\n\n\n## Recommendation\nIf possible, use hard-coded string literals to specify the shell command to run, and provide the dynamic arguments to the shell command separately to avoid interpretation by the shell.\n\nAlternatively, if the shell command must be constructed dynamically, then add code to ensure that special characters in environment values do not alter the shell command unexpectedly.\n\n\n## Example\nThe following example shows a dynamically constructed shell command that recursively removes a temporary directory that is located next to the currently executing JavaScript file. Such utilities are often found in custom build scripts.\n\n\n```javascript\nvar cp = require(\"child_process\"),\n path = require(\"path\");\nfunction cleanupTemp() {\n let cmd = \"rm -rf \" + path.join(__dirname, \"temp\");\n cp.execSync(cmd); // BAD\n}\n\n```\nThe shell command will, however, fail to work as intended if the absolute path of the script's directory contains spaces. In that case, the shell command will interpret the absolute path as multiple paths, instead of a single path.\n\nFor instance, if the absolute path of the temporary directory is `/home/username/important project/temp`, then the shell command will recursively delete `/home/username/important` and `project/temp`, where the latter path gets resolved relative to the working directory of the JavaScript process.\n\nEven worse, although less likely, a malicious user could provide the path `/home/username/; cat /etc/passwd #/important project/temp` in order to execute the command `cat /etc/passwd`.\n\nTo avoid such potentially catastrophic behaviors, provide the directory as an argument that does not get interpreted by a shell:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n path = require(\"path\");\nfunction cleanupTemp() {\n let cmd = \"rm\",\n args = [\"-rf\", path.join(__dirname, \"temp\")];\n cp.execFileSync(cmd, args); // GOOD\n}\n\n```\n\n## References\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n* Common Weakness Enumeration: [CWE-88](https://cwe.mitre.org/data/definitions/88.html).\n","markdown":"# Shell command built from environment values\nDynamically constructing a shell command with values from the local environment, such as file paths, may inadvertently change the meaning of the shell command. Such changes can occur when an environment value contains characters that the shell interprets in a special way, for instance quotes and spaces. This can result in the shell command misbehaving, or even allowing a malicious user to execute arbitrary commands on the system.\n\n\n## Recommendation\nIf possible, use hard-coded string literals to specify the shell command to run, and provide the dynamic arguments to the shell command separately to avoid interpretation by the shell.\n\nAlternatively, if the shell command must be constructed dynamically, then add code to ensure that special characters in environment values do not alter the shell command unexpectedly.\n\n\n## Example\nThe following example shows a dynamically constructed shell command that recursively removes a temporary directory that is located next to the currently executing JavaScript file. Such utilities are often found in custom build scripts.\n\n\n```javascript\nvar cp = require(\"child_process\"),\n path = require(\"path\");\nfunction cleanupTemp() {\n let cmd = \"rm -rf \" + path.join(__dirname, \"temp\");\n cp.execSync(cmd); // BAD\n}\n\n```\nThe shell command will, however, fail to work as intended if the absolute path of the script's directory contains spaces. In that case, the shell command will interpret the absolute path as multiple paths, instead of a single path.\n\nFor instance, if the absolute path of the temporary directory is `/home/username/important project/temp`, then the shell command will recursively delete `/home/username/important` and `project/temp`, where the latter path gets resolved relative to the working directory of the JavaScript process.\n\nEven worse, although less likely, a malicious user could provide the path `/home/username/; cat /etc/passwd #/important project/temp` in order to execute the command `cat /etc/passwd`.\n\nTo avoid such potentially catastrophic behaviors, provide the directory as an argument that does not get interpreted by a shell:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n path = require(\"path\");\nfunction cleanupTemp() {\n let cmd = \"rm\",\n args = [\"-rf\", path.join(__dirname, \"temp\")];\n cp.execFileSync(cmd, args); // GOOD\n}\n\n```\n\n## References\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n* Common Weakness Enumeration: [CWE-88](https://cwe.mitre.org/data/definitions/88.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-078","external/cwe/cwe-088"],"description":"Building a shell command string with values from the enclosing\n environment may cause subtle bugs or vulnerabilities.","id":"js/shell-command-injection-from-environment","kind":"path-problem","name":"Shell command built from environment values","precision":"high","problem.severity":"warning","security-severity":"6.3"}},{"id":"js/command-line-injection","name":"js/command-line-injection","shortDescription":{"text":"Uncontrolled command line"},"fullDescription":{"text":"Using externally controlled strings in a command line may allow a malicious user to change the meaning of the command."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Uncontrolled command line\nCode that passes untrusted user input directly to `child_process.exec` or similar APIs that execute shell commands allows the user to execute malicious code.\n\n\n## Recommendation\nIf possible, use APIs that don't run shell commands and that accept command arguments as an array of strings rather than a single concatenated string. This is both safer and more portable.\n\nIf given arguments as a single string, avoid simply splitting the string on whitespace. Arguments may contain quoted whitespace, causing them to split into multiple arguments. Use a library like `shell-quote` to parse the string into an array of arguments instead.\n\nIf this approach is not viable, then add code to verify that the user input string is safe before using it.\n\n\n## Example\nThe following example shows code that extracts a filename from an HTTP query parameter that may contain untrusted data, and then embeds it into a shell command to count its lines without examining it first:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n http = require('http'),\n url = require('url');\n\nvar server = http.createServer(function(req, res) {\n let file = url.parse(req.url, true).query.path;\n\n cp.execSync(`wc -l ${file}`); // BAD\n});\n\n```\nA malicious user can take advantage of this code by executing arbitrary shell commands. For example, by providing a filename like `foo.txt; rm -rf .`, the user can first count the lines in `foo.txt` and subsequently delete all files in the current directory.\n\nTo avoid this catastrophic behavior, use an API such as `child_process.execFileSync` that does not spawn a shell by default:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n http = require('http'),\n url = require('url');\n\nvar server = http.createServer(function(req, res) {\n let file = url.parse(req.url, true).query.path;\n\n cp.execFileSync('wc', ['-l', file]); // GOOD\n});\n\n```\nIf you want to allow the user to specify other options to `wc`, you can use a library like `shell-quote` to parse the user input into an array of arguments without risking command injection:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n http = require('http'),\n url = require('url'),\n shellQuote = require('shell-quote');\n\nvar server = http.createServer(function(req, res) {\n let options = url.parse(req.url, true).query.options;\n\n cp.execFileSync('wc', shellQuote.parse(options)); // GOOD\n});\n\n```\nAlternatively, the original example can be made safe by checking the filename against an allowlist of safe characters before using it:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n http = require('http'),\n url = require('url');\n\nvar server = http.createServer(function(req, res) {\n let file = url.parse(req.url, true).query.path;\n\n // only allow safe characters in file name\n if (file.match(/^[\\w\\.\\-\\/]+$/)) {\n cp.execSync(`wc -l ${file}`); // GOOD\n }\n});\n\n```\n\n## References\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* npm: [shell-quote](https://www.npmjs.com/package/shell-quote).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n* Common Weakness Enumeration: [CWE-88](https://cwe.mitre.org/data/definitions/88.html).\n","markdown":"# Uncontrolled command line\nCode that passes untrusted user input directly to `child_process.exec` or similar APIs that execute shell commands allows the user to execute malicious code.\n\n\n## Recommendation\nIf possible, use APIs that don't run shell commands and that accept command arguments as an array of strings rather than a single concatenated string. This is both safer and more portable.\n\nIf given arguments as a single string, avoid simply splitting the string on whitespace. Arguments may contain quoted whitespace, causing them to split into multiple arguments. Use a library like `shell-quote` to parse the string into an array of arguments instead.\n\nIf this approach is not viable, then add code to verify that the user input string is safe before using it.\n\n\n## Example\nThe following example shows code that extracts a filename from an HTTP query parameter that may contain untrusted data, and then embeds it into a shell command to count its lines without examining it first:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n http = require('http'),\n url = require('url');\n\nvar server = http.createServer(function(req, res) {\n let file = url.parse(req.url, true).query.path;\n\n cp.execSync(`wc -l ${file}`); // BAD\n});\n\n```\nA malicious user can take advantage of this code by executing arbitrary shell commands. For example, by providing a filename like `foo.txt; rm -rf .`, the user can first count the lines in `foo.txt` and subsequently delete all files in the current directory.\n\nTo avoid this catastrophic behavior, use an API such as `child_process.execFileSync` that does not spawn a shell by default:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n http = require('http'),\n url = require('url');\n\nvar server = http.createServer(function(req, res) {\n let file = url.parse(req.url, true).query.path;\n\n cp.execFileSync('wc', ['-l', file]); // GOOD\n});\n\n```\nIf you want to allow the user to specify other options to `wc`, you can use a library like `shell-quote` to parse the user input into an array of arguments without risking command injection:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n http = require('http'),\n url = require('url'),\n shellQuote = require('shell-quote');\n\nvar server = http.createServer(function(req, res) {\n let options = url.parse(req.url, true).query.options;\n\n cp.execFileSync('wc', shellQuote.parse(options)); // GOOD\n});\n\n```\nAlternatively, the original example can be made safe by checking the filename against an allowlist of safe characters before using it:\n\n\n```javascript\nvar cp = require(\"child_process\"),\n http = require('http'),\n url = require('url');\n\nvar server = http.createServer(function(req, res) {\n let file = url.parse(req.url, true).query.path;\n\n // only allow safe characters in file name\n if (file.match(/^[\\w\\.\\-\\/]+$/)) {\n cp.execSync(`wc -l ${file}`); // GOOD\n }\n});\n\n```\n\n## References\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* npm: [shell-quote](https://www.npmjs.com/package/shell-quote).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n* Common Weakness Enumeration: [CWE-88](https://cwe.mitre.org/data/definitions/88.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-078","external/cwe/cwe-088"],"description":"Using externally controlled strings in a command line may allow a malicious\n user to change the meaning of the command.","id":"js/command-line-injection","kind":"path-problem","name":"Uncontrolled command line","precision":"high","problem.severity":"error","security-severity":"9.8"}},{"id":"js/shell-command-constructed-from-input","name":"js/shell-command-constructed-from-input","shortDescription":{"text":"Unsafe shell command constructed from library input"},"fullDescription":{"text":"Using externally controlled strings in a command line may allow a malicious user to change the meaning of the command."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Unsafe shell command constructed from library input\nDynamically constructing a shell command with inputs from exported functions may inadvertently change the meaning of the shell command. Clients using the exported function may use inputs containing characters that the shell interprets in a special way, for instance quotes and spaces. This can result in the shell command misbehaving, or even allowing a malicious user to execute arbitrary commands on the system.\n\n\n## Recommendation\nIf possible, provide the dynamic arguments to the shell as an array using a safe API such as `child_process.execFile` to avoid interpretation by the shell.\n\nIf given arguments as a single string, avoid simply splitting the string on whitespace. Arguments may contain quoted whitespace, causing them to split into multiple arguments. Use a library like `shell-quote` to parse the string into an array of arguments instead.\n\nAlternatively, if the command must be interpreted by a shell (for example because it includes I/O redirections), you can use `shell-quote` to escape any special characters in the input before embedding it in the command.\n\n\n## Example\nThe following example shows a dynamically constructed shell command that downloads a file from a remote URL.\n\n\n```javascript\nvar cp = require(\"child_process\");\n\nmodule.exports = function download(path, callback) {\n cp.exec(\"wget \" + path, callback);\n}\n\n```\nThe shell command will, however, fail to work as intended if the input contains spaces or other special characters interpreted in a special way by the shell.\n\nEven worse, a client might pass in user-controlled data, not knowing that the input is interpreted as a shell command. This could allow a malicious user to provide the input `http://example.org; cat /etc/passwd` in order to execute the command `cat /etc/passwd`.\n\nTo avoid such potentially catastrophic behaviors, provide the inputs from exported functions as an argument that does not get interpreted by a shell:\n\n\n```javascript\nvar cp = require(\"child_process\");\n\nmodule.exports = function download(path, callback) {\n cp.execFile(\"wget\", [path], callback);\n}\n\n```\nAs another example, consider the following code which is similar to the preceding example, but pipes the output of `wget` into `wc -l` to count the number of lines in the downloaded file.\n\n\n```javascript\nvar cp = require(\"child_process\");\n\nmodule.exports = function download(path, callback) {\n cp.exec(\"wget \" + path + \" | wc -l\", callback);\n};\n\n```\nIn this case, using `child_process.execFile` is not an option because the shell is needed to interpret the pipe operator. Instead, you can use `shell-quote` to escape the input before embedding it in the command:\n\n\n```javascript\nvar cp = require(\"child_process\");\n\nmodule.exports = function download(path, callback) {\n cp.exec(\"wget \" + shellQuote.quote([path]) + \" | wc -l\", callback);\n};\n\n```\n\n## References\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* npm: [shell-quote](https://www.npmjs.com/package/shell-quote).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n* Common Weakness Enumeration: [CWE-88](https://cwe.mitre.org/data/definitions/88.html).\n","markdown":"# Unsafe shell command constructed from library input\nDynamically constructing a shell command with inputs from exported functions may inadvertently change the meaning of the shell command. Clients using the exported function may use inputs containing characters that the shell interprets in a special way, for instance quotes and spaces. This can result in the shell command misbehaving, or even allowing a malicious user to execute arbitrary commands on the system.\n\n\n## Recommendation\nIf possible, provide the dynamic arguments to the shell as an array using a safe API such as `child_process.execFile` to avoid interpretation by the shell.\n\nIf given arguments as a single string, avoid simply splitting the string on whitespace. Arguments may contain quoted whitespace, causing them to split into multiple arguments. Use a library like `shell-quote` to parse the string into an array of arguments instead.\n\nAlternatively, if the command must be interpreted by a shell (for example because it includes I/O redirections), you can use `shell-quote` to escape any special characters in the input before embedding it in the command.\n\n\n## Example\nThe following example shows a dynamically constructed shell command that downloads a file from a remote URL.\n\n\n```javascript\nvar cp = require(\"child_process\");\n\nmodule.exports = function download(path, callback) {\n cp.exec(\"wget \" + path, callback);\n}\n\n```\nThe shell command will, however, fail to work as intended if the input contains spaces or other special characters interpreted in a special way by the shell.\n\nEven worse, a client might pass in user-controlled data, not knowing that the input is interpreted as a shell command. This could allow a malicious user to provide the input `http://example.org; cat /etc/passwd` in order to execute the command `cat /etc/passwd`.\n\nTo avoid such potentially catastrophic behaviors, provide the inputs from exported functions as an argument that does not get interpreted by a shell:\n\n\n```javascript\nvar cp = require(\"child_process\");\n\nmodule.exports = function download(path, callback) {\n cp.execFile(\"wget\", [path], callback);\n}\n\n```\nAs another example, consider the following code which is similar to the preceding example, but pipes the output of `wget` into `wc -l` to count the number of lines in the downloaded file.\n\n\n```javascript\nvar cp = require(\"child_process\");\n\nmodule.exports = function download(path, callback) {\n cp.exec(\"wget \" + path + \" | wc -l\", callback);\n};\n\n```\nIn this case, using `child_process.execFile` is not an option because the shell is needed to interpret the pipe operator. Instead, you can use `shell-quote` to escape the input before embedding it in the command:\n\n\n```javascript\nvar cp = require(\"child_process\");\n\nmodule.exports = function download(path, callback) {\n cp.exec(\"wget \" + shellQuote.quote([path]) + \" | wc -l\", callback);\n};\n\n```\n\n## References\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* npm: [shell-quote](https://www.npmjs.com/package/shell-quote).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n* Common Weakness Enumeration: [CWE-88](https://cwe.mitre.org/data/definitions/88.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-078","external/cwe/cwe-088"],"description":"Using externally controlled strings in a command line may allow a malicious\n user to change the meaning of the command.","id":"js/shell-command-constructed-from-input","kind":"path-problem","name":"Unsafe shell command constructed from library input","precision":"high","problem.severity":"error","security-severity":"6.3"}},{"id":"js/unnecessary-use-of-cat","name":"js/unnecessary-use-of-cat","shortDescription":{"text":"Unnecessary use of `cat` process"},"fullDescription":{"text":"Using the `cat` process to read a file is unnecessarily complex, inefficient, unportable, and can lead to subtle bugs, or even security vulnerabilities."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Unnecessary use of `cat` process\nUsing the unix command `cat` only to read a file is an unnecessarily complex way to achieve something that can be done in a simpler and safer manner using the Node.js `fs.readFile` API.\n\nThe use of `cat` for simple file reads leads to code that is unportable, inefficient, complex, and can lead to subtle bugs or even security vulnerabilities.\n\n\n## Recommendation\nUse `fs.readFile` or `fs.readFileSync` to read files from the file system.\n\n\n## Example\nThe following example shows code that reads a file using `cat`:\n\n\n```javascript\nvar child_process = require('child_process');\n\nmodule.exports = function (name) {\n return child_process.execSync(\"cat \" + name).toString();\n};\n\n```\nThe code in the example will break if the input `name` contains special characters (including space). Additionally, it does not work on Windows and if the input is user-controlled, a command injection attack can happen.\n\nThe `fs.readFile` API should be used to avoid these potential issues:\n\n\n```javascript\nvar fs = require('fs');\n\nmodule.exports = function (name) {\n return fs.readFileSync(name).toString();\n};\n\n```\n\n## References\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* Node.js: [File System API](https://nodejs.org/api/fs.html).\n* [The Useless Use of Cat Award](http://porkmail.org/era/unix/award.html#cat).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n","markdown":"# Unnecessary use of `cat` process\nUsing the unix command `cat` only to read a file is an unnecessarily complex way to achieve something that can be done in a simpler and safer manner using the Node.js `fs.readFile` API.\n\nThe use of `cat` for simple file reads leads to code that is unportable, inefficient, complex, and can lead to subtle bugs or even security vulnerabilities.\n\n\n## Recommendation\nUse `fs.readFile` or `fs.readFileSync` to read files from the file system.\n\n\n## Example\nThe following example shows code that reads a file using `cat`:\n\n\n```javascript\nvar child_process = require('child_process');\n\nmodule.exports = function (name) {\n return child_process.execSync(\"cat \" + name).toString();\n};\n\n```\nThe code in the example will break if the input `name` contains special characters (including space). Additionally, it does not work on Windows and if the input is user-controlled, a command injection attack can happen.\n\nThe `fs.readFile` API should be used to avoid these potential issues:\n\n\n```javascript\nvar fs = require('fs');\n\nmodule.exports = function (name) {\n return fs.readFileSync(name).toString();\n};\n\n```\n\n## References\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* Node.js: [File System API](https://nodejs.org/api/fs.html).\n* [The Useless Use of Cat Award](http://porkmail.org/era/unix/award.html#cat).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n"},"properties":{"tags":["correctness","security","maintainability","external/cwe/cwe-078"],"description":"Using the `cat` process to read a file is unnecessarily complex, inefficient, unportable, and can lead to subtle bugs, or even security vulnerabilities.","id":"js/unnecessary-use-of-cat","kind":"problem","name":"Unnecessary use of `cat` process","precision":"high","problem.severity":"error","security-severity":"6.3"}},{"id":"js/second-order-command-line-injection","name":"js/second-order-command-line-injection","shortDescription":{"text":"Second order command injection"},"fullDescription":{"text":"Using user-controlled data as arguments to some commands, such as git clone, can allow arbitrary commands to be executed."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Second order command injection\nSome shell commands, like `git ls-remote`, can execute arbitrary commands if a user provides a malicious URL that starts with `--upload-pack`. This can be used to execute arbitrary code on the server.\n\n\n## Recommendation\nSanitize user input before passing it to the shell command. For example, ensure that URLs are valid and do not contain malicious commands.\n\n\n## Example\nThe following example shows code that executes `git ls-remote` on a URL that can be controlled by a malicious user.\n\n\n```javascript\nconst express = require(\"express\");\nconst app = express();\n\nconst cp = require(\"child_process\");\n\napp.get(\"/ls-remote\", (req, res) => {\n const remote = req.query.remote;\n cp.execFile(\"git\", [\"ls-remote\", remote]); // NOT OK\n});\n\n```\nThe problem has been fixed in the snippet below, where the URL is validated before being passed to the shell command.\n\n\n```javascript\nconst express = require(\"express\");\nconst app = express();\n\nconst cp = require(\"child_process\");\n\napp.get(\"/ls-remote\", (req, res) => {\n const remote = req.query.remote;\n if (!(remote.startsWith(\"git@\") || remote.startsWith(\"https://\"))) {\n throw new Error(\"Invalid remote: \" + remote);\n }\n cp.execFile(\"git\", [\"ls-remote\", remote]); // OK\n});\n\n```\n\n## References\n* Max Justicz: [Hacking 3,000,000 apps at once through CocoaPods](https://justi.cz/security/2021/04/20/cocoapods-rce.html).\n* Git: [Git - git-ls-remote Documentation](https://git-scm.com/docs/git-ls-remote/2.22.0#Documentation/git-ls-remote.txt---upload-packltexecgt).\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n* Common Weakness Enumeration: [CWE-88](https://cwe.mitre.org/data/definitions/88.html).\n","markdown":"# Second order command injection\nSome shell commands, like `git ls-remote`, can execute arbitrary commands if a user provides a malicious URL that starts with `--upload-pack`. This can be used to execute arbitrary code on the server.\n\n\n## Recommendation\nSanitize user input before passing it to the shell command. For example, ensure that URLs are valid and do not contain malicious commands.\n\n\n## Example\nThe following example shows code that executes `git ls-remote` on a URL that can be controlled by a malicious user.\n\n\n```javascript\nconst express = require(\"express\");\nconst app = express();\n\nconst cp = require(\"child_process\");\n\napp.get(\"/ls-remote\", (req, res) => {\n const remote = req.query.remote;\n cp.execFile(\"git\", [\"ls-remote\", remote]); // NOT OK\n});\n\n```\nThe problem has been fixed in the snippet below, where the URL is validated before being passed to the shell command.\n\n\n```javascript\nconst express = require(\"express\");\nconst app = express();\n\nconst cp = require(\"child_process\");\n\napp.get(\"/ls-remote\", (req, res) => {\n const remote = req.query.remote;\n if (!(remote.startsWith(\"git@\") || remote.startsWith(\"https://\"))) {\n throw new Error(\"Invalid remote: \" + remote);\n }\n cp.execFile(\"git\", [\"ls-remote\", remote]); // OK\n});\n\n```\n\n## References\n* Max Justicz: [Hacking 3,000,000 apps at once through CocoaPods](https://justi.cz/security/2021/04/20/cocoapods-rce.html).\n* Git: [Git - git-ls-remote Documentation](https://git-scm.com/docs/git-ls-remote/2.22.0#Documentation/git-ls-remote.txt---upload-packltexecgt).\n* OWASP: [Command Injection](https://www.owasp.org/index.php/Command_Injection).\n* Common Weakness Enumeration: [CWE-78](https://cwe.mitre.org/data/definitions/78.html).\n* Common Weakness Enumeration: [CWE-88](https://cwe.mitre.org/data/definitions/88.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-078","external/cwe/cwe-088"],"description":"Using user-controlled data as arguments to some commands, such as git clone,\n can allow arbitrary commands to be executed.","id":"js/second-order-command-line-injection","kind":"path-problem","name":"Second order command injection","precision":"high","problem.severity":"error","security-severity":"7.0"}},{"id":"js/insecure-dependency","name":"js/insecure-dependency","shortDescription":{"text":"Dependency download using unencrypted communication channel"},"fullDescription":{"text":"Using unencrypted protocols to fetch dependencies can leave an application open to man-in-the-middle attacks."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Dependency download using unencrypted communication channel\nUsing an insecure protocol like HTTP or FTP to download build dependencies makes the build process vulnerable to a man-in-the-middle (MITM) attack.\n\nThis can allow attackers to inject malicious code into the downloaded dependencies, and thereby infect the build artifacts and execute arbitrary code on the machine building the artifacts.\n\n\n## Recommendation\nAlways use a secure protocol, such as HTTPS or SFTP, when downloading artifacts from an URL.\n\n\n## Example\nThe below example shows a `package.json` file that downloads a dependency using the insecure HTTP protocol.\n\n\n```json\n{\n \"name\": \"example-project\",\n \"dependencies\": {\n \"unencrypted\": \"http://example.org/foo/tarball/release/0.0.1\",\n \"lodash\": \"^4.0.0\"\n }\n}\n```\nThe fix is to change the protocol to HTTPS.\n\n\n```json\n{\n \"name\": \"example-project\",\n \"dependencies\": {\n \"unencrypted\": \"https://example.org/foo/tarball/release/0.0.1\",\n \"lodash\": \"^4.0.0\"\n }\n}\n```\n\n## References\n* Jonathan Leitschuh: [ Want to take over the Java ecosystem? All you need is a MITM! ](https://infosecwriteups.com/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb)\n* Max Veytsman: [ How to take over the computer of any Java (or Closure or Scala) Developer. ](https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/)\n* Wikipedia: [Supply chain attack.](https://en.wikipedia.org/wiki/Supply_chain_attack)\n* Wikipedia: [Man-in-the-middle attack.](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)\n* Common Weakness Enumeration: [CWE-300](https://cwe.mitre.org/data/definitions/300.html).\n* Common Weakness Enumeration: [CWE-319](https://cwe.mitre.org/data/definitions/319.html).\n* Common Weakness Enumeration: [CWE-494](https://cwe.mitre.org/data/definitions/494.html).\n* Common Weakness Enumeration: [CWE-829](https://cwe.mitre.org/data/definitions/829.html).\n","markdown":"# Dependency download using unencrypted communication channel\nUsing an insecure protocol like HTTP or FTP to download build dependencies makes the build process vulnerable to a man-in-the-middle (MITM) attack.\n\nThis can allow attackers to inject malicious code into the downloaded dependencies, and thereby infect the build artifacts and execute arbitrary code on the machine building the artifacts.\n\n\n## Recommendation\nAlways use a secure protocol, such as HTTPS or SFTP, when downloading artifacts from an URL.\n\n\n## Example\nThe below example shows a `package.json` file that downloads a dependency using the insecure HTTP protocol.\n\n\n```json\n{\n \"name\": \"example-project\",\n \"dependencies\": {\n \"unencrypted\": \"http://example.org/foo/tarball/release/0.0.1\",\n \"lodash\": \"^4.0.0\"\n }\n}\n```\nThe fix is to change the protocol to HTTPS.\n\n\n```json\n{\n \"name\": \"example-project\",\n \"dependencies\": {\n \"unencrypted\": \"https://example.org/foo/tarball/release/0.0.1\",\n \"lodash\": \"^4.0.0\"\n }\n}\n```\n\n## References\n* Jonathan Leitschuh: [ Want to take over the Java ecosystem? All you need is a MITM! ](https://infosecwriteups.com/want-to-take-over-the-java-ecosystem-all-you-need-is-a-mitm-1fc329d898fb)\n* Max Veytsman: [ How to take over the computer of any Java (or Closure or Scala) Developer. ](https://max.computer/blog/how-to-take-over-the-computer-of-any-java-or-clojure-or-scala-developer/)\n* Wikipedia: [Supply chain attack.](https://en.wikipedia.org/wiki/Supply_chain_attack)\n* Wikipedia: [Man-in-the-middle attack.](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)\n* Common Weakness Enumeration: [CWE-300](https://cwe.mitre.org/data/definitions/300.html).\n* Common Weakness Enumeration: [CWE-319](https://cwe.mitre.org/data/definitions/319.html).\n* Common Weakness Enumeration: [CWE-494](https://cwe.mitre.org/data/definitions/494.html).\n* Common Weakness Enumeration: [CWE-829](https://cwe.mitre.org/data/definitions/829.html).\n"},"properties":{"tags":["security","external/cwe/cwe-300","external/cwe/cwe-319","external/cwe/cwe-494","external/cwe/cwe-829"],"description":"Using unencrypted protocols to fetch dependencies can leave an application\n open to man-in-the-middle attacks.","id":"js/insecure-dependency","kind":"problem","name":"Dependency download using unencrypted communication channel","precision":"high","problem.severity":"warning","security-severity":"8.1"}},{"id":"js/disabling-certificate-validation","name":"js/disabling-certificate-validation","shortDescription":{"text":"Disabling certificate validation"},"fullDescription":{"text":"Disabling cryptographic certificate validation can cause security vulnerabilities."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Disabling certificate validation\nCertificate validation is the standard authentication method of a secure TLS connection. Without it, there is no guarantee about who the other party of a TLS connection is, making man-in-the-middle attacks more likely to occur\n\nWhen testing software that uses TLS connections, it may be useful to disable the certificate validation temporarily. But disabling it in production environments is strongly discouraged, unless an alternative method of authentication is used.\n\n\n## Recommendation\nDo not disable certificate validation for TLS connections.\n\n\n## Example\nThe following example shows a HTTPS connection that transfers confidential information to a remote server. But the connection is not secure since the `rejectUnauthorized` option of the connection is set to `false`. As a consequence, anyone can impersonate the remote server, and receive the confidential information.\n\n\n```javascript\nlet https = require(\"https\");\n\nhttps.request(\n {\n hostname: \"secure.my-online-bank.com\",\n port: 443,\n method: \"POST\",\n path: \"send-confidential-information\",\n rejectUnauthorized: false // BAD\n },\n response => {\n // ... communicate with secure.my-online-bank.com\n }\n);\n\n```\nTo make the connection secure, the `rejectUnauthorized` option should have its default value, or be explicitly set to `true`.\n\n\n## References\n* Wikipedia: [Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security)\n* Wikipedia: [Man-in-the-middle attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)\n* Node.js: [TLS (SSL)](https://nodejs.org/api/tls.html)\n* Common Weakness Enumeration: [CWE-295](https://cwe.mitre.org/data/definitions/295.html).\n* Common Weakness Enumeration: [CWE-297](https://cwe.mitre.org/data/definitions/297.html).\n","markdown":"# Disabling certificate validation\nCertificate validation is the standard authentication method of a secure TLS connection. Without it, there is no guarantee about who the other party of a TLS connection is, making man-in-the-middle attacks more likely to occur\n\nWhen testing software that uses TLS connections, it may be useful to disable the certificate validation temporarily. But disabling it in production environments is strongly discouraged, unless an alternative method of authentication is used.\n\n\n## Recommendation\nDo not disable certificate validation for TLS connections.\n\n\n## Example\nThe following example shows a HTTPS connection that transfers confidential information to a remote server. But the connection is not secure since the `rejectUnauthorized` option of the connection is set to `false`. As a consequence, anyone can impersonate the remote server, and receive the confidential information.\n\n\n```javascript\nlet https = require(\"https\");\n\nhttps.request(\n {\n hostname: \"secure.my-online-bank.com\",\n port: 443,\n method: \"POST\",\n path: \"send-confidential-information\",\n rejectUnauthorized: false // BAD\n },\n response => {\n // ... communicate with secure.my-online-bank.com\n }\n);\n\n```\nTo make the connection secure, the `rejectUnauthorized` option should have its default value, or be explicitly set to `true`.\n\n\n## References\n* Wikipedia: [Transport Layer Security (TLS)](https://en.wikipedia.org/wiki/Transport_Layer_Security)\n* Wikipedia: [Man-in-the-middle attack](https://en.wikipedia.org/wiki/Man-in-the-middle_attack)\n* Node.js: [TLS (SSL)](https://nodejs.org/api/tls.html)\n* Common Weakness Enumeration: [CWE-295](https://cwe.mitre.org/data/definitions/295.html).\n* Common Weakness Enumeration: [CWE-297](https://cwe.mitre.org/data/definitions/297.html).\n"},"properties":{"tags":["security","external/cwe/cwe-295","external/cwe/cwe-297"],"description":"Disabling cryptographic certificate validation can cause security vulnerabilities.","id":"js/disabling-certificate-validation","kind":"problem","name":"Disabling certificate validation","precision":"very-high","problem.severity":"error","security-severity":"7.5"}},{"id":"js/xpath-injection","name":"js/xpath-injection","shortDescription":{"text":"XPath injection"},"fullDescription":{"text":"Building an XPath expression from user-controlled sources is vulnerable to insertion of malicious code by the user."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# XPath injection\nIf an XPath expression is built using string concatenation, and the components of the concatenation include user input, it makes it very easy for a user to create a malicious XPath expression.\n\n\n## Recommendation\nIf user input must be included in an XPath expression, either sanitize the data or use variable references to safely embed it without altering the structure of the expression.\n\n\n## Example\nIn this example, the code accepts a user name specified by the user, and uses this unvalidated and unsanitized value in an XPath expression constructed using the `xpath` package. This is vulnerable to the user providing special characters or string sequences that change the meaning of the XPath expression to search for different values.\n\n\n```javascript\nconst express = require('express');\nconst xpath = require('xpath');\nconst app = express();\n\napp.get('/some/route', function(req, res) {\n let userName = req.param(\"userName\");\n\n // BAD: Use user-provided data directly in an XPath expression\n let badXPathExpr = xpath.parse(\"//users/user[login/text()='\" + userName + \"']/home_dir/text()\");\n badXPathExpr.select({\n node: root\n });\n});\n\n```\nInstead, embed the user input using the variable replacement mechanism offered by `xpath`:\n\n\n```javascript\nconst express = require('express');\nconst xpath = require('xpath');\nconst app = express();\n\napp.get('/some/route', function(req, res) {\n let userName = req.param(\"userName\");\n\n // GOOD: Embed user-provided data using variables\n let goodXPathExpr = xpath.parse(\"//users/user[login/text()=$userName]/home_dir/text()\");\n goodXPathExpr.select({\n node: root,\n variables: { userName: userName }\n });\n});\n\n```\n\n## References\n* OWASP: [Testing for XPath Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/09-Testing_for_XPath_Injection).\n* OWASP: [XPath Injection](https://www.owasp.org/index.php/XPATH_Injection).\n* npm: [xpath](https://www.npmjs.com/package/xpath).\n* Common Weakness Enumeration: [CWE-643](https://cwe.mitre.org/data/definitions/643.html).\n","markdown":"# XPath injection\nIf an XPath expression is built using string concatenation, and the components of the concatenation include user input, it makes it very easy for a user to create a malicious XPath expression.\n\n\n## Recommendation\nIf user input must be included in an XPath expression, either sanitize the data or use variable references to safely embed it without altering the structure of the expression.\n\n\n## Example\nIn this example, the code accepts a user name specified by the user, and uses this unvalidated and unsanitized value in an XPath expression constructed using the `xpath` package. This is vulnerable to the user providing special characters or string sequences that change the meaning of the XPath expression to search for different values.\n\n\n```javascript\nconst express = require('express');\nconst xpath = require('xpath');\nconst app = express();\n\napp.get('/some/route', function(req, res) {\n let userName = req.param(\"userName\");\n\n // BAD: Use user-provided data directly in an XPath expression\n let badXPathExpr = xpath.parse(\"//users/user[login/text()='\" + userName + \"']/home_dir/text()\");\n badXPathExpr.select({\n node: root\n });\n});\n\n```\nInstead, embed the user input using the variable replacement mechanism offered by `xpath`:\n\n\n```javascript\nconst express = require('express');\nconst xpath = require('xpath');\nconst app = express();\n\napp.get('/some/route', function(req, res) {\n let userName = req.param(\"userName\");\n\n // GOOD: Embed user-provided data using variables\n let goodXPathExpr = xpath.parse(\"//users/user[login/text()=$userName]/home_dir/text()\");\n goodXPathExpr.select({\n node: root,\n variables: { userName: userName }\n });\n});\n\n```\n\n## References\n* OWASP: [Testing for XPath Injection](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/09-Testing_for_XPath_Injection).\n* OWASP: [XPath Injection](https://www.owasp.org/index.php/XPATH_Injection).\n* npm: [xpath](https://www.npmjs.com/package/xpath).\n* Common Weakness Enumeration: [CWE-643](https://cwe.mitre.org/data/definitions/643.html).\n"},"properties":{"tags":["security","external/cwe/cwe-643"],"description":"Building an XPath expression from user-controlled sources is vulnerable to insertion of\n malicious code by the user.","id":"js/xpath-injection","kind":"path-problem","name":"XPath injection","precision":"high","problem.severity":"error","security-severity":"9.8"}},{"id":"js/html-constructed-from-input","name":"js/html-constructed-from-input","shortDescription":{"text":"Unsafe HTML constructed from library input"},"fullDescription":{"text":"Using externally controlled strings to construct HTML might allow a malicious user to perform a cross-site scripting attack."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Unsafe HTML constructed from library input\nWhen a library function dynamically constructs HTML in a potentially unsafe way, then it's important to document to clients of the library that the function should only be used with trusted inputs. If the function is not documented as being potentially unsafe, then a client may inadvertently use inputs containing unsafe HTML fragments, and thereby leave the client vulnerable to cross-site scripting attacks.\n\n\n## Recommendation\nDocument all library functions that can lead to cross-site scripting attacks, and guard against unsafe inputs where dynamic HTML construction is not intended.\n\n\n## Example\nThe following example has a library function that renders a boldface name by writing to the `innerHTML` property of an element.\n\n\n```javascript\nmodule.exports = function showBoldName(name) {\n document.getElementById('name').innerHTML = \"\" + name + \"\";\n}\n\n```\nThis library function, however, does not escape unsafe HTML, and a client that calls the function with user-supplied input may be vulnerable to cross-site scripting attacks.\n\nThe library could either document that this function should not be used with unsafe inputs, or use safe APIs such as `innerText`.\n\n\n```javascript\nmodule.exports = function showBoldName(name) {\n const bold = document.createElement('b');\n bold.innerText = name;\n document.getElementById('name').appendChild(bold);\n}\n\n```\nAlternatively, an HTML sanitizer can be used to remove unsafe content.\n\n\n```javascript\n\nconst striptags = require('striptags');\nmodule.exports = function showBoldName(name) {\n document.getElementById('name').innerHTML = \"\" + striptags(name) + \"\";\n}\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet).\n* OWASP [DOM Based XSS](https://www.owasp.org/index.php/DOM_Based_XSS).\n* OWASP [Types of Cross-Site Scripting](https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Unsafe HTML constructed from library input\nWhen a library function dynamically constructs HTML in a potentially unsafe way, then it's important to document to clients of the library that the function should only be used with trusted inputs. If the function is not documented as being potentially unsafe, then a client may inadvertently use inputs containing unsafe HTML fragments, and thereby leave the client vulnerable to cross-site scripting attacks.\n\n\n## Recommendation\nDocument all library functions that can lead to cross-site scripting attacks, and guard against unsafe inputs where dynamic HTML construction is not intended.\n\n\n## Example\nThe following example has a library function that renders a boldface name by writing to the `innerHTML` property of an element.\n\n\n```javascript\nmodule.exports = function showBoldName(name) {\n document.getElementById('name').innerHTML = \"\" + name + \"\";\n}\n\n```\nThis library function, however, does not escape unsafe HTML, and a client that calls the function with user-supplied input may be vulnerable to cross-site scripting attacks.\n\nThe library could either document that this function should not be used with unsafe inputs, or use safe APIs such as `innerText`.\n\n\n```javascript\nmodule.exports = function showBoldName(name) {\n const bold = document.createElement('b');\n bold.innerText = name;\n document.getElementById('name').appendChild(bold);\n}\n\n```\nAlternatively, an HTML sanitizer can be used to remove unsafe content.\n\n\n```javascript\n\nconst striptags = require('striptags');\nmodule.exports = function showBoldName(name) {\n document.getElementById('name').innerHTML = \"\" + striptags(name) + \"\";\n}\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet).\n* OWASP [DOM Based XSS](https://www.owasp.org/index.php/DOM_Based_XSS).\n* OWASP [Types of Cross-Site Scripting](https://www.owasp.org/index.php/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116"],"description":"Using externally controlled strings to construct HTML might allow a malicious\n user to perform a cross-site scripting attack.","id":"js/html-constructed-from-input","kind":"path-problem","name":"Unsafe HTML constructed from library input","precision":"high","problem.severity":"error","security-severity":"6.1"}},{"id":"js/stored-xss","name":"js/stored-xss","shortDescription":{"text":"Stored cross-site scripting"},"fullDescription":{"text":"Using uncontrolled stored values in HTML allows for a stored cross-site scripting vulnerability."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Stored cross-site scripting\nDirectly using uncontrolled stored value (for example, file names) to create HTML content without properly sanitizing the input first, allows for a cross-site scripting vulnerability.\n\nThis kind of vulnerability is also called *stored* cross-site scripting, to distinguish it from other types of cross-site scripting.\n\n\n## Recommendation\nTo guard against cross-site scripting, consider using contextual output encoding/escaping before using uncontrolled stored values to create HTML content, or one of the other solutions that are mentioned in the references.\n\n\n## Example\nThe following example code writes file names directly to a HTTP response. This leaves the website vulnerable to cross-site scripting, if an attacker can choose the file names on the disk.\n\n\n```javascript\nvar express = require('express'),\n fs = require('fs');\n\nexpress().get('/list-directory', function(req, res) {\n fs.readdir('/public', function (error, fileNames) {\n var list = '- ';\n fileNames.forEach(fileName => {\n // BAD: `fileName` can contain HTML elements\n list += '
- ' + fileName + ' ';\n });\n list += '
- ';\n fileNames.forEach(fileName => {\n // GOOD: escaped `fileName` can not contain HTML elements\n list += '
- ' + escape(fileName) + ' ';\n });\n list += '
- ';\n fileNames.forEach(fileName => {\n // BAD: `fileName` can contain HTML elements\n list += '
- ' + fileName + ' ';\n });\n list += '
- ';\n fileNames.forEach(fileName => {\n // GOOD: escaped `fileName` can not contain HTML elements\n list += '
- ' + escape(fileName) + ' ';\n });\n list += '
Hello world
');\n});\n```\nTo force the cookie to be transmitted using SSL, set the `secure` attribute on the cookie.\n\n\n```javascript\nconst http = require('http');\n\nconst server = http.createServer((req, res) => {\n res.setHeader(\"Set-Cookie\", `authKey=${makeAuthkey()}; secure; httpOnly`);\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('Hello world
');\n});\n```\n\n## References\n* ExpressJS: [Use cookies securely](https://expressjs.com/en/advanced/best-practice-security.html#use-cookies-securely).\n* OWASP: [Set cookie flags appropriately](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#set-cookie-flags-appropriately).\n* Mozilla: [Set-Cookie](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie).\n* Common Weakness Enumeration: [CWE-614](https://cwe.mitre.org/data/definitions/614.html).\n* Common Weakness Enumeration: [CWE-311](https://cwe.mitre.org/data/definitions/311.html).\n* Common Weakness Enumeration: [CWE-312](https://cwe.mitre.org/data/definitions/312.html).\n* Common Weakness Enumeration: [CWE-319](https://cwe.mitre.org/data/definitions/319.html).\n","markdown":"# Clear text transmission of sensitive cookie\nCookies that are transmitted in clear text can be intercepted by an attacker. If sensitive cookies are intercepted, the attacker can read the cookie and use it to perform actions on the user's behalf.\n\n\n## Recommendation\nAlways transmit sensitive cookies using SSL by setting the `secure` attribute on the cookie.\n\n\n## Example\nThe following example stores an authentication token in a cookie that can be transmitted in clear text.\n\n\n```javascript\nconst http = require('http');\n\nconst server = http.createServer((req, res) => {\n res.setHeader(\"Set-Cookie\", `authKey=${makeAuthkey()}`);\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('Hello world
');\n});\n```\nTo force the cookie to be transmitted using SSL, set the `secure` attribute on the cookie.\n\n\n```javascript\nconst http = require('http');\n\nconst server = http.createServer((req, res) => {\n res.setHeader(\"Set-Cookie\", `authKey=${makeAuthkey()}; secure; httpOnly`);\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('Hello world
');\n});\n```\n\n## References\n* ExpressJS: [Use cookies securely](https://expressjs.com/en/advanced/best-practice-security.html#use-cookies-securely).\n* OWASP: [Set cookie flags appropriately](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#set-cookie-flags-appropriately).\n* Mozilla: [Set-Cookie](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie).\n* Common Weakness Enumeration: [CWE-614](https://cwe.mitre.org/data/definitions/614.html).\n* Common Weakness Enumeration: [CWE-311](https://cwe.mitre.org/data/definitions/311.html).\n* Common Weakness Enumeration: [CWE-312](https://cwe.mitre.org/data/definitions/312.html).\n* Common Weakness Enumeration: [CWE-319](https://cwe.mitre.org/data/definitions/319.html).\n"},"properties":{"tags":["security","external/cwe/cwe-614","external/cwe/cwe-311","external/cwe/cwe-312","external/cwe/cwe-319"],"description":"Sending sensitive information in a cookie without requring SSL encryption\n can expose the cookie to an attacker.","id":"js/clear-text-cookie","kind":"problem","name":"Clear text transmission of sensitive cookie","precision":"high","problem.severity":"warning","security-severity":"5.0"}},{"id":"js/jwt-missing-verification","name":"js/jwt-missing-verification","shortDescription":{"text":"JWT missing secret or public key verification"},"fullDescription":{"text":"The application does not verify the JWT payload with a cryptographic secret or public key."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# JWT missing secret or public key verification\nApplications decoding JSON Web Tokens (JWT) may be misconfigured due to the `None` algorithm.\n\nThe `None` algorithm is selected by calling the `verify()` function with a falsy value instead of a cryptographic secret or key. The `None` algorithm disables the integrity enforcement of a JWT payload and may allow a malicious actor to make unintended changes to a JWT payload leading to critical security issues like privilege escalation.\n\n\n## Recommendation\nCalls to `verify()` functions should use a cryptographic secret or key to decode JWT payloads.\n\n\n## Example\nIn the example below, `false` is used to disable the integrity enforcement of a JWT payload. This may allow a malicious actor to make changes to a JWT payload.\n\n\n```javascript\nconst jwt = require(\"jsonwebtoken\");\n\nconst secret = \"my-secret-key\";\n\nvar token = jwt.sign({ foo: 'bar' }, secret, { algorithm: \"none\" })\njwt.verify(token, false, { algorithms: [\"HS256\", \"none\"] })\n```\nThe following code fixes the problem by using a cryptographic secret or key to decode JWT payloads.\n\n\n```javascript\n\nconst jwt = require(\"jsonwebtoken\");\n\nconst secret = \"my-secret-key\";\n\nvar token = jwt.sign({ foo: 'bar' }, secret, { algorithm: \"HS256\" }) \njwt.verify(token, secret, { algorithms: [\"HS256\", \"none\"] })\n```\n\n## References\n* Auth0 Blog: [Meet the \"None\" Algorithm](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/#Meet-the--None--Algorithm).\n* Common Weakness Enumeration: [CWE-347](https://cwe.mitre.org/data/definitions/347.html).\n","markdown":"# JWT missing secret or public key verification\nApplications decoding JSON Web Tokens (JWT) may be misconfigured due to the `None` algorithm.\n\nThe `None` algorithm is selected by calling the `verify()` function with a falsy value instead of a cryptographic secret or key. The `None` algorithm disables the integrity enforcement of a JWT payload and may allow a malicious actor to make unintended changes to a JWT payload leading to critical security issues like privilege escalation.\n\n\n## Recommendation\nCalls to `verify()` functions should use a cryptographic secret or key to decode JWT payloads.\n\n\n## Example\nIn the example below, `false` is used to disable the integrity enforcement of a JWT payload. This may allow a malicious actor to make changes to a JWT payload.\n\n\n```javascript\nconst jwt = require(\"jsonwebtoken\");\n\nconst secret = \"my-secret-key\";\n\nvar token = jwt.sign({ foo: 'bar' }, secret, { algorithm: \"none\" })\njwt.verify(token, false, { algorithms: [\"HS256\", \"none\"] })\n```\nThe following code fixes the problem by using a cryptographic secret or key to decode JWT payloads.\n\n\n```javascript\n\nconst jwt = require(\"jsonwebtoken\");\n\nconst secret = \"my-secret-key\";\n\nvar token = jwt.sign({ foo: 'bar' }, secret, { algorithm: \"HS256\" }) \njwt.verify(token, secret, { algorithms: [\"HS256\", \"none\"] })\n```\n\n## References\n* Auth0 Blog: [Meet the \"None\" Algorithm](https://auth0.com/blog/critical-vulnerabilities-in-json-web-token-libraries/#Meet-the--None--Algorithm).\n* Common Weakness Enumeration: [CWE-347](https://cwe.mitre.org/data/definitions/347.html).\n"},"properties":{"tags":["security","external/cwe/cwe-347"],"description":"The application does not verify the JWT payload with a cryptographic secret or public key.","id":"js/jwt-missing-verification","kind":"problem","name":"JWT missing secret or public key verification","precision":"high","problem.severity":"warning","security-severity":"7.0"}},{"id":"js/type-confusion-through-parameter-tampering","name":"js/type-confusion-through-parameter-tampering","shortDescription":{"text":"Type confusion through parameter tampering"},"fullDescription":{"text":"Sanitizing an HTTP request parameter may be ineffective if the user controls its type."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Type confusion through parameter tampering\nSanitizing untrusted HTTP request parameters is a common technique for preventing injection attacks such as SQL injection or path traversal. This is sometimes done by checking if the request parameters contain blacklisted substrings.\n\nHowever, sanitizing request parameters assuming they have type `String` and using the builtin string methods such as `String.prototype.indexOf` is susceptible to type confusion attacks. In a type confusion attack, an attacker tampers with an HTTP request parameter such that it has a value of type `Array` instead of the expected type `String`. Furthermore, the content of the array has been crafted to bypass sanitizers by exploiting that some identically named methods of strings and arrays behave differently.\n\n\n## Recommendation\nCheck the runtime type of sanitizer inputs if the input type is user-controlled.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using prepared statements for SQL queries.\n\n\n## Example\nFor example, Node.js server frameworks usually present request parameters as strings. But if an attacker sends multiple request parameters with the same name, then the request parameter is represented as an array instead.\n\nIn the following example, a sanitizer checks that a path does not contain the `\"..\"` string, which would allow an attacker to access content outside a user-accessible directory.\n\n\n```javascript\nvar app = require(\"express\")(),\n path = require(\"path\");\n\napp.get(\"/user-files\", function(req, res) {\n var file = req.param(\"file\");\n if (file.indexOf(\"..\") !== -1) {\n // BAD\n // we forbid relative paths that contain ..\n // as these could leave the public directory\n res.status(400).send(\"Bad request\");\n } else {\n var absolute = path.resolve(\"/public/\" + file);\n console.log(\"Sending file: %s\", absolute);\n res.sendFile(absolute);\n }\n});\n\n```\nAs written, this sanitizer is ineffective: an array like `[\"../\", \"/../secret.txt\"]` will bypass the sanitizer. The array does not contain `\"..\"` as an element, so the call to `indexOf` returns `-1` . This is problematic since the value of the `absolute` variable then ends up being `\"/secret.txt\"`. This happens since the concatenation of `\"/public/\"` and the array results in `\"/public/../,/../secret.txt\"`, which the `resolve`-call converts to `\"/secret.txt\"`.\n\nTo fix the sanitizer, check that the request parameter is a string, and not an array:\n\n\n```javascript\nvar app = require(\"express\")(),\n path = require(\"path\");\n\napp.get(\"/user-files\", function(req, res) {\n var file = req.param(\"file\");\n if (typeof file !== 'string' || file.indexOf(\"..\") !== -1) {\n // GOOD\n // we forbid relative paths that contain ..\n // as these could leave the public directory\n res.status(400).send(\"Bad request\");\n } else {\n var absolute = path.resolve(\"/public/\" + file);\n console.log(\"Sending file: %s\", absolute);\n res.sendFile(absolute);\n }\n});\n\n```\n\n## References\n* Node.js API: [querystring](https://nodejs.org/api/querystring.html).\n* Common Weakness Enumeration: [CWE-843](https://cwe.mitre.org/data/definitions/843.html).\n","markdown":"# Type confusion through parameter tampering\nSanitizing untrusted HTTP request parameters is a common technique for preventing injection attacks such as SQL injection or path traversal. This is sometimes done by checking if the request parameters contain blacklisted substrings.\n\nHowever, sanitizing request parameters assuming they have type `String` and using the builtin string methods such as `String.prototype.indexOf` is susceptible to type confusion attacks. In a type confusion attack, an attacker tampers with an HTTP request parameter such that it has a value of type `Array` instead of the expected type `String`. Furthermore, the content of the array has been crafted to bypass sanitizers by exploiting that some identically named methods of strings and arrays behave differently.\n\n\n## Recommendation\nCheck the runtime type of sanitizer inputs if the input type is user-controlled.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using prepared statements for SQL queries.\n\n\n## Example\nFor example, Node.js server frameworks usually present request parameters as strings. But if an attacker sends multiple request parameters with the same name, then the request parameter is represented as an array instead.\n\nIn the following example, a sanitizer checks that a path does not contain the `\"..\"` string, which would allow an attacker to access content outside a user-accessible directory.\n\n\n```javascript\nvar app = require(\"express\")(),\n path = require(\"path\");\n\napp.get(\"/user-files\", function(req, res) {\n var file = req.param(\"file\");\n if (file.indexOf(\"..\") !== -1) {\n // BAD\n // we forbid relative paths that contain ..\n // as these could leave the public directory\n res.status(400).send(\"Bad request\");\n } else {\n var absolute = path.resolve(\"/public/\" + file);\n console.log(\"Sending file: %s\", absolute);\n res.sendFile(absolute);\n }\n});\n\n```\nAs written, this sanitizer is ineffective: an array like `[\"../\", \"/../secret.txt\"]` will bypass the sanitizer. The array does not contain `\"..\"` as an element, so the call to `indexOf` returns `-1` . This is problematic since the value of the `absolute` variable then ends up being `\"/secret.txt\"`. This happens since the concatenation of `\"/public/\"` and the array results in `\"/public/../,/../secret.txt\"`, which the `resolve`-call converts to `\"/secret.txt\"`.\n\nTo fix the sanitizer, check that the request parameter is a string, and not an array:\n\n\n```javascript\nvar app = require(\"express\")(),\n path = require(\"path\");\n\napp.get(\"/user-files\", function(req, res) {\n var file = req.param(\"file\");\n if (typeof file !== 'string' || file.indexOf(\"..\") !== -1) {\n // GOOD\n // we forbid relative paths that contain ..\n // as these could leave the public directory\n res.status(400).send(\"Bad request\");\n } else {\n var absolute = path.resolve(\"/public/\" + file);\n console.log(\"Sending file: %s\", absolute);\n res.sendFile(absolute);\n }\n});\n\n```\n\n## References\n* Node.js API: [querystring](https://nodejs.org/api/querystring.html).\n* Common Weakness Enumeration: [CWE-843](https://cwe.mitre.org/data/definitions/843.html).\n"},"properties":{"tags":["security","external/cwe/cwe-843"],"description":"Sanitizing an HTTP request parameter may be ineffective if the user controls its type.","id":"js/type-confusion-through-parameter-tampering","kind":"path-problem","name":"Type confusion through parameter tampering","precision":"high","problem.severity":"error","security-severity":"9.8"}},{"id":"js/case-sensitive-middleware-path","name":"js/case-sensitive-middleware-path","shortDescription":{"text":"Case-sensitive middleware path"},"fullDescription":{"text":"Middleware with case-sensitive paths do not protect endpoints with case-insensitive paths."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Case-sensitive middleware path\nUsing a case-sensitive regular expression path in a middleware route enables an attacker to bypass that middleware when accessing an endpoint with a case-insensitive path. Paths specified using a string are case-insensitive, whereas regular expressions are case-sensitive by default.\n\n\n## Recommendation\nWhen using a regular expression as a middleware path, make sure the regular expression is case-insensitive by adding the `i` flag.\n\n\n## Example\nThe following example restricts access to paths in the `/admin` path to users logged in as administrators:\n\n\n```javascript\nconst app = require('express')();\n\napp.use(/\\/admin\\/.*/, (req, res, next) => {\n if (!req.user.isAdmin) {\n res.status(401).send('Unauthorized');\n } else {\n next();\n }\n});\n\napp.get('/admin/users/:id', (req, res) => {\n res.send(app.database.users[req.params.id]);\n});\n\n```\nA path such as `/admin/users/45` can only be accessed by an administrator. However, the path `/ADMIN/USERS/45` can be accessed by anyone because the upper-case path doesn't match the case-sensitive regular expression, whereas Express considers it to match the path string `/admin/users`.\n\nThe issue can be fixed by adding the `i` flag to the regular expression:\n\n\n```javascript\nconst app = require('express')();\n\napp.use(/\\/admin\\/.*/i, (req, res, next) => {\n if (!req.user.isAdmin) {\n res.status(401).send('Unauthorized');\n } else {\n next();\n }\n});\n\napp.get('/admin/users/:id', (req, res) => {\n res.send(app.database.users[req.params.id]);\n});\n\n```\n\n## References\n* MDN [Regular Expression Flags](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#advanced_searching_with_flags).\n* Common Weakness Enumeration: [CWE-178](https://cwe.mitre.org/data/definitions/178.html).\n","markdown":"# Case-sensitive middleware path\nUsing a case-sensitive regular expression path in a middleware route enables an attacker to bypass that middleware when accessing an endpoint with a case-insensitive path. Paths specified using a string are case-insensitive, whereas regular expressions are case-sensitive by default.\n\n\n## Recommendation\nWhen using a regular expression as a middleware path, make sure the regular expression is case-insensitive by adding the `i` flag.\n\n\n## Example\nThe following example restricts access to paths in the `/admin` path to users logged in as administrators:\n\n\n```javascript\nconst app = require('express')();\n\napp.use(/\\/admin\\/.*/, (req, res, next) => {\n if (!req.user.isAdmin) {\n res.status(401).send('Unauthorized');\n } else {\n next();\n }\n});\n\napp.get('/admin/users/:id', (req, res) => {\n res.send(app.database.users[req.params.id]);\n});\n\n```\nA path such as `/admin/users/45` can only be accessed by an administrator. However, the path `/ADMIN/USERS/45` can be accessed by anyone because the upper-case path doesn't match the case-sensitive regular expression, whereas Express considers it to match the path string `/admin/users`.\n\nThe issue can be fixed by adding the `i` flag to the regular expression:\n\n\n```javascript\nconst app = require('express')();\n\napp.use(/\\/admin\\/.*/i, (req, res, next) => {\n if (!req.user.isAdmin) {\n res.status(401).send('Unauthorized');\n } else {\n next();\n }\n});\n\napp.get('/admin/users/:id', (req, res) => {\n res.send(app.database.users[req.params.id]);\n});\n\n```\n\n## References\n* MDN [Regular Expression Flags](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#advanced_searching_with_flags).\n* Common Weakness Enumeration: [CWE-178](https://cwe.mitre.org/data/definitions/178.html).\n"},"properties":{"tags":["security","external/cwe/cwe-178"],"description":"Middleware with case-sensitive paths do not protect endpoints with case-insensitive paths.","id":"js/case-sensitive-middleware-path","kind":"problem","name":"Case-sensitive middleware path","precision":"high","problem.severity":"warning","security-severity":"7.3"}},{"id":"js/client-exposed-cookie","name":"js/client-exposed-cookie","shortDescription":{"text":"Sensitive server cookie exposed to the client"},"fullDescription":{"text":"Sensitive cookies set by a server can be read by the client if the `httpOnly` flag is not set."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Sensitive server cookie exposed to the client\nAuthentication cookies stored by a server can be accessed by a client if the `httpOnly` flag is not set.\n\nAn attacker that manages a cross-site scripting (XSS) attack can read the cookie and hijack the session.\n\n\n## Recommendation\nSet the `httpOnly` flag on all cookies that are not needed by the client.\n\n\n## Example\nThe following example stores an authentication token in a cookie that can be viewed by the client.\n\n\n```javascript\nconst http = require('http');\n\nconst server = http.createServer((req, res) => {\n res.setHeader(\"Set-Cookie\", `authKey=${makeAuthkey()}`);\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('Hello world
');\n});\n```\nTo force the cookie to be transmitted using SSL, set the `secure` attribute on the cookie.\n\n\n```javascript\nconst http = require('http');\n\nconst server = http.createServer((req, res) => {\n res.setHeader(\"Set-Cookie\", `authKey=${makeAuthkey()}; secure; httpOnly`);\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('Hello world
');\n});\n```\n\n## References\n* ExpressJS: [Use cookies securely](https://expressjs.com/en/advanced/best-practice-security.html#use-cookies-securely).\n* OWASP: [Set cookie flags appropriately](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#set-cookie-flags-appropriately).\n* Mozilla: [Set-Cookie](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie).\n* Common Weakness Enumeration: [CWE-1004](https://cwe.mitre.org/data/definitions/1004.html).\n","markdown":"# Sensitive server cookie exposed to the client\nAuthentication cookies stored by a server can be accessed by a client if the `httpOnly` flag is not set.\n\nAn attacker that manages a cross-site scripting (XSS) attack can read the cookie and hijack the session.\n\n\n## Recommendation\nSet the `httpOnly` flag on all cookies that are not needed by the client.\n\n\n## Example\nThe following example stores an authentication token in a cookie that can be viewed by the client.\n\n\n```javascript\nconst http = require('http');\n\nconst server = http.createServer((req, res) => {\n res.setHeader(\"Set-Cookie\", `authKey=${makeAuthkey()}`);\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('Hello world
');\n});\n```\nTo force the cookie to be transmitted using SSL, set the `secure` attribute on the cookie.\n\n\n```javascript\nconst http = require('http');\n\nconst server = http.createServer((req, res) => {\n res.setHeader(\"Set-Cookie\", `authKey=${makeAuthkey()}; secure; httpOnly`);\n res.writeHead(200, { 'Content-Type': 'text/html' });\n res.end('Hello world
');\n});\n```\n\n## References\n* ExpressJS: [Use cookies securely](https://expressjs.com/en/advanced/best-practice-security.html#use-cookies-securely).\n* OWASP: [Set cookie flags appropriately](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html#set-cookie-flags-appropriately).\n* Mozilla: [Set-Cookie](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie).\n* Common Weakness Enumeration: [CWE-1004](https://cwe.mitre.org/data/definitions/1004.html).\n"},"properties":{"tags":["security","external/cwe/cwe-1004"],"description":"Sensitive cookies set by a server can be read by the client if the `httpOnly` flag is not set.","id":"js/client-exposed-cookie","kind":"problem","name":"Sensitive server cookie exposed to the client","precision":"high","problem.severity":"warning","security-severity":"5.0"}},{"id":"js/loop-bound-injection","name":"js/loop-bound-injection","shortDescription":{"text":"Loop bound injection"},"fullDescription":{"text":"Iterating over an object with a user-controlled .length property can cause indefinite looping."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Loop bound injection\nUsing the `.length` property of an untrusted object as a loop bound may cause indefinite looping since a malicious attacker can set the `.length` property to a very large number. For example, when a program that expects an array is passed a JSON object such as `{length: 1e100}`, the loop will be run for 10100 iterations. This may cause the program to hang or run out of memory, which can be used to mount a denial-of-service (DoS) attack.\n\n\n## Recommendation\nEither check that the object is indeed an array or limit the size of the `.length` property.\n\n\n## Example\nIn the example below, an HTTP request handler iterates over a user-controlled object `obj` using the `obj.length` property in order to copy the elements from `obj` to an array.\n\n\n```javascript\nvar express = require('express');\nvar app = express();\n\napp.post(\"/foo\", (req, res) => {\n var obj = req.body;\n\n var ret = [];\n\n // Potential DoS if obj.length is large.\n for (var i = 0; i < obj.length; i++) {\n ret.push(obj[i]);\n }\n});\n\n```\nThis is not secure since an attacker can control the value of `obj.length`, and thereby cause the loop to iterate indefinitely. Here the potential DoS is fixed by enforcing that the user-controlled object is an array.\n\n\n```javascript\nvar express = require('express');\nvar app = express();\n\napp.post(\"/foo\", (req, res) => {\n var obj = req.body;\n \n if (!(obj instanceof Array)) { // Prevents DoS.\n return [];\n }\n\n var ret = [];\n\n for (var i = 0; i < obj.length; i++) {\n ret.push(obj[i]);\n }\n});\n\n```\n\n## References\n* Common Weakness Enumeration: [CWE-834](https://cwe.mitre.org/data/definitions/834.html).\n* Common Weakness Enumeration: [CWE-730](https://cwe.mitre.org/data/definitions/730.html).\n","markdown":"# Loop bound injection\nUsing the `.length` property of an untrusted object as a loop bound may cause indefinite looping since a malicious attacker can set the `.length` property to a very large number. For example, when a program that expects an array is passed a JSON object such as `{length: 1e100}`, the loop will be run for 10100 iterations. This may cause the program to hang or run out of memory, which can be used to mount a denial-of-service (DoS) attack.\n\n\n## Recommendation\nEither check that the object is indeed an array or limit the size of the `.length` property.\n\n\n## Example\nIn the example below, an HTTP request handler iterates over a user-controlled object `obj` using the `obj.length` property in order to copy the elements from `obj` to an array.\n\n\n```javascript\nvar express = require('express');\nvar app = express();\n\napp.post(\"/foo\", (req, res) => {\n var obj = req.body;\n\n var ret = [];\n\n // Potential DoS if obj.length is large.\n for (var i = 0; i < obj.length; i++) {\n ret.push(obj[i]);\n }\n});\n\n```\nThis is not secure since an attacker can control the value of `obj.length`, and thereby cause the loop to iterate indefinitely. Here the potential DoS is fixed by enforcing that the user-controlled object is an array.\n\n\n```javascript\nvar express = require('express');\nvar app = express();\n\napp.post(\"/foo\", (req, res) => {\n var obj = req.body;\n \n if (!(obj instanceof Array)) { // Prevents DoS.\n return [];\n }\n\n var ret = [];\n\n for (var i = 0; i < obj.length; i++) {\n ret.push(obj[i]);\n }\n});\n\n```\n\n## References\n* Common Weakness Enumeration: [CWE-834](https://cwe.mitre.org/data/definitions/834.html).\n* Common Weakness Enumeration: [CWE-730](https://cwe.mitre.org/data/definitions/730.html).\n"},"properties":{"tags":["security","external/cwe/cwe-834","external/cwe/cwe-730"],"description":"Iterating over an object with a user-controlled .length\n property can cause indefinite looping.","id":"js/loop-bound-injection","kind":"path-problem","name":"Loop bound injection","precision":"high","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/bad-tag-filter","name":"js/bad-tag-filter","shortDescription":{"text":"Bad HTML filtering regexp"},"fullDescription":{"text":"Matching HTML tags using regular expressions is hard to do right, and can easily lead to security issues."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Bad HTML filtering regexp\nIt is possible to match some single HTML tags using regular expressions (parsing general HTML using regular expressions is impossible). However, if the regular expression is not written well it might be possible to circumvent it, which can lead to cross-site scripting or other security issues.\n\nSome of these mistakes are caused by browsers having very forgiving HTML parsers, and will often render invalid HTML containing syntax errors. Regular expressions that attempt to match HTML should also recognize tags containing such syntax errors.\n\n\n## Recommendation\nUse a well-tested sanitization or parser library if at all possible. These libraries are much more likely to handle corner cases correctly than a custom implementation.\n\n\n## Example\nThe following example attempts to filters out all `` as script end tags, but also tags such as `` even though it is a parser error. This means that an attack string such as `` will not be filtered by the function, and `alert(1)` will be executed by a browser if the string is rendered as HTML.\n\nOther corner cases include that HTML comments can end with `--!>`, and that HTML tag names can contain upper case characters.\n\n\n## References\n* Securitum: [The Curious Case of Copy & Paste](https://research.securitum.com/the-curious-case-of-copy-paste/).\n* stackoverflow.com: [You can't parse \\[X\\]HTML with regex](https://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags#answer-1732454).\n* HTML Standard: [Comment end bang state](https://html.spec.whatwg.org/multipage/parsing.html#comment-end-bang-state).\n* stackoverflow.com: [Why aren't browsers strict about HTML?](https://stackoverflow.com/questions/25559999/why-arent-browsers-strict-about-html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n* Common Weakness Enumeration: [CWE-80](https://cwe.mitre.org/data/definitions/80.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-184](https://cwe.mitre.org/data/definitions/184.html).\n* Common Weakness Enumeration: [CWE-185](https://cwe.mitre.org/data/definitions/185.html).\n* Common Weakness Enumeration: [CWE-186](https://cwe.mitre.org/data/definitions/186.html).\n","markdown":"# Bad HTML filtering regexp\nIt is possible to match some single HTML tags using regular expressions (parsing general HTML using regular expressions is impossible). However, if the regular expression is not written well it might be possible to circumvent it, which can lead to cross-site scripting or other security issues.\n\nSome of these mistakes are caused by browsers having very forgiving HTML parsers, and will often render invalid HTML containing syntax errors. Regular expressions that attempt to match HTML should also recognize tags containing such syntax errors.\n\n\n## Recommendation\nUse a well-tested sanitization or parser library if at all possible. These libraries are much more likely to handle corner cases correctly than a custom implementation.\n\n\n## Example\nThe following example attempts to filters out all `` as script end tags, but also tags such as `` even though it is a parser error. This means that an attack string such as `` will not be filtered by the function, and `alert(1)` will be executed by a browser if the string is rendered as HTML.\n\nOther corner cases include that HTML comments can end with `--!>`, and that HTML tag names can contain upper case characters.\n\n\n## References\n* Securitum: [The Curious Case of Copy & Paste](https://research.securitum.com/the-curious-case-of-copy-paste/).\n* stackoverflow.com: [You can't parse \\[X\\]HTML with regex](https://stackoverflow.com/questions/1732348/regex-match-open-tags-except-xhtml-self-contained-tags#answer-1732454).\n* HTML Standard: [Comment end bang state](https://html.spec.whatwg.org/multipage/parsing.html#comment-end-bang-state).\n* stackoverflow.com: [Why aren't browsers strict about HTML?](https://stackoverflow.com/questions/25559999/why-arent-browsers-strict-about-html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n* Common Weakness Enumeration: [CWE-80](https://cwe.mitre.org/data/definitions/80.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-184](https://cwe.mitre.org/data/definitions/184.html).\n* Common Weakness Enumeration: [CWE-185](https://cwe.mitre.org/data/definitions/185.html).\n* Common Weakness Enumeration: [CWE-186](https://cwe.mitre.org/data/definitions/186.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-020","external/cwe/cwe-080","external/cwe/cwe-116","external/cwe/cwe-184","external/cwe/cwe-185","external/cwe/cwe-186"],"description":"Matching HTML tags using regular expressions is hard to do right, and can easily lead to security issues.","id":"js/bad-tag-filter","kind":"problem","name":"Bad HTML filtering regexp","precision":"high","problem.severity":"warning","security-severity":"7.8"}},{"id":"js/double-escaping","name":"js/double-escaping","shortDescription":{"text":"Double escaping or unescaping"},"fullDescription":{"text":"When escaping special characters using a meta-character like backslash or ampersand, the meta-character has to be escaped first to avoid double-escaping, and conversely it has to be unescaped last to avoid double-unescaping."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Double escaping or unescaping\nEscaping meta-characters in untrusted input is an important technique for preventing injection attacks such as cross-site scripting. One particular example of this is HTML entity encoding, where HTML special characters are replaced by HTML character entities to prevent them from being interpreted as HTML markup. For example, the less-than character is encoded as `<` and the double-quote character as `"`. Other examples include backslash-escaping for including untrusted data in string literals and percent-encoding for URI components.\n\nThe reverse process of replacing escape sequences with the characters they represent is known as unescaping.\n\nNote that the escape characters themselves (such as ampersand in the case of HTML encoding) play a special role during escaping and unescaping: they are themselves escaped, but also form part of the escaped representations of other characters. Hence care must be taken to avoid double escaping and unescaping: when escaping, the escape character must be escaped first, when unescaping it has to be unescaped last.\n\nIf used in the context of sanitization, double unescaping may render the sanitization ineffective. Even if it is not used in a security-critical context, it may still result in confusing or garbled output.\n\n\n## Recommendation\nUse a (well-tested) sanitization library if at all possible. These libraries are much more likely to handle corner cases correctly than a custom implementation. For URI encoding, you can use the standard `encodeURIComponent` and `decodeURIComponent` functions.\n\nOtherwise, make sure to always escape the escape character first, and unescape it last.\n\n\n## Example\nThe following example shows a pair of hand-written HTML encoding and decoding functions:\n\n\n```javascript\nmodule.exports.encode = function(s) {\n return s.replace(/&/g, \"&\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n};\n\nmodule.exports.decode = function(s) {\n return s.replace(/&/g, \"&\")\n .replace(/"/g, \"\\\"\")\n .replace(/'/g, \"'\");\n};\n\n```\nThe encoding function correctly handles ampersand before the other characters. For example, the string `me & \"you\"` is encoded as `me & "you"`, and the string `"` is encoded as `"`.\n\nThe decoding function, however, incorrectly decodes `&` into `&` before handling the other characters. So while it correctly decodes the first example above, it decodes the second example (`"`) to `\"` (a single double quote), which is not correct.\n\nInstead, the decoding function should decode the ampersand last:\n\n\n```javascript\nmodule.exports.encode = function(s) {\n return s.replace(/&/g, \"&\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n};\n\nmodule.exports.decode = function(s) {\n return s.replace(/"/g, \"\\\"\")\n .replace(/'/g, \"'\")\n .replace(/&/g, \"&\");\n};\n\n```\n\n## References\n* OWASP Top 10: [A1 Injection](https://www.owasp.org/index.php/Top_10-2017_A1-Injection).\n* npm: [html-entities](https://www.npmjs.com/package/html-entities) package.\n* npm: [js-string-escape](https://www.npmjs.com/package/js-string-escape) package.\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n","markdown":"# Double escaping or unescaping\nEscaping meta-characters in untrusted input is an important technique for preventing injection attacks such as cross-site scripting. One particular example of this is HTML entity encoding, where HTML special characters are replaced by HTML character entities to prevent them from being interpreted as HTML markup. For example, the less-than character is encoded as `<` and the double-quote character as `"`. Other examples include backslash-escaping for including untrusted data in string literals and percent-encoding for URI components.\n\nThe reverse process of replacing escape sequences with the characters they represent is known as unescaping.\n\nNote that the escape characters themselves (such as ampersand in the case of HTML encoding) play a special role during escaping and unescaping: they are themselves escaped, but also form part of the escaped representations of other characters. Hence care must be taken to avoid double escaping and unescaping: when escaping, the escape character must be escaped first, when unescaping it has to be unescaped last.\n\nIf used in the context of sanitization, double unescaping may render the sanitization ineffective. Even if it is not used in a security-critical context, it may still result in confusing or garbled output.\n\n\n## Recommendation\nUse a (well-tested) sanitization library if at all possible. These libraries are much more likely to handle corner cases correctly than a custom implementation. For URI encoding, you can use the standard `encodeURIComponent` and `decodeURIComponent` functions.\n\nOtherwise, make sure to always escape the escape character first, and unescape it last.\n\n\n## Example\nThe following example shows a pair of hand-written HTML encoding and decoding functions:\n\n\n```javascript\nmodule.exports.encode = function(s) {\n return s.replace(/&/g, \"&\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n};\n\nmodule.exports.decode = function(s) {\n return s.replace(/&/g, \"&\")\n .replace(/"/g, \"\\\"\")\n .replace(/'/g, \"'\");\n};\n\n```\nThe encoding function correctly handles ampersand before the other characters. For example, the string `me & \"you\"` is encoded as `me & "you"`, and the string `"` is encoded as `"`.\n\nThe decoding function, however, incorrectly decodes `&` into `&` before handling the other characters. So while it correctly decodes the first example above, it decodes the second example (`"`) to `\"` (a single double quote), which is not correct.\n\nInstead, the decoding function should decode the ampersand last:\n\n\n```javascript\nmodule.exports.encode = function(s) {\n return s.replace(/&/g, \"&\")\n .replace(/\"/g, \""\")\n .replace(/'/g, \"'\");\n};\n\nmodule.exports.decode = function(s) {\n return s.replace(/"/g, \"\\\"\")\n .replace(/'/g, \"'\")\n .replace(/&/g, \"&\");\n};\n\n```\n\n## References\n* OWASP Top 10: [A1 Injection](https://www.owasp.org/index.php/Top_10-2017_A1-Injection).\n* npm: [html-entities](https://www.npmjs.com/package/html-entities) package.\n* npm: [js-string-escape](https://www.npmjs.com/package/js-string-escape) package.\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-116","external/cwe/cwe-020"],"description":"When escaping special characters using a meta-character like backslash or\n ampersand, the meta-character has to be escaped first to avoid double-escaping,\n and conversely it has to be unescaped last to avoid double-unescaping.","id":"js/double-escaping","kind":"problem","name":"Double escaping or unescaping","precision":"high","problem.severity":"warning","security-severity":"7.8"}},{"id":"js/incomplete-sanitization","name":"js/incomplete-sanitization","shortDescription":{"text":"Incomplete string escaping or encoding"},"fullDescription":{"text":"A string transformer that does not replace or escape all occurrences of a meta-character may be ineffective."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Incomplete string escaping or encoding\nSanitizing untrusted input is a common technique for preventing injection attacks such as SQL injection or cross-site scripting. Usually, this is done by escaping meta-characters such as quotes in a domain-specific way so that they are treated as normal characters.\n\nHowever, directly using the string `replace` method to perform escaping is notoriously error-prone. Common mistakes include only replacing the first occurrence of a meta-character, or backslash-escaping various meta-characters but not the backslash itself.\n\nIn the former case, later meta-characters are left undisturbed and can be used to subvert the sanitization. In the latter case, preceding a meta-character with a backslash leads to the backslash being escaped, but the meta-character appearing un-escaped, which again makes the sanitization ineffective.\n\nEven if the escaped string is not used in a security-critical context, incomplete escaping may still have undesirable effects, such as badly rendered or confusing output.\n\n\n## Recommendation\nUse a (well-tested) sanitization library if at all possible. These libraries are much more likely to handle corner cases correctly than a custom implementation.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using prepared statements for SQL queries.\n\nOtherwise, make sure to use a regular expression with the `g` flag to ensure that all occurrences are replaced, and remember to escape backslashes if applicable.\n\n\n## Example\nFor example, assume that we want to embed a user-controlled string `accountNumber` into a SQL query as part of a string literal. To avoid SQL injection, we need to ensure that the string does not contain un-escaped single-quote characters. The following function attempts to ensure this by doubling single quotes, and thereby escaping them:\n\n\n```javascript\nfunction escapeQuotes(s) {\n return s.replace(\"'\", \"''\");\n}\n\n```\nAs written, this sanitizer is ineffective: if the first argument to `replace` is a string literal (as in this case), only the *first* occurrence of that string is replaced.\n\nAs mentioned above, the function `escapeQuotes` should be replaced with a purpose-built sanitization library, such as the npm module `sqlstring`. Many other sanitization libraries are available from npm and other sources.\n\nIf this is not an option, `escapeQuotes` should be rewritten to use a regular expression with the `g` (\"global\") flag instead:\n\n\n```javascript\nfunction escapeQuotes(s) {\n return s.replace(/'/g, \"''\");\n}\n\n```\nNote that it is very important to include the global flag: `s.replace(/'/, \"''\")` *without* the global flag is equivalent to the first example above and only replaces the first quote.\n\n\n## References\n* OWASP Top 10: [A1 Injection](https://www.owasp.org/index.php/Top_10-2017_A1-Injection).\n* npm: [sqlstring](https://www.npmjs.com/package/sqlstring) package.\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n* Common Weakness Enumeration: [CWE-80](https://cwe.mitre.org/data/definitions/80.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Incomplete string escaping or encoding\nSanitizing untrusted input is a common technique for preventing injection attacks such as SQL injection or cross-site scripting. Usually, this is done by escaping meta-characters such as quotes in a domain-specific way so that they are treated as normal characters.\n\nHowever, directly using the string `replace` method to perform escaping is notoriously error-prone. Common mistakes include only replacing the first occurrence of a meta-character, or backslash-escaping various meta-characters but not the backslash itself.\n\nIn the former case, later meta-characters are left undisturbed and can be used to subvert the sanitization. In the latter case, preceding a meta-character with a backslash leads to the backslash being escaped, but the meta-character appearing un-escaped, which again makes the sanitization ineffective.\n\nEven if the escaped string is not used in a security-critical context, incomplete escaping may still have undesirable effects, such as badly rendered or confusing output.\n\n\n## Recommendation\nUse a (well-tested) sanitization library if at all possible. These libraries are much more likely to handle corner cases correctly than a custom implementation.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using prepared statements for SQL queries.\n\nOtherwise, make sure to use a regular expression with the `g` flag to ensure that all occurrences are replaced, and remember to escape backslashes if applicable.\n\n\n## Example\nFor example, assume that we want to embed a user-controlled string `accountNumber` into a SQL query as part of a string literal. To avoid SQL injection, we need to ensure that the string does not contain un-escaped single-quote characters. The following function attempts to ensure this by doubling single quotes, and thereby escaping them:\n\n\n```javascript\nfunction escapeQuotes(s) {\n return s.replace(\"'\", \"''\");\n}\n\n```\nAs written, this sanitizer is ineffective: if the first argument to `replace` is a string literal (as in this case), only the *first* occurrence of that string is replaced.\n\nAs mentioned above, the function `escapeQuotes` should be replaced with a purpose-built sanitization library, such as the npm module `sqlstring`. Many other sanitization libraries are available from npm and other sources.\n\nIf this is not an option, `escapeQuotes` should be rewritten to use a regular expression with the `g` (\"global\") flag instead:\n\n\n```javascript\nfunction escapeQuotes(s) {\n return s.replace(/'/g, \"''\");\n}\n\n```\nNote that it is very important to include the global flag: `s.replace(/'/, \"''\")` *without* the global flag is equivalent to the first example above and only replaces the first quote.\n\n\n## References\n* OWASP Top 10: [A1 Injection](https://www.owasp.org/index.php/Top_10-2017_A1-Injection).\n* npm: [sqlstring](https://www.npmjs.com/package/sqlstring) package.\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n* Common Weakness Enumeration: [CWE-80](https://cwe.mitre.org/data/definitions/80.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-020","external/cwe/cwe-080","external/cwe/cwe-116"],"description":"A string transformer that does not replace or escape all occurrences of a\n meta-character may be ineffective.","id":"js/incomplete-sanitization","kind":"problem","name":"Incomplete string escaping or encoding","precision":"high","problem.severity":"warning","security-severity":"7.8"}},{"id":"js/unsafe-html-expansion","name":"js/unsafe-html-expansion","shortDescription":{"text":"Unsafe expansion of self-closing HTML tag"},"fullDescription":{"text":"Using regular expressions to expand self-closing HTML tags may lead to cross-site scripting vulnerabilities."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Unsafe expansion of self-closing HTML tag\nSanitizing untrusted input for HTML meta-characters is a common technique for preventing cross-site scripting attacks. But even a sanitized input can be dangerous to use if it is modified further before a browser treats it as HTML. A seemingly innocent transformation that expands a self-closing HTML tag from `` to `` may in fact cause cross-site scripting vulnerabilities.\n\n\n## Recommendation\nUse a well-tested sanitization library if at all possible, and avoid modifying sanitized values further before treating them as HTML.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using HTML templates that are explicit about the values they treat as HTML.\n\n\n## Example\nThe following function transforms a self-closing HTML tag to a pair of open/close tags. It does so for all non-`img` and non-`area` tags, by using a regular expression with two capture groups. The first capture group corresponds to the name of the tag, and the second capture group to the content of the tag.\n\n\n```javascript\nfunction expandSelfClosingTags(html) {\n\tvar rxhtmlTag = /<(?!img|area)(([a-z][^\\w\\/>]*)[^>]*)\\/>/gi;\n\treturn html.replace(rxhtmlTag, \"<$1>\"); // BAD\n}\n\n```\nWhile it is generally known regular expressions are ill-suited for parsing HTML, variants of this particular transformation pattern have long been considered safe.\n\nHowever, the function is not safe. As an example, consider the following string:\n\n\n```html\n
\n\"/>\n\n```\nWhen the above function transforms the string, it becomes a string that results in an alert when a browser treats it as HTML.\n\n\n```html\n
\n\"/>\n\n```\n\n## References\n* jQuery: [Security fixes in jQuery 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/)\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [Types of Cross-Site](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Unsafe expansion of self-closing HTML tag\nSanitizing untrusted input for HTML meta-characters is a common technique for preventing cross-site scripting attacks. But even a sanitized input can be dangerous to use if it is modified further before a browser treats it as HTML. A seemingly innocent transformation that expands a self-closing HTML tag from `
` to `` may in fact cause cross-site scripting vulnerabilities.\n\n\n## Recommendation\nUse a well-tested sanitization library if at all possible, and avoid modifying sanitized values further before treating them as HTML.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using HTML templates that are explicit about the values they treat as HTML.\n\n\n## Example\nThe following function transforms a self-closing HTML tag to a pair of open/close tags. It does so for all non-`img` and non-`area` tags, by using a regular expression with two capture groups. The first capture group corresponds to the name of the tag, and the second capture group to the content of the tag.\n\n\n```javascript\nfunction expandSelfClosingTags(html) {\n\tvar rxhtmlTag = /<(?!img|area)(([a-z][^\\w\\/>]*)[^>]*)\\/>/gi;\n\treturn html.replace(rxhtmlTag, \"<$1>\"); // BAD\n}\n\n```\nWhile it is generally known regular expressions are ill-suited for parsing HTML, variants of this particular transformation pattern have long been considered safe.\n\nHowever, the function is not safe. As an example, consider the following string:\n\n\n```html\n
\n\"/>\n\n```\nWhen the above function transforms the string, it becomes a string that results in an alert when a browser treats it as HTML.\n\n\n```html\n
\n\"/>\n\n```\n\n## References\n* jQuery: [Security fixes in jQuery 3.5.0](https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/)\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [Types of Cross-Site](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["correctness","security","external/cwe/cwe-079","external/cwe/cwe-116"],"description":"Using regular expressions to expand self-closing HTML\n tags may lead to cross-site scripting vulnerabilities.","id":"js/unsafe-html-expansion","kind":"problem","name":"Unsafe expansion of self-closing HTML tag","precision":"very-high","problem.severity":"warning","security-severity":"6.1"}},{"id":"js/incomplete-html-attribute-sanitization","name":"js/incomplete-html-attribute-sanitization","shortDescription":{"text":"Incomplete HTML attribute sanitization"},"fullDescription":{"text":"Writing incompletely sanitized values to HTML attribute strings can lead to a cross-site scripting vulnerability."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Incomplete HTML attribute sanitization\nSanitizing untrusted input for HTML meta-characters is a common technique for preventing cross-site scripting attacks. Usually, this is done by escaping `<`, `>`, `&` and `\"`. However, the context in which the sanitized value is used decides the characters that need to be sanitized.\n\nAs a consequence, some programs only sanitize `<` and `>` since those are the most common dangerous characters. The lack of sanitization for `\"` is problematic when an incompletely sanitized value is used as an HTML attribute in a string that later is parsed as HTML.\n\n\n## Recommendation\nSanitize all relevant HTML meta-characters when constructing HTML dynamically, and pay special attention to where the sanitized value is used.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using HTML templates that are explicit about the values they treat as HTML.\n\n\n## Example\nThe following example code writes part of an HTTP request (which is controlled by the user) to an HTML attribute of the server response. The user-controlled value is, however, not sanitized for `\"`. This leaves the website vulnerable to cross-site scripting since an attacker can use a string like `\" onclick=\"alert(42)` to inject JavaScript code into the response.\n\n\n```javascript\nvar app = require('express')();\n\napp.get('/user/:id', function(req, res) {\n\tlet id = req.params.id;\n\tid = id.replace(/<|>/g, \"\"); // BAD\n\tlet userHtml = `\n \n \n```\n\n``` javascript\nsap.ui.define([\"sap/ui/core/mvc/Controller\", \"sap/ui/model/json/JSONModel\"],\n function (Controller, JSONModel) {\n return Controller.extend(\"vulnerable.controller.app\", {\n onInit: function () {\n var oData = { input: null };\n var oModel = new JSONModel(oData);\n this.getView().setModel(oModel);\n },\n });\n },\n);\n```\n\nThe issue can be resolved by setting the `HTML` control's `sanitizeContent` attribute to true.\n\n``` xml\n\n \n```\n\n## References\n\n- OWASP: [DOM Based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS).\n- SAP UI5 Documentation: [Cross-site Scripting](https://sapui5.hana.ondemand.com/sdk/#/topic/91f0bd316f4d1014b6dd926db0e91070.html) in UI5.\n- SAP UI5 Documentation: [Prevention of Cross-site Scripting](https://sapui5.hana.ondemand.com/sdk/#/topic/4de64e2e191f4a7297d4fd2d1e233a2d.html) in UI5.\n- SAP UI5 Documentation: [API Documentation of sap.ui.core.RenderManager](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.RenderManager).\n- SAP UI5 Documentation: [Defining Control Properties](https://sapui5.hana.ondemand.com/sdk/#/topic/ac56d92162ed47ff858fdf1ce26c18c4.html).\n- SAP UI5 Documentation: [Expression Binding](https://sapui5.hana.ondemand.com/sdk/#/topic/daf6852a04b44d118963968a1239d2c0).\n- SAP UI5 API Reference: [`sap.ui.core.HTML`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.HTML%23methods/setSanitizeContent).\n- Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n- Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n","markdown":"# Client-side cross-site scripting\n\nReceiving text from the user, most notably through a control, and rendering it as HTML in another control can lead to a cross-site scripting vulnerability.\n\n## Recommendation\n\n### Preventing XSS Involving User Defined Control\n\nIf the XSS attack vector includes a user-defined control, then we can mitigate the issue by sanitizing the user-provided input in the implementation of the control:\n- Where possible, define the property type to something other than `string` or `any`. If a value should be used, then opt for the `enum` type which only allows a predefined set of strings.\n- Use escaping functions in `sap.base.security`. Relevant sanitizers include `encodeXML` and `encodeHTML`.\n- When using API with `apiVersion: 2` (Semantic Rendering), do not use `RenderManager.unsafeHtml` unless the control property `sanitizeContent` is set to `true`.\n- When using the now-deprecated older API with `RenderManager.write` or `RenderManager.writeAttribute`, use their respective counterparts `RenderManager.writeEscaped` and `RenderManager.writeAttributeEscaped` which sanitizes their rendered contents.\n\n### Preventing XSS Not Involving User Defined Control\n\nAn XSS attack vector can still exist even when no user-defined control is used. In this case, a model property or a control property act as an intermediate step when external data is passed in.\nIn this case, the UI5 application should not use the property as is, but should sanitize the contents before reading it. Such sanitization can take place in the controller or in the view declaration using expression bindings.\n\n## Example\n\n### Custom Control with Custom Rendering Method\n\nThis custom control `vulnerable.control.xss` calls `unsafeHtml` on a given `RenderManager` instance in its static renderer function. Since its `text` property is an unrestricted string type, it can point to a string with contents that can be interpreted as HTML. If it is the case, `unsafeHtml` will render the string, running a possibly embedded JavaScript code in it.\n\n```javascript\nsap.ui.define([\"sap/ui/core/Control\"], function (Control) {\n return Control.extend(\"vulnerable.control.xss\", {\n metadata: { properties: { text: { type: \"string\" } } },\n renderer: {\n apiVersion: 2,\n render: function (oRm, oControl) {\n oRm.openStart(\"div\", oControl);\n oRm.unsafeHtml(oControl.getText()); // sink\n oRm.close(\"div\");\n }\n }\n });\n})\n```\n\nThis is the same custom control without the possibility of XSS using several means of sanitization: The property `text` is enforced to a non-string type, hence disallows unrestricted strings (This is espcially applicable if the expected input is a number anyways). Also, the `sap.base.security.encodeXML` function is used to escape HTML control characters.\n\n```javascript\nsap.ui.define([\"sap/ui/core/Control\", \"sap/base/security/encodeXML\"], function (Control, encodeXML) {\n return Control.extend(\"vulnerable.control.xss\", {\n metadata: { properties: { text: { type: \"int\" } } }, // constrain the type\n renderer: {\n apiVersion: 2,\n render: function (oRm, oControl) {\n oRm.openStart(\"div\", oControl);\n oRm.unsafeHtml(encodeXML(oControl.getText()); // encode using security functions\n oRm.close(\"div\");\n }\n }\n });\n})\n```\n\n### Library Control\n\nThis example contains only library controls that are not user-defined. The untrusted user input flows from `sap.m.Input` and directly flows out via `sap.ui.core.HTML` through the model property `input` as declared in the `onInit` method of the controller.\n\n``` xml\n\n \n \n```\n\n``` javascript\nsap.ui.define([\"sap/ui/core/mvc/Controller\", \"sap/ui/model/json/JSONModel\"],\n function (Controller, JSONModel) {\n return Controller.extend(\"vulnerable.controller.app\", {\n onInit: function () {\n var oData = { input: null };\n var oModel = new JSONModel(oData);\n this.getView().setModel(oModel);\n },\n });\n },\n);\n```\n\nThe issue can be resolved by setting the `HTML` control's `sanitizeContent` attribute to true.\n\n``` xml\n\n \n```\n\n## References\n\n- OWASP: [DOM Based XSS](https://owasp.org/www-community/attacks/DOM_Based_XSS).\n- SAP UI5 Documentation: [Cross-site Scripting](https://sapui5.hana.ondemand.com/sdk/#/topic/91f0bd316f4d1014b6dd926db0e91070.html) in UI5.\n- SAP UI5 Documentation: [Prevention of Cross-site Scripting](https://sapui5.hana.ondemand.com/sdk/#/topic/4de64e2e191f4a7297d4fd2d1e233a2d.html) in UI5.\n- SAP UI5 Documentation: [API Documentation of sap.ui.core.RenderManager](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.RenderManager).\n- SAP UI5 Documentation: [Defining Control Properties](https://sapui5.hana.ondemand.com/sdk/#/topic/ac56d92162ed47ff858fdf1ce26c18c4.html).\n- SAP UI5 Documentation: [Expression Binding](https://sapui5.hana.ondemand.com/sdk/#/topic/daf6852a04b44d118963968a1239d2c0).\n- SAP UI5 API Reference: [`sap.ui.core.HTML`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.HTML%23methods/setSanitizeContent).\n- Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n- Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116"],"description":"Writing user input directly to a UI5 View allows for\n a cross-site scripting vulnerability.","id":"js/ui5-xss","kind":"path-problem","name":"UI5 Client-side cross-site scripting","precision":"high","problem.severity":"error","security-severity":"7.8"}}],"locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/ui5/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/ui5/src/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"advanced-security/javascript-sap-ui5-models","semanticVersion":"2.3.0","locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/.github/codeql/extensions/javascript/frameworks/ui5/ext/ext/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/.github/codeql/extensions/javascript/frameworks/ui5/ext/ext/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}],"properties":{"isCodeQLModelPack":true}},{"name":"codeql/javascript-all","semanticVersion":"2.6.18+28b6aa8616a393ebb45186e3ba4df004a0f3ef4e","locations":[{"uri":"file:///opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/qlpacks/codeql/javascript-all/2.6.18/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/qlpacks/codeql/javascript-all/2.6.18/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"codeql/threat-models","semanticVersion":"1.0.38+28b6aa8616a393ebb45186e3ba4df004a0f3ef4e","locations":[{"uri":"file:///opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/qlpacks/codeql/threat-models/1.0.38/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/qlpacks/codeql/threat-models/1.0.38/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"advanced-security/javascript-sap-cap-queries","semanticVersion":"2.3.0+4627b48907d3149838f214e246d09f1605391fcb","rules":[{"id":"js/cap-log-injection","name":"js/cap-log-injection","shortDescription":{"text":"CAP Log injection"},"fullDescription":{"text":"Building log entries from user-controlled sources is vulnerable to insertion of forged log entries by a malicious user."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# CAP Log Injection\n\nIf unsanitized user input is written to a log entry using the CAP Node.js logging API, a malicious user may be able to forge new log entries.\n\nCAP Node.js offers a CLRF-safe logging API that should be used for application log entries that are logged as plaintext. If the entry is interpreted as HTML, then arbitrary HTML code my be included to forge log entries.\n\n## Recommendation\n\nCAP applications need to care for escaping user data that is used as input parameter for application logging. It's recommended to make use of an existing Encoder such as OWASP ESAPI.\n\n## Examples\n\nThis CAP service directly logs what the user submitted via the `req` request.\n\n``` javascript\nimport cds from '@sap/cds'\nconst { Books } = cds.entities ('sap.capire.bookshop')\n\nclass SampleVulnService extends cds.ApplicationService { init(){\n this.on ('submitOrder', async req => {\n const {book,quantity} = req.data\n const LOG = cds.log(\"nodejs\");\n LOG.info(\"test\" + book); // Log injection alert\n })\n\n return super.init()\n}}\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP CAPire Documentation: [Security Aspects](https://cap.cloud.sap/docs/guides/security/aspects#common-injection-attacks).\n","markdown":"# CAP Log Injection\n\nIf unsanitized user input is written to a log entry using the CAP Node.js logging API, a malicious user may be able to forge new log entries.\n\nCAP Node.js offers a CLRF-safe logging API that should be used for application log entries that are logged as plaintext. If the entry is interpreted as HTML, then arbitrary HTML code my be included to forge log entries.\n\n## Recommendation\n\nCAP applications need to care for escaping user data that is used as input parameter for application logging. It's recommended to make use of an existing Encoder such as OWASP ESAPI.\n\n## Examples\n\nThis CAP service directly logs what the user submitted via the `req` request.\n\n``` javascript\nimport cds from '@sap/cds'\nconst { Books } = cds.entities ('sap.capire.bookshop')\n\nclass SampleVulnService extends cds.ApplicationService { init(){\n this.on ('submitOrder', async req => {\n const {book,quantity} = req.data\n const LOG = cds.log(\"nodejs\");\n LOG.info(\"test\" + book); // Log injection alert\n })\n\n return super.init()\n}}\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP CAPire Documentation: [Security Aspects](https://cap.cloud.sap/docs/guides/security/aspects#common-injection-attacks).\n"},"properties":{"tags":["security"],"description":"Building log entries from user-controlled sources is vulnerable to\n insertion of forged log entries by a malicious user.","id":"js/cap-log-injection","kind":"path-problem","name":"CAP Log injection","precision":"medium","problem.severity":"error","security-severity":"6.1"}},{"id":"js/cap-sql-injection","name":"js/cap-sql-injection","shortDescription":{"text":"CQL query built from user-controlled sources"},"fullDescription":{"text":"Building a CQL query from user-controlled sources is vulnerable to insertion of malicious code by the user."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# CQL query built from user-controlled sources\n\nIf a database query is built from user-provided data without sufficient sanitization, a malicious user may be able to run malicious database queries.\n\n## Recommendation\n\nCAP's intrinsic data querying engine is immune with regards to SQL injections that are introduced by query parameter values that are derived from malicious user input. CQL statements are transformed into prepared statements that are executed in SQL databases such as SAP HANA. \nInjections are still possible even via CQL when the query structure (e.g. target entity, columns etc.) is based on user input.\n\n## Examples\n\nThis CAP application uses user submitted input as entity and column in a CQL query without any validation.\n\n``` javascript\nconst entity = \nconst column = \nSELECT.from(entity).columns(column)\n```\n\n## References\n\n- OWASP: [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injectionn).\n- OWASP: [SQL Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html).\n- SAP CAPire Documentation: [Security Aspects](https://cap.cloud.sap/docs/guides/security/aspects#common-injection-attacks).\n","markdown":"# CQL query built from user-controlled sources\n\nIf a database query is built from user-provided data without sufficient sanitization, a malicious user may be able to run malicious database queries.\n\n## Recommendation\n\nCAP's intrinsic data querying engine is immune with regards to SQL injections that are introduced by query parameter values that are derived from malicious user input. CQL statements are transformed into prepared statements that are executed in SQL databases such as SAP HANA. \nInjections are still possible even via CQL when the query structure (e.g. target entity, columns etc.) is based on user input.\n\n## Examples\n\nThis CAP application uses user submitted input as entity and column in a CQL query without any validation.\n\n``` javascript\nconst entity = \nconst column = \nSELECT.from(entity).columns(column)\n```\n\n## References\n\n- OWASP: [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injectionn).\n- OWASP: [SQL Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html).\n- SAP CAPire Documentation: [Security Aspects](https://cap.cloud.sap/docs/guides/security/aspects#common-injection-attacks).\n"},"properties":{"tags":["security"],"description":"Building a CQL query from user-controlled sources is vulnerable to insertion of\n malicious code by the user.","id":"js/cap-sql-injection","kind":"path-problem","name":"CQL query built from user-controlled sources","precision":"high","problem.severity":"error","security-severity":"8.8"}},{"id":"js/cap-path-injection","name":"js/cap-path-injection","shortDescription":{"text":"Use of user controlled input in CAP CDS file system utilities"},"fullDescription":{"text":"Using unchecked user controlled values can allow an attacker to affect paths constructed and accessed in the filesystem."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# CAP CDS Utils used with user-controlled sources\n\nIf a path is constructed from user-provided input without sufficient sanitization, a malicious user may be able to manipulate the contents of the filesystem without proper authorization.\n\nAdditionally if user-provided input is used to create file contents this can also result in a malicious user manipulating the filesystem in an unchecked way.\n\n## Recommendation\n\nCAP applications using CDS Utils should not use user-provided input without sanitization.\n\nThe sanitization stragety can vary depending on what types of paths are satisfactory as user-provided input. A simple approach to sanitization is to check user-provided input against an allow list. Other potential approaches include checking components of paths or normalizing them to make sure that the path does not escape the expected root folder. \n\nNormalization techniques should be carefully considered and simple naive replacement strategies will not be sufficient, for example replacing any match of a parent directory reference (`../`) in the sample `.../...//` will still result in the path `../` being used which could escape the intended directory.\n\n## Examples\n\nThis CAP service directly uses user-provided input to construct a path.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst { rm } = cds.utils\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n\n init() {\n this.on(\"send1\", async (req) => {\n let userinput = req.data\n await rm(userinput, 'db', 'data') // Path injection alert\n }\n }\n}\n```\n\nThis CAP service directly uses user-provided input to add content to a file.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst { rm } = cds.utils\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n init() {\n this.on(\"send1\", async (req) => {\n let userinput = req.data\n await write(userinput).to('db/data') // Path injection alert\n\n // GOOD: the path can not be controlled by an attacker\n let allowedDirectories = [\n 'this-is-a-safe-directory'\n ];\n if (allowedDirectories.includes(userinput)) {\n await rm(userinput) // sanitized - No Path injection alert\n }\n }\n }\n}\n```\n\n## References\n\n- OWASP 2021: [Injection](https://owasp.org/Top10/A03_2021-Injection/).\n- SAP CAP CDS Utils : [Documentation](https://cap.cloud.sap/docs/node.js/cds-utils).\n- Common Weakness Enumeration: [CWE-020](https://cwe.mitre.org/data/definitions/20.html).\n- Common Weakness Enumeration: [CWE-022](https://cwe.mitre.org/data/definitions/22.html).\n","markdown":"# CAP CDS Utils used with user-controlled sources\n\nIf a path is constructed from user-provided input without sufficient sanitization, a malicious user may be able to manipulate the contents of the filesystem without proper authorization.\n\nAdditionally if user-provided input is used to create file contents this can also result in a malicious user manipulating the filesystem in an unchecked way.\n\n## Recommendation\n\nCAP applications using CDS Utils should not use user-provided input without sanitization.\n\nThe sanitization stragety can vary depending on what types of paths are satisfactory as user-provided input. A simple approach to sanitization is to check user-provided input against an allow list. Other potential approaches include checking components of paths or normalizing them to make sure that the path does not escape the expected root folder. \n\nNormalization techniques should be carefully considered and simple naive replacement strategies will not be sufficient, for example replacing any match of a parent directory reference (`../`) in the sample `.../...//` will still result in the path `../` being used which could escape the intended directory.\n\n## Examples\n\nThis CAP service directly uses user-provided input to construct a path.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst { rm } = cds.utils\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n\n init() {\n this.on(\"send1\", async (req) => {\n let userinput = req.data\n await rm(userinput, 'db', 'data') // Path injection alert\n }\n }\n}\n```\n\nThis CAP service directly uses user-provided input to add content to a file.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst { rm } = cds.utils\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n init() {\n this.on(\"send1\", async (req) => {\n let userinput = req.data\n await write(userinput).to('db/data') // Path injection alert\n\n // GOOD: the path can not be controlled by an attacker\n let allowedDirectories = [\n 'this-is-a-safe-directory'\n ];\n if (allowedDirectories.includes(userinput)) {\n await rm(userinput) // sanitized - No Path injection alert\n }\n }\n }\n}\n```\n\n## References\n\n- OWASP 2021: [Injection](https://owasp.org/Top10/A03_2021-Injection/).\n- SAP CAP CDS Utils : [Documentation](https://cap.cloud.sap/docs/node.js/cds-utils).\n- Common Weakness Enumeration: [CWE-020](https://cwe.mitre.org/data/definitions/20.html).\n- Common Weakness Enumeration: [CWE-022](https://cwe.mitre.org/data/definitions/22.html).\n"},"properties":{"tags":["security","external/cwe/cwe-020","external/cwe/cwe-022"],"description":"Using unchecked user controlled values can allow an\n attacker to affect paths constructed and accessed in\n the filesystem.","id":"js/cap-path-injection","kind":"path-problem","name":"Use of user controlled input in CAP CDS file system utilities","precision":"medium","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/cap-non-prod-auth-strategy","name":"js/cap-non-prod-auth-strategy","shortDescription":{"text":"Non-production authentication strategy used"},"fullDescription":{"text":"Using non-production authentication strategies can lead to unwanted authentication behavior in production."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Non-Production Authentication Strategy Used without Profiles\n\nUsing a non-production authentication strategy without setting up a distinct profile for development may pose allow unintended authentication and/or authorization if the application is deployed into production.\n\n## Recommendation\n\n### Isolate the use of development-level strategies to a development profile\n\nUse separate profiles for development and deployment and select one as needed. In this way, properties including authentication strategies can be substituted by changing a single command line option: `--profile`. For example, having the following section in the application's `package.json` states that the `\"dummy\"` authentication strategy must be used while `\"xsuaa\"`, a production-grade strategy, should be used when deployed:\n\n``` json\n{\n \"requires\": {\n \"[dev]\": {\n \"auth\": \"dummy\"\n },\n \"[deploy]\": {\n \"auth\": \"xsuaa\"\n }\n }\n}\n```\n\nThe application can be now run in different modes depending on the `--profile` command line option:\n\n``` shell\n$ cds serve --profile dev # Runs the application in development profile with strategy \"dummy\"\n$ cds serve --profile deploy # Runs the application in development profile with strategy \"xsuaa\"\n```\n\n## Example\n\nThe following CAP application states that it uses `\"basic\"` authentication strategy along with mocked credentials. Using the pair of username and password, an attacker can gain access to certain assets by signing in to the application.\n\n``` json\n{\n \"cds\": {\n \"requires\": {\n \"auth\": {\n \"kind\": \"basic\",\n \"users\": {\n \"JohnDoe\": {\n \"password\": \"JohnDoesPassword\",\n \"roles\": [\"JohnDoesRole\"],\n \"attr\": {}\n },\n \"JaneDoe\": {\n \"password\": \"JaneDoesPassword\",\n \"roles\": [\"JaneDoesRole\"],\n \"attr\": {}\n }\n }\n }\n }\n }\n}\n```\n\n## References\n\n- Common Weakness Enumeration: [CWE-288](https://cwe.mitre.org/data/definitions/288.html).\n- Common Weakness Enumeration: [CWE-798](https://cwe.mitre.org/data/definitions/798.html).\n- SAP CAPire Documentation: [Authentication Strategies](https://cap.cloud.sap/docs/node.js/authentication#strategies).\n","markdown":"# Non-Production Authentication Strategy Used without Profiles\n\nUsing a non-production authentication strategy without setting up a distinct profile for development may pose allow unintended authentication and/or authorization if the application is deployed into production.\n\n## Recommendation\n\n### Isolate the use of development-level strategies to a development profile\n\nUse separate profiles for development and deployment and select one as needed. In this way, properties including authentication strategies can be substituted by changing a single command line option: `--profile`. For example, having the following section in the application's `package.json` states that the `\"dummy\"` authentication strategy must be used while `\"xsuaa\"`, a production-grade strategy, should be used when deployed:\n\n``` json\n{\n \"requires\": {\n \"[dev]\": {\n \"auth\": \"dummy\"\n },\n \"[deploy]\": {\n \"auth\": \"xsuaa\"\n }\n }\n}\n```\n\nThe application can be now run in different modes depending on the `--profile` command line option:\n\n``` shell\n$ cds serve --profile dev # Runs the application in development profile with strategy \"dummy\"\n$ cds serve --profile deploy # Runs the application in development profile with strategy \"xsuaa\"\n```\n\n## Example\n\nThe following CAP application states that it uses `\"basic\"` authentication strategy along with mocked credentials. Using the pair of username and password, an attacker can gain access to certain assets by signing in to the application.\n\n``` json\n{\n \"cds\": {\n \"requires\": {\n \"auth\": {\n \"kind\": \"basic\",\n \"users\": {\n \"JohnDoe\": {\n \"password\": \"JohnDoesPassword\",\n \"roles\": [\"JohnDoesRole\"],\n \"attr\": {}\n },\n \"JaneDoe\": {\n \"password\": \"JaneDoesPassword\",\n \"roles\": [\"JaneDoesRole\"],\n \"attr\": {}\n }\n }\n }\n }\n }\n}\n```\n\n## References\n\n- Common Weakness Enumeration: [CWE-288](https://cwe.mitre.org/data/definitions/288.html).\n- Common Weakness Enumeration: [CWE-798](https://cwe.mitre.org/data/definitions/798.html).\n- SAP CAPire Documentation: [Authentication Strategies](https://cap.cloud.sap/docs/node.js/authentication#strategies).\n"},"properties":{"tags":["security"],"description":"Using non-production authentication strategies can lead to unwanted authentication behavior in production.","id":"js/cap-non-prod-auth-strategy","kind":"problem","name":"Non-production authentication strategy used","precision":"high","problem.severity":"warning","security-severity":"6"}},{"id":"js/cap-default-user-is-privileged","name":"js/cap-default-user-is-privileged","shortDescription":{"text":"Default user is privileged"},"fullDescription":{"text":"Overriding the default user to the privileged user allows for authentication bypass."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Default User is overwritten as privileged\n\nUsers that cannot be verified as authenticated are represented as `cds.User.default` internally. Setting this property to `cds.User.Privileged` may result in providing protected assets to unauthorized users.\n\n## Recommendation\n\n### Set up a development profile that uses non-production authentication\n\nOverwriting `cds.User.default` as `cds.User.Privileged` for testing purposes is not recommended as such code may easily slip through production.\n\nInstead, set up a development profile and opt in to use a non-production strategy such as `\"basic\"`, `\"dummy\"`, or `\"mocked\"` during its use. This can be done in the file `package.json` in the root folder of the CAP application:\n\n``` json\n{\n \"requires\": {\n \"[dev]\": {\n \"auth\": \"dummy\"\n }\n }\n}\n```\n\nSetting `\"dummy\"` as the development authentication strategy has the effect of disabling `@requires` and `@restrict` annotations of CDS definitions that provides authorization. The application during development then can be run and tested with the `--profile dev` option.\n\n```shell\ncds serve --profile dev\n```\n\n## Example\n\nSetting `cds.User.default` to `cds.User.Privileged` may happen anywhere in the application. In the following example, the `server.js` file provides the top-level definition of a CAP application and overwrites the `default` user property with the `Privileged` class.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst app = require(\"express\")();\n\n/*\n * Antipattern: `cds.User.default` is overwritten to `cds.User.Privileged`\n */\ncds.User.default = cdsUser.Privileged;\n\ncds.serve(\"all\").in(app);\n```\n\n## References\n\n- SAP CAPire Documentation: [cds.User.default](https://cap.cloud.sap/docs/node.js/authentication#default-user).\n- SAP CAPire Documentation: [cds.User.Privileged](https://cap.cloud.sap/docs/node.js/authentication#privileged-user).\n- SAP CAPire Documentation: [Authentication Strategies](https://cap.cloud.sap/docs/node.js/authentication#strategies).\n- Common Weakness Enumeration: [CWE-250](https://cwe.mitre.org/data/definitions/250.html).\n","markdown":"# Default User is overwritten as privileged\n\nUsers that cannot be verified as authenticated are represented as `cds.User.default` internally. Setting this property to `cds.User.Privileged` may result in providing protected assets to unauthorized users.\n\n## Recommendation\n\n### Set up a development profile that uses non-production authentication\n\nOverwriting `cds.User.default` as `cds.User.Privileged` for testing purposes is not recommended as such code may easily slip through production.\n\nInstead, set up a development profile and opt in to use a non-production strategy such as `\"basic\"`, `\"dummy\"`, or `\"mocked\"` during its use. This can be done in the file `package.json` in the root folder of the CAP application:\n\n``` json\n{\n \"requires\": {\n \"[dev]\": {\n \"auth\": \"dummy\"\n }\n }\n}\n```\n\nSetting `\"dummy\"` as the development authentication strategy has the effect of disabling `@requires` and `@restrict` annotations of CDS definitions that provides authorization. The application during development then can be run and tested with the `--profile dev` option.\n\n```shell\ncds serve --profile dev\n```\n\n## Example\n\nSetting `cds.User.default` to `cds.User.Privileged` may happen anywhere in the application. In the following example, the `server.js` file provides the top-level definition of a CAP application and overwrites the `default` user property with the `Privileged` class.\n\n``` javascript\nconst cds = require(\"@sap/cds\");\nconst app = require(\"express\")();\n\n/*\n * Antipattern: `cds.User.default` is overwritten to `cds.User.Privileged`\n */\ncds.User.default = cdsUser.Privileged;\n\ncds.serve(\"all\").in(app);\n```\n\n## References\n\n- SAP CAPire Documentation: [cds.User.default](https://cap.cloud.sap/docs/node.js/authentication#default-user).\n- SAP CAPire Documentation: [cds.User.Privileged](https://cap.cloud.sap/docs/node.js/authentication#privileged-user).\n- SAP CAPire Documentation: [Authentication Strategies](https://cap.cloud.sap/docs/node.js/authentication#strategies).\n- Common Weakness Enumeration: [CWE-250](https://cwe.mitre.org/data/definitions/250.html).\n"},"properties":{"tags":["security"],"description":"Overriding the default user to the privileged user allows for authentication bypass.","id":"js/cap-default-user-is-privileged","kind":"problem","name":"Default user is privileged","precision":"high","problem.severity":"error","security-severity":"6"}},{"id":"js/cap-unnecessarily-granted-privileged-access-rights","name":"js/cap-unnecessarily-granted-privileged-access-rights","shortDescription":{"text":"Access rights to an entity is unnecessarily elevated to privileged"},"fullDescription":{"text":"An entity requiring authorization is being accessed with privileged rights."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Access rights to an entity is unnecessarily elevated to privileged\n\nThe privileged user `cds.User.Privileged` is used to access an entity that requires authorization. If the application does not verify the actual user rights, it may expose protected entities to unauthorized users.\n\nThis is especially important when the accessed entity belongs to a remote service. By default, when using a production-grade authentication strategy all CAP endpoints are authenticated. However, if the entity is outside the application, there is no guarantee that the user is authenticated in the remote service.\n\n## Recommendations\n\n### Avoid using `cds.User.Privileged` when accessing an access-controlled entity\n\nAny entity that requires authorization should be accessed within the context of the authenticated user. When using a transaction, prefer using `cds.User` as the `user` attribute of the option argument to the call of `cds.ApplicationService.tx()` in order to check the required access rights of the entity against that of the user.\n\n## Examples\n\nThe following service, named Service1 and implemented in the file service1.js, is accessing an entity that belongs to another service named Service2 and defined in the file service2.cds. The entity, Service2Entity, demands that the user have level greater than 2.\n\n### `service1.js`\n\n``` javascript\nthis.on(\"action1\", async (req) => {\n const Service2 = await cds.connect.to(\"Service2\");\n const { Service2Entity } = Service2.entities;\n return this.tx({ user: new cds.User.Privileged(\"\") }, (tx) =>\n tx.run(\n SELECT.from(Service2Entity) // Declared in service2.cds\n .where`Attribute4=${req.data.messageToPass}`,\n ),\n );\n});\n```\n\n### `service2.cds`\n\n``` cds\nservice Service2 @(path: 'service-2') {\n /* Read access only to users with access level greater than 2. */\n @(restrict: [ { grant: 'READ', to: '$user.level > 2' } ])\n entity Service2Entity {\n Attribute1 : String(100);\n Attribute2 : String(100)\n }\n}\n```\n\n## References\n\n- SAP CAPire Documentation: [cds.User.Privileged](https://cap.cloud.sap/docs/node.js/authentication#privileged-user).\n- SAP CAPire Documentation: [cds.tx()](https://cap.cloud.sap/docs/node.js/cds-tx#srv-tx-ctx).\n- Common Weakness Enumeration: [CWE-250](https://cwe.mitre.org/data/definitions/250.html).\n- Common Weakness Enumeration: [CWE-266](https://cwe.mitre.org/data/definitions/266.html).\n","markdown":"# Access rights to an entity is unnecessarily elevated to privileged\n\nThe privileged user `cds.User.Privileged` is used to access an entity that requires authorization. If the application does not verify the actual user rights, it may expose protected entities to unauthorized users.\n\nThis is especially important when the accessed entity belongs to a remote service. By default, when using a production-grade authentication strategy all CAP endpoints are authenticated. However, if the entity is outside the application, there is no guarantee that the user is authenticated in the remote service.\n\n## Recommendations\n\n### Avoid using `cds.User.Privileged` when accessing an access-controlled entity\n\nAny entity that requires authorization should be accessed within the context of the authenticated user. When using a transaction, prefer using `cds.User` as the `user` attribute of the option argument to the call of `cds.ApplicationService.tx()` in order to check the required access rights of the entity against that of the user.\n\n## Examples\n\nThe following service, named Service1 and implemented in the file service1.js, is accessing an entity that belongs to another service named Service2 and defined in the file service2.cds. The entity, Service2Entity, demands that the user have level greater than 2.\n\n### `service1.js`\n\n``` javascript\nthis.on(\"action1\", async (req) => {\n const Service2 = await cds.connect.to(\"Service2\");\n const { Service2Entity } = Service2.entities;\n return this.tx({ user: new cds.User.Privileged(\"\") }, (tx) =>\n tx.run(\n SELECT.from(Service2Entity) // Declared in service2.cds\n .where`Attribute4=${req.data.messageToPass}`,\n ),\n );\n});\n```\n\n### `service2.cds`\n\n``` cds\nservice Service2 @(path: 'service-2') {\n /* Read access only to users with access level greater than 2. */\n @(restrict: [ { grant: 'READ', to: '$user.level > 2' } ])\n entity Service2Entity {\n Attribute1 : String(100);\n Attribute2 : String(100)\n }\n}\n```\n\n## References\n\n- SAP CAPire Documentation: [cds.User.Privileged](https://cap.cloud.sap/docs/node.js/authentication#privileged-user).\n- SAP CAPire Documentation: [cds.tx()](https://cap.cloud.sap/docs/node.js/cds-tx#srv-tx-ctx).\n- Common Weakness Enumeration: [CWE-250](https://cwe.mitre.org/data/definitions/250.html).\n- Common Weakness Enumeration: [CWE-266](https://cwe.mitre.org/data/definitions/266.html).\n"},"properties":{"tags":["security"],"description":"An entity requiring authorization is being accessed with privileged rights.","id":"js/cap-unnecessarily-granted-privileged-access-rights","kind":"problem","name":"Access rights to an entity is unnecessarily elevated to privileged","precision":"high","problem.severity":"error","security-severity":"6"}},{"id":"js/cap-entity-exposed-without-authentication","name":"js/cap-entity-exposed-without-authentication","shortDescription":{"text":"Entity exposed without authentication"},"fullDescription":{"text":"Entities exposed to external protocols should require an CDS-based or JS-based access control."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# CAP Definitions Exposed without Access Controls\n\nAlthough using a production-level authentication strategy such as `jwt` ensures that all entities and services require the user to be authenticated, this does not guarantee any further authorization. Furthermore, the lack of required authentication or authorization may imply a gap in the design of the system.\n\n## Recommendation\n\n### Use CDS-based authorization\n\nCDL provides two annotations to declare access controls `@requires` and `@restrict` with the latter providing more granularity than the former. For example, to check if a request is being made by an authenticated user to the CDL entity or service, annotate it with `@requires: 'authenticated-user'`. On the other hand, if it needs to be read only via a certain group of users where the user has level greater than 2, use `@restrict: { grant: 'READ', to: 'SomeUser', where: { $user.level > 2 } }` (note the leading `$`).\n\n#### Check the original CDS entity it is derived from\n\nCDS entities may be derived from other entities by means of selection and projection. Derived definitions inherit access control conditions and optionally override them. In order to accurately determine what authorization an entity requires, the access control of the parent entity should be transitively inspected.\n\n### Enforce authorization with JavaScript\n\nAccess control may be enforced when a request handler for the relevant entity or service is registered. Both `cds.Service.before` and `cds.Service.on` may be used for enforcement. For example, to restrict writing to and updating an entity to a user satisfying certain requirements, either one of the below handler registrations may be used:\n\n``` javascript\n/**\n * Before serving a request to access SomeEntity, check if the request is coming from a user\n * with SomeRole and level greater than 3.\n */\nthis.before([\"WRITE\", \"UPDATE\"], \"SomeEntity\", (req) => {\n (req.user.is(\"SomeRole\") && req.user.attr.level > 3) || req.reject(403);\n});\n\n/**\n * On request to access SomeEntity, check if the request is coming from a user\n * with SomeRole and level greater than 3.\n */\nthis.on([\"WRITE\", \"UPDATE\"], \"SomeEntity\", (req) => {\n if (req.user.is(\"SomeRole\") && req.user.attr.level > 3) {\n /* Do something */\n } else req.reject(403);\n});\n```\n\n## Examples\n\nThe following CDS definition and its JavaScript implementation imposes no authorization on `SomeEntity`. Note that the `OriginalEntity` from which `DerivedEntity` derives from does not control the access either.\n\n### db/schema.cds\n\n``` cap-cds\nnamespace sample_namespace.sample_entities;\n\nentity OriginalEntity {\n Attribute1 : String(100);\n Attribute2 : String(100)\n}\n```\n\n### srv/service1.cds\n\n``` cap-cds\nusing { sample_namespace.sample_entities as db_schema } from '../db/schema';\n\nservice SomeService {\n entity DerivedEntity as projection on db_schema.OriginalEntity excluding { Attribute2 }\n}\n```\n\n### srv/service1.js\n\n``` javascript\n\nconst cds = require(\"@sap/cds\");\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n init() {\n this.on(\"READ\", \"SomeService\", (req) => { })\n }\n}\n```\n\n## References\n\n- SAP CAPire Documentation: [Authorization Enforcement](https://cap.cloud.sap/docs/node.js/authentication#enforcement).\n- SAP CAPire Documentation: [@restrict](https://cap.cloud.sap/docs/guides/security/authorization#restrict-annotation).\n- SAP CAPire Documentation:\n[@requires](https://cap.cloud.sap/docs/guides/security/authorization#requires).\n- SAP CAPire Documentation: [Protecting Certain Entries](https://cap.cloud.sap/docs/cds/common#protecting-certain-entries).\n- SAP CAPire Documentation: [Inheritance of Restrictions](https://cap.cloud.sap/docs/guides/security/authorization#inheritance-of-restrictions).\n- SAP CAPire Documentation: [Authentication Enforced in Production](https://cap.cloud.sap/docs/node.js/authentication#authentication-enforced-in-production).\n- Common Weakness Enumeration: [CWE-862](https://cwe.mitre.org/data/definitions/862.html).\n- Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).\n","markdown":"# CAP Definitions Exposed without Access Controls\n\nAlthough using a production-level authentication strategy such as `jwt` ensures that all entities and services require the user to be authenticated, this does not guarantee any further authorization. Furthermore, the lack of required authentication or authorization may imply a gap in the design of the system.\n\n## Recommendation\n\n### Use CDS-based authorization\n\nCDL provides two annotations to declare access controls `@requires` and `@restrict` with the latter providing more granularity than the former. For example, to check if a request is being made by an authenticated user to the CDL entity or service, annotate it with `@requires: 'authenticated-user'`. On the other hand, if it needs to be read only via a certain group of users where the user has level greater than 2, use `@restrict: { grant: 'READ', to: 'SomeUser', where: { $user.level > 2 } }` (note the leading `$`).\n\n#### Check the original CDS entity it is derived from\n\nCDS entities may be derived from other entities by means of selection and projection. Derived definitions inherit access control conditions and optionally override them. In order to accurately determine what authorization an entity requires, the access control of the parent entity should be transitively inspected.\n\n### Enforce authorization with JavaScript\n\nAccess control may be enforced when a request handler for the relevant entity or service is registered. Both `cds.Service.before` and `cds.Service.on` may be used for enforcement. For example, to restrict writing to and updating an entity to a user satisfying certain requirements, either one of the below handler registrations may be used:\n\n``` javascript\n/**\n * Before serving a request to access SomeEntity, check if the request is coming from a user\n * with SomeRole and level greater than 3.\n */\nthis.before([\"WRITE\", \"UPDATE\"], \"SomeEntity\", (req) => {\n (req.user.is(\"SomeRole\") && req.user.attr.level > 3) || req.reject(403);\n});\n\n/**\n * On request to access SomeEntity, check if the request is coming from a user\n * with SomeRole and level greater than 3.\n */\nthis.on([\"WRITE\", \"UPDATE\"], \"SomeEntity\", (req) => {\n if (req.user.is(\"SomeRole\") && req.user.attr.level > 3) {\n /* Do something */\n } else req.reject(403);\n});\n```\n\n## Examples\n\nThe following CDS definition and its JavaScript implementation imposes no authorization on `SomeEntity`. Note that the `OriginalEntity` from which `DerivedEntity` derives from does not control the access either.\n\n### db/schema.cds\n\n``` cap-cds\nnamespace sample_namespace.sample_entities;\n\nentity OriginalEntity {\n Attribute1 : String(100);\n Attribute2 : String(100)\n}\n```\n\n### srv/service1.cds\n\n``` cap-cds\nusing { sample_namespace.sample_entities as db_schema } from '../db/schema';\n\nservice SomeService {\n entity DerivedEntity as projection on db_schema.OriginalEntity excluding { Attribute2 }\n}\n```\n\n### srv/service1.js\n\n``` javascript\n\nconst cds = require(\"@sap/cds\");\n\nmodule.exports = class Service1 extends cds.ApplicationService {\n init() {\n this.on(\"READ\", \"SomeService\", (req) => { })\n }\n}\n```\n\n## References\n\n- SAP CAPire Documentation: [Authorization Enforcement](https://cap.cloud.sap/docs/node.js/authentication#enforcement).\n- SAP CAPire Documentation: [@restrict](https://cap.cloud.sap/docs/guides/security/authorization#restrict-annotation).\n- SAP CAPire Documentation:\n[@requires](https://cap.cloud.sap/docs/guides/security/authorization#requires).\n- SAP CAPire Documentation: [Protecting Certain Entries](https://cap.cloud.sap/docs/cds/common#protecting-certain-entries).\n- SAP CAPire Documentation: [Inheritance of Restrictions](https://cap.cloud.sap/docs/guides/security/authorization#inheritance-of-restrictions).\n- SAP CAPire Documentation: [Authentication Enforced in Production](https://cap.cloud.sap/docs/node.js/authentication#authentication-enforced-in-production).\n- Common Weakness Enumeration: [CWE-862](https://cwe.mitre.org/data/definitions/862.html).\n- Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).\n"},"properties":{"tags":["security"],"description":"Entities exposed to external protocols should require an\n CDS-based or JS-based access control.","id":"js/cap-entity-exposed-without-authentication","kind":"problem","name":"Entity exposed without authentication","precision":"high","problem.severity":"warning","security-severity":"6"}},{"id":"js/cap-sensitive-log","name":"js/cap-sensitive-log","shortDescription":{"text":"Insertion of sensitive information into log files"},"fullDescription":{"text":"Writing sensitive information to log files can allow that information to be leaked to an attacker more easily."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# CAP Insertion of Sensitive Information into Log File\n\nIf sensitive information is written to a log entry using the CAP Node.js logging API, a malicious user may be able to gain access to user data.\n\nData annotated as `@PersonalData` should not be logged.\n\n## Recommendation\n\nCAP applications should not log sensitive information. Check CDS declarations for annotations before logging certain data types or fields.\n\n## Examples\n\nThis CAP service directly logs the sensitive information.\n\n```cds\nnamespace advanced_security.log_exposure.sample_entities;\n\nentity Sample {\n name : String(111);\n}\n\n// annotations for Data Privacy\nannotate Sample with\n@PersonalData : { DataSubjectRole : 'Sample', EntitySemantics : 'DataSubject' }\n{\n name @PersonalData.IsPotentiallySensitive;\n}\n```\n\n``` javascript\nimport cds from '@sap/cds'\nconst LOG = cds.log(\"logger\");\n\nconst { Sample } = cds.entities('advanced_security.log_exposure.sample_entities')\n\nclass SampleVulnService extends cds.ApplicationService {\n init() {\n LOG.info(\"Received: \", Sample.name); // CAP log exposure alert\n }\n}\n```\n\n## References\n\n- OWASP 2021: [Security Logging and Monitoring Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/).\n- OWASP: [Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- OWASP: [User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html).\n- SAP CAPire Documentation: [PersonalData Annotations](https://cap.cloud.sap/docs/guides/data-privacy/annotations).","markdown":"# CAP Insertion of Sensitive Information into Log File\n\nIf sensitive information is written to a log entry using the CAP Node.js logging API, a malicious user may be able to gain access to user data.\n\nData annotated as `@PersonalData` should not be logged.\n\n## Recommendation\n\nCAP applications should not log sensitive information. Check CDS declarations for annotations before logging certain data types or fields.\n\n## Examples\n\nThis CAP service directly logs the sensitive information.\n\n```cds\nnamespace advanced_security.log_exposure.sample_entities;\n\nentity Sample {\n name : String(111);\n}\n\n// annotations for Data Privacy\nannotate Sample with\n@PersonalData : { DataSubjectRole : 'Sample', EntitySemantics : 'DataSubject' }\n{\n name @PersonalData.IsPotentiallySensitive;\n}\n```\n\n``` javascript\nimport cds from '@sap/cds'\nconst LOG = cds.log(\"logger\");\n\nconst { Sample } = cds.entities('advanced_security.log_exposure.sample_entities')\n\nclass SampleVulnService extends cds.ApplicationService {\n init() {\n LOG.info(\"Received: \", Sample.name); // CAP log exposure alert\n }\n}\n```\n\n## References\n\n- OWASP 2021: [Security Logging and Monitoring Failures](https://owasp.org/Top10/A09_2021-Security_Logging_and_Monitoring_Failures/).\n- OWASP: [Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- OWASP: [User Privacy Protection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/User_Privacy_Protection_Cheat_Sheet.html).\n- SAP CAPire Documentation: [PersonalData Annotations](https://cap.cloud.sap/docs/guides/data-privacy/annotations)."},"properties":{"tags":["security","external/cwe/cwe-532"],"description":"Writing sensitive information to log files can allow that\n information to be leaked to an attacker more easily.","id":"js/cap-sensitive-log","kind":"path-problem","name":"Insertion of sensitive information into log files","precision":"medium","problem.severity":"warning","security-severity":"7.5"}}],"locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/src/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"advanced-security/javascript-sap-xsjs-queries","semanticVersion":"2.3.0+4627b48907d3149838f214e246d09f1605391fcb","rules":[{"id":"js/xsjs-broken-authentication","name":"js/xsjs-broken-authentication","shortDescription":{"text":"Broken XSJS authentication"},"fullDescription":{"text":"Disabling XSJS authentication makes the application vulnerable to unauthorized access."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Authentication not enforced in HANA XS application\n\nThis HANA XS application does not enforce authentication on the requests it handles.\n\n## Overview\n\nSAP HANA XS applications are called via HTTP requests to process a connected HANA database, and this makes it critical to authenticate the sender of the request. Failing to do so allows attackers to impersonate users and gain access to underlying systems and data.\n\n## Recommendation\n\nUse the built-in SAP HANA XS authentication mechanism and session management (cookies).\n- If `XS Advanced` is used, authentication **is enabled by default**, and the `authenticationMethod` property indicates which authentication will be applied. However, avoid setting the property to something else than `none`, as doing so turns off all authentication on all routes.\n- If `XS Classic` is used, authentication is **not enabled by default**, so the `authentication` property in the application's `.xsaccess` file should be set to enable authentication. Set the value of the property according to the method you want to implement (`LogonTicket`, `Form`, or `Basic`).\n\n## Example\n\nThe fragment from an `xs-app.json` file shows the application in question having its authentication explicitly disabled.\n\n```json\n{\n \"welcomeFile\": \"index.html\",\n \"authenticationMethod\": \"none\",\n ...\n}\n```\n\n## References\n\n- SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/2040c1b7e478448cb9904c55ac06cac8.html).\n- SAP: [XS Advanced Application Router Configuration](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod), relevant to XS Advanced applications.\n- SAP: [Application-Access File Keyword Options: Authentication](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03&locale=en-US#authentication), relevant to XS Classic applications.\n- Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).\n","markdown":"# Authentication not enforced in HANA XS application\n\nThis HANA XS application does not enforce authentication on the requests it handles.\n\n## Overview\n\nSAP HANA XS applications are called via HTTP requests to process a connected HANA database, and this makes it critical to authenticate the sender of the request. Failing to do so allows attackers to impersonate users and gain access to underlying systems and data.\n\n## Recommendation\n\nUse the built-in SAP HANA XS authentication mechanism and session management (cookies).\n- If `XS Advanced` is used, authentication **is enabled by default**, and the `authenticationMethod` property indicates which authentication will be applied. However, avoid setting the property to something else than `none`, as doing so turns off all authentication on all routes.\n- If `XS Classic` is used, authentication is **not enabled by default**, so the `authentication` property in the application's `.xsaccess` file should be set to enable authentication. Set the value of the property according to the method you want to implement (`LogonTicket`, `Form`, or `Basic`).\n\n## Example\n\nThe fragment from an `xs-app.json` file shows the application in question having its authentication explicitly disabled.\n\n```json\n{\n \"welcomeFile\": \"index.html\",\n \"authenticationMethod\": \"none\",\n ...\n}\n```\n\n## References\n\n- SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/2040c1b7e478448cb9904c55ac06cac8.html).\n- SAP: [XS Advanced Application Router Configuration](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod), relevant to XS Advanced applications.\n- SAP: [Application-Access File Keyword Options: Authentication](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03&locale=en-US#authentication), relevant to XS Classic applications.\n- Common Weakness Enumeration: [CWE-306](https://cwe.mitre.org/data/definitions/306.html).\n"},"properties":{"tags":["security","external/cwe/cwe-306"],"description":"Disabling XSJS authentication makes the application vulnerable to unauthorized access.","id":"js/xsjs-broken-authentication","kind":"problem","name":"Broken XSJS authentication","precision":"medium","problem.severity":"warning","security-severity":"7.5"}},{"id":"js/xsjs-reflected-xss","name":"js/xsjs-reflected-xss","shortDescription":{"text":"XSJS Reflected XSS"},"fullDescription":{"text":"Including uncontrolled value into a response body and setting it to a scriptable MIME type allows for cross-site scripting vulnerability."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Reflected Cross-site Scripting\n\nIncluding a text, received from a client browser typically through an XSJS request parameter, to be rendered as HTML in a request body may execute arbitrary JavaScript code on the client.\n\n## Recommendation\n\nThe XSJS application should always validate or sanitize the submitted string from a client before including it into a response body to be rendered in a client browser.\n\n### Validate the input string\n\nValidate the submitted input by looking for a sensitive HTML tag such as ``. The pattern may be encoded to a regular expression and matched against the input; If there is a match, then the XSJS application may decide to abort the process and instead return an HTTP code stating that the application rejected the request (e.g. `$.net.FORBIDDEN`). XSJS does not provide a function to reliably perform the above, therefore using a third-party library is recommended.\n\n### Sanitize the input string\n\n#### Server-side sanitization\n\nThe XSJS application may instead allow any user input, but sanitize it before it integrates it into the response body. This is achieved by escaping special characters that are treated as part of the HTML syntax, such as `\"`, `&`, `'`, `<`, and `>`. Since XSJS does not provide a function to escape these, using a third-party library is recommended.\n\n#### Client-side sanitization\n\nAlternatively, if SAP UI5 is used on the frontend, there are client-side escaping mechanisms such as `sap.base.security.encodeXML` and `sap.base.security.encodeHTML`. If `sap.ui.core.HTML` is used in the frontend view, consider setting its `sanitizeContent` property explicitly to `true`, since its default value is `false`.\n\n## Example\n\nThe following XSJS application sets the response body directly to a string received from a user without any validation or sanitization. The header's content type is set as an HTML document, which allows for any embedded JavaScript to be run in the request body. Note that even if `clientData` was not enclosed in a `div`, the vulnerability would still exist.\n\n``` javascript\nlet clientData = requestParameters.get(\"someParameter\");\n$.response.contentType = \"text/html\";\n$.response.setBody(\""
}
diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5.qll
index 9a110016..66a72240 100644
--- a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5.qll
+++ b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5.qll
@@ -1,6 +1,7 @@
import javascript
import DataFlow
import advanced_security.javascript.frameworks.ui5.JsonParser
+import advanced_security.javascript.frameworks.ui5.dataflow.TypeTrackers
import semmle.javascript.security.dataflow.DomBasedXssCustomizations
import advanced_security.javascript.frameworks.ui5.UI5View
import advanced_security.javascript.frameworks.ui5.UI5HTML
@@ -138,6 +139,15 @@ class WebApp extends HTML::HtmlFile {
* by a call to `sap.ui.getCore()`.
*/
class SapUiCore extends MethodCallNode {
+ /*
+ * NOTE: Ideally, we'd like to use `ModelOutput::getATypeNode("SapUICore").asSource()` to
+ * take advantage of the inter-procedural flexibility of MaD, but doing so causes
+ * non-monotomic recursion.
+ *
+ * So, we opt to use `SourceNode.getAPropertyRead/1` and `SourceNode.getAMethodCall/1`
+ * instead and get away with local flow tracking they provide.
+ */
+
SapUiCore() { this = globalVarRef("sap").getAPropertyRead("ui").getAMethodCall("getCore") }
}
@@ -167,11 +177,17 @@ class SapDefineModule extends AmdModuleDefinition::Range, MethodCallExpr, UserMo
sap.getName() = "sap" and
sapUi.getBase() = sap and
sapUi.getPropertyName() = "ui" and
- this.getReceiver() = sapUiDefine
- // and this.getMethodName() = "define"
+ this.getReceiver() = sapUiDefine and
+ this.getMethodName() = ["define", "require"] // TODO: Treat sap.ui.declare in its own class
)
}
+ SapExtendCall getExtendCall() { result.getDefine() = this }
+
+ string getName() { result = this.getExtendCall().getName() }
+
+ Module asModule() { result = this.getTopLevel() }
+
string getDependency(int i) {
result = this.(AmdModuleDefinition).getDependencyExpr(i).getStringValue()
}
@@ -187,18 +203,49 @@ class SapDefineModule extends AmdModuleDefinition::Range, MethodCallExpr, UserMo
WebApp getWebApp() { this.getFile() = result.getAResource() }
/**
- * Gets the module defined with sap.ui.define that imports and extends this module.
+ * Gets the module defined with sap.ui.define that imports and extends (subclasses) this module.
+ */
+ SapDefineModule getExtendingModule() { result.getSuperModule(_) = this }
+
+ /**
+ * Gets the module that this module imports via path `importPath`.
*/
- SapDefineModule getExtendingModule() {
- exists(SapExtendCall baseExtendCall, SapExtendCall subclassExtendCall |
- baseExtendCall.getDefine() = this and
- result = subclassExtendCall.getDefine() and
- result
- .getRequiredObject(baseExtendCall.getName().replaceAll(".", "/"))
- .asSourceNode()
- .flowsTo(subclassExtendCall.getReceiver())
+ SapDefineModule getImportedModule(string importPath) {
+ /* 1. Absolute import paths: We resolve this ourselves. */
+ exists(string importedModuleDefinitionPath, string importedModuleDefinitionPathSlashNormalized |
+ /*
+ * Let `importPath` = "my/app/path1/path2/controller/Some.controller",
+ * `importedModuleDefinitionPath` = "my.app.path1.path2.controller.Some",
+ * `importedModuleDefinitionPathSlashNormalized` = "my/app/path1/path2/controller/Some".
+ * Then, `importedModuleDefinitionPathSlashNormalized` matches `importPath`.
+ */
+
+ importPath = this.asModule().getAnImport().getImportedPathExpr().getStringValue() and
+ importedModuleDefinitionPath = result.getExtendCall().getName() and
+ importedModuleDefinitionPathSlashNormalized =
+ importedModuleDefinitionPath.replaceAll(".", "/") and
+ importPath.matches(importedModuleDefinitionPathSlashNormalized + "%")
+ )
+ or
+ /*
+ * 2. Relative import paths: We delegate the heaving lifting of resolving to
+ * `Import.resolveImportedPath/0`.
+ */
+
+ exists(Import import_ |
+ importPath = import_.getImportedPathExpr().getStringValue() and
+ import_ = this.asModule().getAnImport() and
+ import_.resolveImportedPath() = result.getTopLevel()
)
}
+
+ /**
+ * Holds if the `importingModule` extends the `importedModule`, imported via path `importPath`.
+ */
+ SapDefineModule getSuperModule(string importPath) {
+ result = this.getImportedModule(importPath) and
+ this.getRequiredObject(importPath).asSourceNode().flowsTo(this.getExtendCall().getReceiver())
+ }
}
class JQuerySap extends DataFlow::SourceNode {
@@ -247,10 +294,11 @@ class Renderer extends SapExtendCall {
class CustomControl extends SapExtendCall {
CustomControl() {
- this =
- TypeTrackers::hasDependency(["sap/ui/core/Control", "sap.ui.core.Control"])
- .getAMemberCall("extend") or
- exists(SapDefineModule sapModule | this.getDefine() = sapModule.getExtendingModule())
+ this = ModelOutput::getATypeNode("CustomControl").getACall()
+ or
+ exists(CustomControl superControl |
+ superControl.getDefine() = this.getDefine().getSuperModule(_)
+ )
}
CustomController getController() { this = result.getAControlReference().getDefinition() }
@@ -449,32 +497,37 @@ class ControllerReference extends Reference {
}
class CustomController extends SapExtendCall {
+ API::Node customController;
string name;
CustomController() {
- this =
- TypeTrackers::hasDependency(["sap/ui/core/mvc/Controller", "sap.ui.core.mvc.Controller"])
- .getAMemberCall("extend") and
- name = this.getFile().getBaseName().regexpCapture("([a-zA-Z0-9]+).[cC]ontroller.js", 1)
+ (
+ customController = ModelOutput::getATypeNode("CustomController") and
+ this = customController.getACall()
+ or
+ exists(CustomController superController |
+ superController.getDefine() = this.getDefine().getSuperModule(_)
+ )
+ ) and
+ name = this.getFile().getBaseName().regexpCapture("(.+).[cC]ontroller.js", 1)
}
Component getOwnerComponent() {
- exists(ManifestJson manifestJson, JsonObject rootObj | manifestJson = result.getManifestJson() |
- rootObj
- .getPropValue("targets")
- .(JsonObject)
- // The individual targets
- .getPropValue(_)
- .(JsonObject)
- // The target's "viewName" property
- .getPropValue("viewName")
- .(JsonString)
- .getValue() = name
- )
+ this = result.getParentManifestJson().getARoutingTarget().getView().getController()
}
MethodCallNode getOwnerComponentRef() {
- result = this.getAThisNode().getAMemberCall("getOwnerComponent")
+ exists(API::Node getOwnerComponent |
+ getOwnerComponent = ModelOutput::getATypeNode("CustomControllerGetOwnerComponent")
+ |
+ customController.getASuccessor+() = getOwnerComponent and
+ result = getOwnerComponent.asSource()
+ )
+ or
+ exists(CustomController baseController |
+ baseController.getDefine() = this.getDefine().getSuperModule(_) and
+ result = baseController.getOwnerComponentRef()
+ )
}
/**
@@ -743,6 +796,11 @@ abstract class UI5InternalModel extends UI5Model, NewNode {
abstract string getPathString();
abstract string getPathString(Property property);
+
+ /**
+ * Holds if the content of the model is statically determinable.
+ */
+ abstract predicate contentIsStaticallyVisible();
}
import ManifestJson
@@ -757,16 +815,12 @@ class Component extends SapExtendCall {
* It is the value flowing to a `setModel` call in a handler of a `CustomController` (which is represented by `ControllerHandler`), since it is the closest we can get to the actual model itself.
*/
- this =
- TypeTrackers::hasDependency([
- "sap/ui/core/mvc/Component", "sap.ui.core.mvc.Component", "sap/ui/core/UIComponent",
- "sap.ui.core.UIComponent"
- ]).getAMemberCall("extend")
+ this = ModelOutput::getATypeNode("CustomComponent").getACall()
}
- string getId() { result = this.getName().regexpCapture("([a-zA-Z0-9.]+).Component", 1) }
+ string getId() { result = this.getName().regexpCapture("(.+).Component", 1) }
- ManifestJson getManifestJson() {
+ ManifestJson getParentManifestJson() {
this.getMetadata().getAPropertySource("manifest").asExpr().(StringLiteral).getValue() = "json" and
result.getId() = this.getId()
}
@@ -788,7 +842,7 @@ class Component extends SapExtendCall {
}
ExternalModelManifest getExternalModelDef(string modelName) {
- result.getFile() = this.getManifestJson() and result.getName() = modelName
+ result.getFile() = this.getParentManifestJson() and result.getName() = modelName
}
ExternalModelManifest getAnExternalModelDef() { result = this.getExternalModelDef(_) }
@@ -815,11 +869,51 @@ module ManifestJson {
string getName() { result = dataSourceName }
- ManifestJson getManifestJson() { result = manifestJson }
+ ManifestJson getParentManifestJson() { result = manifestJson }
string getType() { result = this.getPropValue("type").(JsonString).getValue() }
}
+ class RoutingTargetManifest extends JsonObject {
+ /** Note: This is NOT its `viewName` property! */
+ string targetName;
+ ManifestJson manifestJson;
+
+ RoutingTargetManifest() {
+ exists(JsonObject rootObj |
+ this.getJsonFile() = manifestJson and
+ rootObj.getJsonFile() = manifestJson and
+ this =
+ rootObj
+ .getPropValue("sap.ui5")
+ .(JsonObject)
+ .getPropValue("routing")
+ .(JsonObject)
+ .getPropValue("targets")
+ .(JsonObject)
+ .getPropValue(targetName)
+ )
+ }
+
+ /**
+ * Gets the value of the `viewName` property of this target.
+ */
+ string getViewName() { result = this.getPropStringValue("viewName") }
+
+ /**
+ * Gets the view this target is associated with.
+ */
+ UI5View getView() {
+ result.getController().getModuleName() =
+ getSubstringAfterLastOccurrenceOfCharacter(this.getViewName(), "/")
+ }
+
+ /**
+ * Gets the `manifest.json` file that this routing target is a part of.
+ */
+ ManifestJson getParentManifestJson() { result = manifestJson }
+ }
+
class ODataDataSourceManifest extends DataSourceManifest {
ODataDataSourceManifest() { this.getType() = "OData" }
}
@@ -948,498 +1042,688 @@ module ManifestJson {
this.getBaseName() = "manifest.json"
}
- DataSourceManifest getDataSource() { this = result.getManifestJson() }
- }
-}
+ DataSourceManifest getADataSource() { result = this.getDataSource(_) }
-/** The manifest.json file serving as the app descriptor. */
-private string constructPathStringInner(Expr object) {
- if not object instanceof ObjectExpr
- then result = ""
- else
- exists(Property property | property = object.(ObjectExpr).getAProperty().(ValueProperty) |
- result = "/" + property.getName() + constructPathStringInner(property.getInit())
- )
-}
+ DataSourceManifest getDataSource(string name) {
+ this = result.getParentManifestJson() and
+ result.getName() = name
+ }
-/**
- * Create all recursive path strings of an object literal, e.g.
- * if `object = { p1: { p2: 1 }, p3: 2 }`, then create:
- * - `p1/p2`, and
- * - `p3/`.
- */
-private string constructPathString(DataFlow::ObjectLiteralNode object) {
- result = constructPathStringInner(object.asExpr())
-}
+ RoutingTargetManifest getARoutingTarget() { result = this.getRoutingTarget(_) }
-/** Holds if the `property` is in any way nested inside the `object`. */
-private predicate propertyNestedInObject(ObjectExpr object, Property property) {
- exists(Property property2 | property2 = object.getAProperty() |
- property = property2 or
- propertyNestedInObject(property2.getInit().(ObjectExpr), property)
- )
-}
+ RoutingTargetManifest getRoutingTarget(string viewName) {
+ result.getViewName() = viewName and
+ result.getParentManifestJson() = this
+ }
+ }
-private string constructPathStringInner(Expr object, Property property) {
- if not object instanceof ObjectExpr
- then result = ""
- else
- exists(Property property2 | property2 = object.(ObjectExpr).getAProperty().(ValueProperty) |
- if property = property2
- then result = "/" + property2.getName()
- else (
- /* We're sure this property is inside this object */
- propertyNestedInObject(property2.getInit().(ObjectExpr), property) and
- result = "/" + property2.getName() + constructPathStringInner(property2.getInit(), property)
+ /** The manifest.json file serving as the app descriptor. */
+ private string constructPathStringInner(Expr object) {
+ if not object instanceof ObjectExpr
+ then result = ""
+ else
+ exists(Property property | property = object.(ObjectExpr).getAProperty().(ValueProperty) |
+ result = "/" + property.getName() + constructPathStringInner(property.getInit())
)
- )
-}
+ }
-/**
- * Create all possible path strings of an object literal up to a certain property, e.g.
- * if `object = { p1: { p2: 1 }, p3: 2 }` and `property = {p3: 2}` then create `"p3/"`.
- */
-string constructPathString(DataFlow::ObjectLiteralNode object, Property property) {
- result = constructPathStringInner(object.asExpr(), property)
-}
+ /**
+ * Create all recursive path strings of an object literal, e.g.
+ * if `object = { p1: { p2: 1 }, p3: 2 }`, then create:
+ * - `p1/p2`, and
+ * - `p3/`.
+ */
+ private string constructPathString(DataFlow::ObjectLiteralNode object) {
+ result = constructPathStringInner(object.asExpr())
+ }
-/**
- * Create all recursive path strings of a JSON object, e.g.
- * if `object = { "p1": { "p2": 1 }, "p3": 2 }`, then create:
- * - `/p1/p2`, and
- * - `/p3`.
- */
-string constructPathStringJson(JsonValue object) {
- if not object instanceof JsonObject
- then result = ""
- else
- exists(string property |
- result = "/" + property + constructPathStringJson(object.getPropValue(property))
+ /** Holds if the `property` is in any way nested inside the `object`. */
+ private predicate propertyNestedInObject(ObjectExpr object, Property property) {
+ exists(Property property2 | property2 = object.getAProperty() |
+ property = property2 or
+ propertyNestedInObject(property2.getInit().(ObjectExpr), property)
)
-}
-
-/**
- * Create all possible path strings of a JSON object up to a certain property name, e.g.
- * if `object = { "p1": { "p2": 1 }, "p3": 2 }` and `propName = "p3"` then create `"/p3"`.
- * PRECONDITION: All of `object`'s keys are unique.
- */
-bindingset[propName]
-string constructPathStringJson(JsonValue object, string propName) {
- exists(string pathString | pathString = constructPathStringJson(object) |
- pathString.regexpMatch(".*" + propName + ".*") and
- result = pathString
- )
-}
-
-/**
- * When given a constructor call `new JSONModel("controller/model.json")`,
- * get the content of the file referred to by URI (`"controller/model.json"`)
- * inside the string argument.
- */
-bindingset[path]
-JsonObject resolveDirectPath(string path) {
- exists(WebApp webApp | result.getJsonFile() = webApp.getResource(path))
-}
-
-/**
- * When given a constructor call `new JSONModel(sap.ui.require.toUrl("sap/ui/demo/mock/products.json")`,
- * get the content of the file referred to by resolving the argument.
- * Currently only supports `sap.ui.require.toUrl`.
- */
-bindingset[path]
-private JsonObject resolveIndirectPath(string path) {
- result = any(JsonObject tODO | tODO.getFile().getAbsolutePath() = path)
-}
+ }
-class JsonModel extends UI5InternalModel {
- JsonModel() {
- this instanceof NewNode and
- (
- exists(RequiredObject jsonModel |
- jsonModel.asSourceNode().flowsTo(this.getCalleeNode()) and
- jsonModel.getDependency() = "sap/ui/model/json/JSONModel"
+ private string constructPathStringInner(Expr object, Property property) {
+ if not object instanceof ObjectExpr
+ then result = ""
+ else
+ exists(Property property2 | property2 = object.(ObjectExpr).getAProperty().(ValueProperty) |
+ if property = property2
+ then result = "/" + property2.getName()
+ else (
+ /* We're sure this property is inside this object */
+ propertyNestedInObject(property2.getInit().(ObjectExpr), property) and
+ result =
+ "/" + property2.getName() + constructPathStringInner(property2.getInit(), property)
+ )
)
- or
- /* Fallback */
- this.getCalleeName() = "JSONModel"
- )
}
/**
- * Gets all possible path strings that can be constructed from this JSON model.
+ * Create all possible path strings of an object literal up to a certain property, e.g.
+ * if `object = { p1: { p2: 1 }, p3: 2 }` and `property = {p3: 2}` then create `"p3/"`.
*/
- override string getPathString() {
- /* 1. new JSONModel("controller/model.json") */
- if this.getAnArgument().asExpr() instanceof StringLiteral
- then
- result =
- constructPathStringJson(resolveDirectPath(this.getAnArgument()
- .asExpr()
- .(StringLiteral)
- .getValue()))
- else
- if this.getAnArgument().(MethodCallNode).getAnArgument().asExpr() instanceof StringLiteral
- then
- /* 2. new JSONModel(sap.ui.require.toUrl("sap/ui/demo/mock/products.json")) */
- result =
- constructPathStringJson(resolveIndirectPath(this.getAnArgument()
- .(MethodCallNode)
- .getAnArgument()
- .asExpr()
- .(StringLiteral)
- .getValue()))
- else
- /*
- * 3. new JSONModel(oData) where
- * var oData = { input: null };
- */
-
- exists(ObjectLiteralNode objectNode |
- objectNode.flowsTo(this.getAnArgument()) and constructPathString(objectNode) = result
- )
+ string constructPathString(DataFlow::ObjectLiteralNode object, Property property) {
+ result = constructPathStringInner(object.asExpr(), property)
}
- override string getPathString(Property property) {
- /*
- * 3. new JSONModel(oData) where
- * var oData = { input: null };
- */
-
- exists(ObjectLiteralNode objectNode |
- objectNode.flowsTo(this.getAnArgument()) and
- constructPathString(objectNode, property) = result
- )
+ /**
+ * Create all recursive path strings of a JSON object, e.g.
+ * if `object = { "p1": { "p2": 1 }, "p3": 2 }`, then create:
+ * - `/p1/p2`, and
+ * - `/p3`.
+ */
+ string constructPathStringJson(JsonValue object) {
+ if not object instanceof JsonObject
+ then result = ""
+ else
+ exists(string property |
+ result = "/" + property + constructPathStringJson(object.getPropValue(property))
+ )
}
+ /**
+ * Create all possible path strings of a JSON object up to a certain property name, e.g.
+ * if `object = { "p1": { "p2": 1 }, "p3": 2 }` and `propName = "p3"` then create `"/p3"`.
+ * PRECONDITION: All of `object`'s keys are unique.
+ */
bindingset[propName]
- string getPathStringPropName(string propName) {
- exists(JsonObject jsonObject |
- jsonObject =
- resolveDirectPath(this.getArgument(0).getALocalSource().asExpr().(StringLiteral).getValue())
- |
- constructPathStringJson(jsonObject, propName) = result
+ string constructPathStringJson(JsonValue object, string propName) {
+ exists(string pathString | pathString = constructPathStringJson(object) |
+ pathString.regexpMatch(".*" + propName + ".*") and
+ result = pathString
)
}
/**
- * A model possibly supporting two-way binding explicitly set as a one-way binding model.
+ * When given a constructor call `new JSONModel("controller/model.json")`,
+ * get the content of the file referred to by URI (`"controller/model.json"`)
+ * inside the string argument.
*/
- predicate isOneWayBinding() {
- exists(MethodCallNode call, BindingMode bindingMode |
- this.flowsTo(call.getReceiver()) and
- call.getMethodName() = "setDefaultBindingMode" and
- bindingMode.getOneWay().flowsTo(call.getArgument(0))
- )
- }
-
- predicate isTwoWayBinding() {
- // Either explicitly set as two-way, or
- exists(MethodCallNode call, BindingMode bindingMode |
- this.flowsTo(call.getReceiver()) and
- call.getMethodName() = "setDefaultBindingMode" and
- bindingMode.getTwoWay().flowsTo(call.getArgument(0))
- )
- or
- // left untouched as default mode which is two-way.
- not exists(MethodCallNode call |
- this.flowsTo(call.getReceiver()) and
- call.getMethodName() = "setDefaultBindingMode"
- )
+ bindingset[path]
+ JsonObject resolveDirectPath(string path) {
+ exists(WebApp webApp | result.getJsonFile() = webApp.getResource(path))
}
/**
- * Get a property of this `JsonModel`, e.g. given a JSON model `oModel` defined either of the following:
- * ```javascript
- * oModel = new JSONModel({x: null});
- * ```
- * ```javascript
- * oContent = {x: null};
- * oModel = new JSONModel(oContent);
- * ```
- * Get `x: null` as its result.
+ * When given a constructor call `new JSONModel(sap.ui.require.toUrl("sap/ui/demo/mock/products.json")`,
+ * get the content of the file referred to by resolving the argument.
+ * Currently only supports `sap.ui.require.toUrl`.
*/
- DataFlow::PropWrite getAProperty() {
- this.getArgument(0).getALocalSource().asExpr() = result.getPropertyNameExpr().getParent+()
+ bindingset[path]
+ private JsonObject resolveIndirectPath(string path) {
+ result = any(JsonObject tODO | tODO.getFile().getAbsolutePath() = path)
}
-}
-class XmlModel extends UI5InternalModel {
- XmlModel() {
- this instanceof NewNode and
- exists(RequiredObject xmlModel |
- xmlModel.asSourceNode().flowsTo(this.getCalleeNode()) and
- xmlModel.getDependency() = "sap/ui/model/xml/XMLModel"
- )
- }
+ class JsonModel extends UI5InternalModel {
+ JsonModel() {
+ this instanceof NewNode and
+ (
+ exists(RequiredObject jsonModel |
+ jsonModel.asSourceNode().flowsTo(this.getCalleeNode()) and
+ jsonModel.getDependency() = "sap/ui/model/json/JSONModel"
+ )
+ or
+ /* Fallback */
+ this.getCalleeName() = "JSONModel"
+ )
+ }
- override string getPathString(Property property) {
- /* TODO */
- result = property.toString()
- }
+ /**
+ * Gets all possible path strings that can be constructed from this JSON model.
+ */
+ override string getPathString() {
+ /* 1. new JSONModel("controller/model.json") */
+ if this.getAnArgument().asExpr() instanceof StringLiteral
+ then
+ result =
+ constructPathStringJson(resolveDirectPath(this.getAnArgument()
+ .asExpr()
+ .(StringLiteral)
+ .getValue()))
+ else
+ if this.getAnArgument().(MethodCallNode).getAnArgument().asExpr() instanceof StringLiteral
+ then
+ /* 2. new JSONModel(sap.ui.require.toUrl("sap/ui/demo/mock/products.json")) */
+ result =
+ constructPathStringJson(resolveIndirectPath(this.getAnArgument()
+ .(MethodCallNode)
+ .getAnArgument()
+ .asExpr()
+ .(StringLiteral)
+ .getValue()))
+ else
+ /*
+ * 3. new JSONModel(oData) where
+ * var oData = { input: null };
+ */
+
+ exists(ObjectLiteralNode objectNode |
+ objectNode.flowsTo(this.getAnArgument()) and constructPathString(objectNode) = result
+ )
+ }
- override string getPathString() { result = "TODO" }
-}
+ override string getPathString(Property property) {
+ /*
+ * 3. new JSONModel(oData) where
+ * var oData = { input: null };
+ */
-class ResourceModel extends UI5Model, ModelReference {
- string modelName;
+ exists(ObjectLiteralNode objectNode |
+ objectNode.flowsTo(this.getAnArgument()) and
+ constructPathString(objectNode, property) = result
+ )
+ }
- ResourceModel() {
- /* A model reference obtained from this.getOwnerComponent().getModel("i18n") */
- exists(CustomController controller, ResourceModelManifest manifest |
- (
- this = controller.getAThisNode().getAMemberCall("getModel") or
- this = controller.getOwnerComponentRef().getAMemberCall("getModel")
- ) and
- modelName = this.getModelName() and
- manifest.getName() = modelName
- )
- }
+ bindingset[propName]
+ string getPathStringPropName(string propName) {
+ exists(JsonObject jsonObject |
+ jsonObject =
+ resolveDirectPath(this.getArgument(0)
+ .getALocalSource()
+ .asExpr()
+ .(StringLiteral)
+ .getValue())
+ |
+ constructPathStringJson(jsonObject, propName) = result
+ )
+ }
- override MethodCallNode getARead() { result = ModelReference.super.getARead() }
+ override predicate contentIsStaticallyVisible() {
+ /* 1. There is at least one path string that can be constructed out of the path string. */
+ exists(this.getPathString())
+ or
+ /* 2. There is a JSON file that can be loaded from. */
+ exists(JsonObject jsonObject |
+ jsonObject = resolveDirectPath(this.getArgument(0).getStringValue())
+ )
+ }
- MethodCallNode getResourceBundle() { result = this.getAMemberCall("getResourceBundle") }
-}
+ /**
+ * A model possibly supporting two-way binding explicitly set as a one-way binding model.
+ */
+ predicate isOneWayBinding() {
+ exists(MethodCallNode call, BindingMode bindingMode |
+ this.flowsTo(call.getReceiver()) and
+ call.getMethodName() = "setDefaultBindingMode" and
+ bindingMode.getOneWay().flowsTo(call.getArgument(0))
+ )
+ }
-class BindingMode extends RequiredObject {
- BindingMode() { this.getDependency() = "sap/ui/model/BindingMode" }
+ predicate isTwoWayBinding() {
+ // Either explicitly set as two-way, or
+ exists(MethodCallNode call, BindingMode bindingMode |
+ this.flowsTo(call.getReceiver()) and
+ call.getMethodName() = "setDefaultBindingMode" and
+ bindingMode.getTwoWay().flowsTo(call.getArgument(0))
+ )
+ or
+ // left untouched as default mode which is two-way.
+ not exists(MethodCallNode call |
+ this.flowsTo(call.getReceiver()) and
+ call.getMethodName() = "setDefaultBindingMode"
+ )
+ }
- PropRead getOneWay() { result = this.asSourceNode().getAPropertyRead("OneWay") }
+ /**
+ * Get a property of this `JsonModel`, e.g. given a JSON model `oModel` defined either of the following:
+ * ```javascript
+ * oModel = new JSONModel({x: null});
+ * ```
+ * ```javascript
+ * oContent = {x: null};
+ * oModel = new JSONModel(oContent);
+ * ```
+ * Get `x: null` as its result.
+ */
+ DataFlow::PropWrite getAProperty() {
+ this.getArgument(0).getALocalSource().asExpr() = result.getPropertyNameExpr().getParent+()
+ }
+ }
- PropRead getTwoWay() { result = this.asSourceNode().getAPropertyRead("TwoWay") }
+ class XmlModel extends UI5InternalModel {
+ XmlModel() {
+ this instanceof NewNode and
+ exists(RequiredObject xmlModel |
+ xmlModel.asSourceNode().flowsTo(this.getCalleeNode()) and
+ xmlModel.getDependency() = "sap/ui/model/xml/XMLModel"
+ )
+ }
- PropRead getDefault_() { result = this.asSourceNode().getAPropertyRead("Default") }
+ override string getPathString(Property property) {
+ /* TODO */
+ result = property.toString()
+ }
- PropRead getOneTime() { result = this.asSourceNode().getAPropertyRead("OneTime") }
-}
+ override string getPathString() { result = "TODO" }
-class RequiredObject extends Expr {
- RequiredObject() {
- exists(SapDefineModule sapDefineModule |
- this = sapDefineModule.getArgument(1).(Function).getParameter(_)
- ) or
- exists(JQueryDefineModule jQueryDefineModule |
- /* WARNING: toString() Hack! */
- this.toString() = jQueryDefineModule.getArgument(0).(StringLiteral).getValue()
- )
+ override predicate contentIsStaticallyVisible() { exists(this.getPathString()) }
}
- pragma[inline]
- SourceNode asSourceNode() { result = this.flow() }
+ class ResourceModel extends UI5Model, ModelReference {
+ string modelName;
- UserModule getDefiningModule() { result.getArgument(1).(Function).getParameter(_) = this }
+ ResourceModel() {
+ /* A model reference obtained from this.getOwnerComponent().getModel("i18n") */
+ exists(CustomController controller, ResourceModelManifest manifest |
+ (
+ this = controller.getAThisNode().getAMemberCall("getModel") or
+ this = controller.getOwnerComponentRef().getAMemberCall("getModel")
+ ) and
+ modelName = this.getModelName() and
+ manifest.getName() = modelName
+ )
+ }
- string getDependency() {
- exists(SapDefineModule module_ | this = module_.getRequiredObject(result))
- }
-}
+ override MethodCallNode getARead() { result = ModelReference.super.getARead() }
-/**
- * `SomeModule.extend(...)` where `SomeModule` stands for a module imported with `sap.ui.define`.
- */
-class SapExtendCall extends InvokeNode, MethodCallNode {
- SapExtendCall() {
- exists(RequiredObject requiredModule |
- this = requiredModule.asSourceNode().getAMemberCall("extend")
- )
+ MethodCallNode getResourceBundle() { result = this.getAMemberCall("getResourceBundle") }
}
- FunctionNode getMethod(string methodName) {
- result = this.getContent().(ObjectLiteralNode).getAPropertySource(methodName)
- }
+ class BindingMode extends RequiredObject {
+ BindingMode() { this.getDependency() = "sap/ui/model/BindingMode" }
- FunctionNode getAMethod() { result = this.getMethod(_) }
+ PropRead getOneWay() { result = this.asSourceNode().getAPropertyRead("OneWay") }
- string getName() { result = this.getArgument(0).getALocalSource().getStringValue() }
+ PropRead getTwoWay() { result = this.asSourceNode().getAPropertyRead("TwoWay") }
- ObjectLiteralNode getContent() { result = this.getArgument(1) }
+ PropRead getDefault_() { result = this.asSourceNode().getAPropertyRead("Default") }
- Metadata getMetadata() {
- result = this.getContent().getAPropertySource("metadata")
- or
- exists(SapExtendCall baseExtendCall |
- baseExtendCall.getDefine().getExtendingModule() = this.getDefine() and
- result = baseExtendCall.getMetadata()
- )
+ PropRead getOneTime() { result = this.asSourceNode().getAPropertyRead("OneTime") }
}
- /** Gets the `sap.ui.define` call that wraps this extension. */
- SapDefineModule getDefine() { this.getEnclosingFunction() = result.getArgument(1) }
+ class RequiredObject extends Expr {
+ RequiredObject() {
+ exists(SapDefineModule sapDefineModule |
+ this = sapDefineModule.getArgument(1).(Function).getParameter(_)
+ ) or
+ exists(JQueryDefineModule jQueryDefineModule |
+ /* WARNING: toString() Hack! */
+ this.toString() = jQueryDefineModule.getArgument(0).(StringLiteral).getValue()
+ )
+ }
- ThisNode getAThisNode() { result.getBinder() = this.getAMethod() }
-}
+ pragma[inline]
+ SourceNode asSourceNode() { result = this.flow() }
-class ElementInstantiation extends NewNode {
- string importPath;
+ UserModule getDefiningModule() { result.getArgument(1).(Function).getParameter(_) = this }
- ElementInstantiation() {
- exists(RequiredObject requiredObject |
- this = requiredObject.asSourceNode().getAnInstantiation() and
- importPath = requiredObject.getDependency()
- )
+ string getDependency() {
+ exists(SapDefineModule module_ | this = module_.getRequiredObject(result))
+ }
}
- string getId() {
- result = this.getArgument(0).(SourceNode).getAPropertyWrite("id").getRhs().getStringValue()
- }
+ /**
+ * `SomeModule.extend(...)` where `SomeModule` stands for a module imported with `sap.ui.define`.
+ */
+ class SapExtendCall extends InvokeNode, MethodCallNode {
+ SapExtendCall() {
+ exists(RequiredObject requiredModule |
+ this = requiredModule.asSourceNode().getAMemberCall("extend")
+ )
+ }
- string getImportPath() { result = importPath }
-}
+ FunctionNode getMethod(string methodName) {
+ result = this.getContent().(ObjectLiteralNode).getAPropertySource(methodName)
+ }
-/**
- * The property metadata found in an SapExtendCall.
- */
-class Metadata extends ObjectLiteralNode {
- SapExtendCall extension;
+ FunctionNode getAMethod() { result = this.getMethod(_) }
- SapExtendCall getExtension() { result = extension }
+ string getName() { result = this.getArgument(0).getALocalSource().getStringValue() }
- Metadata() { this = extension.getContent().getAPropertySource("metadata") }
+ string getModuleName() {
+ result = getSubstringAfterLastOccurrenceOfCharacter(this.getName(), ".")
+ }
- PropertyMetadata getProperty(string name) {
- result.getParentMetadata() = this and result.getName() = name
- }
-}
+ ObjectLiteralNode getContent() { result = this.getArgument(1) }
-class AggregationMetadata extends ObjectLiteralNode {
- string name;
- Metadata parentMetadata;
+ Metadata getMetadata() {
+ result = this.getContent().getAPropertySource("metadata")
+ or
+ exists(SapExtendCall baseExtendCall |
+ baseExtendCall.getDefine().getExtendingModule() = this.getDefine() and
+ result = baseExtendCall.getMetadata()
+ )
+ }
+
+ /** Gets the `sap.ui.define` call that wraps this extension. */
+ SapDefineModule getDefine() { this.getEnclosingFunction() = result.getArgument(1) }
- AggregationMetadata() {
- this = parentMetadata.getAPropertySource("aggregations").getAPropertySource(name)
+ ThisNode getAThisNode() { result.getBinder() = this.getAMethod() }
}
- Metadata getParentMetadata() { result = parentMetadata }
+ class ElementInstantiation extends NewNode {
+ string importPath;
- string getName() { result = name }
+ ElementInstantiation() {
+ exists(RequiredObject requiredObject |
+ this = requiredObject.asSourceNode().getAnInstantiation() and
+ importPath = requiredObject.getDependency()
+ )
+ }
+
+ string getId() {
+ result = this.getArgument(0).(SourceNode).getAPropertyWrite("id").getRhs().getStringValue()
+ }
+
+ string getImportPath() { result = importPath }
+ }
/**
- * Gets the type of this aggregation.
+ * The property metadata found in an SapExtendCall.
*/
- string getType() {
- result = this.getAPropertySource("type").getALocalSource().asExpr().(StringLiteral).getValue()
- }
-}
+ class Metadata extends ObjectLiteralNode {
+ SapExtendCall extension;
-class PropertyMetadata extends ObjectLiteralNode {
- string name;
- Metadata parentMetadata;
+ SapExtendCall getExtension() { result = extension }
+
+ Metadata() { this = extension.getContent().getAPropertySource("metadata") }
- PropertyMetadata() {
- this = parentMetadata.getAPropertySource("properties").getAPropertySource(name)
+ PropertyMetadata getProperty(string name) {
+ result.getParentMetadata() = this and result.getName() = name
+ }
}
- Metadata getParentMetadata() { result = parentMetadata }
+ class AggregationMetadata extends ObjectLiteralNode {
+ string name;
+ Metadata parentMetadata;
- string getName() { result = name }
+ AggregationMetadata() {
+ this = parentMetadata.getAPropertySource("aggregations").getAPropertySource(name)
+ }
- /**
- * Gets the type of this aggregation.
- */
- string getType() {
- if this.isUnrestrictedStringType()
- then result = "string"
- else
+ Metadata getParentMetadata() { result = parentMetadata }
+
+ string getName() { result = name }
+
+ /**
+ * Gets the type of this aggregation.
+ */
+ string getType() {
result = this.getAPropertySource("type").getALocalSource().asExpr().(StringLiteral).getValue()
+ }
}
- /**
- * Holds if this property's type is an unrestricted string not belonging to any enum.
- * This makes the property a possible avenue of a client-side XSS.
- */
- predicate isUnrestrictedStringType() {
- /* text : "string" */
- this.getStringValue() = "string"
- or
- /* text: { type: "string" } */
- this.getAPropertySource("type").getStringValue() = "string"
- or
- /* text: { someOther: "someOtherVal", ... } */
- not exists(this.getAPropertySource("type"))
- }
+ class PropertyMetadata extends ObjectLiteralNode {
+ string name;
+ Metadata parentMetadata;
- MethodCallNode getAWrite() {
- (
- /*
- * 1. The receiver is a reference to a custom control whose property
- * has the same name of the property the setter is writing to.
- */
+ PropertyMetadata() {
+ this = parentMetadata.getAPropertySource("properties").getAPropertySource(name)
+ }
- exists(ControlReference controlReference |
- result.getReceiver().getALocalSource() = controlReference and
- exists(controlReference.getDefinition().getMetadata().getProperty(name))
- )
- or
- /*
- * 2. The receiver is a parameter of the `renderer` method of the custom
- * control whose property has the same name of the property the setter is
- * writing to.
- */
+ Metadata getParentMetadata() { result = parentMetadata }
- exists(CustomControl control |
- result.getReceiver().getALocalSource() = control.getRenderer().getParameter(1) and
- exists(control.getMetadata().getProperty(name))
- )
- ) and
- (
- result.getNumArgument() = 1 and
- result.getMethodName() = "set" + capitalize(name) and
- name != "property"
+ string getName() { result = name }
+
+ /**
+ * Gets the type of this aggregation.
+ */
+ string getType() {
+ if this.isUnrestrictedStringType()
+ then result = "string"
+ else
+ result =
+ this.getAPropertySource("type").getALocalSource().asExpr().(StringLiteral).getValue()
+ }
+
+ /**
+ * Holds if this property's type is an unrestricted string not belonging to any enum.
+ * This makes the property a possible avenue of a client-side XSS.
+ */
+ predicate isUnrestrictedStringType() {
+ /* text : "string" */
+ this.getStringValue() = "string"
or
- result.getNumArgument() = 2 and
- result.getMethodName() = "setProperty" and
- result.getArgument(0).getALocalSource().asExpr().(StringLiteral).getValue() = name
- ) and
- inSameWebApp(this.getFile(), result.getFile())
+ /* text: { type: "string" } */
+ this.getAPropertySource("type").getStringValue() = "string"
+ or
+ /* text: { someOther: "someOtherVal", ... } */
+ not exists(this.getAPropertySource("type"))
+ }
+
+ MethodCallNode getAWrite() {
+ (
+ /*
+ * 1. The receiver is a reference to a custom control whose property
+ * has the same name of the property the setter is writing to.
+ */
+
+ exists(ControlReference controlReference |
+ result.getReceiver().getALocalSource() = controlReference and
+ exists(controlReference.getDefinition().getMetadata().getProperty(name))
+ )
+ or
+ /*
+ * 2. The receiver is a parameter of the `renderer` method of the custom
+ * control whose property has the same name of the property the setter is
+ * writing to.
+ */
+
+ exists(CustomControl control |
+ result.getReceiver().getALocalSource() = control.getRenderer().getParameter(1) and
+ exists(control.getMetadata().getProperty(name))
+ )
+ ) and
+ (
+ result.getNumArgument() = 1 and
+ result.getMethodName() = "set" + capitalize(name) and
+ name != "property"
+ or
+ result.getNumArgument() = 2 and
+ result.getMethodName() = "setProperty" and
+ result.getArgument(0).getALocalSource().asExpr().(StringLiteral).getValue() = name
+ ) and
+ inSameWebApp(this.getFile(), result.getFile())
+ }
+
+ MethodCallNode getARead() {
+ (
+ /*
+ * 1. The receiver is a reference to a custom control whose property
+ * has the same name of the property the getter is reading from.
+ */
+
+ exists(ControlReference controlReference |
+ result.getReceiver().getALocalSource() = controlReference and
+ exists(controlReference.getDefinition().getMetadata().getProperty(name))
+ )
+ or
+ /*
+ * 2. The receiver is a parameter of the `renderer` method of the custom
+ * control whose property has the same name of the property the getter is
+ * reading from.
+ */
+
+ exists(CustomControl control |
+ result.getReceiver().getALocalSource() = control.getRenderer().getParameter(1) and
+ exists(control.getMetadata().getProperty(name))
+ )
+ ) and
+ (
+ result.getNumArgument() = 0 and
+ result.getMethodName() = "get" + capitalize(name) and
+ name != "property"
+ or
+ result.getNumArgument() = 1 and
+ result.getMethodName() = "getProperty" and
+ result.getArgument(0).getALocalSource().asExpr().(StringLiteral).getValue() = name
+ ) and
+ inSameWebApp(this.getFile(), result.getFile())
+ }
}
- MethodCallNode getARead() {
- (
- /*
- * 1. The receiver is a reference to a custom control whose property
- * has the same name of the property the getter is reading from.
- */
+ module EventBus {
+ abstract class EventBusPublishCall extends CallNode {
+ abstract EventBusSubscribeCall getAMatchingSubscribeCall();
- exists(ControlReference controlReference |
- result.getReceiver().getALocalSource() = controlReference and
- exists(controlReference.getDefinition().getMetadata().getProperty(name))
- )
- or
- /*
- * 2. The receiver is a parameter of the `renderer` method of the custom
- * control whose property has the same name of the property the getter is
- * reading from.
- */
+ abstract DataFlow::Node getPublishedData();
- exists(CustomControl control |
- result.getReceiver().getALocalSource() = control.getRenderer().getParameter(1) and
- exists(control.getMetadata().getProperty(name))
- )
- ) and
- (
- result.getNumArgument() = 0 and
- result.getMethodName() = "get" + capitalize(name) and
- name != "property"
- or
- result.getNumArgument() = 1 and
- result.getMethodName() = "getProperty" and
- result.getArgument(0).getALocalSource().asExpr().(StringLiteral).getValue() = name
- ) and
- inSameWebApp(this.getFile(), result.getFile())
+ string getChannelName() { result = this.getArgument(0).getALocalSource().getStringValue() }
+
+ string getMessageType() { result = this.getArgument(1).getALocalSource().getStringValue() }
+ }
+
+ abstract class EventBusSubscribeCall extends CallNode {
+ abstract EventBusPublishCall getMatchingPublishCall();
+
+ abstract DataFlow::Node getSubscriptionData();
+
+ string getChannelName() { result = this.getArgument(0).getALocalSource().getStringValue() }
+
+ string getMessageType() { result = this.getArgument(1).getALocalSource().getStringValue() }
+ }
+
+ class GlobalEventBusPublishCall extends EventBusPublishCall {
+ API::Node publishMethod;
+
+ GlobalEventBusPublishCall() {
+ publishMethod = ModelOutput::getATypeNode("UI5EventBusPublish") and
+ this = publishMethod.getACall()
+ }
+
+ override GlobalEventBusSubscribeCall getAMatchingSubscribeCall() {
+ result.getChannelName() = this.getChannelName() and
+ result.getMessageType() = this.getMessageType()
+ }
+
+ override DataFlow::Node getPublishedData() {
+ exists(API::Node publishedData |
+ publishedData = ModelOutput::getATypeNode("UI5EventBusPublishedEventData")
+ |
+ publishMethod.getASuccessor*() = publishedData and
+ result = publishedData.getInducingNode()
+ )
+ }
+ }
+
+ class SapUICoreEventBusPublishCall extends EventBusPublishCall {
+ API::Node publishMethod;
+
+ SapUICoreEventBusPublishCall() {
+ publishMethod = ModelOutput::getATypeNode("SapUICoreEventBusPublish") and
+ this = publishMethod.getACall()
+ }
+
+ override SapUICoreEventBusSubscribeCall getAMatchingSubscribeCall() {
+ result.getChannelName() = this.getChannelName() and
+ result.getMessageType() = this.getMessageType()
+ }
+
+ override DataFlow::Node getPublishedData() {
+ exists(API::Node publishedData |
+ publishedData = ModelOutput::getATypeNode("SapUICoreEventBusPublishedEventData")
+ |
+ publishMethod.getASuccessor*() = publishedData and
+ result = publishedData.getInducingNode()
+ )
+ }
+ }
+
+ class ComponentEventBusPublishCall extends EventBusPublishCall {
+ API::Node customController;
+
+ ComponentEventBusPublishCall() {
+ exists(API::Node customControllerGetOwnerComponentEventBusPublish |
+ customControllerGetOwnerComponentEventBusPublish =
+ ModelOutput::getATypeNode("CustomControllerGetOwnerComponentEventBusPublish")
+ |
+ customController = ModelOutput::getATypeNode("CustomController") and
+ customControllerGetOwnerComponentEventBusPublish = customController.getASuccessor+() and
+ this = customControllerGetOwnerComponentEventBusPublish.getACall()
+ )
+ }
+
+ override ComponentEventBusSubscribeCall getAMatchingSubscribeCall() {
+ result.getChannelName() = this.getChannelName() and
+ result.getMessageType() = this.getMessageType()
+ }
+
+ override DataFlow::Node getPublishedData() { result = this.getArgument(2) }
+ }
+
+ class GlobalEventBusSubscribeCall extends EventBusSubscribeCall {
+ API::Node subscribeMethod;
+
+ GlobalEventBusSubscribeCall() {
+ subscribeMethod = ModelOutput::getATypeNode("UI5EventBusSubscribe") and
+ this = subscribeMethod.getACall()
+ }
+
+ override GlobalEventBusPublishCall getMatchingPublishCall() {
+ result.getChannelName() = this.getChannelName() and
+ result.getMessageType() = this.getMessageType()
+ }
+
+ override DataFlow::Node getSubscriptionData() {
+ exists(API::Node subscribeMethodCallbackDataParameter |
+ subscribeMethodCallbackDataParameter =
+ ModelOutput::getATypeNode("UI5EventSubscriptionHandlerDataParameter")
+ |
+ subscribeMethod.getASuccessor*() = subscribeMethodCallbackDataParameter and
+ result = subscribeMethodCallbackDataParameter.getInducingNode()
+ )
+ }
+ }
+
+ class SapUICoreEventBusSubscribeCall extends EventBusSubscribeCall {
+ API::Node subscribeMethod;
+
+ SapUICoreEventBusSubscribeCall() {
+ subscribeMethod = ModelOutput::getATypeNode("SapUICoreEventBusSubscribe") and
+ this = subscribeMethod.getACall()
+ }
+
+ override SapUICoreEventBusPublishCall getMatchingPublishCall() {
+ result.getChannelName() = this.getChannelName() and
+ result.getMessageType() = this.getMessageType()
+ }
+
+ override DataFlow::Node getSubscriptionData() {
+ exists(API::Node subscribeMethodCallbackDataParameter |
+ subscribeMethodCallbackDataParameter =
+ ModelOutput::getATypeNode("SapUICoreEventSubscriptionHandlerDataParameter")
+ |
+ subscribeMethod.getASuccessor+() = subscribeMethodCallbackDataParameter and
+ result = subscribeMethodCallbackDataParameter.getInducingNode()
+ )
+ }
+ }
+
+ class ComponentEventBusSubscribeCall extends EventBusSubscribeCall {
+ API::Node customController;
+
+ ComponentEventBusSubscribeCall() {
+ exists(API::Node customControllerGetOwnerComponentEventBusSubscribe |
+ customControllerGetOwnerComponentEventBusSubscribe =
+ ModelOutput::getATypeNode("CustomControllerGetOwnerComponentEventBusSubscribe")
+ |
+ customController = ModelOutput::getATypeNode("CustomController") and
+ customControllerGetOwnerComponentEventBusSubscribe = customController.getASuccessor+() and
+ this = customControllerGetOwnerComponentEventBusSubscribe.getACall()
+ )
+ }
+
+ override ComponentEventBusPublishCall getMatchingPublishCall() {
+ result.getChannelName() = this.getChannelName() and
+ result.getMessageType() = this.getMessageType()
+ }
+
+ override DataFlow::Node getSubscriptionData() {
+ result = this.getABoundCallbackParameter(2, 2)
+ }
+ }
}
}
-module TypeTrackers {
- private SourceNode hasDependency(TypeTracker t, string dependencyPath) {
- t.start() and
- exists(UserModule d |
- d.getADependency() = dependencyPath and
- result = d.getRequiredObject(dependencyPath).asSourceNode()
- )
- or
- exists(TypeTracker t2 | result = hasDependency(t2, dependencyPath).track(t2, t))
- }
+bindingset[input, character]
+private int countCharacterInString(string input, string character) {
+ result = count(int index | character = input.charAt(index) | index)
+}
- SourceNode hasDependency(string dependencyPath) {
- result = hasDependency(TypeTracker::end(), dependencyPath)
- }
+bindingset[input, character]
+private string getSubstringAfterLastOccurrenceOfCharacter(string input, string character) {
+ result = input.splitAt(character, countCharacterInString(input, character))
}
diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll
index 576ba413..ccbb6bc0 100644
--- a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll
+++ b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll
@@ -160,6 +160,13 @@ abstract class UI5BindingPath extends BindingPath {
inSameWebApp(this.getLocation().getFile(), result.getFile())
)
or
+ exists(JsonModel model, CustomController controller |
+ not model.contentIsStaticallyVisible() and
+ result = model and
+ this.getView() = controller.getAViewReference().getDefinition() and
+ controller.getModel() = result
+ )
+ or
/* 2. External (Server-side) model */
result = this.getModel().(UI5ExternalModel) and
/* Restrict search to inside the same webapp. */
@@ -942,30 +949,3 @@ class UI5Handler extends FunctionNode {
UI5Control getControl() { result = control }
}
-
-/**
- * Models controller references in event handlers as types
- */
-overlay[local?]
-class ControlTypeInHandlerModel extends ModelInput::TypeModel {
- override DataFlow::CallNode getASource(string type) {
- // oEvent.getSource() is of the type of the Control calling the handler
- exists(UI5Handler h |
- type = h.getControl().getImportPath() and
- result.getCalleeName() = "getSource" and
- result.getReceiver().getALocalSource() = h.getParameter(0)
- )
- or
- // this.getView().byId("id") is of the type of the Control with id="id"
- exists(UI5Control c |
- type = c.getImportPath() and
- result = c.getAReference()
- )
- }
-
- /**
- * Prevents model pruning for `ControlType`types
- */
- bindingset[type]
- override predicate isTypeUsed(string type) { any() }
-}
diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5XssQuery.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5XssQuery.qll
index 947b3d7d..034c04ac 100644
--- a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5XssQuery.qll
+++ b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5XssQuery.qll
@@ -36,6 +36,7 @@ module UI5Xss implements DataFlow::ConfigSig {
predicate isSink(DataFlow::Node node) {
node instanceof UI5ExtHtmlISink or
node instanceof UI5ModelHtmlISink or
+ node instanceof UI5HTMLControlReferenceContentAPI or
node instanceof DynamicallySetElementValueOfInstantiatedHTMLControlPlacedAtDom
}
@@ -68,10 +69,26 @@ class UI5ModelHtmlISink extends DataFlow::Node {
/**
* An HTML injection sink typically for custom controls whose RenderManager calls acting as sinks.
*/
+private class UI5HTMLControlReferenceContentAPI extends DataFlow::Node {
+ UI5HTMLControlReferenceContentAPI() {
+ exists(UI5Control sinkControl, string typeAlias, ControlReference controlReference |
+ typeModel(typeAlias, sinkControl.getImportPath(), _) and
+ sinkModel(typeAlias, _, "ui5-html-injection", _) and
+ sinkControl.getAReference() = controlReference and
+ (
+ this = controlReference.getAMemberCall("setContent").getArgument(0) or
+ this = controlReference.getAPropertyWrite("content").getRhs()
+ )
+ ) and
+ /* Exclude property writes to instantiated HTML controls; they are covered in a separate class below. */
+ not this instanceof DynamicallySetElementValueOfInstantiatedHTMLControlPlacedAtDom
+ }
+}
+
private class UI5ExtHtmlISink extends DataFlow::Node {
UI5ExtHtmlISink() {
this = ModelOutput::getASinkNode("ui5-html-injection").asSink() and
- /* Exclude property writes to HTML controls; they are covered in a separate class below. */
+ /* Exclude property writes to instantiated HTML controls; they are covered in a separate class below. */
not this instanceof DynamicallySetElementValueOfInstantiatedHTMLControlPlacedAtDom
}
}
diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll
index a3463e07..c8c15907 100644
--- a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll
+++ b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/FlowSteps.qll
@@ -366,3 +366,42 @@ class LogArgumentToListener extends DataFlow::SharedFlowStep {
logArgumentToListener(start, end)
}
}
+
+class PublishedEventToEventSubscribedEventData extends DataFlow::SharedFlowStep {
+ override predicate step(DataFlow::Node start, DataFlow::Node end) {
+ exists(
+ EventBus::EventBusPublishCall publishCall, EventBus::EventBusSubscribeCall subscribeCall
+ |
+ publishCall.getAMatchingSubscribeCall() = subscribeCall
+ |
+ start = publishCall.getPublishedData() and
+ end = subscribeCall.getSubscriptionData()
+ )
+ }
+}
+
+/**
+ * A step within an object wrapped in an `sap.ui.extend` call. Jumps from
+ * the value written to a property of the object to the read of it.
+ *
+ * This step is only established only if the property read and property writes
+ * are in different methods, so as not to jump to a property read that comes
+ * before the property write in the same method.
+ */
+class ThisNodePropertyWriteToThisNodePropertyRead extends DataFlow::SharedFlowStep {
+ override predicate step(DataFlow::Node start, DataFlow::Node end) {
+ exists(
+ SapExtendCall sapExtendCall, ThisNode propReadThisNode, ThisNode propWriteThisNode,
+ PropRead propRead, PropWrite propWrite, string propName
+ |
+ propReadThisNode = sapExtendCall.getAThisNode() and
+ propWriteThisNode = sapExtendCall.getAThisNode() and
+ propRead = propReadThisNode.getAPropertyRead(propName) and
+ propWrite = propWriteThisNode.getAPropertyWrite(propName) and
+ start = propWrite.getRhs() and
+ end = propRead and
+ /* They belong to different methods of the object. */
+ propReadThisNode.getBinder() != propWriteThisNode.getBinder()
+ )
+ }
+}
diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/TypeTrackers.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/TypeTrackers.qll
new file mode 100644
index 00000000..4d2ed9c3
--- /dev/null
+++ b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/dataflow/TypeTrackers.qll
@@ -0,0 +1,34 @@
+import javascript
+import DataFlow
+
+module TypeTrackers {
+ private SourceNode hasDependency(TypeTracker t, string dependencyPath) {
+ t.start() and
+ exists(UserModule d |
+ d.getADependency() = dependencyPath and
+ result = d.getRequiredObject(dependencyPath).asSourceNode()
+ )
+ or
+ exists(TypeTracker t2 | result = hasDependency(t2, dependencyPath).track(t2, t))
+ }
+
+ SourceNode hasDependency(string dependencyPath) {
+ result = hasDependency(TypeTracker::end(), dependencyPath)
+ }
+
+ private class ObjFieldStep extends SharedTypeTrackingStep {
+ override predicate step(DataFlow::Node start, DataFlow::Node end) {
+ exists(SapExtendCall sapExtendCall, ObjectLiteralNode wrappedObject, string name |
+ wrappedObject = sapExtendCall.getContent() and
+ start = getAnAlias(wrappedObject).getAPropertyWrite(name).getRhs() and
+ end = getAnAlias(wrappedObject).getAPropertyRead(name)
+ )
+ }
+ }
+
+ private DataFlow::SourceNode getAnAlias(DataFlow::SourceNode object) {
+ result = object
+ or
+ result = getAnAlias(object).getAPropertySource().(DataFlow::FunctionNode).getReceiver()
+ }
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/UI5Xss.expected b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/UI5Xss.expected
new file mode 100644
index 00000000..ca7566ff
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/UI5Xss.expected
@@ -0,0 +1,105 @@
+nodes
+| webapp/controller/App1.controller.js:26:11:26:15 | value |
+| webapp/controller/App1.controller.js:26:19:26:35 | oInput.getValue() |
+| webapp/controller/App1.controller.js:27:45:27:62 | { message: value } |
+| webapp/controller/App1.controller.js:27:56:27:60 | value |
+| webapp/controller/App1.controller.js:30:34:30:38 | model |
+| webapp/controller/App1.controller.js:32:30:32:34 | model |
+| webapp/controller/App1.controller.js:32:30:32:42 | model.message |
+| webapp/controller/App2.controller.js:26:11:26:15 | value |
+| webapp/controller/App2.controller.js:26:19:26:35 | oInput.getValue() |
+| webapp/controller/App2.controller.js:27:45:27:62 | { message: value } |
+| webapp/controller/App2.controller.js:27:56:27:60 | value |
+| webapp/controller/App2.controller.js:30:34:30:38 | model |
+| webapp/controller/App2.controller.js:32:30:32:34 | model |
+| webapp/controller/App2.controller.js:32:30:32:42 | model.message |
+| webapp/controller/App3.controller.js:25:11:25:15 | value |
+| webapp/controller/App3.controller.js:25:19:25:35 | oInput.getValue() |
+| webapp/controller/App3.controller.js:26:45:26:62 | { message: value } |
+| webapp/controller/App3.controller.js:26:56:26:60 | value |
+| webapp/controller/App4.controller.js:24:34:24:38 | model |
+| webapp/controller/App4.controller.js:26:30:26:34 | model |
+| webapp/controller/App4.controller.js:26:30:26:42 | model.message |
+| webapp/view/App1.view.xml:5:3:8:29 | value={/input} |
+| webapp/view/App1.view.xml:11:3:12:37 | content={/output1} |
+| webapp/view/App2.view.xml:5:3:8:29 | value={/input} |
+| webapp/view/App2.view.xml:11:3:12:37 | content={/output1} |
+| webapp/view/App3.view.xml:5:3:8:29 | value={/input} |
+| webapp/view/App4.view.xml:5:3:6:37 | content={/output1} |
+edges
+| webapp/controller/App1.controller.js:15:9:15:19 | input: null | webapp/view/App1.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App1.controller.js:15:9:15:19 | input: null | webapp/view/App2.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App1.controller.js:15:9:15:19 | input: null | webapp/view/App3.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App1.controller.js:16:9:16:21 | output1: null | webapp/view/App1.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App1.controller.js:16:9:16:21 | output1: null | webapp/view/App2.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App1.controller.js:16:9:16:21 | output1: null | webapp/view/App4.view.xml:5:3:6:37 | content={/output1} |
+| webapp/controller/App1.controller.js:18:20:18:39 | new JSONModel(oData) | webapp/view/App1.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App1.controller.js:26:11:26:15 | value | webapp/controller/App1.controller.js:27:56:27:60 | value |
+| webapp/controller/App1.controller.js:26:19:26:35 | oInput.getValue() | webapp/controller/App1.controller.js:26:11:26:15 | value |
+| webapp/controller/App1.controller.js:27:45:27:62 | { message: value } | webapp/controller/App1.controller.js:30:34:30:38 | model |
+| webapp/controller/App1.controller.js:27:56:27:60 | value | webapp/controller/App1.controller.js:27:45:27:62 | { message: value } |
+| webapp/controller/App1.controller.js:30:34:30:38 | model | webapp/controller/App1.controller.js:32:30:32:34 | model |
+| webapp/controller/App1.controller.js:32:30:32:34 | model | webapp/controller/App1.controller.js:32:30:32:42 | model.message |
+| webapp/controller/App2.controller.js:15:9:15:19 | input: null | webapp/view/App1.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App2.controller.js:15:9:15:19 | input: null | webapp/view/App2.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App2.controller.js:15:9:15:19 | input: null | webapp/view/App3.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App2.controller.js:16:9:16:21 | output1: null | webapp/view/App1.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App2.controller.js:16:9:16:21 | output1: null | webapp/view/App2.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App2.controller.js:16:9:16:21 | output1: null | webapp/view/App4.view.xml:5:3:6:37 | content={/output1} |
+| webapp/controller/App2.controller.js:18:20:18:39 | new JSONModel(oData) | webapp/view/App2.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App2.controller.js:26:11:26:15 | value | webapp/controller/App2.controller.js:27:56:27:60 | value |
+| webapp/controller/App2.controller.js:26:19:26:35 | oInput.getValue() | webapp/controller/App2.controller.js:26:11:26:15 | value |
+| webapp/controller/App2.controller.js:27:45:27:62 | { message: value } | webapp/controller/App2.controller.js:30:34:30:38 | model |
+| webapp/controller/App2.controller.js:27:56:27:60 | value | webapp/controller/App2.controller.js:27:45:27:62 | { message: value } |
+| webapp/controller/App2.controller.js:30:34:30:38 | model | webapp/controller/App2.controller.js:32:30:32:34 | model |
+| webapp/controller/App2.controller.js:32:30:32:34 | model | webapp/controller/App2.controller.js:32:30:32:42 | model.message |
+| webapp/controller/App3.controller.js:15:9:15:19 | input: null | webapp/view/App1.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App3.controller.js:15:9:15:19 | input: null | webapp/view/App2.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App3.controller.js:15:9:15:19 | input: null | webapp/view/App3.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App3.controller.js:16:9:16:21 | output1: null | webapp/view/App1.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App3.controller.js:16:9:16:21 | output1: null | webapp/view/App2.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App3.controller.js:16:9:16:21 | output1: null | webapp/view/App4.view.xml:5:3:6:37 | content={/output1} |
+| webapp/controller/App3.controller.js:25:11:25:15 | value | webapp/controller/App3.controller.js:26:56:26:60 | value |
+| webapp/controller/App3.controller.js:25:19:25:35 | oInput.getValue() | webapp/controller/App3.controller.js:25:11:25:15 | value |
+| webapp/controller/App3.controller.js:26:45:26:62 | { message: value } | webapp/controller/App4.controller.js:24:34:24:38 | model |
+| webapp/controller/App3.controller.js:26:56:26:60 | value | webapp/controller/App3.controller.js:26:45:26:62 | { message: value } |
+| webapp/controller/App4.controller.js:15:9:15:19 | input: null | webapp/view/App1.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App4.controller.js:15:9:15:19 | input: null | webapp/view/App2.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App4.controller.js:15:9:15:19 | input: null | webapp/view/App3.view.xml:5:3:8:29 | value={/input} |
+| webapp/controller/App4.controller.js:16:9:16:21 | output1: null | webapp/view/App1.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App4.controller.js:16:9:16:21 | output1: null | webapp/view/App2.view.xml:11:3:12:37 | content={/output1} |
+| webapp/controller/App4.controller.js:16:9:16:21 | output1: null | webapp/view/App4.view.xml:5:3:6:37 | content={/output1} |
+| webapp/controller/App4.controller.js:18:20:18:39 | new JSONModel(oData) | webapp/view/App4.view.xml:5:3:6:37 | content={/output1} |
+| webapp/controller/App4.controller.js:24:34:24:38 | model | webapp/controller/App4.controller.js:26:30:26:34 | model |
+| webapp/controller/App4.controller.js:26:30:26:34 | model | webapp/controller/App4.controller.js:26:30:26:42 | model.message |
+| webapp/view/App1.view.xml:5:3:8:29 | value={/input} | webapp/controller/App1.controller.js:15:9:15:19 | input: null |
+| webapp/view/App1.view.xml:5:3:8:29 | value={/input} | webapp/controller/App1.controller.js:18:20:18:39 | new JSONModel(oData) |
+| webapp/view/App1.view.xml:5:3:8:29 | value={/input} | webapp/controller/App2.controller.js:15:9:15:19 | input: null |
+| webapp/view/App1.view.xml:5:3:8:29 | value={/input} | webapp/controller/App3.controller.js:15:9:15:19 | input: null |
+| webapp/view/App1.view.xml:5:3:8:29 | value={/input} | webapp/controller/App4.controller.js:15:9:15:19 | input: null |
+| webapp/view/App1.view.xml:11:3:12:37 | content={/output1} | webapp/controller/App1.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App1.view.xml:11:3:12:37 | content={/output1} | webapp/controller/App2.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App1.view.xml:11:3:12:37 | content={/output1} | webapp/controller/App3.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App1.view.xml:11:3:12:37 | content={/output1} | webapp/controller/App4.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App2.view.xml:5:3:8:29 | value={/input} | webapp/controller/App1.controller.js:15:9:15:19 | input: null |
+| webapp/view/App2.view.xml:5:3:8:29 | value={/input} | webapp/controller/App2.controller.js:15:9:15:19 | input: null |
+| webapp/view/App2.view.xml:5:3:8:29 | value={/input} | webapp/controller/App2.controller.js:18:20:18:39 | new JSONModel(oData) |
+| webapp/view/App2.view.xml:5:3:8:29 | value={/input} | webapp/controller/App3.controller.js:15:9:15:19 | input: null |
+| webapp/view/App2.view.xml:5:3:8:29 | value={/input} | webapp/controller/App4.controller.js:15:9:15:19 | input: null |
+| webapp/view/App2.view.xml:11:3:12:37 | content={/output1} | webapp/controller/App1.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App2.view.xml:11:3:12:37 | content={/output1} | webapp/controller/App2.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App2.view.xml:11:3:12:37 | content={/output1} | webapp/controller/App3.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App2.view.xml:11:3:12:37 | content={/output1} | webapp/controller/App4.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App3.view.xml:5:3:8:29 | value={/input} | webapp/controller/App1.controller.js:15:9:15:19 | input: null |
+| webapp/view/App3.view.xml:5:3:8:29 | value={/input} | webapp/controller/App2.controller.js:15:9:15:19 | input: null |
+| webapp/view/App3.view.xml:5:3:8:29 | value={/input} | webapp/controller/App3.controller.js:15:9:15:19 | input: null |
+| webapp/view/App3.view.xml:5:3:8:29 | value={/input} | webapp/controller/App3.controller.js:18:20:18:39 | new JSONModel(oData) |
+| webapp/view/App3.view.xml:5:3:8:29 | value={/input} | webapp/controller/App4.controller.js:15:9:15:19 | input: null |
+| webapp/view/App4.view.xml:5:3:6:37 | content={/output1} | webapp/controller/App1.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App4.view.xml:5:3:6:37 | content={/output1} | webapp/controller/App2.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App4.view.xml:5:3:6:37 | content={/output1} | webapp/controller/App3.controller.js:16:9:16:21 | output1: null |
+| webapp/view/App4.view.xml:5:3:6:37 | content={/output1} | webapp/controller/App4.controller.js:16:9:16:21 | output1: null |
+#select
+| webapp/controller/App1.controller.js:32:30:32:42 | model.message | webapp/controller/App1.controller.js:26:19:26:35 | oInput.getValue() | webapp/controller/App1.controller.js:32:30:32:42 | model.message | XSS vulnerability due to $@. | webapp/controller/App1.controller.js:26:19:26:35 | oInput.getValue() | user-provided value |
+| webapp/controller/App2.controller.js:32:30:32:42 | model.message | webapp/controller/App2.controller.js:26:19:26:35 | oInput.getValue() | webapp/controller/App2.controller.js:32:30:32:42 | model.message | XSS vulnerability due to $@. | webapp/controller/App2.controller.js:26:19:26:35 | oInput.getValue() | user-provided value |
+| webapp/controller/App4.controller.js:26:30:26:42 | model.message | webapp/controller/App3.controller.js:25:19:25:35 | oInput.getValue() | webapp/controller/App4.controller.js:26:30:26:42 | model.message | XSS vulnerability due to $@. | webapp/controller/App3.controller.js:25:19:25:35 | oInput.getValue() | user-provided value |
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/UI5Xss.qlref b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/UI5Xss.qlref
new file mode 100644
index 00000000..ce544f1d
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/UI5Xss.qlref
@@ -0,0 +1 @@
+UI5Xss/UI5Xss.ql
\ No newline at end of file
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package-lock.json b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package-lock.json
new file mode 100644
index 00000000..4d9fc1f3
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package-lock.json
@@ -0,0 +1,6008 @@
+{
+ "name": "sap-ui5-xss",
+ "version": "1.0.0",
+ "lockfileVersion": 3,
+ "requires": true,
+ "packages": {
+ "": {
+ "name": "sap-ui5-xss",
+ "version": "1.0.0",
+ "dependencies": {
+ "@ui5/cli": "^3.0.7"
+ }
+ },
+ "node_modules/@ui5/cli": {
+ "version": "3.11.12",
+ "resolved": "https://registry.npmjs.org/@ui5/cli/-/cli-3.11.12.tgz",
+ "integrity": "sha512-9XBoAytXFWo3kX5iVTS5h2l7JrOhudTdS2tUe//szMMwpDQ1wZ+5lDoXz73/jzd1n3rnpdFNctO9EnHGuQepuQ==",
+ "hasShrinkwrap": true,
+ "license": "Apache-2.0",
+ "dependencies": {
+ "@ui5/builder": "^3.7.1",
+ "@ui5/fs": "^3.0.6",
+ "@ui5/logger": "^3.0.1",
+ "@ui5/project": "^3.9.5",
+ "@ui5/server": "^3.6.1",
+ "chalk": "^5.6.2",
+ "data-with-position": "^0.5.0",
+ "import-local": "^3.2.0",
+ "js-yaml": "^4.1.1",
+ "open": "^9.1.0",
+ "pretty-hrtime": "^1.0.3",
+ "semver": "^7.7.3",
+ "update-notifier": "^6.0.2",
+ "yargs": "^17.7.2"
+ },
+ "bin": {
+ "ui5": "bin/ui5.cjs"
+ },
+ "engines": {
+ "node": "^16.18.0 || >=18.12.0",
+ "npm": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@adobe/css-tools": {
+ "version": "4.4.4",
+ "resolved": "https://registry.npmjs.org/@adobe/css-tools/-/css-tools-4.4.4.tgz",
+ "integrity": "sha512-Elp+iwUx5rN5+Y8xLt5/GRoG20WGoDCQ/1Fb+1LiGtvwbDavuSk0jhD/eZdckHAuzcDzccnkv+rEjyWfRx18gg=="
+ },
+ "node_modules/@ui5/cli/node_modules/@babel/code-frame": {
+ "version": "7.27.1",
+ "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.27.1.tgz",
+ "integrity": "sha512-cjQ7ZlQ0Mv3b47hABuTevyTuYN4i+loJKGeV9flcCgIK37cCXRh+L1bd3iBHlynerhQ7BhCkn2BPbQUL+rGqFg==",
+ "dependencies": {
+ "@babel/helper-validator-identifier": "^7.27.1",
+ "js-tokens": "^4.0.0",
+ "picocolors": "^1.1.1"
+ },
+ "engines": {
+ "node": ">=6.9.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@babel/helper-string-parser": {
+ "version": "7.27.1",
+ "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.27.1.tgz",
+ "integrity": "sha512-qMlSxKbpRlAridDExk92nSobyDdpPijUq2DW6oDnUqd0iOGxmQjyqhMIihI9+zv4LPyZdRje2cavWPbCbWm3eA==",
+ "engines": {
+ "node": ">=6.9.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@babel/helper-validator-identifier": {
+ "version": "7.28.5",
+ "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz",
+ "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==",
+ "engines": {
+ "node": ">=6.9.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@babel/parser": {
+ "version": "7.28.5",
+ "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.28.5.tgz",
+ "integrity": "sha512-KKBU1VGYR7ORr3At5HAtUQ+TV3SzRCXmA/8OdDZiLDBIZxVyzXuztPjfLd3BV1PRAQGCMWWSHYhL0F8d5uHBDQ==",
+ "dependencies": {
+ "@babel/types": "^7.28.5"
+ },
+ "bin": {
+ "parser": "bin/babel-parser.js"
+ },
+ "engines": {
+ "node": ">=6.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@babel/types": {
+ "version": "7.28.5",
+ "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.28.5.tgz",
+ "integrity": "sha512-qQ5m48eI/MFLQ5PxQj4PFaprjyCTLI37ElWMmNs0K8Lk3dVeOdNpB3ks8jc7yM5CDmVC73eMVk/trk3fgmrUpA==",
+ "dependencies": {
+ "@babel/helper-string-parser": "^7.27.1",
+ "@babel/helper-validator-identifier": "^7.28.5"
+ },
+ "engines": {
+ "node": ">=6.9.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@isaacs/cliui": {
+ "version": "8.0.2",
+ "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+ "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+ "dependencies": {
+ "string-width": "^5.1.2",
+ "string-width-cjs": "npm:string-width@^4.2.0",
+ "strip-ansi": "^7.0.1",
+ "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+ "wrap-ansi": "^8.1.0",
+ "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+ },
+ "engines": {
+ "node": ">=12"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@isaacs/cliui/node_modules/emoji-regex": {
+ "version": "9.2.2",
+ "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+ "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
+ },
+ "node_modules/@ui5/cli/node_modules/@isaacs/cliui/node_modules/string-width": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+ "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+ "dependencies": {
+ "eastasianwidth": "^0.2.0",
+ "emoji-regex": "^9.2.2",
+ "strip-ansi": "^7.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@jridgewell/gen-mapping": {
+ "version": "0.3.13",
+ "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
+ "integrity": "sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==",
+ "dependencies": {
+ "@jridgewell/sourcemap-codec": "^1.5.0",
+ "@jridgewell/trace-mapping": "^0.3.24"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@jridgewell/resolve-uri": {
+ "version": "3.1.2",
+ "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz",
+ "integrity": "sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==",
+ "engines": {
+ "node": ">=6.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@jridgewell/source-map": {
+ "version": "0.3.11",
+ "resolved": "https://registry.npmjs.org/@jridgewell/source-map/-/source-map-0.3.11.tgz",
+ "integrity": "sha512-ZMp1V8ZFcPG5dIWnQLr3NSI1MiCU7UETdS/A0G8V/XWHvJv3ZsFqutJn1Y5RPmAPX6F3BiE397OqveU/9NCuIA==",
+ "dependencies": {
+ "@jridgewell/gen-mapping": "^0.3.5",
+ "@jridgewell/trace-mapping": "^0.3.25"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@jridgewell/sourcemap-codec": {
+ "version": "1.5.5",
+ "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.5.tgz",
+ "integrity": "sha512-cYQ9310grqxueWbl+WuIUIaiUaDcj7WOq5fVhEljNVgRfOUhY9fy2zTvfoqWsnebh8Sl70VScFbICvJnLKB0Og=="
+ },
+ "node_modules/@ui5/cli/node_modules/@jridgewell/trace-mapping": {
+ "version": "0.3.31",
+ "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.31.tgz",
+ "integrity": "sha512-zzNR+SdQSDJzc8joaeP8QQoCQr8NuYx2dIIytl1QeBEZHJ9uW6hebsrYgbz8hJwUQao3TWCMtmfV8Nu1twOLAw==",
+ "dependencies": {
+ "@jridgewell/resolve-uri": "^3.1.0",
+ "@jridgewell/sourcemap-codec": "^1.4.14"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@jsdoc/salty": {
+ "version": "0.2.9",
+ "resolved": "https://registry.npmjs.org/@jsdoc/salty/-/salty-0.2.9.tgz",
+ "integrity": "sha512-yYxMVH7Dqw6nO0d5NIV8OQWnitU8k6vXH8NtgqAfIa/IUqRMxRv/NUJJ08VEKbAakwxlgBl5PJdrU0dMPStsnw==",
+ "dependencies": {
+ "lodash": "^4.17.21"
+ },
+ "engines": {
+ "node": ">=v12.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@nodelib/fs.scandir": {
+ "version": "2.1.5",
+ "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz",
+ "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==",
+ "dependencies": {
+ "@nodelib/fs.stat": "2.0.5",
+ "run-parallel": "^1.1.9"
+ },
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@nodelib/fs.stat": {
+ "version": "2.0.5",
+ "resolved": "https://registry.npmjs.org/@nodelib/fs.stat/-/fs.stat-2.0.5.tgz",
+ "integrity": "sha512-RkhPPp2zrqDAQA/2jNhnztcPAlv64XdhIp7a7454A5ovI7Bukxgt7MX7udwAu3zg1DcpPU0rz3VV1SeaqvY4+A==",
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@nodelib/fs.walk": {
+ "version": "1.2.8",
+ "resolved": "https://registry.npmjs.org/@nodelib/fs.walk/-/fs.walk-1.2.8.tgz",
+ "integrity": "sha512-oGB+UxlgWcgQkgwo8GcEGwemoTFt3FIO9ababBmaGwXIoBKZ+GTy0pP185beGg7Llih/NSHSV2XAs1lnznocSg==",
+ "dependencies": {
+ "@nodelib/fs.scandir": "2.1.5",
+ "fastq": "^1.6.0"
+ },
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/agent": {
+ "version": "2.2.2",
+ "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-2.2.2.tgz",
+ "integrity": "sha512-OrcNPXdpSl9UX7qPVRWbmWMCSXrcDa2M9DvrbOTj7ao1S4PlqVFYv9/yLKMkrJKZ/V5A/kDBC690or307i26Og==",
+ "dependencies": {
+ "agent-base": "^7.1.0",
+ "http-proxy-agent": "^7.0.0",
+ "https-proxy-agent": "^7.0.1",
+ "lru-cache": "^10.0.1",
+ "socks-proxy-agent": "^8.0.3"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/agent/node_modules/lru-cache": {
+ "version": "10.4.3",
+ "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+ "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/config": {
+ "version": "8.3.4",
+ "resolved": "https://registry.npmjs.org/@npmcli/config/-/config-8.3.4.tgz",
+ "integrity": "sha512-01rtHedemDNhUXdicU7s+QYz/3JyV5Naj84cvdXGH4mgCdL+agmSYaLF4LUG4vMCLzhBO8YtS0gPpH1FGvbgAw==",
+ "dependencies": {
+ "@npmcli/map-workspaces": "^3.0.2",
+ "@npmcli/package-json": "^5.1.1",
+ "ci-info": "^4.0.0",
+ "ini": "^4.1.2",
+ "nopt": "^7.2.1",
+ "proc-log": "^4.2.0",
+ "semver": "^7.3.5",
+ "walk-up-path": "^3.0.1"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/fs": {
+ "version": "3.1.1",
+ "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-3.1.1.tgz",
+ "integrity": "sha512-q9CRWjpHCMIh5sVyefoD1cA7PkvILqCZsnSOEUUivORLjxCO/Irmue2DprETiNgEqktDBZaM1Bi+jrarx1XdCg==",
+ "dependencies": {
+ "semver": "^7.3.5"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/git": {
+ "version": "5.0.8",
+ "resolved": "https://registry.npmjs.org/@npmcli/git/-/git-5.0.8.tgz",
+ "integrity": "sha512-liASfw5cqhjNW9UFd+ruwwdEf/lbOAQjLL2XY2dFW/bkJheXDYZgOyul/4gVvEV4BWkTXjYGmDqMw9uegdbJNQ==",
+ "dependencies": {
+ "@npmcli/promise-spawn": "^7.0.0",
+ "ini": "^4.1.3",
+ "lru-cache": "^10.0.1",
+ "npm-pick-manifest": "^9.0.0",
+ "proc-log": "^4.0.0",
+ "promise-inflight": "^1.0.1",
+ "promise-retry": "^2.0.1",
+ "semver": "^7.3.5",
+ "which": "^4.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/git/node_modules/lru-cache": {
+ "version": "10.4.3",
+ "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+ "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/installed-package-contents": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/@npmcli/installed-package-contents/-/installed-package-contents-2.1.0.tgz",
+ "integrity": "sha512-c8UuGLeZpm69BryRykLuKRyKFZYJsZSCT4aVY5ds4omyZqJ172ApzgfKJ5eV/r3HgLdUYgFVe54KSFVjKoe27w==",
+ "dependencies": {
+ "npm-bundled": "^3.0.0",
+ "npm-normalize-package-bin": "^3.0.0"
+ },
+ "bin": {
+ "installed-package-contents": "bin/index.js"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/map-workspaces": {
+ "version": "3.0.6",
+ "resolved": "https://registry.npmjs.org/@npmcli/map-workspaces/-/map-workspaces-3.0.6.tgz",
+ "integrity": "sha512-tkYs0OYnzQm6iIRdfy+LcLBjcKuQCeE5YLb8KnrIlutJfheNaPvPpgoFEyEFgbjzl5PLZ3IA/BWAwRU0eHuQDA==",
+ "dependencies": {
+ "@npmcli/name-from-folder": "^2.0.0",
+ "glob": "^10.2.2",
+ "minimatch": "^9.0.0",
+ "read-package-json-fast": "^3.0.0"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/name-from-folder": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/@npmcli/name-from-folder/-/name-from-folder-2.0.0.tgz",
+ "integrity": "sha512-pwK+BfEBZJbKdNYpHHRTNBwBoqrN/iIMO0AiGvYsp3Hoaq0WbgGSWQR6SCldZovoDpY3yje5lkFUe6gsDgJ2vg==",
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/node-gyp": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/@npmcli/node-gyp/-/node-gyp-3.0.0.tgz",
+ "integrity": "sha512-gp8pRXC2oOxu0DUE1/M3bYtb1b3/DbJ5aM113+XJBgfXdussRAsX0YOrOhdd8WvnAR6auDBvJomGAkLKA5ydxA==",
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/package-json": {
+ "version": "5.2.1",
+ "resolved": "https://registry.npmjs.org/@npmcli/package-json/-/package-json-5.2.1.tgz",
+ "integrity": "sha512-f7zYC6kQautXHvNbLEWgD/uGu1+xCn9izgqBfgItWSx22U0ZDekxN08A1vM8cTxj/cRVe0Q94Ode+tdoYmIOOQ==",
+ "dependencies": {
+ "@npmcli/git": "^5.0.0",
+ "glob": "^10.2.2",
+ "hosted-git-info": "^7.0.0",
+ "json-parse-even-better-errors": "^3.0.0",
+ "normalize-package-data": "^6.0.0",
+ "proc-log": "^4.0.0",
+ "semver": "^7.5.3"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/promise-spawn": {
+ "version": "7.0.2",
+ "resolved": "https://registry.npmjs.org/@npmcli/promise-spawn/-/promise-spawn-7.0.2.tgz",
+ "integrity": "sha512-xhfYPXoV5Dy4UkY0D+v2KkwvnDfiA/8Mt3sWCGI/hM03NsYIH8ZaG6QzS9x7pje5vHZBZJ2v6VRFVTWACnqcmQ==",
+ "dependencies": {
+ "which": "^4.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@npmcli/redact": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/@npmcli/redact/-/redact-2.0.1.tgz",
+ "integrity": "sha512-YgsR5jCQZhVmTJvjduTOIHph0L73pK8xwMVaDY0PatySqVM9AZj93jpoXYSJqfHFxFkN9dmqTw6OiqExsS3LPw==",
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@pkgjs/parseargs": {
+ "version": "0.11.0",
+ "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+ "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+ "optional": true,
+ "engines": {
+ "node": ">=14"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@pnpm/config.env-replace": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/@pnpm/config.env-replace/-/config.env-replace-1.1.0.tgz",
+ "integrity": "sha512-htyl8TWnKL7K/ESFa1oW2UB5lVDxuF5DpM7tBi6Hu2LNL3mWkIzNLG6N4zoCUP1lCKNxWy/3iu8mS8MvToGd6w==",
+ "engines": {
+ "node": ">=12.22.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@pnpm/network.ca-file": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/@pnpm/network.ca-file/-/network.ca-file-1.0.2.tgz",
+ "integrity": "sha512-YcPQ8a0jwYU9bTdJDpXjMi7Brhkr1mXsXrUJvjqM2mQDgkRiz8jFaQGOdaLxgjtUfQgZhKy/O3cG/YwmgKaxLA==",
+ "dependencies": {
+ "graceful-fs": "4.2.10"
+ },
+ "engines": {
+ "node": ">=12.22.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@pnpm/network.ca-file/node_modules/graceful-fs": {
+ "version": "4.2.10",
+ "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.10.tgz",
+ "integrity": "sha512-9ByhssR2fPVsNZj478qUUbKfmL0+t5BDVyjShtyZZLiK7ZDAArFFfopyOTj0M05wE2tJPisA4iTnnXl2YoPvOA=="
+ },
+ "node_modules/@ui5/cli/node_modules/@pnpm/npm-conf": {
+ "version": "2.3.1",
+ "resolved": "https://registry.npmjs.org/@pnpm/npm-conf/-/npm-conf-2.3.1.tgz",
+ "integrity": "sha512-c83qWb22rNRuB0UaVCI0uRPNRr8Z0FWnEIvT47jiHAmOIUHbBOg5XvV7pM5x+rKn9HRpjxquDbXYSXr3fAKFcw==",
+ "dependencies": {
+ "@pnpm/config.env-replace": "^1.1.0",
+ "@pnpm/network.ca-file": "^1.0.1",
+ "config-chain": "^1.1.11"
+ },
+ "engines": {
+ "node": ">=12"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@sigstore/bundle": {
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/@sigstore/bundle/-/bundle-2.3.2.tgz",
+ "integrity": "sha512-wueKWDk70QixNLB363yHc2D2ItTgYiMTdPwK8D9dKQMR3ZQ0c35IxP5xnwQ8cNLoCgCRcHf14kE+CLIvNX1zmA==",
+ "dependencies": {
+ "@sigstore/protobuf-specs": "^0.3.2"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@sigstore/core": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/@sigstore/core/-/core-1.1.0.tgz",
+ "integrity": "sha512-JzBqdVIyqm2FRQCulY6nbQzMpJJpSiJ8XXWMhtOX9eKgaXXpfNOF53lzQEjIydlStnd/eFtuC1dW4VYdD93oRg==",
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@sigstore/protobuf-specs": {
+ "version": "0.3.3",
+ "resolved": "https://registry.npmjs.org/@sigstore/protobuf-specs/-/protobuf-specs-0.3.3.tgz",
+ "integrity": "sha512-RpacQhBlwpBWd7KEJsRKcBQalbV28fvkxwTOJIqhIuDysMMaJW47V4OqW30iJB9uRpqOSxxEAQFdr8tTattReQ==",
+ "engines": {
+ "node": "^18.17.0 || >=20.5.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@sigstore/sign": {
+ "version": "2.3.2",
+ "resolved": "https://registry.npmjs.org/@sigstore/sign/-/sign-2.3.2.tgz",
+ "integrity": "sha512-5Vz5dPVuunIIvC5vBb0APwo7qKA4G9yM48kPWJT+OEERs40md5GoUR1yedwpekWZ4m0Hhw44m6zU+ObsON+iDA==",
+ "dependencies": {
+ "@sigstore/bundle": "^2.3.2",
+ "@sigstore/core": "^1.0.0",
+ "@sigstore/protobuf-specs": "^0.3.2",
+ "make-fetch-happen": "^13.0.1",
+ "proc-log": "^4.2.0",
+ "promise-retry": "^2.0.1"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@sigstore/tuf": {
+ "version": "2.3.4",
+ "resolved": "https://registry.npmjs.org/@sigstore/tuf/-/tuf-2.3.4.tgz",
+ "integrity": "sha512-44vtsveTPUpqhm9NCrbU8CWLe3Vck2HO1PNLw7RIajbB7xhtn5RBPm1VNSCMwqGYHhDsBJG8gDF0q4lgydsJvw==",
+ "dependencies": {
+ "@sigstore/protobuf-specs": "^0.3.2",
+ "tuf-js": "^2.2.1"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@sigstore/verify": {
+ "version": "1.2.1",
+ "resolved": "https://registry.npmjs.org/@sigstore/verify/-/verify-1.2.1.tgz",
+ "integrity": "sha512-8iKx79/F73DKbGfRf7+t4dqrc0bRr0thdPrxAtCKWRm/F0tG71i6O1rvlnScncJLLBZHn3h8M3c1BSUAb9yu8g==",
+ "dependencies": {
+ "@sigstore/bundle": "^2.3.2",
+ "@sigstore/core": "^1.1.0",
+ "@sigstore/protobuf-specs": "^0.3.2"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@sindresorhus/is": {
+ "version": "5.6.0",
+ "resolved": "https://registry.npmjs.org/@sindresorhus/is/-/is-5.6.0.tgz",
+ "integrity": "sha512-TV7t8GKYaJWsn00tFDqBw8+Uqmr8A0fRU1tvTQhyZzGv0sJCGRQL3JGMI3ucuKo3XIZdUP+Lx7/gh2t3lewy7g==",
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sindresorhus/is?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@szmarczak/http-timer": {
+ "version": "5.0.1",
+ "resolved": "https://registry.npmjs.org/@szmarczak/http-timer/-/http-timer-5.0.1.tgz",
+ "integrity": "sha512-+PmQX0PiAYPMeVYe237LJAYvOMYW1j2rH5YROyS3b4CTVJum34HfRvKvAzozHAQG0TnHNdUfY9nCeUyRAs//cw==",
+ "dependencies": {
+ "defer-to-connect": "^2.0.1"
+ },
+ "engines": {
+ "node": ">=14.16"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@tufjs/canonical-json": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/@tufjs/canonical-json/-/canonical-json-2.0.0.tgz",
+ "integrity": "sha512-yVtV8zsdo8qFHe+/3kw81dSLyF7D576A5cCFCi4X7B39tWT7SekaEFUnvnWJHz+9qO7qJTah1JbrDjWKqFtdWA==",
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@tufjs/models": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/@tufjs/models/-/models-2.0.1.tgz",
+ "integrity": "sha512-92F7/SFyufn4DXsha9+QfKnN03JGqtMFMXgSHbZOo8JG59WkTni7UzAouNQDf7AuP9OAMxVOPQcqG3sB7w+kkg==",
+ "dependencies": {
+ "@tufjs/canonical-json": "2.0.0",
+ "minimatch": "^9.0.4"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@types/http-cache-semantics": {
+ "version": "4.0.4",
+ "resolved": "https://registry.npmjs.org/@types/http-cache-semantics/-/http-cache-semantics-4.0.4.tgz",
+ "integrity": "sha512-1m0bIFVc7eJWyve9S0RnuRgcQqF/Xd5QsUZAZeQFr1Q3/p9JWoQQEqmVy+DPTNpGXwhgIetAoYF8JSc33q29QA=="
+ },
+ "node_modules/@ui5/cli/node_modules/@types/linkify-it": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/@types/linkify-it/-/linkify-it-5.0.0.tgz",
+ "integrity": "sha512-sVDA58zAw4eWAffKOaQH5/5j3XeayukzDk+ewSsnv3p4yJEZHCCzMDiZM8e0OUrRvmpGZ85jf4yDHkHsgBNr9Q=="
+ },
+ "node_modules/@ui5/cli/node_modules/@types/markdown-it": {
+ "version": "14.1.2",
+ "resolved": "https://registry.npmjs.org/@types/markdown-it/-/markdown-it-14.1.2.tgz",
+ "integrity": "sha512-promo4eFwuiW+TfGxhi+0x3czqTYJkG8qB17ZUJiVF10Xm7NLVRSLUsfRTU/6h1e24VvRnXCx+hG7li58lkzog==",
+ "dependencies": {
+ "@types/linkify-it": "^5",
+ "@types/mdurl": "^2"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@types/mdurl": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/@types/mdurl/-/mdurl-2.0.0.tgz",
+ "integrity": "sha512-RGdgjQUZba5p6QEFAVx2OGb8rQDL/cPRG7GiedRzMcJ1tYnUANBncjbSB1NRGwbvjcPeikRABz2nshyPk1bhWg=="
+ },
+ "node_modules/@ui5/cli/node_modules/@types/normalize-package-data": {
+ "version": "2.4.4",
+ "resolved": "https://registry.npmjs.org/@types/normalize-package-data/-/normalize-package-data-2.4.4.tgz",
+ "integrity": "sha512-37i+OaWTh9qeK4LSHPsyRC7NahnGotNuZvjLSgcPzblpHB3rrCJxAOgI5gCdKm7coonsaX1Of0ILiTcnZjbfxA=="
+ },
+ "node_modules/@ui5/cli/node_modules/@ui5/builder": {
+ "version": "3.7.1",
+ "resolved": "https://registry.npmjs.org/@ui5/builder/-/builder-3.7.1.tgz",
+ "integrity": "sha512-AxlnNpE5NHM9YDZx9HVlP1wMGM7UWWn/Jsx4jT5qGrPcidok3NFFbIuNuV+l5HLJw4O/BCDGoaXihlulPgKZTQ==",
+ "dependencies": {
+ "@jridgewell/sourcemap-codec": "^1.5.5",
+ "@ui5/fs": "^3.0.6",
+ "@ui5/logger": "^3.0.1",
+ "cheerio": "1.0.0-rc.12",
+ "escape-unicode": "^0.2.0",
+ "escope": "^4.0.0",
+ "espree": "^9.6.1",
+ "graceful-fs": "^4.2.11",
+ "jsdoc": "^4.0.4",
+ "less-openui5": "^0.11.6",
+ "pretty-data": "^0.40.0",
+ "rimraf": "^5.0.10",
+ "semver": "^7.7.2",
+ "terser": "^5.44.0",
+ "workerpool": "^6.5.1",
+ "xml2js": "^0.6.2"
+ },
+ "engines": {
+ "node": "^16.18.0 || >=18.12.0",
+ "npm": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@ui5/fs": {
+ "version": "3.0.6",
+ "resolved": "https://registry.npmjs.org/@ui5/fs/-/fs-3.0.6.tgz",
+ "integrity": "sha512-q1jf7k3cUP3bbYizpjzwxh8WX7AQ1e4d03Ye9S0gvT3S3YuDBfhJ9g+53lkR0fUTCnyvUuilQ9n0cjJYQo7rCg==",
+ "dependencies": {
+ "@ui5/logger": "^3.0.1",
+ "clone": "^2.1.2",
+ "escape-string-regexp": "^5.0.0",
+ "globby": "^13.2.2",
+ "graceful-fs": "^4.2.11",
+ "micromatch": "^4.0.8",
+ "minimatch": "^9.0.5",
+ "pretty-hrtime": "^1.0.3",
+ "random-int": "^3.0.0"
+ },
+ "engines": {
+ "node": "^16.18.0 || >=18.12.0",
+ "npm": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@ui5/logger": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/@ui5/logger/-/logger-3.0.1.tgz",
+ "integrity": "sha512-XiTK38qx7p6v3IagKS1khbqMwQ1qe0IfZ88VQTJ5M/1mG3vaZ97KrDuP7JEEI/XuRJVQDXuCexJJAU4+e6drqw==",
+ "dependencies": {
+ "chalk": "^5.6.0",
+ "cli-progress": "^3.12.0",
+ "figures": "^5.0.0"
+ },
+ "engines": {
+ "node": "^16.18.0 || >=18.12.0",
+ "npm": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@ui5/project": {
+ "version": "3.9.5",
+ "resolved": "https://registry.npmjs.org/@ui5/project/-/project-3.9.5.tgz",
+ "integrity": "sha512-sXdn5DScFieH0p7hTLA+UT+cvvy389JwoklsruToDRmTvd9ymjuqR0Q1SkAxNIHePkh8zrZKPzxHrzbARK0uHg==",
+ "dependencies": {
+ "@npmcli/config": "^8.3.4",
+ "@ui5/builder": "^3.7.1",
+ "@ui5/fs": "^3.0.6",
+ "@ui5/logger": "^3.0.1",
+ "ajv": "^6.12.6",
+ "ajv-errors": "^1.0.1",
+ "chalk": "^5.6.2",
+ "escape-string-regexp": "^5.0.0",
+ "globby": "^13.2.2",
+ "graceful-fs": "^4.2.11",
+ "js-yaml": "^4.1.0",
+ "lockfile": "^1.0.4",
+ "make-fetch-happen": "^13.0.1",
+ "node-stream-zip": "^1.15.0",
+ "pacote": "^18.0.6",
+ "pretty-hrtime": "^1.0.3",
+ "read-pkg": "^8.1.0",
+ "read-pkg-up": "^10.1.0",
+ "resolve": "^1.22.10",
+ "rimraf": "^5.0.10",
+ "semver": "^7.7.2",
+ "xml2js": "^0.6.2",
+ "yesno": "^0.4.0"
+ },
+ "engines": {
+ "node": "^16.18.0 || >=18.12.0",
+ "npm": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/@ui5/server": {
+ "version": "3.6.1",
+ "resolved": "https://registry.npmjs.org/@ui5/server/-/server-3.6.1.tgz",
+ "integrity": "sha512-Se4oYSY8eTv/wshiVN0Cvlh7ukJ2Ko8Bxq9Wpv35SCHPRiIVfimXMCVvcI5vaGwagnDleDG7QmUW1VdP9AVcPA==",
+ "dependencies": {
+ "@ui5/builder": "^3.7.1",
+ "@ui5/fs": "^3.0.6",
+ "@ui5/logger": "^3.0.1",
+ "body-parser": "^1.20.2",
+ "compression": "^1.8.1",
+ "cors": "^2.8.5",
+ "devcert-sanscache": "^0.4.8",
+ "escape-html": "^1.0.3",
+ "etag": "^1.8.1",
+ "express": "^4.21.2",
+ "fresh": "^0.5.2",
+ "graceful-fs": "^4.2.11",
+ "mime-types": "^2.1.35",
+ "parseurl": "^1.3.3",
+ "portscanner": "^2.2.0",
+ "replacestream": "^4.0.3",
+ "router": "^2.2.0",
+ "spdy": "^4.0.2",
+ "yesno": "^0.4.0"
+ },
+ "engines": {
+ "node": "^16.18.0 || >=18.12.0",
+ "npm": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/abbrev": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-2.0.0.tgz",
+ "integrity": "sha512-6/mh1E2u2YgEsCHdY0Yx5oW+61gZU+1vXaoiHHrpKeuRNNgFvS+/jrwHiQhB5apAf5oB7UB7E19ol2R2LKH8hQ==",
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/accepts": {
+ "version": "1.3.8",
+ "resolved": "https://registry.npmjs.org/accepts/-/accepts-1.3.8.tgz",
+ "integrity": "sha512-PYAthTa2m2VKxuvSD3DPC/Gy+U+sOA1LAuT8mkmRuvw+NACSaeXEQ+NHcVF7rONl6qcaxV3Uuemwawk+7+SJLw==",
+ "dependencies": {
+ "mime-types": "~2.1.34",
+ "negotiator": "0.6.3"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/accepts/node_modules/negotiator": {
+ "version": "0.6.3",
+ "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.3.tgz",
+ "integrity": "sha512-+EUsqGPLsM+j/zdChZjsnX51g4XrHFOIXwfnCVPGlQk/k5giakcKsuxCObBRu6DSm9opw/O6slWbJdghQM4bBg==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/acorn": {
+ "version": "8.15.0",
+ "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.15.0.tgz",
+ "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
+ "bin": {
+ "acorn": "bin/acorn"
+ },
+ "engines": {
+ "node": ">=0.4.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/acorn-jsx": {
+ "version": "5.3.2",
+ "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
+ "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
+ "peerDependencies": {
+ "acorn": "^6.0.0 || ^7.0.0 || ^8.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/agent-base": {
+ "version": "7.1.4",
+ "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+ "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+ "engines": {
+ "node": ">= 14"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ajv": {
+ "version": "6.12.6",
+ "resolved": "https://registry.npmjs.org/ajv/-/ajv-6.12.6.tgz",
+ "integrity": "sha512-j3fVLgvTo527anyYyJOGTYJbG+vnnQYvE0m5mmkc1TK+nxAppkCLMIL0aZ4dblVCNoGShhm+kzE4ZUykBoMg4g==",
+ "dependencies": {
+ "fast-deep-equal": "^3.1.1",
+ "fast-json-stable-stringify": "^2.0.0",
+ "json-schema-traverse": "^0.4.1",
+ "uri-js": "^4.2.2"
+ },
+ "funding": {
+ "type": "github",
+ "url": "https://github.com/sponsors/epoberezkin"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ajv-errors": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/ajv-errors/-/ajv-errors-1.0.1.tgz",
+ "integrity": "sha512-DCRfO/4nQ+89p/RK43i8Ezd41EqdGIU4ld7nGF8OQ14oc/we5rEntLCUa7+jrn3nn83BosfwZA0wb4pon2o8iQ==",
+ "peerDependencies": {
+ "ajv": ">=5.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ansi-align": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/ansi-align/-/ansi-align-3.0.1.tgz",
+ "integrity": "sha512-IOfwwBF5iczOjp/WeY4YxyjqAFMQoZufdQWDd19SEExbVLNXqvpzSJ/M7Za4/sCPmQ0+GRquoA7bGcINcxew6w==",
+ "dependencies": {
+ "string-width": "^4.1.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ansi-regex": {
+ "version": "6.2.2",
+ "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+ "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ansi-styles": {
+ "version": "6.2.3",
+ "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
+ "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/argparse": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+ "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q=="
+ },
+ "node_modules/@ui5/cli/node_modules/array-flatten": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/array-flatten/-/array-flatten-1.1.1.tgz",
+ "integrity": "sha512-PCVAQswWemu6UdxsDFFX/+gVeYqKAod3D3UVm91jHwynguOwAvYPhx8nNlM++NqRcK6CxxpUafjmhIdKiHibqg=="
+ },
+ "node_modules/@ui5/cli/node_modules/async": {
+ "version": "2.6.4",
+ "resolved": "https://registry.npmjs.org/async/-/async-2.6.4.tgz",
+ "integrity": "sha512-mzo5dfJYwAn29PeiJ0zvwTo04zj8HDJj0Mn8TD7sno7q12prdbnasKJHhkm2c1LgrhlJ0teaea8860oxi51mGA==",
+ "dependencies": {
+ "lodash": "^4.17.14"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/balanced-match": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+ "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
+ },
+ "node_modules/@ui5/cli/node_modules/big-integer": {
+ "version": "1.6.52",
+ "resolved": "https://registry.npmjs.org/big-integer/-/big-integer-1.6.52.tgz",
+ "integrity": "sha512-QxD8cf2eVqJOOz63z6JIN9BzvVs/dlySa5HGSBH5xtR8dPteIRQnBxxKqkNTiT6jbDTF6jAfrd4oMcND9RGbQg==",
+ "engines": {
+ "node": ">=0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/bluebird": {
+ "version": "3.7.2",
+ "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
+ "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
+ },
+ "node_modules/@ui5/cli/node_modules/body-parser": {
+ "version": "1.20.3",
+ "resolved": "https://registry.npmjs.org/body-parser/-/body-parser-1.20.3.tgz",
+ "integrity": "sha512-7rAxByjUMqQ3/bHJy7D6OGXvx/MMc4IqBn/X0fcM1QUcAItpZrBEYhWGem+tzXH90c+G01ypMcYJBO9Y30203g==",
+ "dependencies": {
+ "bytes": "3.1.2",
+ "content-type": "~1.0.5",
+ "debug": "2.6.9",
+ "depd": "2.0.0",
+ "destroy": "1.2.0",
+ "http-errors": "2.0.0",
+ "iconv-lite": "0.4.24",
+ "on-finished": "2.4.1",
+ "qs": "6.13.0",
+ "raw-body": "2.5.2",
+ "type-is": "~1.6.18",
+ "unpipe": "1.0.0"
+ },
+ "engines": {
+ "node": ">= 0.8",
+ "npm": "1.2.8000 || >= 1.4.16"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/body-parser/node_modules/debug": {
+ "version": "2.6.9",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+ "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+ "dependencies": {
+ "ms": "2.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/body-parser/node_modules/ms": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+ },
+ "node_modules/@ui5/cli/node_modules/boolbase": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/boolbase/-/boolbase-1.0.0.tgz",
+ "integrity": "sha512-JZOSA7Mo9sNGB8+UjSgzdLtokWAky1zbztM3WRLCbZ70/3cTANmQmOdR7y2g+J0e2WXywy1yS468tY+IruqEww=="
+ },
+ "node_modules/@ui5/cli/node_modules/boxen": {
+ "version": "7.1.1",
+ "resolved": "https://registry.npmjs.org/boxen/-/boxen-7.1.1.tgz",
+ "integrity": "sha512-2hCgjEmP8YLWQ130n2FerGv7rYpfBmnmp9Uy2Le1vge6X3gZIfSmEzP5QTDElFxcvVcXlEn8Aq6MU/PZygIOog==",
+ "dependencies": {
+ "ansi-align": "^3.0.1",
+ "camelcase": "^7.0.1",
+ "chalk": "^5.2.0",
+ "cli-boxes": "^3.0.0",
+ "string-width": "^5.1.2",
+ "type-fest": "^2.13.0",
+ "widest-line": "^4.0.1",
+ "wrap-ansi": "^8.1.0"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/boxen/node_modules/camelcase": {
+ "version": "7.0.1",
+ "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-7.0.1.tgz",
+ "integrity": "sha512-xlx1yCK2Oc1APsPXDL2LdlNP6+uu8OCDdhOBSVT279M/S+y75O30C2VuD8T2ogdePBBl7PfPF4504tnLgX3zfw==",
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/boxen/node_modules/emoji-regex": {
+ "version": "9.2.2",
+ "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+ "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
+ },
+ "node_modules/@ui5/cli/node_modules/boxen/node_modules/string-width": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+ "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+ "dependencies": {
+ "eastasianwidth": "^0.2.0",
+ "emoji-regex": "^9.2.2",
+ "strip-ansi": "^7.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/boxen/node_modules/type-fest": {
+ "version": "2.19.0",
+ "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-2.19.0.tgz",
+ "integrity": "sha512-RAH822pAdBgcNMAfWnCBU3CFZcfZ/i1eZjwFU/dsLKumyuuP3niueg2UAukXYF0E2AAoc82ZSSf9J0WQBinzHA==",
+ "engines": {
+ "node": ">=12.20"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/bplist-parser": {
+ "version": "0.2.0",
+ "resolved": "https://registry.npmjs.org/bplist-parser/-/bplist-parser-0.2.0.tgz",
+ "integrity": "sha512-z0M+byMThzQmD9NILRniCUXYsYpjwnlO8N5uCFaCqIOpqRsJCrQL9NK3JsD67CN5a08nF5oIL2bD6loTdHOuKw==",
+ "dependencies": {
+ "big-integer": "^1.6.44"
+ },
+ "engines": {
+ "node": ">= 5.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/brace-expansion": {
+ "version": "2.0.2",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+ "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+ "dependencies": {
+ "balanced-match": "^1.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/braces": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+ "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
+ "dependencies": {
+ "fill-range": "^7.1.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/buffer-from": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+ "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/bundle-name": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/bundle-name/-/bundle-name-3.0.0.tgz",
+ "integrity": "sha512-PKA4BeSvBpQKQ8iPOGCSiell+N8P+Tf1DlwqmYhpe2gAhKPHn8EYOxVT+ShuGmhg8lN8XiSlS80yiExKXrURlw==",
+ "dependencies": {
+ "run-applescript": "^5.0.0"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/bytes": {
+ "version": "3.1.2",
+ "resolved": "https://registry.npmjs.org/bytes/-/bytes-3.1.2.tgz",
+ "integrity": "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cacheable-lookup": {
+ "version": "7.0.0",
+ "resolved": "https://registry.npmjs.org/cacheable-lookup/-/cacheable-lookup-7.0.0.tgz",
+ "integrity": "sha512-+qJyx4xiKra8mZrcwhjMRMUhD5NR1R8esPkzIYxX96JiecFoxAXFuz/GpR3+ev4PE1WamHip78wV0vcmPQtp8w==",
+ "engines": {
+ "node": ">=14.16"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cacheable-request": {
+ "version": "10.2.14",
+ "resolved": "https://registry.npmjs.org/cacheable-request/-/cacheable-request-10.2.14.tgz",
+ "integrity": "sha512-zkDT5WAF4hSSoUgyfg5tFIxz8XQK+25W/TLVojJTMKBaxevLBBtLxgqguAuVQB8PVW79FVjHcU+GJ9tVbDZ9mQ==",
+ "dependencies": {
+ "@types/http-cache-semantics": "^4.0.2",
+ "get-stream": "^6.0.1",
+ "http-cache-semantics": "^4.1.1",
+ "keyv": "^4.5.3",
+ "mimic-response": "^4.0.0",
+ "normalize-url": "^8.0.0",
+ "responselike": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=14.16"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cacheable-request/node_modules/get-stream": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+ "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/call-bind-apply-helpers": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz",
+ "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==",
+ "dependencies": {
+ "es-errors": "^1.3.0",
+ "function-bind": "^1.1.2"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/call-bound": {
+ "version": "1.0.4",
+ "resolved": "https://registry.npmjs.org/call-bound/-/call-bound-1.0.4.tgz",
+ "integrity": "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==",
+ "dependencies": {
+ "call-bind-apply-helpers": "^1.0.2",
+ "get-intrinsic": "^1.3.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/catharsis": {
+ "version": "0.9.0",
+ "resolved": "https://registry.npmjs.org/catharsis/-/catharsis-0.9.0.tgz",
+ "integrity": "sha512-prMTQVpcns/tzFgFVkVp6ak6RykZyWb3gu8ckUpd6YkTlacOd3DXGJjIpD4Q6zJirizvaiAjSSHlOsA+6sNh2A==",
+ "dependencies": {
+ "lodash": "^4.17.15"
+ },
+ "engines": {
+ "node": ">= 10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/chalk": {
+ "version": "5.6.2",
+ "resolved": "https://registry.npmjs.org/chalk/-/chalk-5.6.2.tgz",
+ "integrity": "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA==",
+ "engines": {
+ "node": "^12.17.0 || ^14.13 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/chalk?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cheerio": {
+ "version": "1.0.0-rc.12",
+ "resolved": "https://registry.npmjs.org/cheerio/-/cheerio-1.0.0-rc.12.tgz",
+ "integrity": "sha512-VqR8m68vM46BNnuZ5NtnGBKIE/DfN0cRIzg9n40EIq9NOv90ayxLBXA8fXC5gquFRGJSTRqBq25Jt2ECLR431Q==",
+ "dependencies": {
+ "cheerio-select": "^2.1.0",
+ "dom-serializer": "^2.0.0",
+ "domhandler": "^5.0.3",
+ "domutils": "^3.0.1",
+ "htmlparser2": "^8.0.1",
+ "parse5": "^7.0.0",
+ "parse5-htmlparser2-tree-adapter": "^7.0.0"
+ },
+ "engines": {
+ "node": ">= 6"
+ },
+ "funding": {
+ "url": "https://github.com/cheeriojs/cheerio?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cheerio-select": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/cheerio-select/-/cheerio-select-2.1.0.tgz",
+ "integrity": "sha512-9v9kG0LvzrlcungtnJtpGNxY+fzECQKhK4EGJX2vByejiMX84MFNQw4UxPJl3bFbTMw+Dfs37XaIkCwTZfLh4g==",
+ "dependencies": {
+ "boolbase": "^1.0.0",
+ "css-select": "^5.1.0",
+ "css-what": "^6.1.0",
+ "domelementtype": "^2.3.0",
+ "domhandler": "^5.0.3",
+ "domutils": "^3.0.1"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/fb55"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/chownr": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/chownr/-/chownr-2.0.0.tgz",
+ "integrity": "sha512-bIomtDF5KGpdogkLd9VspvFzk9KfpyyGlS8YFVZl7TGPBHL5snIOnxeshwVgPteQ9b4Eydl+pVbIyE1DcvCWgQ==",
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ci-info": {
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-4.3.1.tgz",
+ "integrity": "sha512-Wdy2Igu8OcBpI2pZePZ5oWjPC38tmDVx5WKUXKwlLYkA0ozo85sLsLvkBbBn/sZaSCMFOGZJ14fvW9t5/d7kdA==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/sibiraj-s"
+ }
+ ],
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cli-boxes": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/cli-boxes/-/cli-boxes-3.0.0.tgz",
+ "integrity": "sha512-/lzGpEWL/8PfI0BmBOPRwp0c/wFNX1RdUML3jK/RcSBA9T8mZDdQpqYBKtCFTOfQbwPqWEOpjqW+Fnayc0969g==",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cli-progress": {
+ "version": "3.12.0",
+ "resolved": "https://registry.npmjs.org/cli-progress/-/cli-progress-3.12.0.tgz",
+ "integrity": "sha512-tRkV3HJ1ASwm19THiiLIXLO7Im7wlTuKnvkYaTkyoAPefqjNg7W7DHKUlGRxy9vxDvbyCYQkQozvptuMkGCg8A==",
+ "dependencies": {
+ "string-width": "^4.2.3"
+ },
+ "engines": {
+ "node": ">=4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cliui": {
+ "version": "8.0.1",
+ "resolved": "https://registry.npmjs.org/cliui/-/cliui-8.0.1.tgz",
+ "integrity": "sha512-BSeNnyus75C4//NQ9gQt1/csTXyo/8Sb+afLAkzAptFuMsod9HFokGNudZpi/oQV73hnVK+sR+5PVRMd+Dr7YQ==",
+ "dependencies": {
+ "string-width": "^4.2.0",
+ "strip-ansi": "^6.0.1",
+ "wrap-ansi": "^7.0.0"
+ },
+ "engines": {
+ "node": ">=12"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cliui/node_modules/ansi-regex": {
+ "version": "5.0.1",
+ "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+ "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cliui/node_modules/ansi-styles": {
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+ "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+ "dependencies": {
+ "color-convert": "^2.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cliui/node_modules/color-convert": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+ "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+ "dependencies": {
+ "color-name": "~1.1.4"
+ },
+ "engines": {
+ "node": ">=7.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cliui/node_modules/color-name": {
+ "version": "1.1.4",
+ "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+ "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
+ },
+ "node_modules/@ui5/cli/node_modules/cliui/node_modules/strip-ansi": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+ "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+ "dependencies": {
+ "ansi-regex": "^5.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cliui/node_modules/wrap-ansi": {
+ "version": "7.0.0",
+ "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+ "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+ "dependencies": {
+ "ansi-styles": "^4.0.0",
+ "string-width": "^4.1.0",
+ "strip-ansi": "^6.0.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/clone": {
+ "version": "2.1.2",
+ "resolved": "https://registry.npmjs.org/clone/-/clone-2.1.2.tgz",
+ "integrity": "sha512-3Pe/CF1Nn94hyhIYpjtiLhdCoEoz0DqQ+988E9gmeEdQZlojxnOb74wctFyuwWQHzqyf9X7C7MG8juUpqBJT8w==",
+ "engines": {
+ "node": ">=0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/command-exists": {
+ "version": "1.2.9",
+ "resolved": "https://registry.npmjs.org/command-exists/-/command-exists-1.2.9.tgz",
+ "integrity": "sha512-LTQ/SGc+s0Xc0Fu5WaKnR0YiygZkm9eKFvyS+fRsU7/ZWFF8ykFM6Pc9aCVf1+xasOOZpO3BAVgVrKvsqKHV7w=="
+ },
+ "node_modules/@ui5/cli/node_modules/commander": {
+ "version": "2.20.3",
+ "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+ "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/compressible": {
+ "version": "2.0.18",
+ "resolved": "https://registry.npmjs.org/compressible/-/compressible-2.0.18.tgz",
+ "integrity": "sha512-AF3r7P5dWxL8MxyITRMlORQNaOA2IkAFaTr4k7BUumjPtRpGDTZpl0Pb1XCO6JeDCBdp126Cgs9sMxqSjgYyRg==",
+ "dependencies": {
+ "mime-db": ">= 1.43.0 < 2"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/compression": {
+ "version": "1.8.1",
+ "resolved": "https://registry.npmjs.org/compression/-/compression-1.8.1.tgz",
+ "integrity": "sha512-9mAqGPHLakhCLeNyxPkK4xVo746zQ/czLH1Ky+vkitMnWfWZps8r0qXuwhwizagCRttsL4lfG4pIOvaWLpAP0w==",
+ "dependencies": {
+ "bytes": "3.1.2",
+ "compressible": "~2.0.18",
+ "debug": "2.6.9",
+ "negotiator": "~0.6.4",
+ "on-headers": "~1.1.0",
+ "safe-buffer": "5.2.1",
+ "vary": "~1.1.2"
+ },
+ "engines": {
+ "node": ">= 0.8.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/compression/node_modules/debug": {
+ "version": "2.6.9",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+ "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+ "dependencies": {
+ "ms": "2.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/compression/node_modules/ms": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+ },
+ "node_modules/@ui5/cli/node_modules/concat-map": {
+ "version": "0.0.1",
+ "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+ "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg=="
+ },
+ "node_modules/@ui5/cli/node_modules/config-chain": {
+ "version": "1.1.13",
+ "resolved": "https://registry.npmjs.org/config-chain/-/config-chain-1.1.13.tgz",
+ "integrity": "sha512-qj+f8APARXHrM0hraqXYb2/bOVSV4PvJQlNZ/DVj0QrmNM2q2euizkeuVckQ57J+W0mRH6Hvi+k50M4Jul2VRQ==",
+ "dependencies": {
+ "ini": "^1.3.4",
+ "proto-list": "~1.2.1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/config-chain/node_modules/ini": {
+ "version": "1.3.8",
+ "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+ "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew=="
+ },
+ "node_modules/@ui5/cli/node_modules/configstore": {
+ "version": "6.0.0",
+ "resolved": "https://registry.npmjs.org/configstore/-/configstore-6.0.0.tgz",
+ "integrity": "sha512-cD31W1v3GqUlQvbBCGcXmd2Nj9SvLDOP1oQ0YFuLETufzSPaKp11rYBsSOm7rCsW3OnIRAFM3OxRhceaXNYHkA==",
+ "dependencies": {
+ "dot-prop": "^6.0.1",
+ "graceful-fs": "^4.2.6",
+ "unique-string": "^3.0.0",
+ "write-file-atomic": "^3.0.3",
+ "xdg-basedir": "^5.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/yeoman/configstore?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/configstore/node_modules/signal-exit": {
+ "version": "3.0.7",
+ "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+ "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/configstore/node_modules/write-file-atomic": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/write-file-atomic/-/write-file-atomic-3.0.3.tgz",
+ "integrity": "sha512-AvHcyZ5JnSfq3ioSyjrBkH9yW4m7Ayk8/9My/DD9onKeu/94fwrMocemO2QAJFAlnnDN+ZDS+ZjAR5ua1/PV/Q==",
+ "dependencies": {
+ "imurmurhash": "^0.1.4",
+ "is-typedarray": "^1.0.0",
+ "signal-exit": "^3.0.2",
+ "typedarray-to-buffer": "^3.1.5"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/content-disposition": {
+ "version": "0.5.4",
+ "resolved": "https://registry.npmjs.org/content-disposition/-/content-disposition-0.5.4.tgz",
+ "integrity": "sha512-FveZTNuGw04cxlAiWbzi6zTAL/lhehaWbTtgluJh4/E95DqMwTmha3KZN1aAWA8cFIhHzMZUvLevkw5Rqk+tSQ==",
+ "dependencies": {
+ "safe-buffer": "5.2.1"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/content-type": {
+ "version": "1.0.5",
+ "resolved": "https://registry.npmjs.org/content-type/-/content-type-1.0.5.tgz",
+ "integrity": "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cookie": {
+ "version": "0.7.1",
+ "resolved": "https://registry.npmjs.org/cookie/-/cookie-0.7.1.tgz",
+ "integrity": "sha512-6DnInpx7SJ2AK3+CTUE/ZM0vWTUboZCegxhC2xiIydHR9jNuTAASBrfEpHhiGOZw/nX51bHt6YQl8jsGo4y/0w==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cookie-signature": {
+ "version": "1.0.6",
+ "resolved": "https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.6.tgz",
+ "integrity": "sha512-QADzlaHc8icV8I7vbaJXJwod9HWYp8uCqf1xa4OfNu1T7JVxQIrUgOWtHdNDtPiywmFbiS12VjotIXLrKM3orQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/core-util-is": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/core-util-is/-/core-util-is-1.0.3.tgz",
+ "integrity": "sha512-ZQBvi1DcpJ4GDqanjucZ2Hj3wEO5pZDS89BWbkcrvdxksJorwUDDZamX9ldFkp9aw2lmBDLgkObEA4DWNJ9FYQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/cors": {
+ "version": "2.8.5",
+ "resolved": "https://registry.npmjs.org/cors/-/cors-2.8.5.tgz",
+ "integrity": "sha512-KIHbLJqu73RGr/hnbrO9uBeixNGuvSQjul/jdFvS/KFSIH1hWVd1ng7zOHx+YrEfInLG7q4n6GHQ9cDtxv/P6g==",
+ "dependencies": {
+ "object-assign": "^4",
+ "vary": "^1"
+ },
+ "engines": {
+ "node": ">= 0.10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cross-spawn": {
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+ "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+ "dependencies": {
+ "path-key": "^3.1.0",
+ "shebang-command": "^2.0.0",
+ "which": "^2.0.1"
+ },
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/cross-spawn/node_modules/isexe": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+ "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="
+ },
+ "node_modules/@ui5/cli/node_modules/cross-spawn/node_modules/which": {
+ "version": "2.0.2",
+ "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+ "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+ "dependencies": {
+ "isexe": "^2.0.0"
+ },
+ "bin": {
+ "node-which": "bin/node-which"
+ },
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/crypto-random-string": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/crypto-random-string/-/crypto-random-string-4.0.0.tgz",
+ "integrity": "sha512-x8dy3RnvYdlUcPOjkEHqozhiwzKNSq7GcPuXFbnyMOCHxX8V3OgIg/pYuabl2sbUPfIJaeAQB7PMOK8DFIdoRA==",
+ "dependencies": {
+ "type-fest": "^1.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/crypto-random-string/node_modules/type-fest": {
+ "version": "1.4.0",
+ "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-1.4.0.tgz",
+ "integrity": "sha512-yGSza74xk0UG8k+pLh5oeoYirvIiWo5t0/o3zHHAO2tRDiZcxWP7fywNlXhqb6/r6sWvwi+RsyQMWhVLe4BVuA==",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/css-select": {
+ "version": "5.2.2",
+ "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.2.2.tgz",
+ "integrity": "sha512-TizTzUddG/xYLA3NXodFM0fSbNizXjOKhqiQQwvhlspadZokn1KDy0NZFS0wuEubIYAV5/c1/lAr0TaaFXEXzw==",
+ "dependencies": {
+ "boolbase": "^1.0.0",
+ "css-what": "^6.1.0",
+ "domhandler": "^5.0.2",
+ "domutils": "^3.0.1",
+ "nth-check": "^2.0.1"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/fb55"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/css-what": {
+ "version": "6.2.2",
+ "resolved": "https://registry.npmjs.org/css-what/-/css-what-6.2.2.tgz",
+ "integrity": "sha512-u/O3vwbptzhMs3L1fQE82ZSLHQQfto5gyZzwteVIEyeaY5Fc7R4dapF/BvRoSYFeqfBk4m0V1Vafq5Pjv25wvA==",
+ "engines": {
+ "node": ">= 6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/fb55"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/data-with-position": {
+ "version": "0.5.0",
+ "resolved": "https://registry.npmjs.org/data-with-position/-/data-with-position-0.5.0.tgz",
+ "integrity": "sha512-GhsgEIPWk7WCAisjwBkOjvPqpAlVUOSl1CTmy9KyhVMG1wxl29Zj5+J71WhQ/KgoJS/Psxq6Cnioz3xdBjeIWQ==",
+ "dependencies": {
+ "yaml-ast-parser": "^0.0.43"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/debug": {
+ "version": "4.4.3",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz",
+ "integrity": "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==",
+ "dependencies": {
+ "ms": "^2.1.3"
+ },
+ "engines": {
+ "node": ">=6.0"
+ },
+ "peerDependenciesMeta": {
+ "supports-color": {
+ "optional": true
+ }
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/decompress-response": {
+ "version": "6.0.0",
+ "resolved": "https://registry.npmjs.org/decompress-response/-/decompress-response-6.0.0.tgz",
+ "integrity": "sha512-aW35yZM6Bb/4oJlZncMH2LCoZtJXTRxES17vE3hoRiowU2kWHaJKFkSBDnDR+cm9J+9QhXmREyIfv0pji9ejCQ==",
+ "dependencies": {
+ "mimic-response": "^3.1.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/decompress-response/node_modules/mimic-response": {
+ "version": "3.1.0",
+ "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-3.1.0.tgz",
+ "integrity": "sha512-z0yWI+4FDrrweS8Zmt4Ej5HdJmky15+L2e6Wgn3+iK5fWzb6T3fhNFq2+MeTRb064c6Wr4N/wv0DzQTjNzHNGQ==",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/deep-extend": {
+ "version": "0.6.0",
+ "resolved": "https://registry.npmjs.org/deep-extend/-/deep-extend-0.6.0.tgz",
+ "integrity": "sha512-LOHxIOaPYdHlJRtCQfDIVZtfw/ufM8+rVj649RIHzcm/vGwQRXFt6OPqIFWsm2XEMrNIEtWR64sY1LEKD2vAOA==",
+ "engines": {
+ "node": ">=4.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/default-browser": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/default-browser/-/default-browser-4.0.0.tgz",
+ "integrity": "sha512-wX5pXO1+BrhMkSbROFsyxUm0i/cJEScyNhA4PPxc41ICuv05ZZB/MX28s8aZx6xjmatvebIapF6hLEKEcpneUA==",
+ "dependencies": {
+ "bundle-name": "^3.0.0",
+ "default-browser-id": "^3.0.0",
+ "execa": "^7.1.1",
+ "titleize": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/default-browser-id": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/default-browser-id/-/default-browser-id-3.0.0.tgz",
+ "integrity": "sha512-OZ1y3y0SqSICtE8DE4S8YOE9UZOJ8wO16fKWVP5J1Qz42kV9jcnMVFrEE/noXb/ss3Q4pZIH79kxofzyNNtUNA==",
+ "dependencies": {
+ "bplist-parser": "^0.2.0",
+ "untildify": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/default-browser/node_modules/execa": {
+ "version": "7.2.0",
+ "resolved": "https://registry.npmjs.org/execa/-/execa-7.2.0.tgz",
+ "integrity": "sha512-UduyVP7TLB5IcAQl+OzLyLcS/l32W/GLg+AhHJ+ow40FOk2U3SAllPwR44v4vmdFwIWqpdwxxpQbF1n5ta9seA==",
+ "dependencies": {
+ "cross-spawn": "^7.0.3",
+ "get-stream": "^6.0.1",
+ "human-signals": "^4.3.0",
+ "is-stream": "^3.0.0",
+ "merge-stream": "^2.0.0",
+ "npm-run-path": "^5.1.0",
+ "onetime": "^6.0.0",
+ "signal-exit": "^3.0.7",
+ "strip-final-newline": "^3.0.0"
+ },
+ "engines": {
+ "node": "^14.18.0 || ^16.14.0 || >=18.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sindresorhus/execa?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/default-browser/node_modules/get-stream": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+ "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/default-browser/node_modules/human-signals": {
+ "version": "4.3.1",
+ "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-4.3.1.tgz",
+ "integrity": "sha512-nZXjEF2nbo7lIw3mgYjItAfgQXog3OjJogSbKa2CQIIvSGWcKgeJnQlNXip6NglNzYH45nSRiEVimMvYL8DDqQ==",
+ "engines": {
+ "node": ">=14.18.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/default-browser/node_modules/signal-exit": {
+ "version": "3.0.7",
+ "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+ "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/defer-to-connect": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/defer-to-connect/-/defer-to-connect-2.0.1.tgz",
+ "integrity": "sha512-4tvttepXG1VaYGrRibk5EwJd1t4udunSOVMdLSAL6mId1ix438oPwPZMALY41FCijukO1L0twNcGsdzS7dHgDg==",
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/define-lazy-prop": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/define-lazy-prop/-/define-lazy-prop-3.0.0.tgz",
+ "integrity": "sha512-N+MeXYoqr3pOgn8xfyRPREN7gHakLYjhsHhWGT3fWAiL4IkAt0iDw14QiiEm2bE30c5XX5q0FtAA3CK5f9/BUg==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/depd": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/depd/-/depd-2.0.0.tgz",
+ "integrity": "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/destroy": {
+ "version": "1.2.0",
+ "resolved": "https://registry.npmjs.org/destroy/-/destroy-1.2.0.tgz",
+ "integrity": "sha512-2sJGJTaXIIaR1w4iJSNoN0hnMY7Gpc/n8D4qSCJw8QqFWXf7cuAgnEHxBpweaVcPevC2l3KpjYCx3NypQQgaJg==",
+ "engines": {
+ "node": ">= 0.8",
+ "npm": "1.2.8000 || >= 1.4.16"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/detect-node": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/detect-node/-/detect-node-2.1.0.tgz",
+ "integrity": "sha512-T0NIuQpnTvFDATNuHN5roPwSBG83rFsuO+MXXH9/3N1eFbn4wcPjttvjMLEPWJ0RGUYgQE7cGgS3tNxbqCGM7g=="
+ },
+ "node_modules/@ui5/cli/node_modules/devcert-sanscache": {
+ "version": "0.4.8",
+ "resolved": "https://registry.npmjs.org/devcert-sanscache/-/devcert-sanscache-0.4.8.tgz",
+ "integrity": "sha512-AcuD5yTpKdY5VnZdADR2wIZMOaEqNQnIEIxuvSzu7iAWLh/I/g3Bhm6FebUby1tfd6RGtPwN5/Gp0nNT67ZSRQ==",
+ "dependencies": {
+ "command-exists": "^1.2.2",
+ "get-port": "^3.0.0",
+ "glob": "^7.1.1",
+ "mkdirp": "^0.5.1",
+ "rimraf": "^2.6.2"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/devcert-sanscache/node_modules/brace-expansion": {
+ "version": "1.1.12",
+ "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.12.tgz",
+ "integrity": "sha512-9T9UjW3r0UW5c1Q7GTwllptXwhvYmEzFhzMfZ9H7FQWt+uZePjZPjBP/W1ZEyZ1twGWom5/56TF4lPcqjnDHcg==",
+ "dependencies": {
+ "balanced-match": "^1.0.0",
+ "concat-map": "0.0.1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/devcert-sanscache/node_modules/glob": {
+ "version": "7.2.3",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+ "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+ "deprecated": "Glob versions prior to v9 are no longer supported",
+ "dependencies": {
+ "fs.realpath": "^1.0.0",
+ "inflight": "^1.0.4",
+ "inherits": "2",
+ "minimatch": "^3.1.1",
+ "once": "^1.3.0",
+ "path-is-absolute": "^1.0.0"
+ },
+ "engines": {
+ "node": "*"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/devcert-sanscache/node_modules/minimatch": {
+ "version": "3.1.2",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+ "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+ "dependencies": {
+ "brace-expansion": "^1.1.7"
+ },
+ "engines": {
+ "node": "*"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/devcert-sanscache/node_modules/rimraf": {
+ "version": "2.7.1",
+ "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.7.1.tgz",
+ "integrity": "sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==",
+ "deprecated": "Rimraf versions prior to v4 are no longer supported",
+ "dependencies": {
+ "glob": "^7.1.3"
+ },
+ "bin": {
+ "rimraf": "bin.js"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/dir-glob": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/dir-glob/-/dir-glob-3.0.1.tgz",
+ "integrity": "sha512-WkrWp9GR4KXfKGYzOLmTuGVi1UWFfws377n9cc55/tb6DuqyF6pcQ5AbiHEshaDpY9v6oaSr2XCDidGmMwdzIA==",
+ "dependencies": {
+ "path-type": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/dom-serializer": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/dom-serializer/-/dom-serializer-2.0.0.tgz",
+ "integrity": "sha512-wIkAryiqt/nV5EQKqQpo3SToSOV9J0DnbJqwK7Wv/Trc92zIAYZ4FlMu+JPFW1DfGFt81ZTCGgDEabffXeLyJg==",
+ "dependencies": {
+ "domelementtype": "^2.3.0",
+ "domhandler": "^5.0.2",
+ "entities": "^4.2.0"
+ },
+ "funding": {
+ "url": "https://github.com/cheeriojs/dom-serializer?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/domelementtype": {
+ "version": "2.3.0",
+ "resolved": "https://registry.npmjs.org/domelementtype/-/domelementtype-2.3.0.tgz",
+ "integrity": "sha512-OLETBj6w0OsagBwdXnPdN0cnMfF9opN69co+7ZrbfPGrdpPVNBUj02spi6B1N7wChLQiPn4CSH/zJvXw56gmHw==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/fb55"
+ }
+ ]
+ },
+ "node_modules/@ui5/cli/node_modules/domhandler": {
+ "version": "5.0.3",
+ "resolved": "https://registry.npmjs.org/domhandler/-/domhandler-5.0.3.tgz",
+ "integrity": "sha512-cgwlv/1iFQiFnU96XXgROh8xTeetsnJiDsTc7TYCLFd9+/WNkIqPTxiM/8pSd8VIrhXGTf1Ny1q1hquVqDJB5w==",
+ "dependencies": {
+ "domelementtype": "^2.3.0"
+ },
+ "engines": {
+ "node": ">= 4"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/domhandler?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/domutils": {
+ "version": "3.2.2",
+ "resolved": "https://registry.npmjs.org/domutils/-/domutils-3.2.2.tgz",
+ "integrity": "sha512-6kZKyUajlDuqlHKVX1w7gyslj9MPIXzIFiz/rGu35uC1wMi+kMhQwGhl4lt9unC9Vb9INnY9Z3/ZA3+FhASLaw==",
+ "dependencies": {
+ "dom-serializer": "^2.0.0",
+ "domelementtype": "^2.3.0",
+ "domhandler": "^5.0.3"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/domutils?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/dot-prop": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/dot-prop/-/dot-prop-6.0.1.tgz",
+ "integrity": "sha512-tE7ztYzXHIeyvc7N+hR3oi7FIbf/NIjVP9hmAt3yMXzrQ072/fpjGLx2GxNxGxUl5V73MEqYzioOMoVhGMJ5cA==",
+ "dependencies": {
+ "is-obj": "^2.0.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/dunder-proto": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz",
+ "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==",
+ "dependencies": {
+ "call-bind-apply-helpers": "^1.0.1",
+ "es-errors": "^1.3.0",
+ "gopd": "^1.2.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/eastasianwidth": {
+ "version": "0.2.0",
+ "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+ "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA=="
+ },
+ "node_modules/@ui5/cli/node_modules/ee-first": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/ee-first/-/ee-first-1.1.1.tgz",
+ "integrity": "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="
+ },
+ "node_modules/@ui5/cli/node_modules/emoji-regex": {
+ "version": "8.0.0",
+ "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+ "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
+ },
+ "node_modules/@ui5/cli/node_modules/encodeurl": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-2.0.0.tgz",
+ "integrity": "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/encoding": {
+ "version": "0.1.13",
+ "resolved": "https://registry.npmjs.org/encoding/-/encoding-0.1.13.tgz",
+ "integrity": "sha512-ETBauow1T35Y/WZMkio9jiM0Z5xjHHmJ4XmjZOq1l/dXz3lr2sRn87nJy20RupqSh1F2m3HHPSp8ShIPQJrJ3A==",
+ "optional": true,
+ "dependencies": {
+ "iconv-lite": "^0.6.2"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/encoding/node_modules/iconv-lite": {
+ "version": "0.6.3",
+ "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.6.3.tgz",
+ "integrity": "sha512-4fCk79wshMdzMp2rH06qWrJE4iolqLhCUH+OiuIgU++RB0+94NlDL81atO7GX55uUKueo0txHNtvEyI6D7WdMw==",
+ "optional": true,
+ "dependencies": {
+ "safer-buffer": ">= 2.1.2 < 3.0.0"
+ },
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/entities": {
+ "version": "4.5.0",
+ "resolved": "https://registry.npmjs.org/entities/-/entities-4.5.0.tgz",
+ "integrity": "sha512-V0hjH4dGPh9Ao5p0MoRY6BVqtwCjhz6vI5LT8AJ55H+4g9/4vbHx1I54fS0XuclLhDHArPQCiMjDxjaL8fPxhw==",
+ "engines": {
+ "node": ">=0.12"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/entities?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/env-paths": {
+ "version": "2.2.1",
+ "resolved": "https://registry.npmjs.org/env-paths/-/env-paths-2.2.1.tgz",
+ "integrity": "sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/err-code": {
+ "version": "2.0.3",
+ "resolved": "https://registry.npmjs.org/err-code/-/err-code-2.0.3.tgz",
+ "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA=="
+ },
+ "node_modules/@ui5/cli/node_modules/error-ex": {
+ "version": "1.3.4",
+ "resolved": "https://registry.npmjs.org/error-ex/-/error-ex-1.3.4.tgz",
+ "integrity": "sha512-sqQamAnR14VgCr1A618A3sGrygcpK+HEbenA/HiEAkkUwcZIIB/tgWqHFxWgOyDh4nB4JCRimh79dR5Ywc9MDQ==",
+ "dependencies": {
+ "is-arrayish": "^0.2.1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/es-define-property": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz",
+ "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==",
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/es-errors": {
+ "version": "1.3.0",
+ "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz",
+ "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==",
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/es-object-atoms": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz",
+ "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==",
+ "dependencies": {
+ "es-errors": "^1.3.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/escalade": {
+ "version": "3.2.0",
+ "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.2.0.tgz",
+ "integrity": "sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/escape-goat": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/escape-goat/-/escape-goat-4.0.0.tgz",
+ "integrity": "sha512-2Sd4ShcWxbx6OY1IHyla/CVNwvg7XwZVoXZHcSu9w9SReNP1EzzD5T8NWKIR38fIqEns9kDWKUQTXXAmlDrdPg==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/escape-html": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/escape-html/-/escape-html-1.0.3.tgz",
+ "integrity": "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="
+ },
+ "node_modules/@ui5/cli/node_modules/escape-string-regexp": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-5.0.0.tgz",
+ "integrity": "sha512-/veY75JbMK4j1yjvuUxuVsiS/hr/4iHs9FTT6cgTexxdE0Ly/glccBAkloH/DofkjRbZU3bnoj38mOmhkZ0lHw==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/escape-unicode": {
+ "version": "0.2.0",
+ "resolved": "https://registry.npmjs.org/escape-unicode/-/escape-unicode-0.2.0.tgz",
+ "integrity": "sha512-7jMQuKb8nm0h/9HYLfu4NCLFwoUsd5XO6OZ1z86PbKcMf8zDK1m7nFR0iA2CCShq4TSValaLIveE8T1UBxgALQ==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/escope": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/escope/-/escope-4.0.0.tgz",
+ "integrity": "sha512-E36qlD/r6RJHVpPKArgMoMlNJzoRJFH8z/cAZlI9lbc45zB3+S7i9k6e/MNb+7bZQzNEa6r8WKN3BovpeIBwgA==",
+ "dependencies": {
+ "esrecurse": "^4.1.0",
+ "estraverse": "^4.1.1"
+ },
+ "engines": {
+ "node": ">=4.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/eslint-visitor-keys": {
+ "version": "3.4.3",
+ "resolved": "https://registry.npmjs.org/eslint-visitor-keys/-/eslint-visitor-keys-3.4.3.tgz",
+ "integrity": "sha512-wpc+LXeiyiisxPlEkUzU6svyS1frIO3Mgxj1fdy7Pm8Ygzguax2N3Fa/D/ag1WqbOprdI+uY6wMUl8/a2G+iag==",
+ "engines": {
+ "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://opencollective.com/eslint"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/espree": {
+ "version": "9.6.1",
+ "resolved": "https://registry.npmjs.org/espree/-/espree-9.6.1.tgz",
+ "integrity": "sha512-oruZaFkjorTpF32kDSI5/75ViwGeZginGGy2NoOSg3Q9bnwlnmDm4HLnkl0RE3n+njDXR037aY1+x58Z/zFdwQ==",
+ "dependencies": {
+ "acorn": "^8.9.0",
+ "acorn-jsx": "^5.3.2",
+ "eslint-visitor-keys": "^3.4.1"
+ },
+ "engines": {
+ "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://opencollective.com/eslint"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/esrecurse": {
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
+ "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+ "dependencies": {
+ "estraverse": "^5.2.0"
+ },
+ "engines": {
+ "node": ">=4.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/esrecurse/node_modules/estraverse": {
+ "version": "5.3.0",
+ "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
+ "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+ "engines": {
+ "node": ">=4.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/estraverse": {
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
+ "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+ "engines": {
+ "node": ">=4.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/etag": {
+ "version": "1.8.1",
+ "resolved": "https://registry.npmjs.org/etag/-/etag-1.8.1.tgz",
+ "integrity": "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/exponential-backoff": {
+ "version": "3.1.3",
+ "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
+ "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA=="
+ },
+ "node_modules/@ui5/cli/node_modules/express": {
+ "version": "4.21.2",
+ "resolved": "https://registry.npmjs.org/express/-/express-4.21.2.tgz",
+ "integrity": "sha512-28HqgMZAmih1Czt9ny7qr6ek2qddF4FclbMzwhCREB6OFfH+rXAnuNCwo1/wFvrtbgsQDb4kSbX9de9lFbrXnA==",
+ "dependencies": {
+ "accepts": "~1.3.8",
+ "array-flatten": "1.1.1",
+ "body-parser": "1.20.3",
+ "content-disposition": "0.5.4",
+ "content-type": "~1.0.4",
+ "cookie": "0.7.1",
+ "cookie-signature": "1.0.6",
+ "debug": "2.6.9",
+ "depd": "2.0.0",
+ "encodeurl": "~2.0.0",
+ "escape-html": "~1.0.3",
+ "etag": "~1.8.1",
+ "finalhandler": "1.3.1",
+ "fresh": "0.5.2",
+ "http-errors": "2.0.0",
+ "merge-descriptors": "1.0.3",
+ "methods": "~1.1.2",
+ "on-finished": "2.4.1",
+ "parseurl": "~1.3.3",
+ "path-to-regexp": "0.1.12",
+ "proxy-addr": "~2.0.7",
+ "qs": "6.13.0",
+ "range-parser": "~1.2.1",
+ "safe-buffer": "5.2.1",
+ "send": "0.19.0",
+ "serve-static": "1.16.2",
+ "setprototypeof": "1.2.0",
+ "statuses": "2.0.1",
+ "type-is": "~1.6.18",
+ "utils-merge": "1.0.1",
+ "vary": "~1.1.2"
+ },
+ "engines": {
+ "node": ">= 0.10.0"
+ },
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/express"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/express/node_modules/debug": {
+ "version": "2.6.9",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+ "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+ "dependencies": {
+ "ms": "2.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/express/node_modules/ms": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+ },
+ "node_modules/@ui5/cli/node_modules/fast-deep-equal": {
+ "version": "3.1.3",
+ "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-3.1.3.tgz",
+ "integrity": "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="
+ },
+ "node_modules/@ui5/cli/node_modules/fast-glob": {
+ "version": "3.3.3",
+ "resolved": "https://registry.npmjs.org/fast-glob/-/fast-glob-3.3.3.tgz",
+ "integrity": "sha512-7MptL8U0cqcFdzIzwOTHoilX9x5BrNqye7Z/LuC7kCMRio1EMSyqRK3BEAUD7sXRq4iT4AzTVuZdhgQ2TCvYLg==",
+ "dependencies": {
+ "@nodelib/fs.stat": "^2.0.2",
+ "@nodelib/fs.walk": "^1.2.3",
+ "glob-parent": "^5.1.2",
+ "merge2": "^1.3.0",
+ "micromatch": "^4.0.8"
+ },
+ "engines": {
+ "node": ">=8.6.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/fast-json-stable-stringify": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/fast-json-stable-stringify/-/fast-json-stable-stringify-2.1.0.tgz",
+ "integrity": "sha512-lhd/wF+Lk98HZoTCtlVraHtfh5XYijIjalXck7saUtuanSDyLMxnHhSXEDJqHxD7msR8D0uCmqlkwjCV8xvwHw=="
+ },
+ "node_modules/@ui5/cli/node_modules/fastq": {
+ "version": "1.19.1",
+ "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.19.1.tgz",
+ "integrity": "sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==",
+ "dependencies": {
+ "reusify": "^1.0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/figures": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/figures/-/figures-5.0.0.tgz",
+ "integrity": "sha512-ej8ksPF4x6e5wvK9yevct0UCXh8TTFlWGVLlgjZuoBH1HwjIfKE/IdL5mq89sFA7zELi1VhKpmtDnrs7zWyeyg==",
+ "dependencies": {
+ "escape-string-regexp": "^5.0.0",
+ "is-unicode-supported": "^1.2.0"
+ },
+ "engines": {
+ "node": ">=14"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/fill-range": {
+ "version": "7.1.1",
+ "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+ "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
+ "dependencies": {
+ "to-regex-range": "^5.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/finalhandler": {
+ "version": "1.3.1",
+ "resolved": "https://registry.npmjs.org/finalhandler/-/finalhandler-1.3.1.tgz",
+ "integrity": "sha512-6BN9trH7bp3qvnrRyzsBz+g3lZxTNZTbVO2EV1CS0WIcDbawYVdYvGflME/9QP0h0pYlCDBCTjYa9nZzMDpyxQ==",
+ "dependencies": {
+ "debug": "2.6.9",
+ "encodeurl": "~2.0.0",
+ "escape-html": "~1.0.3",
+ "on-finished": "2.4.1",
+ "parseurl": "~1.3.3",
+ "statuses": "2.0.1",
+ "unpipe": "~1.0.0"
+ },
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/finalhandler/node_modules/debug": {
+ "version": "2.6.9",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+ "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+ "dependencies": {
+ "ms": "2.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/finalhandler/node_modules/ms": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+ },
+ "node_modules/@ui5/cli/node_modules/find-up": {
+ "version": "4.1.0",
+ "resolved": "https://registry.npmjs.org/find-up/-/find-up-4.1.0.tgz",
+ "integrity": "sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw==",
+ "dependencies": {
+ "locate-path": "^5.0.0",
+ "path-exists": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/foreground-child": {
+ "version": "3.3.1",
+ "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+ "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+ "dependencies": {
+ "cross-spawn": "^7.0.6",
+ "signal-exit": "^4.0.1"
+ },
+ "engines": {
+ "node": ">=14"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/form-data-encoder": {
+ "version": "2.1.4",
+ "resolved": "https://registry.npmjs.org/form-data-encoder/-/form-data-encoder-2.1.4.tgz",
+ "integrity": "sha512-yDYSgNMraqvnxiEXO4hi88+YZxaHC6QKzb5N84iRCTDeRO7ZALpir/lVmf/uXUhnwUr2O4HU8s/n6x+yNjQkHw==",
+ "engines": {
+ "node": ">= 14.17"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/forwarded": {
+ "version": "0.2.0",
+ "resolved": "https://registry.npmjs.org/forwarded/-/forwarded-0.2.0.tgz",
+ "integrity": "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/fresh": {
+ "version": "0.5.2",
+ "resolved": "https://registry.npmjs.org/fresh/-/fresh-0.5.2.tgz",
+ "integrity": "sha512-zJ2mQYM18rEFOudeV4GShTGIQ7RbzA7ozbU9I/XBpm7kqgMywgmylMwXHxZJmkVoYkna9d2pVXVXPdYTP9ej8Q==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/fs-minipass": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
+ "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
+ "dependencies": {
+ "minipass": "^7.0.3"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/fs.realpath": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+ "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw=="
+ },
+ "node_modules/@ui5/cli/node_modules/function-bind": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz",
+ "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==",
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/get-caller-file": {
+ "version": "2.0.5",
+ "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+ "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+ "engines": {
+ "node": "6.* || 8.* || >= 10.*"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/get-intrinsic": {
+ "version": "1.3.0",
+ "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz",
+ "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==",
+ "dependencies": {
+ "call-bind-apply-helpers": "^1.0.2",
+ "es-define-property": "^1.0.1",
+ "es-errors": "^1.3.0",
+ "es-object-atoms": "^1.1.1",
+ "function-bind": "^1.1.2",
+ "get-proto": "^1.0.1",
+ "gopd": "^1.2.0",
+ "has-symbols": "^1.1.0",
+ "hasown": "^2.0.2",
+ "math-intrinsics": "^1.1.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/get-port": {
+ "version": "3.2.0",
+ "resolved": "https://registry.npmjs.org/get-port/-/get-port-3.2.0.tgz",
+ "integrity": "sha512-x5UJKlgeUiNT8nyo/AcnwLnZuZNcSjSw0kogRB+Whd1fjjFq4B1hySFxSFWWSn4mIBzg3sRNUDFYc4g5gjPoLg==",
+ "engines": {
+ "node": ">=4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/get-proto": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz",
+ "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==",
+ "dependencies": {
+ "dunder-proto": "^1.0.1",
+ "es-object-atoms": "^1.0.0"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/glob": {
+ "version": "10.4.5",
+ "resolved": "https://registry.npmjs.org/glob/-/glob-10.4.5.tgz",
+ "integrity": "sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==",
+ "dependencies": {
+ "foreground-child": "^3.1.0",
+ "jackspeak": "^3.1.2",
+ "minimatch": "^9.0.4",
+ "minipass": "^7.1.2",
+ "package-json-from-dist": "^1.0.0",
+ "path-scurry": "^1.11.1"
+ },
+ "bin": {
+ "glob": "dist/esm/bin.mjs"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/glob-parent": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+ "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+ "dependencies": {
+ "is-glob": "^4.0.1"
+ },
+ "engines": {
+ "node": ">= 6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/global-dirs": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/global-dirs/-/global-dirs-3.0.1.tgz",
+ "integrity": "sha512-NBcGGFbBA9s1VzD41QXDG+3++t9Mn5t1FpLdhESY6oKY4gYTFpX4wO3sqGUa0Srjtbfj3szX0RnemmrVRUdULA==",
+ "dependencies": {
+ "ini": "2.0.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/global-dirs/node_modules/ini": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/ini/-/ini-2.0.0.tgz",
+ "integrity": "sha512-7PnF4oN3CvZF23ADhA5wRaYEQpJ8qygSkbtTXWBeXWXmEVRXK+1ITciHWwHhsjv1TmW0MgacIv6hEi5pX5NQdA==",
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/globby": {
+ "version": "13.2.2",
+ "resolved": "https://registry.npmjs.org/globby/-/globby-13.2.2.tgz",
+ "integrity": "sha512-Y1zNGV+pzQdh7H39l9zgB4PJqjRNqydvdYCDG4HFXM4XuvSaQQlEc91IU1yALL8gUTDomgBAfz3XJdmUS+oo0w==",
+ "dependencies": {
+ "dir-glob": "^3.0.1",
+ "fast-glob": "^3.3.0",
+ "ignore": "^5.2.4",
+ "merge2": "^1.4.1",
+ "slash": "^4.0.0"
+ },
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/gopd": {
+ "version": "1.2.0",
+ "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz",
+ "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==",
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/got": {
+ "version": "12.6.1",
+ "resolved": "https://registry.npmjs.org/got/-/got-12.6.1.tgz",
+ "integrity": "sha512-mThBblvlAF1d4O5oqyvN+ZxLAYwIJK7bpMxgYqPD9okW0C3qm5FFn7k811QrcuEBwaogR3ngOFoCfs6mRv7teQ==",
+ "dependencies": {
+ "@sindresorhus/is": "^5.2.0",
+ "@szmarczak/http-timer": "^5.0.1",
+ "cacheable-lookup": "^7.0.0",
+ "cacheable-request": "^10.2.8",
+ "decompress-response": "^6.0.0",
+ "form-data-encoder": "^2.1.2",
+ "get-stream": "^6.0.1",
+ "http2-wrapper": "^2.1.10",
+ "lowercase-keys": "^3.0.0",
+ "p-cancelable": "^3.0.0",
+ "responselike": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sindresorhus/got?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/got/node_modules/get-stream": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+ "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/graceful-fs": {
+ "version": "4.2.11",
+ "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",
+ "integrity": "sha512-RbJ5/jmFcNNCcDV5o9eTnBLJ/HszWV0P73bc+Ff4nS/rJj+YaS6IGyiOL0VoBYX+l1Wrl3k63h/KrH+nhJ0XvQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/handle-thing": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/handle-thing/-/handle-thing-2.0.1.tgz",
+ "integrity": "sha512-9Qn4yBxelxoh2Ow62nP+Ka/kMnOXRi8BXnRaUwezLNhqelnN49xKz4F/dPP8OYLxLxq6JDtZb2i9XznUQbNPTg=="
+ },
+ "node_modules/@ui5/cli/node_modules/has-symbols": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz",
+ "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==",
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/has-yarn": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/has-yarn/-/has-yarn-3.0.0.tgz",
+ "integrity": "sha512-IrsVwUHhEULx3R8f/aA8AHuEzAorplsab/v8HBzEiIukwq5i/EC+xmOW+HfP1OaDP+2JkgT1yILHN2O3UFIbcA==",
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/hasown": {
+ "version": "2.0.2",
+ "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz",
+ "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==",
+ "dependencies": {
+ "function-bind": "^1.1.2"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/hosted-git-info": {
+ "version": "7.0.2",
+ "resolved": "https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-7.0.2.tgz",
+ "integrity": "sha512-puUZAUKT5m8Zzvs72XWy3HtvVbTWljRE66cP60bxJzAqf2DgICo7lYTY2IHUmLnNpjYvw5bvmoHvPc0QO2a62w==",
+ "dependencies": {
+ "lru-cache": "^10.0.1"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/hosted-git-info/node_modules/lru-cache": {
+ "version": "10.4.3",
+ "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+ "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/hpack.js": {
+ "version": "2.1.6",
+ "resolved": "https://registry.npmjs.org/hpack.js/-/hpack.js-2.1.6.tgz",
+ "integrity": "sha512-zJxVehUdMGIKsRaNt7apO2Gqp0BdqW5yaiGHXXmbpvxgBYVZnAql+BJb4RO5ad2MgpbZKn5G6nMnegrH1FcNYQ==",
+ "dependencies": {
+ "inherits": "^2.0.1",
+ "obuf": "^1.0.0",
+ "readable-stream": "^2.0.1",
+ "wbuf": "^1.1.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/hpack.js/node_modules/readable-stream": {
+ "version": "2.3.8",
+ "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+ "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+ "dependencies": {
+ "core-util-is": "~1.0.0",
+ "inherits": "~2.0.3",
+ "isarray": "~1.0.0",
+ "process-nextick-args": "~2.0.0",
+ "safe-buffer": "~5.1.1",
+ "string_decoder": "~1.1.1",
+ "util-deprecate": "~1.0.1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/hpack.js/node_modules/safe-buffer": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+ "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+ },
+ "node_modules/@ui5/cli/node_modules/hpack.js/node_modules/string_decoder": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+ "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+ "dependencies": {
+ "safe-buffer": "~5.1.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/htmlparser2": {
+ "version": "8.0.2",
+ "resolved": "https://registry.npmjs.org/htmlparser2/-/htmlparser2-8.0.2.tgz",
+ "integrity": "sha512-GYdjWKDkbRLkZ5geuHs5NY1puJ+PXwP7+fHPRz06Eirsb9ugf6d8kkXav6ADhcODhFFPMIXyxkxSuMf3D6NCFA==",
+ "funding": [
+ "https://github.com/fb55/htmlparser2?sponsor=1",
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/fb55"
+ }
+ ],
+ "dependencies": {
+ "domelementtype": "^2.3.0",
+ "domhandler": "^5.0.3",
+ "domutils": "^3.0.1",
+ "entities": "^4.4.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/http-cache-semantics": {
+ "version": "4.2.0",
+ "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
+ "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/http-deceiver": {
+ "version": "1.2.7",
+ "resolved": "https://registry.npmjs.org/http-deceiver/-/http-deceiver-1.2.7.tgz",
+ "integrity": "sha512-LmpOGxTfbpgtGVxJrj5k7asXHCgNZp5nLfp+hWc8QQRqtb7fUy6kRY3BO1h9ddF6yIPYUARgxGOwB42DnxIaNw=="
+ },
+ "node_modules/@ui5/cli/node_modules/http-errors": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/http-errors/-/http-errors-2.0.0.tgz",
+ "integrity": "sha512-FtwrG/euBzaEjYeRqOgly7G0qviiXoJWnvEH2Z1plBdXgbyjv34pHTSb9zoeHMyDy33+DWy5Wt9Wo+TURtOYSQ==",
+ "dependencies": {
+ "depd": "2.0.0",
+ "inherits": "2.0.4",
+ "setprototypeof": "1.2.0",
+ "statuses": "2.0.1",
+ "toidentifier": "1.0.1"
+ },
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/http-proxy-agent": {
+ "version": "7.0.2",
+ "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+ "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+ "dependencies": {
+ "agent-base": "^7.1.0",
+ "debug": "^4.3.4"
+ },
+ "engines": {
+ "node": ">= 14"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/http2-wrapper": {
+ "version": "2.2.1",
+ "resolved": "https://registry.npmjs.org/http2-wrapper/-/http2-wrapper-2.2.1.tgz",
+ "integrity": "sha512-V5nVw1PAOgfI3Lmeaj2Exmeg7fenjhRUgz1lPSezy1CuhPYbgQtbQj4jZfEAEMlaL+vupsvhjqCyjzob0yxsmQ==",
+ "dependencies": {
+ "quick-lru": "^5.1.1",
+ "resolve-alpn": "^1.2.0"
+ },
+ "engines": {
+ "node": ">=10.19.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/http2-wrapper/node_modules/quick-lru": {
+ "version": "5.1.1",
+ "resolved": "https://registry.npmjs.org/quick-lru/-/quick-lru-5.1.1.tgz",
+ "integrity": "sha512-WuyALRjWPDGtt/wzJiadO5AXY+8hZ80hVpe6MyivgraREW751X3SbhRvG3eLKOYN+8VEvqLcf3wdnt44Z4S4SA==",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/https-proxy-agent": {
+ "version": "7.0.6",
+ "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+ "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+ "dependencies": {
+ "agent-base": "^7.1.2",
+ "debug": "4"
+ },
+ "engines": {
+ "node": ">= 14"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/iconv-lite": {
+ "version": "0.4.24",
+ "resolved": "https://registry.npmjs.org/iconv-lite/-/iconv-lite-0.4.24.tgz",
+ "integrity": "sha512-v3MXnZAcvnywkTUEZomIActle7RXXeedOR31wwl7VlyoXO4Qi9arvSenNQWne1TcRwhCL1HwLI21bEqdpj8/rA==",
+ "dependencies": {
+ "safer-buffer": ">= 2.1.2 < 3"
+ },
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ignore": {
+ "version": "5.3.2",
+ "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
+ "integrity": "sha512-hsBTNUqQTDwkWtcdYI2i06Y/nUBEsNEDJKjWdigLvegy8kDuJAS8uRlpkkcQpyEXL0Z/pjDy5HBmMjRCJ2gq+g==",
+ "engines": {
+ "node": ">= 4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ignore-walk": {
+ "version": "6.0.5",
+ "resolved": "https://registry.npmjs.org/ignore-walk/-/ignore-walk-6.0.5.tgz",
+ "integrity": "sha512-VuuG0wCnjhnylG1ABXT3dAuIpTNDs/G8jlpmwXY03fXoXy/8ZK8/T+hMzt8L4WnrLCJgdybqgPagnF/f97cg3A==",
+ "dependencies": {
+ "minimatch": "^9.0.0"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/import-lazy": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/import-lazy/-/import-lazy-4.0.0.tgz",
+ "integrity": "sha512-rKtvo6a868b5Hu3heneU+L4yEQ4jYKLtjpnPeUdK7h0yzXGmyBTypknlkCvHFBqfX9YlorEiMM6Dnq/5atfHkw==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/import-local": {
+ "version": "3.2.0",
+ "resolved": "https://registry.npmjs.org/import-local/-/import-local-3.2.0.tgz",
+ "integrity": "sha512-2SPlun1JUPWoM6t3F0dw0FkCF/jWY8kttcY4f599GLTSjh2OCuuhdTkJQsEcZzBqbXZGKMK2OqW1oZsjtf/gQA==",
+ "dependencies": {
+ "pkg-dir": "^4.2.0",
+ "resolve-cwd": "^3.0.0"
+ },
+ "bin": {
+ "import-local-fixture": "fixtures/cli.js"
+ },
+ "engines": {
+ "node": ">=8"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/import-local/node_modules/pkg-dir": {
+ "version": "4.2.0",
+ "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz",
+ "integrity": "sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==",
+ "dependencies": {
+ "find-up": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/imurmurhash": {
+ "version": "0.1.4",
+ "resolved": "https://registry.npmjs.org/imurmurhash/-/imurmurhash-0.1.4.tgz",
+ "integrity": "sha512-JmXMZ6wuvDmLiHEml9ykzqO6lwFbof0GG4IkcGaENdCRDDmMVnny7s5HsIgHCbaq0w2MyPhDqkhTUgS2LU2PHA==",
+ "engines": {
+ "node": ">=0.8.19"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/inflight": {
+ "version": "1.0.6",
+ "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+ "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+ "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+ "dependencies": {
+ "once": "^1.3.0",
+ "wrappy": "1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/inherits": {
+ "version": "2.0.4",
+ "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+ "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/ini": {
+ "version": "4.1.3",
+ "resolved": "https://registry.npmjs.org/ini/-/ini-4.1.3.tgz",
+ "integrity": "sha512-X7rqawQBvfdjS10YU1y1YVreA3SsLrW9dX2CewP2EbBJM4ypVNLDkO5y04gejPwKIY9lR+7r9gn3rFPt/kmWFg==",
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ip-address": {
+ "version": "10.1.0",
+ "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.1.0.tgz",
+ "integrity": "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q==",
+ "engines": {
+ "node": ">= 12"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ipaddr.js": {
+ "version": "1.9.1",
+ "resolved": "https://registry.npmjs.org/ipaddr.js/-/ipaddr.js-1.9.1.tgz",
+ "integrity": "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g==",
+ "engines": {
+ "node": ">= 0.10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-arrayish": {
+ "version": "0.2.1",
+ "resolved": "https://registry.npmjs.org/is-arrayish/-/is-arrayish-0.2.1.tgz",
+ "integrity": "sha512-zz06S8t0ozoDXMG+ube26zeCTNXcKIPJZJi8hBrF4idCLms4CG9QtK7qBl1boi5ODzFpjswb5JPmHCbMpjaYzg=="
+ },
+ "node_modules/@ui5/cli/node_modules/is-ci": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/is-ci/-/is-ci-3.0.1.tgz",
+ "integrity": "sha512-ZYvCgrefwqoQ6yTyYUbQu64HsITZ3NfKX1lzaEYdkTDcfKzzCI/wthRRYKkdjHKFVgNiXKAKm65Zo1pk2as/QQ==",
+ "dependencies": {
+ "ci-info": "^3.2.0"
+ },
+ "bin": {
+ "is-ci": "bin.js"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-ci/node_modules/ci-info": {
+ "version": "3.9.0",
+ "resolved": "https://registry.npmjs.org/ci-info/-/ci-info-3.9.0.tgz",
+ "integrity": "sha512-NIxF55hv4nSqQswkAeiOi1r83xy8JldOFDTWiug55KBu9Jnblncd2U6ViHmYgHf01TPZS77NJBhBMKdWj9HQMQ==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/sibiraj-s"
+ }
+ ],
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-core-module": {
+ "version": "2.16.1",
+ "resolved": "https://registry.npmjs.org/is-core-module/-/is-core-module-2.16.1.tgz",
+ "integrity": "sha512-UfoeMA6fIJ8wTYFEUjelnaGI67v6+N7qXJEvQuIGa99l4xsCruSYOVSQ0uPANn4dAzm8lkYPaKLrrijLq7x23w==",
+ "dependencies": {
+ "hasown": "^2.0.2"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-docker": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-3.0.0.tgz",
+ "integrity": "sha512-eljcgEDlEns/7AXFosB5K/2nCM4P7FQPkGc/DWLy5rmFEWvZayGrik1d9/QIY5nJ4f9YsVvBkA6kJpHn9rISdQ==",
+ "bin": {
+ "is-docker": "cli.js"
+ },
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-extglob": {
+ "version": "2.1.1",
+ "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+ "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-glob": {
+ "version": "4.0.3",
+ "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+ "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+ "dependencies": {
+ "is-extglob": "^2.1.1"
+ },
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-inside-container": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/is-inside-container/-/is-inside-container-1.0.0.tgz",
+ "integrity": "sha512-KIYLCCJghfHZxqjYBE7rEy0OBuTd5xCHS7tHVgvCLkx7StIoaxwNW3hCALgEUjFfeRk+MG/Qxmp/vtETEF3tRA==",
+ "dependencies": {
+ "is-docker": "^3.0.0"
+ },
+ "bin": {
+ "is-inside-container": "cli.js"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-installed-globally": {
+ "version": "0.4.0",
+ "resolved": "https://registry.npmjs.org/is-installed-globally/-/is-installed-globally-0.4.0.tgz",
+ "integrity": "sha512-iwGqO3J21aaSkC7jWnHP/difazwS7SFeIqxv6wEtLU8Y5KlzFTjyqcSIT0d8s4+dDhKytsk9PJZ2BkS5eZwQRQ==",
+ "dependencies": {
+ "global-dirs": "^3.0.0",
+ "is-path-inside": "^3.0.2"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-lambda": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/is-lambda/-/is-lambda-1.0.1.tgz",
+ "integrity": "sha512-z7CMFGNrENq5iFB9Bqo64Xk6Y9sg+epq1myIcdHaGnbMTYOxvzsEtdYqQUylB7LxfkvgrrjP32T6Ywciio9UIQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/is-npm": {
+ "version": "6.1.0",
+ "resolved": "https://registry.npmjs.org/is-npm/-/is-npm-6.1.0.tgz",
+ "integrity": "sha512-O2z4/kNgyjhQwVR1Wpkbfc19JIhggF97NZNCpWTnjH7kVcZMUrnut9XSN7txI7VdyIYk5ZatOq3zvSuWpU8hoA==",
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-number": {
+ "version": "7.0.0",
+ "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+ "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+ "engines": {
+ "node": ">=0.12.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-number-like": {
+ "version": "1.0.8",
+ "resolved": "https://registry.npmjs.org/is-number-like/-/is-number-like-1.0.8.tgz",
+ "integrity": "sha512-6rZi3ezCyFcn5L71ywzz2bS5b2Igl1En3eTlZlvKjpz1n3IZLAYMbKYAIQgFmEu0GENg92ziU/faEOA/aixjbA==",
+ "dependencies": {
+ "lodash.isfinite": "^3.3.2"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-obj": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/is-obj/-/is-obj-2.0.0.tgz",
+ "integrity": "sha512-drqDG3cbczxxEJRoOXcOjtdp1J/lyp1mNn0xaznRs8+muBhgQcrnbspox5X5fOw0HnMnbfDzvnEMEtqDEJEo8w==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-path-inside": {
+ "version": "3.0.3",
+ "resolved": "https://registry.npmjs.org/is-path-inside/-/is-path-inside-3.0.3.tgz",
+ "integrity": "sha512-Fd4gABb+ycGAmKou8eMftCupSir5lRxqf4aD/vd0cD2qc4HL07OjCeuHMr8Ro4CoMaeCKDB0/ECBOVWjTwUvPQ==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-promise": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/is-promise/-/is-promise-4.0.0.tgz",
+ "integrity": "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/is-stream": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-3.0.0.tgz",
+ "integrity": "sha512-LnQR4bZ9IADDRSkvpqMGvt/tEJWclzklNgSw48V5EAaAeDd6qGvN8ei6k5p0tvxSR171VmGyHuTiAOfxAbr8kA==",
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-typedarray": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/is-typedarray/-/is-typedarray-1.0.0.tgz",
+ "integrity": "sha512-cyA56iCMHAh5CdzjJIa4aohJyeO1YbwLi3Jc35MmRU6poroFjIGZzUzupGiRPOjgHg9TLu43xbpwXk523fMxKA=="
+ },
+ "node_modules/@ui5/cli/node_modules/is-unicode-supported": {
+ "version": "1.3.0",
+ "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-1.3.0.tgz",
+ "integrity": "sha512-43r2mRvz+8JRIKnWJ+3j8JtjRKZ6GmjzfaE/qiBJnikNnYv/6bagRJ1kUhNk8R5EX/GkobD+r+sfxCPJsiKBLQ==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-wsl": {
+ "version": "2.2.0",
+ "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-2.2.0.tgz",
+ "integrity": "sha512-fKzAra0rGJUUBwGBgNkHZuToZcn+TtXHpeCgmkMJMMYx1sQDYaCSyjJBSCa2nH1DGm7s3n1oBnohoVTBaN7Lww==",
+ "dependencies": {
+ "is-docker": "^2.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-wsl/node_modules/is-docker": {
+ "version": "2.2.1",
+ "resolved": "https://registry.npmjs.org/is-docker/-/is-docker-2.2.1.tgz",
+ "integrity": "sha512-F+i2BKsFrH66iaUFc0woD8sLy8getkwTwtOBjvs56Cx4CgJDeKQeqfz8wAYiSb8JOprWhHH5p77PbmYCvvUuXQ==",
+ "bin": {
+ "is-docker": "cli.js"
+ },
+ "engines": {
+ "node": ">=8"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/is-yarn-global": {
+ "version": "0.4.1",
+ "resolved": "https://registry.npmjs.org/is-yarn-global/-/is-yarn-global-0.4.1.tgz",
+ "integrity": "sha512-/kppl+R+LO5VmhYSEWARUFjodS25D68gvj8W7z0I7OWhUla5xWu8KL6CtB2V0R6yqhnRgbcaREMr4EEM6htLPQ==",
+ "engines": {
+ "node": ">=12"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/isarray": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
+ "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/isexe": {
+ "version": "3.1.1",
+ "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.1.tgz",
+ "integrity": "sha512-LpB/54B+/2J5hqQ7imZHfdU31OlgQqx7ZicVlkm9kzg9/w8GKLEcFfJl/t7DCEDueOyBAD6zCCwTO6Fzs0NoEQ==",
+ "engines": {
+ "node": ">=16"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/jackspeak": {
+ "version": "3.4.3",
+ "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
+ "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+ "dependencies": {
+ "@isaacs/cliui": "^8.0.2"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ },
+ "optionalDependencies": {
+ "@pkgjs/parseargs": "^0.11.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/js-tokens": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+ "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/js-yaml": {
+ "version": "4.1.1",
+ "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
+ "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+ "dependencies": {
+ "argparse": "^2.0.1"
+ },
+ "bin": {
+ "js-yaml": "bin/js-yaml.js"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/js2xmlparser": {
+ "version": "4.0.2",
+ "resolved": "https://registry.npmjs.org/js2xmlparser/-/js2xmlparser-4.0.2.tgz",
+ "integrity": "sha512-6n4D8gLlLf1n5mNLQPRfViYzu9RATblzPEtm1SthMX1Pjao0r9YI9nw7ZIfRxQMERS87mcswrg+r/OYrPRX6jA==",
+ "dependencies": {
+ "xmlcreate": "^2.0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/jsdoc": {
+ "version": "4.0.5",
+ "resolved": "https://registry.npmjs.org/jsdoc/-/jsdoc-4.0.5.tgz",
+ "integrity": "sha512-P4C6MWP9yIlMiK8nwoZvxN84vb6MsnXcHuy7XzVOvQoCizWX5JFCBsWIIWKXBltpoRZXddUOVQmCTOZt9yDj9g==",
+ "dependencies": {
+ "@babel/parser": "^7.20.15",
+ "@jsdoc/salty": "^0.2.1",
+ "@types/markdown-it": "^14.1.1",
+ "bluebird": "^3.7.2",
+ "catharsis": "^0.9.0",
+ "escape-string-regexp": "^2.0.0",
+ "js2xmlparser": "^4.0.2",
+ "klaw": "^3.0.0",
+ "markdown-it": "^14.1.0",
+ "markdown-it-anchor": "^8.6.7",
+ "marked": "^4.0.10",
+ "mkdirp": "^1.0.4",
+ "requizzle": "^0.2.3",
+ "strip-json-comments": "^3.1.0",
+ "underscore": "~1.13.2"
+ },
+ "bin": {
+ "jsdoc": "jsdoc.js"
+ },
+ "engines": {
+ "node": ">=12.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/jsdoc/node_modules/escape-string-regexp": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-2.0.0.tgz",
+ "integrity": "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/jsdoc/node_modules/mkdirp": {
+ "version": "1.0.4",
+ "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
+ "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+ "bin": {
+ "mkdirp": "bin/cmd.js"
+ },
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/json-buffer": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
+ "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/json-parse-even-better-errors": {
+ "version": "3.0.2",
+ "resolved": "https://registry.npmjs.org/json-parse-even-better-errors/-/json-parse-even-better-errors-3.0.2.tgz",
+ "integrity": "sha512-fi0NG4bPjCHunUJffmLd0gxssIgkNmArMvis4iNah6Owg1MCJjWhEcDLmsK6iGkJq3tHwbDkTlce70/tmXN4cQ==",
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/json-schema-traverse": {
+ "version": "0.4.1",
+ "resolved": "https://registry.npmjs.org/json-schema-traverse/-/json-schema-traverse-0.4.1.tgz",
+ "integrity": "sha512-xbbCH5dCYU5T8LcEhhuh7HJ88HXuW3qsI3Y0zOZFKfZEHcpWiHU/Jxzk629Brsab/mMiHQti9wMP+845RPe3Vg=="
+ },
+ "node_modules/@ui5/cli/node_modules/jsonparse": {
+ "version": "1.3.1",
+ "resolved": "https://registry.npmjs.org/jsonparse/-/jsonparse-1.3.1.tgz",
+ "integrity": "sha512-POQXvpdL69+CluYsillJ7SUhKvytYjW9vG/GKpnf+xP8UWgYEM/RaMzHHofbALDiKbbP1W8UEYmgGl39WkPZsg==",
+ "engines": [
+ "node >= 0.2.0"
+ ]
+ },
+ "node_modules/@ui5/cli/node_modules/keyv": {
+ "version": "4.5.4",
+ "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
+ "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+ "dependencies": {
+ "json-buffer": "3.0.1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/klaw": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/klaw/-/klaw-3.0.0.tgz",
+ "integrity": "sha512-0Fo5oir+O9jnXu5EefYbVK+mHMBeEVEy2cmctR1O1NECcCkPRreJKrS6Qt/j3KC2C148Dfo9i3pCmCMsdqGr0g==",
+ "dependencies": {
+ "graceful-fs": "^4.1.9"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/latest-version": {
+ "version": "7.0.0",
+ "resolved": "https://registry.npmjs.org/latest-version/-/latest-version-7.0.0.tgz",
+ "integrity": "sha512-KvNT4XqAMzdcL6ka6Tl3i2lYeFDgXNCuIX+xNx6ZMVR1dFq+idXd9FLKNMOIx0t9mJ9/HudyX4oZWXZQ0UJHeg==",
+ "dependencies": {
+ "package-json": "^8.1.0"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/less-openui5": {
+ "version": "0.11.6",
+ "resolved": "https://registry.npmjs.org/less-openui5/-/less-openui5-0.11.6.tgz",
+ "integrity": "sha512-sQmU+G2pJjFfzRI+XtXkk+T9G0s6UmWWUfOW0utPR46C9lfhNr4DH1lNJuImj64reXYi+vOwyNxPRkj0F3mofA==",
+ "dependencies": {
+ "@adobe/css-tools": "^4.0.2",
+ "clone": "^2.1.2",
+ "mime": "^1.6.0"
+ },
+ "engines": {
+ "node": ">= 10",
+ "npm": ">= 5"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/linkify-it": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.0.tgz",
+ "integrity": "sha512-5aHCbzQRADcdP+ATqnDuhhJ/MRIqDkZX5pyjFHRRysS8vZ5AbqGEoFIb6pYHPZ+L/OC2Lc+xT8uHVVR5CAK/wQ==",
+ "dependencies": {
+ "uc.micro": "^2.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/locate-path": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-5.0.0.tgz",
+ "integrity": "sha512-t7hw9pI+WvuwNJXwk5zVHpyhIqzg2qTlklJOf0mVxGSbe3Fp2VieZcduNYjaLDoy6p9uGpQEGWG87WpMKlNq8g==",
+ "dependencies": {
+ "p-locate": "^4.1.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/lockfile": {
+ "version": "1.0.4",
+ "resolved": "https://registry.npmjs.org/lockfile/-/lockfile-1.0.4.tgz",
+ "integrity": "sha512-cvbTwETRfsFh4nHsL1eGWapU1XFi5Ot9E85sWAwia7Y7EgB7vfqcZhTKZ+l7hCGxSPoushMv5GKhT5PdLv03WA==",
+ "dependencies": {
+ "signal-exit": "^3.0.2"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/lockfile/node_modules/signal-exit": {
+ "version": "3.0.7",
+ "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+ "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/lodash": {
+ "version": "4.17.21",
+ "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
+ "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
+ },
+ "node_modules/@ui5/cli/node_modules/lodash.isfinite": {
+ "version": "3.3.2",
+ "resolved": "https://registry.npmjs.org/lodash.isfinite/-/lodash.isfinite-3.3.2.tgz",
+ "integrity": "sha512-7FGG40uhC8Mm633uKW1r58aElFlBlxCrg9JfSi3P6aYiWmfiWF0PgMd86ZUsxE5GwWPdHoS2+48bwTh2VPkIQA=="
+ },
+ "node_modules/@ui5/cli/node_modules/lowercase-keys": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/lowercase-keys/-/lowercase-keys-3.0.0.tgz",
+ "integrity": "sha512-ozCC6gdQ+glXOQsveKD0YsDy8DSQFjDTz4zyzEHNV5+JP5D62LmfDZ6o1cycFx9ouG940M5dE8C8CTewdj2YWQ==",
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/make-fetch-happen": {
+ "version": "13.0.1",
+ "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-13.0.1.tgz",
+ "integrity": "sha512-cKTUFc/rbKUd/9meOvgrpJ2WrNzymt6jfRDdwg5UCnVzv9dTpEj9JS5m3wtziXVCjluIXyL8pcaukYqezIzZQA==",
+ "dependencies": {
+ "@npmcli/agent": "^2.0.0",
+ "cacache": "^18.0.0",
+ "http-cache-semantics": "^4.1.1",
+ "is-lambda": "^1.0.1",
+ "minipass": "^7.0.2",
+ "minipass-fetch": "^3.0.0",
+ "minipass-flush": "^1.0.5",
+ "minipass-pipeline": "^1.2.4",
+ "negotiator": "^0.6.3",
+ "proc-log": "^4.2.0",
+ "promise-retry": "^2.0.1",
+ "ssri": "^10.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/make-fetch-happen/node_modules/aggregate-error": {
+ "version": "3.1.0",
+ "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz",
+ "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
+ "dependencies": {
+ "clean-stack": "^2.0.0",
+ "indent-string": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/make-fetch-happen/node_modules/cacache": {
+ "version": "18.0.4",
+ "resolved": "https://registry.npmjs.org/cacache/-/cacache-18.0.4.tgz",
+ "integrity": "sha512-B+L5iIa9mgcjLbliir2th36yEwPftrzteHYujzsx3dFP/31GCHcIeS8f5MGd80odLOjaOvSpU3EEAmRQptkxLQ==",
+ "dependencies": {
+ "@npmcli/fs": "^3.1.0",
+ "fs-minipass": "^3.0.0",
+ "glob": "^10.2.2",
+ "lru-cache": "^10.0.1",
+ "minipass": "^7.0.3",
+ "minipass-collect": "^2.0.1",
+ "minipass-flush": "^1.0.5",
+ "minipass-pipeline": "^1.2.4",
+ "p-map": "^4.0.0",
+ "ssri": "^10.0.0",
+ "tar": "^6.1.11",
+ "unique-filename": "^3.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/make-fetch-happen/node_modules/clean-stack": {
+ "version": "2.2.0",
+ "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
+ "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/make-fetch-happen/node_modules/indent-string": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
+ "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/make-fetch-happen/node_modules/lru-cache": {
+ "version": "10.4.3",
+ "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+ "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/make-fetch-happen/node_modules/minipass-collect": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
+ "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
+ "dependencies": {
+ "minipass": "^7.0.3"
+ },
+ "engines": {
+ "node": ">=16 || 14 >=14.17"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/make-fetch-happen/node_modules/p-map": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/p-map/-/p-map-4.0.0.tgz",
+ "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==",
+ "dependencies": {
+ "aggregate-error": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/markdown-it": {
+ "version": "14.1.0",
+ "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.1.0.tgz",
+ "integrity": "sha512-a54IwgWPaeBCAAsv13YgmALOF1elABB08FxO9i+r4VFk5Vl4pKokRPeX8u5TCgSsPi6ec1otfLjdOpVcgbpshg==",
+ "dependencies": {
+ "argparse": "^2.0.1",
+ "entities": "^4.4.0",
+ "linkify-it": "^5.0.0",
+ "mdurl": "^2.0.0",
+ "punycode.js": "^2.3.1",
+ "uc.micro": "^2.1.0"
+ },
+ "bin": {
+ "markdown-it": "bin/markdown-it.mjs"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/markdown-it-anchor": {
+ "version": "8.6.7",
+ "resolved": "https://registry.npmjs.org/markdown-it-anchor/-/markdown-it-anchor-8.6.7.tgz",
+ "integrity": "sha512-FlCHFwNnutLgVTflOYHPW2pPcl2AACqVzExlkGQNsi4CJgqOHN7YTgDd4LuhgN1BFO3TS0vLAruV1Td6dwWPJA==",
+ "peerDependencies": {
+ "@types/markdown-it": "*",
+ "markdown-it": "*"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/marked": {
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/marked/-/marked-4.3.0.tgz",
+ "integrity": "sha512-PRsaiG84bK+AMvxziE/lCFss8juXjNaWzVbN5tXAm4XjeaS9NAHhop+PjQxz2A9h8Q4M/xGmzP8vqNwy6JeK0A==",
+ "bin": {
+ "marked": "bin/marked.js"
+ },
+ "engines": {
+ "node": ">= 12"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/math-intrinsics": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
+ "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==",
+ "engines": {
+ "node": ">= 0.4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/mdurl": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-2.0.0.tgz",
+ "integrity": "sha512-Lf+9+2r+Tdp5wXDXC4PcIBjTDtq4UKjCPMQhKIuzpJNW0b96kVqSwW0bT7FhRSfmAiFYgP+SCRvdrDozfh0U5w=="
+ },
+ "node_modules/@ui5/cli/node_modules/media-typer": {
+ "version": "0.3.0",
+ "resolved": "https://registry.npmjs.org/media-typer/-/media-typer-0.3.0.tgz",
+ "integrity": "sha512-dq+qelQ9akHpcOl/gUVRTxVIOkAJ1wR3QAvb4RsVjS8oVoFjDGTc679wJYmUmknUF5HwMLOgb5O+a3KxfWapPQ==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/merge-descriptors": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/merge-descriptors/-/merge-descriptors-1.0.3.tgz",
+ "integrity": "sha512-gaNvAS7TZ897/rVaZ0nMtAyxNyi/pdbjbAwUpFQpN70GqnVfOiXpeUUMKRBmzXaSQ8DdTX4/0ms62r2K+hE6mQ==",
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/merge-stream": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/merge-stream/-/merge-stream-2.0.0.tgz",
+ "integrity": "sha512-abv/qOcuPfk3URPfDzmZU1LKmuw8kT+0nIHvKrKgFrwifol/doWcdA4ZqsWQ8ENrFKkd67Mfpo/LovbIUsbt3w=="
+ },
+ "node_modules/@ui5/cli/node_modules/merge2": {
+ "version": "1.4.1",
+ "resolved": "https://registry.npmjs.org/merge2/-/merge2-1.4.1.tgz",
+ "integrity": "sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==",
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/methods": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/methods/-/methods-1.1.2.tgz",
+ "integrity": "sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/micromatch": {
+ "version": "4.0.8",
+ "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+ "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
+ "dependencies": {
+ "braces": "^3.0.3",
+ "picomatch": "^2.3.1"
+ },
+ "engines": {
+ "node": ">=8.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/mime": {
+ "version": "1.6.0",
+ "resolved": "https://registry.npmjs.org/mime/-/mime-1.6.0.tgz",
+ "integrity": "sha512-x0Vn8spI+wuJ1O6S7gnbaQg8Pxh4NNHb7KSINmEWKiPE4RKOplvijn+NkmYmmRgP68mc70j2EbeTFRsrswaQeg==",
+ "bin": {
+ "mime": "cli.js"
+ },
+ "engines": {
+ "node": ">=4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/mime-db": {
+ "version": "1.54.0",
+ "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.54.0.tgz",
+ "integrity": "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/mime-types": {
+ "version": "2.1.35",
+ "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+ "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+ "dependencies": {
+ "mime-db": "1.52.0"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/mime-types/node_modules/mime-db": {
+ "version": "1.52.0",
+ "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+ "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/mimic-fn": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-4.0.0.tgz",
+ "integrity": "sha512-vqiC06CuhBTUdZH+RYl8sFrL096vA45Ok5ISO6sE/Mr1jRbGH4Csnhi8f3wKVl7x8mO4Au7Ir9D3Oyv1VYMFJw==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/mimic-response": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/mimic-response/-/mimic-response-4.0.0.tgz",
+ "integrity": "sha512-e5ISH9xMYU0DzrT+jl8q2ze9D6eWBto+I8CNpe+VI+K2J/F/k3PdkdTdz4wvGVH4NTpo+NRYTVIuMQEMMcsLqg==",
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minimalistic-assert": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/minimalistic-assert/-/minimalistic-assert-1.0.1.tgz",
+ "integrity": "sha512-UtJcAD4yEaGtjPezWuO9wC4nwUnVH/8/Im3yEHQP4b67cXlD/Qr9hdITCU1xDbSEXg2XKNaP8jsReV7vQd00/A=="
+ },
+ "node_modules/@ui5/cli/node_modules/minimatch": {
+ "version": "9.0.5",
+ "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.5.tgz",
+ "integrity": "sha512-G6T0ZX48xgozx7587koeX9Ys2NYy6Gmv//P89sEte9V9whIapMNF4idKxnW2QtCcLiTWlb/wfCabAtAFWhhBow==",
+ "dependencies": {
+ "brace-expansion": "^2.0.1"
+ },
+ "engines": {
+ "node": ">=16 || 14 >=14.17"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minimist": {
+ "version": "1.2.8",
+ "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+ "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass": {
+ "version": "7.1.2",
+ "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.2.tgz",
+ "integrity": "sha512-qOOzS1cBTWYF4BH8fVePDBOO9iptMnGUEZwNc/cMWnTV2nVLZ7VoNWEPHkYczZA0pdoA7dl6e7FL659nX9S2aw==",
+ "engines": {
+ "node": ">=16 || 14 >=14.17"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-fetch": {
+ "version": "3.0.5",
+ "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-3.0.5.tgz",
+ "integrity": "sha512-2N8elDQAtSnFV0Dk7gt15KHsS0Fyz6CbYZ360h0WTYV1Ty46li3rAXVOQj1THMNLdmrD9Vt5pBPtWtVkpwGBqg==",
+ "dependencies": {
+ "minipass": "^7.0.3",
+ "minipass-sized": "^1.0.3",
+ "minizlib": "^2.1.2"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ },
+ "optionalDependencies": {
+ "encoding": "^0.1.13"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-flush": {
+ "version": "1.0.5",
+ "resolved": "https://registry.npmjs.org/minipass-flush/-/minipass-flush-1.0.5.tgz",
+ "integrity": "sha512-JmQSYYpPUqX5Jyn1mXaRwOda1uQ8HP5KAT/oDSLCzt1BYRhQU0/hDtsB1ufZfEEzMZ9aAVmsBw8+FWsIXlClWw==",
+ "dependencies": {
+ "minipass": "^3.0.0"
+ },
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-flush/node_modules/minipass": {
+ "version": "3.3.6",
+ "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+ "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+ "dependencies": {
+ "yallist": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-flush/node_modules/yallist": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+ "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-pipeline": {
+ "version": "1.2.4",
+ "resolved": "https://registry.npmjs.org/minipass-pipeline/-/minipass-pipeline-1.2.4.tgz",
+ "integrity": "sha512-xuIq7cIOt09RPRJ19gdi4b+RiNvDFYe5JH+ggNvBqGqpQXcru3PcRmOZuHBKWK1Txf9+cQ+HMVN4d6z46LZP7A==",
+ "dependencies": {
+ "minipass": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-pipeline/node_modules/minipass": {
+ "version": "3.3.6",
+ "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+ "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+ "dependencies": {
+ "yallist": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-pipeline/node_modules/yallist": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+ "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-sized": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/minipass-sized/-/minipass-sized-1.0.3.tgz",
+ "integrity": "sha512-MbkQQ2CTiBMlA2Dm/5cY+9SWFEN8pzzOXi6rlM5Xxq0Yqbda5ZQy9sU75a673FE9ZK0Zsbr6Y5iP6u9nktfg2g==",
+ "dependencies": {
+ "minipass": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-sized/node_modules/minipass": {
+ "version": "3.3.6",
+ "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+ "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+ "dependencies": {
+ "yallist": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minipass-sized/node_modules/yallist": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+ "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
+ },
+ "node_modules/@ui5/cli/node_modules/minizlib": {
+ "version": "2.1.2",
+ "resolved": "https://registry.npmjs.org/minizlib/-/minizlib-2.1.2.tgz",
+ "integrity": "sha512-bAxsR8BVfj60DWXHE3u30oHzfl4G7khkSuPW+qvpd7jFRHm7dLxOjUk1EHACJ/hxLY8phGJ0YhYHZo7jil7Qdg==",
+ "dependencies": {
+ "minipass": "^3.0.0",
+ "yallist": "^4.0.0"
+ },
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minizlib/node_modules/minipass": {
+ "version": "3.3.6",
+ "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+ "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+ "dependencies": {
+ "yallist": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/minizlib/node_modules/yallist": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+ "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
+ },
+ "node_modules/@ui5/cli/node_modules/mkdirp": {
+ "version": "0.5.6",
+ "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
+ "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+ "dependencies": {
+ "minimist": "^1.2.6"
+ },
+ "bin": {
+ "mkdirp": "bin/cmd.js"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ms": {
+ "version": "2.1.3",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="
+ },
+ "node_modules/@ui5/cli/node_modules/negotiator": {
+ "version": "0.6.4",
+ "resolved": "https://registry.npmjs.org/negotiator/-/negotiator-0.6.4.tgz",
+ "integrity": "sha512-myRT3DiWPHqho5PrJaIRyaMv2kgYf0mUVgBNOYMuCH5Ki1yEiQaf/ZJuQ62nvpc44wL5WDbTX7yGJi1Neevw8w==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/node-stream-zip": {
+ "version": "1.15.0",
+ "resolved": "https://registry.npmjs.org/node-stream-zip/-/node-stream-zip-1.15.0.tgz",
+ "integrity": "sha512-LN4fydt9TqhZhThkZIVQnF9cwjU3qmUH9h78Mx/K7d3VvfRqqwthLwJEUOEL0QPZ0XQmNN7be5Ggit5+4dq3Bw==",
+ "engines": {
+ "node": ">=0.12.0"
+ },
+ "funding": {
+ "type": "github",
+ "url": "https://github.com/sponsors/antelle"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/nopt": {
+ "version": "7.2.1",
+ "resolved": "https://registry.npmjs.org/nopt/-/nopt-7.2.1.tgz",
+ "integrity": "sha512-taM24ViiimT/XntxbPyJQzCG+p4EKOpgD3mxFwW38mGjVUrfERQOeY4EDHjdnptttfHuHQXFx+lTP08Q+mLa/w==",
+ "dependencies": {
+ "abbrev": "^2.0.0"
+ },
+ "bin": {
+ "nopt": "bin/nopt.js"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/normalize-package-data": {
+ "version": "6.0.2",
+ "resolved": "https://registry.npmjs.org/normalize-package-data/-/normalize-package-data-6.0.2.tgz",
+ "integrity": "sha512-V6gygoYb/5EmNI+MEGrWkC+e6+Rr7mTmfHrxDbLzxQogBkgzo76rkok0Am6thgSF7Mv2nLOajAJj5vDJZEFn7g==",
+ "dependencies": {
+ "hosted-git-info": "^7.0.0",
+ "semver": "^7.3.5",
+ "validate-npm-package-license": "^3.0.4"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/normalize-url": {
+ "version": "8.1.0",
+ "resolved": "https://registry.npmjs.org/normalize-url/-/normalize-url-8.1.0.tgz",
+ "integrity": "sha512-X06Mfd/5aKsRHc0O0J5CUedwnPmnDtLF2+nq+KN9KSDlJHkPuh0JUviWjEWMe0SW/9TDdSLVPuk7L5gGTIA1/w==",
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/npm-bundled": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/npm-bundled/-/npm-bundled-3.0.1.tgz",
+ "integrity": "sha512-+AvaheE/ww1JEwRHOrn4WHNzOxGtVp+adrg2AeZS/7KuxGUYFuBta98wYpfHBbJp6Tg6j1NKSEVHNcfZzJHQwQ==",
+ "dependencies": {
+ "npm-normalize-package-bin": "^3.0.0"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/npm-install-checks": {
+ "version": "6.3.0",
+ "resolved": "https://registry.npmjs.org/npm-install-checks/-/npm-install-checks-6.3.0.tgz",
+ "integrity": "sha512-W29RiK/xtpCGqn6f3ixfRYGk+zRyr+Ew9F2E20BfXxT5/euLdA/Nm7fO7OeTGuAmTs30cpgInyJ0cYe708YTZw==",
+ "dependencies": {
+ "semver": "^7.1.1"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/npm-normalize-package-bin": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/npm-normalize-package-bin/-/npm-normalize-package-bin-3.0.1.tgz",
+ "integrity": "sha512-dMxCf+zZ+3zeQZXKxmyuCKlIDPGuv8EF940xbkC4kQVDTtqoh6rJFO+JTKSA6/Rwi0getWmtuy4Itup0AMcaDQ==",
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/npm-packlist": {
+ "version": "8.0.2",
+ "resolved": "https://registry.npmjs.org/npm-packlist/-/npm-packlist-8.0.2.tgz",
+ "integrity": "sha512-shYrPFIS/JLP4oQmAwDyk5HcyysKW8/JLTEA32S0Z5TzvpaeeX2yMFfoK1fjEBnCBvVyIB/Jj/GBFdm0wsgzbA==",
+ "dependencies": {
+ "ignore-walk": "^6.0.4"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/npm-pick-manifest": {
+ "version": "9.1.0",
+ "resolved": "https://registry.npmjs.org/npm-pick-manifest/-/npm-pick-manifest-9.1.0.tgz",
+ "integrity": "sha512-nkc+3pIIhqHVQr085X9d2JzPzLyjzQS96zbruppqC9aZRm/x8xx6xhI98gHtsfELP2bE+loHq8ZaHFHhe+NauA==",
+ "dependencies": {
+ "npm-install-checks": "^6.0.0",
+ "npm-normalize-package-bin": "^3.0.0",
+ "npm-package-arg": "^11.0.0",
+ "semver": "^7.3.5"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/npm-pick-manifest/node_modules/npm-package-arg": {
+ "version": "11.0.3",
+ "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-11.0.3.tgz",
+ "integrity": "sha512-sHGJy8sOC1YraBywpzQlIKBE4pBbGbiF95U6Auspzyem956E0+FtDtsx1ZxlOJkQCZ1AFXAY/yuvtFYrOxF+Bw==",
+ "dependencies": {
+ "hosted-git-info": "^7.0.0",
+ "proc-log": "^4.0.0",
+ "semver": "^7.3.5",
+ "validate-npm-package-name": "^5.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/npm-run-path": {
+ "version": "5.3.0",
+ "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-5.3.0.tgz",
+ "integrity": "sha512-ppwTtiJZq0O/ai0z7yfudtBpWIoxM8yE6nHi1X47eFR2EWORqfbu6CnPlNsjeN683eT0qG6H/Pyf9fCcvjnnnQ==",
+ "dependencies": {
+ "path-key": "^4.0.0"
+ },
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/npm-run-path/node_modules/path-key": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/path-key/-/path-key-4.0.0.tgz",
+ "integrity": "sha512-haREypq7xkM7ErfgIyA0z+Bj4AGKlMSdlQE2jvJo6huWD1EdkKYV+G/T4nq0YEF2vgTT8kqMFKo1uHn950r4SQ==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/nth-check": {
+ "version": "2.1.1",
+ "resolved": "https://registry.npmjs.org/nth-check/-/nth-check-2.1.1.tgz",
+ "integrity": "sha512-lqjrjmaOoAnWfMmBPL+XNnynZh2+swxiX3WUE0s4yEHI6m+AwrK2UZOimIRl3X/4QctVqS8AiZjFqyOGrMXb/w==",
+ "dependencies": {
+ "boolbase": "^1.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/nth-check?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/object-assign": {
+ "version": "4.1.1",
+ "resolved": "https://registry.npmjs.org/object-assign/-/object-assign-4.1.1.tgz",
+ "integrity": "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg==",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/object-inspect": {
+ "version": "1.13.4",
+ "resolved": "https://registry.npmjs.org/object-inspect/-/object-inspect-1.13.4.tgz",
+ "integrity": "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew==",
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/obuf": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/obuf/-/obuf-1.1.2.tgz",
+ "integrity": "sha512-PX1wu0AmAdPqOL1mWhqmlOd8kOIZQwGZw6rh7uby9fTc5lhaOWFLX3I6R1hrF9k3zUY40e6igsLGkDXK92LJNg=="
+ },
+ "node_modules/@ui5/cli/node_modules/on-finished": {
+ "version": "2.4.1",
+ "resolved": "https://registry.npmjs.org/on-finished/-/on-finished-2.4.1.tgz",
+ "integrity": "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg==",
+ "dependencies": {
+ "ee-first": "1.1.1"
+ },
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/on-headers": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/on-headers/-/on-headers-1.1.0.tgz",
+ "integrity": "sha512-737ZY3yNnXy37FHkQxPzt4UZ2UWPWiCZWLvFZ4fu5cueciegX0zGPnrlY6bwRg4FdQOe9YU8MkmJwGhoMybl8A==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/once": {
+ "version": "1.4.0",
+ "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+ "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+ "dependencies": {
+ "wrappy": "1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/onetime": {
+ "version": "6.0.0",
+ "resolved": "https://registry.npmjs.org/onetime/-/onetime-6.0.0.tgz",
+ "integrity": "sha512-1FlR+gjXK7X+AsAHso35MnyN5KqGwJRi/31ft6x0M194ht7S+rWAvd7PHss9xSKMzE0asv1pyIHaJYq+BbacAQ==",
+ "dependencies": {
+ "mimic-fn": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/open": {
+ "version": "9.1.0",
+ "resolved": "https://registry.npmjs.org/open/-/open-9.1.0.tgz",
+ "integrity": "sha512-OS+QTnw1/4vrf+9hh1jc1jnYjzSG4ttTBB8UxOwAnInG3Uo4ssetzC1ihqaIHjLJnA5GGlRl6QlZXOTQhRBUvg==",
+ "dependencies": {
+ "default-browser": "^4.0.0",
+ "define-lazy-prop": "^3.0.0",
+ "is-inside-container": "^1.0.0",
+ "is-wsl": "^2.2.0"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/p-cancelable": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/p-cancelable/-/p-cancelable-3.0.0.tgz",
+ "integrity": "sha512-mlVgR3PGuzlo0MmTdk4cXqXWlwQDLnONTAg6sm62XkMJEiRxN3GL3SffkYvqwonbkJBcrI7Uvv5Zh9yjvn2iUw==",
+ "engines": {
+ "node": ">=12.20"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/p-limit": {
+ "version": "2.3.0",
+ "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-2.3.0.tgz",
+ "integrity": "sha512-//88mFWSJx8lxCzwdAABTJL2MyWB12+eIY7MDL2SqLmAkeKU9qxRvWuSyTjm3FUmpBEMuFfckAIqEaVGUDxb6w==",
+ "dependencies": {
+ "p-try": "^2.0.0"
+ },
+ "engines": {
+ "node": ">=6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/p-locate": {
+ "version": "4.1.0",
+ "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-4.1.0.tgz",
+ "integrity": "sha512-R79ZZ/0wAxKGu3oYMlz8jy/kbhsNrS7SKZ7PxEHBgJ5+F2mtFW2fK2cOtBh1cHYkQsbzFV7I+EoRKe6Yt0oK7A==",
+ "dependencies": {
+ "p-limit": "^2.2.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/p-try": {
+ "version": "2.2.0",
+ "resolved": "https://registry.npmjs.org/p-try/-/p-try-2.2.0.tgz",
+ "integrity": "sha512-R4nPAVTAU0B9D35/Gk3uJf/7XYbQcyohSKdvAxIRSNghFl4e71hVoGnBNQz9cWaXxO2I10KTC+3jMdvvoKw6dQ==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/package-json": {
+ "version": "8.1.1",
+ "resolved": "https://registry.npmjs.org/package-json/-/package-json-8.1.1.tgz",
+ "integrity": "sha512-cbH9IAIJHNj9uXi196JVsRlt7cHKak6u/e6AkL/bkRelZ7rlL3X1YKxsZwa36xipOEKAsdtmaG6aAJoM1fx2zA==",
+ "dependencies": {
+ "got": "^12.1.0",
+ "registry-auth-token": "^5.0.1",
+ "registry-url": "^6.0.0",
+ "semver": "^7.3.7"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/package-json-from-dist": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+ "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw=="
+ },
+ "node_modules/@ui5/cli/node_modules/pacote": {
+ "version": "18.0.6",
+ "resolved": "https://registry.npmjs.org/pacote/-/pacote-18.0.6.tgz",
+ "integrity": "sha512-+eK3G27SMwsB8kLIuj4h1FUhHtwiEUo21Tw8wNjmvdlpOEr613edv+8FUsTj/4F/VN5ywGE19X18N7CC2EJk6A==",
+ "dependencies": {
+ "@npmcli/git": "^5.0.0",
+ "@npmcli/installed-package-contents": "^2.0.1",
+ "@npmcli/package-json": "^5.1.0",
+ "@npmcli/promise-spawn": "^7.0.0",
+ "@npmcli/run-script": "^8.0.0",
+ "cacache": "^18.0.0",
+ "fs-minipass": "^3.0.0",
+ "minipass": "^7.0.2",
+ "npm-package-arg": "^11.0.0",
+ "npm-packlist": "^8.0.0",
+ "npm-pick-manifest": "^9.0.0",
+ "npm-registry-fetch": "^17.0.0",
+ "proc-log": "^4.0.0",
+ "promise-retry": "^2.0.1",
+ "sigstore": "^2.2.0",
+ "ssri": "^10.0.0",
+ "tar": "^6.1.11"
+ },
+ "bin": {
+ "pacote": "bin/index.js"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/@npmcli/run-script": {
+ "version": "8.1.0",
+ "resolved": "https://registry.npmjs.org/@npmcli/run-script/-/run-script-8.1.0.tgz",
+ "integrity": "sha512-y7efHHwghQfk28G2z3tlZ67pLG0XdfYbcVG26r7YIXALRsrVQcTq4/tdenSmdOrEsNahIYA/eh8aEVROWGFUDg==",
+ "dependencies": {
+ "@npmcli/node-gyp": "^3.0.0",
+ "@npmcli/package-json": "^5.0.0",
+ "@npmcli/promise-spawn": "^7.0.0",
+ "node-gyp": "^10.0.0",
+ "proc-log": "^4.0.0",
+ "which": "^4.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/aggregate-error": {
+ "version": "3.1.0",
+ "resolved": "https://registry.npmjs.org/aggregate-error/-/aggregate-error-3.1.0.tgz",
+ "integrity": "sha512-4I7Td01quW/RpocfNayFdFVk1qSuoh0E7JrbRJ16nH01HhKFQ88INq9Sd+nd72zqRySlr9BmDA8xlEJ6vJMrYA==",
+ "dependencies": {
+ "clean-stack": "^2.0.0",
+ "indent-string": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/cacache": {
+ "version": "18.0.4",
+ "resolved": "https://registry.npmjs.org/cacache/-/cacache-18.0.4.tgz",
+ "integrity": "sha512-B+L5iIa9mgcjLbliir2th36yEwPftrzteHYujzsx3dFP/31GCHcIeS8f5MGd80odLOjaOvSpU3EEAmRQptkxLQ==",
+ "dependencies": {
+ "@npmcli/fs": "^3.1.0",
+ "fs-minipass": "^3.0.0",
+ "glob": "^10.2.2",
+ "lru-cache": "^10.0.1",
+ "minipass": "^7.0.3",
+ "minipass-collect": "^2.0.1",
+ "minipass-flush": "^1.0.5",
+ "minipass-pipeline": "^1.2.4",
+ "p-map": "^4.0.0",
+ "ssri": "^10.0.0",
+ "tar": "^6.1.11",
+ "unique-filename": "^3.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/clean-stack": {
+ "version": "2.2.0",
+ "resolved": "https://registry.npmjs.org/clean-stack/-/clean-stack-2.2.0.tgz",
+ "integrity": "sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/indent-string": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/indent-string/-/indent-string-4.0.0.tgz",
+ "integrity": "sha512-EdDDZu4A2OyIK7Lr/2zG+w5jmbuk1DVBnEwREQvBzspBJkCEbRa8GxU1lghYcaGJCnRWibjDXlq779X1/y5xwg==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/lru-cache": {
+ "version": "10.4.3",
+ "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+ "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/minipass-collect": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
+ "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
+ "dependencies": {
+ "minipass": "^7.0.3"
+ },
+ "engines": {
+ "node": ">=16 || 14 >=14.17"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/node-gyp": {
+ "version": "10.3.1",
+ "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-10.3.1.tgz",
+ "integrity": "sha512-Pp3nFHBThHzVtNY7U6JfPjvT/DTE8+o/4xKsLQtBoU+j2HLsGlhcfzflAoUreaJbNmYnX+LlLi0qjV8kpyO6xQ==",
+ "dependencies": {
+ "env-paths": "^2.2.0",
+ "exponential-backoff": "^3.1.1",
+ "glob": "^10.3.10",
+ "graceful-fs": "^4.2.6",
+ "make-fetch-happen": "^13.0.0",
+ "nopt": "^7.0.0",
+ "proc-log": "^4.1.0",
+ "semver": "^7.3.5",
+ "tar": "^6.2.1",
+ "which": "^4.0.0"
+ },
+ "bin": {
+ "node-gyp": "bin/node-gyp.js"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/npm-package-arg": {
+ "version": "11.0.3",
+ "resolved": "https://registry.npmjs.org/npm-package-arg/-/npm-package-arg-11.0.3.tgz",
+ "integrity": "sha512-sHGJy8sOC1YraBywpzQlIKBE4pBbGbiF95U6Auspzyem956E0+FtDtsx1ZxlOJkQCZ1AFXAY/yuvtFYrOxF+Bw==",
+ "dependencies": {
+ "hosted-git-info": "^7.0.0",
+ "proc-log": "^4.0.0",
+ "semver": "^7.3.5",
+ "validate-npm-package-name": "^5.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/npm-registry-fetch": {
+ "version": "17.1.0",
+ "resolved": "https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-17.1.0.tgz",
+ "integrity": "sha512-5+bKQRH0J1xG1uZ1zMNvxW0VEyoNWgJpY9UDuluPFLKDfJ9u2JmmjmTJV1srBGQOROfdBMiVvnH2Zvpbm+xkVA==",
+ "dependencies": {
+ "@npmcli/redact": "^2.0.0",
+ "jsonparse": "^1.3.1",
+ "make-fetch-happen": "^13.0.0",
+ "minipass": "^7.0.2",
+ "minipass-fetch": "^3.0.0",
+ "minizlib": "^2.1.2",
+ "npm-package-arg": "^11.0.0",
+ "proc-log": "^4.0.0"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pacote/node_modules/p-map": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/p-map/-/p-map-4.0.0.tgz",
+ "integrity": "sha512-/bjOqmgETBYB5BoEeGVea8dmvHb2m9GLy1E9W43yeyfP6QQCZGFNa+XRceJEuDB6zqr+gKpIAmlLebMpykw/MQ==",
+ "dependencies": {
+ "aggregate-error": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/parse5": {
+ "version": "7.3.0",
+ "resolved": "https://registry.npmjs.org/parse5/-/parse5-7.3.0.tgz",
+ "integrity": "sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==",
+ "dependencies": {
+ "entities": "^6.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/inikulin/parse5?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/parse5-htmlparser2-tree-adapter": {
+ "version": "7.1.0",
+ "resolved": "https://registry.npmjs.org/parse5-htmlparser2-tree-adapter/-/parse5-htmlparser2-tree-adapter-7.1.0.tgz",
+ "integrity": "sha512-ruw5xyKs6lrpo9x9rCZqZZnIUntICjQAd0Wsmp396Ul9lN/h+ifgVV1x1gZHi8euej6wTfpqX8j+BFQxF0NS/g==",
+ "dependencies": {
+ "domhandler": "^5.0.3",
+ "parse5": "^7.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/inikulin/parse5?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/parse5/node_modules/entities": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/entities/-/entities-6.0.1.tgz",
+ "integrity": "sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==",
+ "engines": {
+ "node": ">=0.12"
+ },
+ "funding": {
+ "url": "https://github.com/fb55/entities?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/parseurl": {
+ "version": "1.3.3",
+ "resolved": "https://registry.npmjs.org/parseurl/-/parseurl-1.3.3.tgz",
+ "integrity": "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/path-exists": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+ "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/path-is-absolute": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+ "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/path-key": {
+ "version": "3.1.1",
+ "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+ "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/path-parse": {
+ "version": "1.0.7",
+ "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
+ "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="
+ },
+ "node_modules/@ui5/cli/node_modules/path-scurry": {
+ "version": "1.11.1",
+ "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+ "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+ "dependencies": {
+ "lru-cache": "^10.2.0",
+ "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+ },
+ "engines": {
+ "node": ">=16 || 14 >=14.18"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/path-scurry/node_modules/lru-cache": {
+ "version": "10.4.3",
+ "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+ "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/path-to-regexp": {
+ "version": "0.1.12",
+ "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.12.tgz",
+ "integrity": "sha512-RA1GjUVMnvYFxuqovrEqZoxxW5NUZqbwKtYz/Tt7nXerk0LbLblQmrsgdeOxV5SFHf0UDggjS/bSeOZwt1pmEQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/path-type": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/path-type/-/path-type-4.0.0.tgz",
+ "integrity": "sha512-gDKb8aZMDeD/tZWs9P6+q0J9Mwkdl6xMV8TjnGP3qJVJ06bdMgkbBlLU8IdfOsIsFz2BW1rNVT3XuNEl8zPAvw==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/picocolors": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+ "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="
+ },
+ "node_modules/@ui5/cli/node_modules/picomatch": {
+ "version": "2.3.1",
+ "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+ "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+ "engines": {
+ "node": ">=8.6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/jonschlinkert"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/portscanner": {
+ "version": "2.2.0",
+ "resolved": "https://registry.npmjs.org/portscanner/-/portscanner-2.2.0.tgz",
+ "integrity": "sha512-IFroCz/59Lqa2uBvzK3bKDbDDIEaAY8XJ1jFxcLWTqosrsc32//P4VuSB2vZXoHiHqOmx8B5L5hnKOxL/7FlPw==",
+ "dependencies": {
+ "async": "^2.6.0",
+ "is-number-like": "^1.0.3"
+ },
+ "engines": {
+ "node": ">=0.4",
+ "npm": ">=1.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pretty-data": {
+ "version": "0.40.0",
+ "resolved": "https://registry.npmjs.org/pretty-data/-/pretty-data-0.40.0.tgz",
+ "integrity": "sha512-YFLnEdDEDnkt/GEhet5CYZHCvALw6+Elyb/tp8kQG03ZSIuzeaDWpZYndCXwgqu4NAjh1PI534dhDS1mHarRnQ==",
+ "engines": {
+ "node": "*"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pretty-hrtime": {
+ "version": "1.0.3",
+ "resolved": "https://registry.npmjs.org/pretty-hrtime/-/pretty-hrtime-1.0.3.tgz",
+ "integrity": "sha512-66hKPCr+72mlfiSjlEB1+45IjXSqvVAIy6mocupoww4tBFE9R9IhwwUGoI4G++Tc9Aq+2rxOt0RFU6gPcrte0A==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/proc-log": {
+ "version": "4.2.0",
+ "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-4.2.0.tgz",
+ "integrity": "sha512-g8+OnU/L2v+wyiVK+D5fA34J7EH8jZ8DDlvwhRCMxmMj7UCBvxiO1mGeN+36JXIKF4zevU4kRBd8lVgG9vLelA==",
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/process-nextick-args": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
+ "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag=="
+ },
+ "node_modules/@ui5/cli/node_modules/promise-inflight": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/promise-inflight/-/promise-inflight-1.0.1.tgz",
+ "integrity": "sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g=="
+ },
+ "node_modules/@ui5/cli/node_modules/promise-retry": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/promise-retry/-/promise-retry-2.0.1.tgz",
+ "integrity": "sha512-y+WKFlBR8BGXnsNlIHFGPZmyDf3DFMoLhaflAnyZgV6rG6xu+JwesTo2Q9R6XwYmtmwAFCkAk3e35jEdoeh/3g==",
+ "dependencies": {
+ "err-code": "^2.0.2",
+ "retry": "^0.12.0"
+ },
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/proto-list": {
+ "version": "1.2.4",
+ "resolved": "https://registry.npmjs.org/proto-list/-/proto-list-1.2.4.tgz",
+ "integrity": "sha512-vtK/94akxsTMhe0/cbfpR+syPuszcuwhqVjJq26CuNDgFGj682oRBXOP5MJpv2r7JtE8MsiepGIqvvOTBwn2vA=="
+ },
+ "node_modules/@ui5/cli/node_modules/proxy-addr": {
+ "version": "2.0.7",
+ "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
+ "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+ "dependencies": {
+ "forwarded": "0.2.0",
+ "ipaddr.js": "1.9.1"
+ },
+ "engines": {
+ "node": ">= 0.10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/punycode": {
+ "version": "2.3.1",
+ "resolved": "https://registry.npmjs.org/punycode/-/punycode-2.3.1.tgz",
+ "integrity": "sha512-vYt7UD1U9Wg6138shLtLOvdAu+8DsC/ilFtEVHcH+wydcSpNE20AfSOduf6MkRFahL5FY7X1oU7nKVZFtfq8Fg==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/punycode.js": {
+ "version": "2.3.1",
+ "resolved": "https://registry.npmjs.org/punycode.js/-/punycode.js-2.3.1.tgz",
+ "integrity": "sha512-uxFIHU0YlHYhDQtV4R9J6a52SLx28BCjT+4ieh7IGbgwVJWO+km431c4yRlREUAsAmt/uMjQUyQHNEPf0M39CA==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/pupa": {
+ "version": "3.3.0",
+ "resolved": "https://registry.npmjs.org/pupa/-/pupa-3.3.0.tgz",
+ "integrity": "sha512-LjgDO2zPtoXP2wJpDjZrGdojii1uqO0cnwKoIoUzkfS98HDmbeiGmYiXo3lXeFlq2xvne1QFQhwYXSUCLKtEuA==",
+ "dependencies": {
+ "escape-goat": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=12.20"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/qs": {
+ "version": "6.13.0",
+ "resolved": "https://registry.npmjs.org/qs/-/qs-6.13.0.tgz",
+ "integrity": "sha512-+38qI9SOr8tfZ4QmJNplMUxqjbe7LKvvZgWdExBOmd+egZTtjLB67Gu0HRX3u/XOq7UU2Nx6nsjvS16Z9uwfpg==",
+ "dependencies": {
+ "side-channel": "^1.0.6"
+ },
+ "engines": {
+ "node": ">=0.6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/queue-microtask": {
+ "version": "1.2.3",
+ "resolved": "https://registry.npmjs.org/queue-microtask/-/queue-microtask-1.2.3.tgz",
+ "integrity": "sha512-NuaNSa6flKT5JaSYQzJok04JzTL1CA6aGhv5rfLW3PgqA+M2ChpZQnAC8h8i4ZFkBS8X5RqkDBHA7r4hej3K9A==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/feross"
+ },
+ {
+ "type": "patreon",
+ "url": "https://www.patreon.com/feross"
+ },
+ {
+ "type": "consulting",
+ "url": "https://feross.org/support"
+ }
+ ]
+ },
+ "node_modules/@ui5/cli/node_modules/random-int": {
+ "version": "3.1.0",
+ "resolved": "https://registry.npmjs.org/random-int/-/random-int-3.1.0.tgz",
+ "integrity": "sha512-h8CRz8cpvzj0hC/iH/1Gapgcl2TQ6xtnCpyOI5WvWfXf/yrDx2DOU+tD9rX23j36IF11xg1KqB9W11Z18JPMdw==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/range-parser": {
+ "version": "1.2.1",
+ "resolved": "https://registry.npmjs.org/range-parser/-/range-parser-1.2.1.tgz",
+ "integrity": "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg==",
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/raw-body": {
+ "version": "2.5.2",
+ "resolved": "https://registry.npmjs.org/raw-body/-/raw-body-2.5.2.tgz",
+ "integrity": "sha512-8zGqypfENjCIqGhgXToC8aB2r7YrBX+AQAfIPs/Mlk+BtPTztOvTS01NRW/3Eh60J+a48lt8qsCzirQ6loCVfA==",
+ "dependencies": {
+ "bytes": "3.1.2",
+ "http-errors": "2.0.0",
+ "iconv-lite": "0.4.24",
+ "unpipe": "1.0.0"
+ },
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/rc": {
+ "version": "1.2.8",
+ "resolved": "https://registry.npmjs.org/rc/-/rc-1.2.8.tgz",
+ "integrity": "sha512-y3bGgqKj3QBdxLbLkomlohkvsA8gdAiUQlSBJnBhfn+BPxg4bc62d8TcBW15wavDfgexCgccckhcZvywyQYPOw==",
+ "dependencies": {
+ "deep-extend": "^0.6.0",
+ "ini": "~1.3.0",
+ "minimist": "^1.2.0",
+ "strip-json-comments": "~2.0.1"
+ },
+ "bin": {
+ "rc": "cli.js"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/rc/node_modules/ini": {
+ "version": "1.3.8",
+ "resolved": "https://registry.npmjs.org/ini/-/ini-1.3.8.tgz",
+ "integrity": "sha512-JV/yugV2uzW5iMRSiZAyDtQd+nxtUnjeLt0acNdw98kKLrvuRVyB80tsREOE7yvGVgalhZ6RNXCmEHkUKBKxew=="
+ },
+ "node_modules/@ui5/cli/node_modules/rc/node_modules/strip-json-comments": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-2.0.1.tgz",
+ "integrity": "sha512-4gB8na07fecVVkOI6Rs4e7T6NOTki5EmL7TUduTs6bu3EdnSycntVJ4re8kgZA+wx9IueI2Y11bfbgwtzuE0KQ==",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-package-json-fast": {
+ "version": "3.0.2",
+ "resolved": "https://registry.npmjs.org/read-package-json-fast/-/read-package-json-fast-3.0.2.tgz",
+ "integrity": "sha512-0J+Msgym3vrLOUB3hzQCuZHII0xkNGCtz/HJH9xZshwv9DbDwkw1KaE3gx/e2J5rpEY5rtOy6cyhKOPrkP7FZw==",
+ "dependencies": {
+ "json-parse-even-better-errors": "^3.0.0",
+ "npm-normalize-package-bin": "^3.0.0"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg": {
+ "version": "8.1.0",
+ "resolved": "https://registry.npmjs.org/read-pkg/-/read-pkg-8.1.0.tgz",
+ "integrity": "sha512-PORM8AgzXeskHO/WEv312k9U03B8K9JSiWF/8N9sUuFjBa+9SF2u6K7VClzXwDXab51jCd8Nd36CNM+zR97ScQ==",
+ "dependencies": {
+ "@types/normalize-package-data": "^2.4.1",
+ "normalize-package-data": "^6.0.0",
+ "parse-json": "^7.0.0",
+ "type-fest": "^4.2.0"
+ },
+ "engines": {
+ "node": ">=16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg-up": {
+ "version": "10.1.0",
+ "resolved": "https://registry.npmjs.org/read-pkg-up/-/read-pkg-up-10.1.0.tgz",
+ "integrity": "sha512-aNtBq4jR8NawpKJQldrQcSW9y/d+KWH4v24HWkHljOZ7H0av+YTGANBzRh9A5pw7v/bLVsLVPpOhJ7gHNVy8lA==",
+ "dependencies": {
+ "find-up": "^6.3.0",
+ "read-pkg": "^8.1.0",
+ "type-fest": "^4.2.0"
+ },
+ "engines": {
+ "node": ">=16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg-up/node_modules/find-up": {
+ "version": "6.3.0",
+ "resolved": "https://registry.npmjs.org/find-up/-/find-up-6.3.0.tgz",
+ "integrity": "sha512-v2ZsoEuVHYy8ZIlYqwPe/39Cy+cFDzp4dXPaxNvkEuouymu+2Jbz0PxpKarJHYJTmv2HWT3O382qY8l4jMWthw==",
+ "dependencies": {
+ "locate-path": "^7.1.0",
+ "path-exists": "^5.0.0"
+ },
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg-up/node_modules/locate-path": {
+ "version": "7.2.0",
+ "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-7.2.0.tgz",
+ "integrity": "sha512-gvVijfZvn7R+2qyPX8mAuKcFGDf6Nc61GdvGafQsHL0sBIxfKzA+usWn4GFC/bk+QdwPUD4kWFJLhElipq+0VA==",
+ "dependencies": {
+ "p-locate": "^6.0.0"
+ },
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg-up/node_modules/p-limit": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-4.0.0.tgz",
+ "integrity": "sha512-5b0R4txpzjPWVw/cXXUResoD4hb6U/x9BH08L7nw+GN1sezDzPdxeRvpc9c433fZhBan/wusjbCsqwqm4EIBIQ==",
+ "dependencies": {
+ "yocto-queue": "^1.0.0"
+ },
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg-up/node_modules/p-locate": {
+ "version": "6.0.0",
+ "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-6.0.0.tgz",
+ "integrity": "sha512-wPrq66Llhl7/4AGC6I+cqxT07LhXvWL08LNXz1fENOw0Ap4sRZZ/gZpTTJ5jpurzzzfS2W/Ge9BY3LgLjCShcw==",
+ "dependencies": {
+ "p-limit": "^4.0.0"
+ },
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg-up/node_modules/path-exists": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-5.0.0.tgz",
+ "integrity": "sha512-RjhtfwJOxzcFmNOi6ltcbcu4Iu+FL3zEj83dk4kAS+fVpTxXLO1b38RvJgT/0QwvV/L3aY9TAnyv0EOqW4GoMQ==",
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg-up/node_modules/type-fest": {
+ "version": "4.41.0",
+ "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
+ "integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
+ "engines": {
+ "node": ">=16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg-up/node_modules/yocto-queue": {
+ "version": "1.2.2",
+ "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-1.2.2.tgz",
+ "integrity": "sha512-4LCcse/U2MHZ63HAJVE+v71o7yOdIe4cZ70Wpf8D/IyjDKYQLV5GD46B+hSTjJsvV5PztjvHoU580EftxjDZFQ==",
+ "engines": {
+ "node": ">=12.20"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg/node_modules/lines-and-columns": {
+ "version": "2.0.4",
+ "resolved": "https://registry.npmjs.org/lines-and-columns/-/lines-and-columns-2.0.4.tgz",
+ "integrity": "sha512-wM1+Z03eypVAVUCE7QdSqpVIvelbOakn1M0bPDoA4SGWPx3sNDVUiMo3L6To6WWGClB7VyXnhQ4Sn7gxiJbE6A==",
+ "engines": {
+ "node": "^12.20.0 || ^14.13.1 || >=16.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg/node_modules/parse-json": {
+ "version": "7.1.1",
+ "resolved": "https://registry.npmjs.org/parse-json/-/parse-json-7.1.1.tgz",
+ "integrity": "sha512-SgOTCX/EZXtZxBE5eJ97P4yGM5n37BwRU+YMsH4vNzFqJV/oWFXXCmwFlgWUM4PrakybVOueJJ6pwHqSVhTFDw==",
+ "dependencies": {
+ "@babel/code-frame": "^7.21.4",
+ "error-ex": "^1.3.2",
+ "json-parse-even-better-errors": "^3.0.0",
+ "lines-and-columns": "^2.0.3",
+ "type-fest": "^3.8.0"
+ },
+ "engines": {
+ "node": ">=16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg/node_modules/parse-json/node_modules/type-fest": {
+ "version": "3.13.1",
+ "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-3.13.1.tgz",
+ "integrity": "sha512-tLq3bSNx+xSpwvAJnzrK0Ep5CLNWjvFTOp71URMaAEWBfRb9nnJiBoUe0tF8bI4ZFO3omgBR6NvnbzVUT3Ly4g==",
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/read-pkg/node_modules/type-fest": {
+ "version": "4.41.0",
+ "resolved": "https://registry.npmjs.org/type-fest/-/type-fest-4.41.0.tgz",
+ "integrity": "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA==",
+ "engines": {
+ "node": ">=16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/registry-auth-token": {
+ "version": "5.1.0",
+ "resolved": "https://registry.npmjs.org/registry-auth-token/-/registry-auth-token-5.1.0.tgz",
+ "integrity": "sha512-GdekYuwLXLxMuFTwAPg5UKGLW/UXzQrZvH/Zj791BQif5T05T0RsaLfHc9q3ZOKi7n+BoprPD9mJ0O0k4xzUlw==",
+ "dependencies": {
+ "@pnpm/npm-conf": "^2.1.0"
+ },
+ "engines": {
+ "node": ">=14"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/registry-url": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/registry-url/-/registry-url-6.0.1.tgz",
+ "integrity": "sha512-+crtS5QjFRqFCoQmvGduwYWEBng99ZvmFvF+cUJkGYF1L1BfU8C6Zp9T7f5vPAwyLkUExpvK+ANVZmGU49qi4Q==",
+ "dependencies": {
+ "rc": "1.2.8"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/replacestream": {
+ "version": "4.0.3",
+ "resolved": "https://registry.npmjs.org/replacestream/-/replacestream-4.0.3.tgz",
+ "integrity": "sha512-AC0FiLS352pBBiZhd4VXB1Ab/lh0lEgpP+GGvZqbQh8a5cmXVoTe5EX/YeTFArnp4SRGTHh1qCHu9lGs1qG8sA==",
+ "dependencies": {
+ "escape-string-regexp": "^1.0.3",
+ "object-assign": "^4.0.1",
+ "readable-stream": "^2.0.2"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/replacestream/node_modules/escape-string-regexp": {
+ "version": "1.0.5",
+ "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+ "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
+ "engines": {
+ "node": ">=0.8.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/replacestream/node_modules/readable-stream": {
+ "version": "2.3.8",
+ "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
+ "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+ "dependencies": {
+ "core-util-is": "~1.0.0",
+ "inherits": "~2.0.3",
+ "isarray": "~1.0.0",
+ "process-nextick-args": "~2.0.0",
+ "safe-buffer": "~5.1.1",
+ "string_decoder": "~1.1.1",
+ "util-deprecate": "~1.0.1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/replacestream/node_modules/safe-buffer": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
+ "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
+ },
+ "node_modules/@ui5/cli/node_modules/replacestream/node_modules/string_decoder": {
+ "version": "1.1.1",
+ "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+ "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+ "dependencies": {
+ "safe-buffer": "~5.1.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/require-directory": {
+ "version": "2.1.1",
+ "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+ "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/requizzle": {
+ "version": "0.2.4",
+ "resolved": "https://registry.npmjs.org/requizzle/-/requizzle-0.2.4.tgz",
+ "integrity": "sha512-JRrFk1D4OQ4SqovXOgdav+K8EAhSB/LJZqCz8tbX0KObcdeM15Ss59ozWMBWmmINMagCwmqn4ZNryUGpBsl6Jw==",
+ "dependencies": {
+ "lodash": "^4.17.21"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/resolve": {
+ "version": "1.22.11",
+ "resolved": "https://registry.npmjs.org/resolve/-/resolve-1.22.11.tgz",
+ "integrity": "sha512-RfqAvLnMl313r7c9oclB1HhUEAezcpLjz95wFH4LVuhk9JF/r22qmVP9AMmOU4vMX7Q8pN8jwNg/CSpdFnMjTQ==",
+ "dependencies": {
+ "is-core-module": "^2.16.1",
+ "path-parse": "^1.0.7",
+ "supports-preserve-symlinks-flag": "^1.0.0"
+ },
+ "bin": {
+ "resolve": "bin/resolve"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/resolve-alpn": {
+ "version": "1.2.1",
+ "resolved": "https://registry.npmjs.org/resolve-alpn/-/resolve-alpn-1.2.1.tgz",
+ "integrity": "sha512-0a1F4l73/ZFZOakJnQ3FvkJ2+gSTQWz/r2KE5OdDY0TxPm5h4GkqkWWfM47T7HsbnOtcJVEF4epCVy6u7Q3K+g=="
+ },
+ "node_modules/@ui5/cli/node_modules/resolve-cwd": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/resolve-cwd/-/resolve-cwd-3.0.0.tgz",
+ "integrity": "sha512-OrZaX2Mb+rJCpH/6CpSqt9xFVpN++x01XnN2ie9g6P5/3xelLAkXWVADpdz1IHD/KFfEXyE6V0U01OQ3UO2rEg==",
+ "dependencies": {
+ "resolve-from": "^5.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/resolve-from": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/resolve-from/-/resolve-from-5.0.0.tgz",
+ "integrity": "sha512-qYg9KP24dD5qka9J47d0aVky0N+b4fTU89LN9iDnjB5waksiC49rvMB0PrUJQGoTmH50XPiqOvAjDfaijGxYZw==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/responselike": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/responselike/-/responselike-3.0.0.tgz",
+ "integrity": "sha512-40yHxbNcl2+rzXvZuVkrYohathsSJlMTXKryG5y8uciHv1+xDLHQpgjG64JUO9nrEq2jGLH6IZ8BcZyw3wrweg==",
+ "dependencies": {
+ "lowercase-keys": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/retry": {
+ "version": "0.12.0",
+ "resolved": "https://registry.npmjs.org/retry/-/retry-0.12.0.tgz",
+ "integrity": "sha512-9LkiTwjUh6rT555DtE9rTX+BKByPfrMzEAtnlEtdEwr3Nkffwiihqe2bWADg+OQRjt9gl6ICdmB/ZFDCGAtSow==",
+ "engines": {
+ "node": ">= 4"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/reusify": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz",
+ "integrity": "sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==",
+ "engines": {
+ "iojs": ">=1.0.0",
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/rimraf": {
+ "version": "5.0.10",
+ "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-5.0.10.tgz",
+ "integrity": "sha512-l0OE8wL34P4nJH/H2ffoaniAokM2qSmrtXHmlpvYr5AVVX8msAyW0l8NVJFDxlSK4u3Uh/f41cQheDVdnYijwQ==",
+ "dependencies": {
+ "glob": "^10.3.7"
+ },
+ "bin": {
+ "rimraf": "dist/esm/bin.mjs"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/router": {
+ "version": "2.2.0",
+ "resolved": "https://registry.npmjs.org/router/-/router-2.2.0.tgz",
+ "integrity": "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ==",
+ "dependencies": {
+ "debug": "^4.4.0",
+ "depd": "^2.0.0",
+ "is-promise": "^4.0.0",
+ "parseurl": "^1.3.3",
+ "path-to-regexp": "^8.0.0"
+ },
+ "engines": {
+ "node": ">= 18"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/router/node_modules/path-to-regexp": {
+ "version": "8.3.0",
+ "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-8.3.0.tgz",
+ "integrity": "sha512-7jdwVIRtsP8MYpdXSwOS0YdD0Du+qOoF/AEPIt88PcCFrZCzx41oxku1jD88hZBwbNUIEfpqvuhjFaMAqMTWnA==",
+ "funding": {
+ "type": "opencollective",
+ "url": "https://opencollective.com/express"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/run-applescript/-/run-applescript-5.0.0.tgz",
+ "integrity": "sha512-XcT5rBksx1QdIhlFOCtgZkB99ZEouFZ1E2Kc2LHqNW13U3/74YGdkQRmThTwxy4QIyookibDKYZOPqX//6BlAg==",
+ "dependencies": {
+ "execa": "^5.0.0"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/execa": {
+ "version": "5.1.1",
+ "resolved": "https://registry.npmjs.org/execa/-/execa-5.1.1.tgz",
+ "integrity": "sha512-8uSpZZocAZRBAPIEINJj3Lo9HyGitllczc27Eh5YYojjMFMn8yHMDMaUHE2Jqfq05D/wucwI4JGURyXt1vchyg==",
+ "dependencies": {
+ "cross-spawn": "^7.0.3",
+ "get-stream": "^6.0.0",
+ "human-signals": "^2.1.0",
+ "is-stream": "^2.0.0",
+ "merge-stream": "^2.0.0",
+ "npm-run-path": "^4.0.1",
+ "onetime": "^5.1.2",
+ "signal-exit": "^3.0.3",
+ "strip-final-newline": "^2.0.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sindresorhus/execa?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/get-stream": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/get-stream/-/get-stream-6.0.1.tgz",
+ "integrity": "sha512-ts6Wi+2j3jQjqi70w5AlN8DFnkSwC+MqmxEzdEALB2qXZYV3X/b1CTfgPLGJNMeAWxdPfU8FO1ms3NUfaHCPYg==",
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/human-signals": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/human-signals/-/human-signals-2.1.0.tgz",
+ "integrity": "sha512-B4FFZ6q/T2jhhksgkbEW3HBvWIfDW85snkQgawt07S7J5QXTk6BkNV+0yAeZrM5QpMAdYlocGoljn0sJ/WQkFw==",
+ "engines": {
+ "node": ">=10.17.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/is-stream": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+ "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+ "engines": {
+ "node": ">=8"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/mimic-fn": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/mimic-fn/-/mimic-fn-2.1.0.tgz",
+ "integrity": "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/npm-run-path": {
+ "version": "4.0.1",
+ "resolved": "https://registry.npmjs.org/npm-run-path/-/npm-run-path-4.0.1.tgz",
+ "integrity": "sha512-S48WzZW777zhNIrn7gxOlISNAqi9ZC/uQFnRdbeIHhZhCA6UqpkOT8T1G7BvfdgP4Er8gF4sUbaS0i7QvIfCWw==",
+ "dependencies": {
+ "path-key": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/onetime": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/onetime/-/onetime-5.1.2.tgz",
+ "integrity": "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg==",
+ "dependencies": {
+ "mimic-fn": "^2.1.0"
+ },
+ "engines": {
+ "node": ">=6"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/signal-exit": {
+ "version": "3.0.7",
+ "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-3.0.7.tgz",
+ "integrity": "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/run-applescript/node_modules/strip-final-newline": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-2.0.0.tgz",
+ "integrity": "sha512-BrpvfNAE3dcvq7ll3xVumzjKjZQ5tI1sEUIKr3Uoks0XUl45St3FlatVqef9prk4jRDzhW6WZg+3bk93y6pLjA==",
+ "engines": {
+ "node": ">=6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/run-parallel": {
+ "version": "1.2.0",
+ "resolved": "https://registry.npmjs.org/run-parallel/-/run-parallel-1.2.0.tgz",
+ "integrity": "sha512-5l4VyZR86LZ/lDxZTR6jqL8AFE2S0IFLMP26AbjsLVADxHdhB/c0GUsH+y39UfCi3dzz8OlQuPmnaJOMoDHQBA==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/feross"
+ },
+ {
+ "type": "patreon",
+ "url": "https://www.patreon.com/feross"
+ },
+ {
+ "type": "consulting",
+ "url": "https://feross.org/support"
+ }
+ ],
+ "dependencies": {
+ "queue-microtask": "^1.2.2"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/safe-buffer": {
+ "version": "5.2.1",
+ "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+ "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+ "funding": [
+ {
+ "type": "github",
+ "url": "https://github.com/sponsors/feross"
+ },
+ {
+ "type": "patreon",
+ "url": "https://www.patreon.com/feross"
+ },
+ {
+ "type": "consulting",
+ "url": "https://feross.org/support"
+ }
+ ]
+ },
+ "node_modules/@ui5/cli/node_modules/safer-buffer": {
+ "version": "2.1.2",
+ "resolved": "https://registry.npmjs.org/safer-buffer/-/safer-buffer-2.1.2.tgz",
+ "integrity": "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="
+ },
+ "node_modules/@ui5/cli/node_modules/sax": {
+ "version": "1.4.3",
+ "resolved": "https://registry.npmjs.org/sax/-/sax-1.4.3.tgz",
+ "integrity": "sha512-yqYn1JhPczigF94DMS+shiDMjDowYO6y9+wB/4WgO0Y19jWYk0lQ4tuG5KI7kj4FTp1wxPj5IFfcrz/s1c3jjQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/select-hose": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/select-hose/-/select-hose-2.0.0.tgz",
+ "integrity": "sha512-mEugaLK+YfkijB4fx0e6kImuJdCIt2LxCRcbEYPqRGCs4F2ogyfZU5IAZRdjCP8JPq2AtdNoC/Dux63d9Kiryg=="
+ },
+ "node_modules/@ui5/cli/node_modules/semver": {
+ "version": "7.7.3",
+ "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
+ "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+ "bin": {
+ "semver": "bin/semver.js"
+ },
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/semver-diff": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/semver-diff/-/semver-diff-4.0.0.tgz",
+ "integrity": "sha512-0Ju4+6A8iOnpL/Thra7dZsSlOHYAHIeMxfhWQRI1/VLcT3WDBZKKtQt/QkBOsiIN9ZpuvHE6cGZ0x4glCMmfiA==",
+ "dependencies": {
+ "semver": "^7.3.5"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/send": {
+ "version": "0.19.0",
+ "resolved": "https://registry.npmjs.org/send/-/send-0.19.0.tgz",
+ "integrity": "sha512-dW41u5VfLXu8SJh5bwRmyYUbAoSB3c9uQh6L8h/KtsFREPWpbX1lrljJo186Jc4nmci/sGUZ9a0a0J2zgfq2hw==",
+ "dependencies": {
+ "debug": "2.6.9",
+ "depd": "2.0.0",
+ "destroy": "1.2.0",
+ "encodeurl": "~1.0.2",
+ "escape-html": "~1.0.3",
+ "etag": "~1.8.1",
+ "fresh": "0.5.2",
+ "http-errors": "2.0.0",
+ "mime": "1.6.0",
+ "ms": "2.1.3",
+ "on-finished": "2.4.1",
+ "range-parser": "~1.2.1",
+ "statuses": "2.0.1"
+ },
+ "engines": {
+ "node": ">= 0.8.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/send/node_modules/debug": {
+ "version": "2.6.9",
+ "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
+ "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+ "dependencies": {
+ "ms": "2.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/send/node_modules/debug/node_modules/ms": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
+ "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+ },
+ "node_modules/@ui5/cli/node_modules/send/node_modules/encodeurl": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/encodeurl/-/encodeurl-1.0.2.tgz",
+ "integrity": "sha512-TPJXq8JqFaVYm2CWmPvnP2Iyo4ZSM7/QKcSmuMLDObfpH5fi7RUGmd/rTDf+rut/saiDiQEeVTNgAmJEdAOx0w==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/serve-static": {
+ "version": "1.16.2",
+ "resolved": "https://registry.npmjs.org/serve-static/-/serve-static-1.16.2.tgz",
+ "integrity": "sha512-VqpjJZKadQB/PEbEwvFdO43Ax5dFBZ2UECszz8bQ7pi7wt//PWe1P6MN7eCnjsatYtBT6EuiClbjSWP2WrIoTw==",
+ "dependencies": {
+ "encodeurl": "~2.0.0",
+ "escape-html": "~1.0.3",
+ "parseurl": "~1.3.3",
+ "send": "0.19.0"
+ },
+ "engines": {
+ "node": ">= 0.8.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/setprototypeof": {
+ "version": "1.2.0",
+ "resolved": "https://registry.npmjs.org/setprototypeof/-/setprototypeof-1.2.0.tgz",
+ "integrity": "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="
+ },
+ "node_modules/@ui5/cli/node_modules/shebang-command": {
+ "version": "2.0.0",
+ "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+ "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+ "dependencies": {
+ "shebang-regex": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/shebang-regex": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+ "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/side-channel": {
+ "version": "1.1.0",
+ "resolved": "https://registry.npmjs.org/side-channel/-/side-channel-1.1.0.tgz",
+ "integrity": "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==",
+ "dependencies": {
+ "es-errors": "^1.3.0",
+ "object-inspect": "^1.13.3",
+ "side-channel-list": "^1.0.0",
+ "side-channel-map": "^1.0.1",
+ "side-channel-weakmap": "^1.0.2"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/side-channel-list": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/side-channel-list/-/side-channel-list-1.0.0.tgz",
+ "integrity": "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==",
+ "dependencies": {
+ "es-errors": "^1.3.0",
+ "object-inspect": "^1.13.3"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/side-channel-map": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/side-channel-map/-/side-channel-map-1.0.1.tgz",
+ "integrity": "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==",
+ "dependencies": {
+ "call-bound": "^1.0.2",
+ "es-errors": "^1.3.0",
+ "get-intrinsic": "^1.2.5",
+ "object-inspect": "^1.13.3"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/side-channel-weakmap": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/side-channel-weakmap/-/side-channel-weakmap-1.0.2.tgz",
+ "integrity": "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A==",
+ "dependencies": {
+ "call-bound": "^1.0.2",
+ "es-errors": "^1.3.0",
+ "get-intrinsic": "^1.2.5",
+ "object-inspect": "^1.13.3",
+ "side-channel-map": "^1.0.1"
+ },
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/signal-exit": {
+ "version": "4.1.0",
+ "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+ "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+ "engines": {
+ "node": ">=14"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/isaacs"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/sigstore": {
+ "version": "2.3.1",
+ "resolved": "https://registry.npmjs.org/sigstore/-/sigstore-2.3.1.tgz",
+ "integrity": "sha512-8G+/XDU8wNsJOQS5ysDVO0Etg9/2uA5gR9l4ZwijjlwxBcrU6RPfwi2+jJmbP+Ap1Hlp/nVAaEO4Fj22/SL2gQ==",
+ "dependencies": {
+ "@sigstore/bundle": "^2.3.2",
+ "@sigstore/core": "^1.0.0",
+ "@sigstore/protobuf-specs": "^0.3.2",
+ "@sigstore/sign": "^2.3.2",
+ "@sigstore/tuf": "^2.3.4",
+ "@sigstore/verify": "^1.2.1"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/slash": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/slash/-/slash-4.0.0.tgz",
+ "integrity": "sha512-3dOsAHXXUkQTpOYcoAxLIorMTp4gIQr5IW3iVb7A7lFIp0VHhnynm9izx6TssdrIcVIESAlVjtnO2K8bg+Coew==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/smart-buffer": {
+ "version": "4.2.0",
+ "resolved": "https://registry.npmjs.org/smart-buffer/-/smart-buffer-4.2.0.tgz",
+ "integrity": "sha512-94hK0Hh8rPqQl2xXc3HsaBoOXKV20MToPkcXvwbISWLEs+64sBq5kFgn2kJDHb1Pry9yrP0dxrCI9RRci7RXKg==",
+ "engines": {
+ "node": ">= 6.0.0",
+ "npm": ">= 3.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/socks": {
+ "version": "2.8.7",
+ "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.7.tgz",
+ "integrity": "sha512-HLpt+uLy/pxB+bum/9DzAgiKS8CX1EvbWxI4zlmgGCExImLdiad2iCwXT5Z4c9c3Eq8rP2318mPW2c+QbtjK8A==",
+ "dependencies": {
+ "ip-address": "^10.0.1",
+ "smart-buffer": "^4.2.0"
+ },
+ "engines": {
+ "node": ">= 10.0.0",
+ "npm": ">= 3.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/socks-proxy-agent": {
+ "version": "8.0.5",
+ "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
+ "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
+ "dependencies": {
+ "agent-base": "^7.1.2",
+ "debug": "^4.3.4",
+ "socks": "^2.8.3"
+ },
+ "engines": {
+ "node": ">= 14"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/source-map": {
+ "version": "0.6.1",
+ "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+ "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+ "engines": {
+ "node": ">=0.10.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/source-map-support": {
+ "version": "0.5.21",
+ "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+ "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+ "dependencies": {
+ "buffer-from": "^1.0.0",
+ "source-map": "^0.6.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/spdx-correct": {
+ "version": "3.2.0",
+ "resolved": "https://registry.npmjs.org/spdx-correct/-/spdx-correct-3.2.0.tgz",
+ "integrity": "sha512-kN9dJbvnySHULIluDHy32WHRUu3Og7B9sbY7tsFLctQkIqnMh3hErYgdMjTYuqmcXX+lK5T1lnUt3G7zNswmZA==",
+ "dependencies": {
+ "spdx-expression-parse": "^3.0.0",
+ "spdx-license-ids": "^3.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/spdx-correct/node_modules/spdx-expression-parse": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+ "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+ "dependencies": {
+ "spdx-exceptions": "^2.1.0",
+ "spdx-license-ids": "^3.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/spdx-exceptions": {
+ "version": "2.5.0",
+ "resolved": "https://registry.npmjs.org/spdx-exceptions/-/spdx-exceptions-2.5.0.tgz",
+ "integrity": "sha512-PiU42r+xO4UbUS1buo3LPJkjlO7430Xn5SVAhdpzzsPHsjbYVflnnFdATgabnLude+Cqu25p6N+g2lw/PFsa4w=="
+ },
+ "node_modules/@ui5/cli/node_modules/spdx-license-ids": {
+ "version": "3.0.22",
+ "resolved": "https://registry.npmjs.org/spdx-license-ids/-/spdx-license-ids-3.0.22.tgz",
+ "integrity": "sha512-4PRT4nh1EImPbt2jASOKHX7PB7I+e4IWNLvkKFDxNhJlfjbYlleYQh285Z/3mPTHSAK/AvdMmw5BNNuYH8ShgQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/spdy": {
+ "version": "4.0.2",
+ "resolved": "https://registry.npmjs.org/spdy/-/spdy-4.0.2.tgz",
+ "integrity": "sha512-r46gZQZQV+Kl9oItvl1JZZqJKGr+oEkB08A6BzkiR7593/7IbtuncXHd2YoYeTsG4157ZssMu9KYvUHLcjcDoA==",
+ "dependencies": {
+ "debug": "^4.1.0",
+ "handle-thing": "^2.0.0",
+ "http-deceiver": "^1.2.7",
+ "select-hose": "^2.0.0",
+ "spdy-transport": "^3.0.0"
+ },
+ "engines": {
+ "node": ">=6.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/spdy-transport": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/spdy-transport/-/spdy-transport-3.0.0.tgz",
+ "integrity": "sha512-hsLVFE5SjA6TCisWeJXFKniGGOpBgMLmerfO2aCyCU5s7nJ/rpAepqmFifv/GCbSbueEeAJJnmSQ2rKC/g8Fcw==",
+ "dependencies": {
+ "debug": "^4.1.0",
+ "detect-node": "^2.0.4",
+ "hpack.js": "^2.1.6",
+ "obuf": "^1.1.2",
+ "readable-stream": "^3.0.6",
+ "wbuf": "^1.7.3"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/spdy-transport/node_modules/readable-stream": {
+ "version": "3.6.2",
+ "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
+ "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+ "dependencies": {
+ "inherits": "^2.0.3",
+ "string_decoder": "^1.1.1",
+ "util-deprecate": "^1.0.1"
+ },
+ "engines": {
+ "node": ">= 6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/ssri": {
+ "version": "10.0.6",
+ "resolved": "https://registry.npmjs.org/ssri/-/ssri-10.0.6.tgz",
+ "integrity": "sha512-MGrFH9Z4NP9Iyhqn16sDtBpRRNJ0Y2hNa6D65h736fVSaPCHr4DM4sWUNvVaSuC+0OBGhwsrydQwmgfg5LncqQ==",
+ "dependencies": {
+ "minipass": "^7.0.3"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/statuses": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/statuses/-/statuses-2.0.1.tgz",
+ "integrity": "sha512-RwNA9Z/7PrK06rYLIzFMlaF+l73iwpzsqRIFgbMLbTcLD6cOao82TaWefPXQvB2fOC4AjuYSEndS7N/mTCbkdQ==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string_decoder": {
+ "version": "1.3.0",
+ "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
+ "integrity": "sha512-hkRX8U1WjJFd8LsDJ2yQ/wWWxaopEsABU1XfkM8A+j0+85JAGppt16cr1Whg6KIbb4okU6Mql6BOj+uup/wKeA==",
+ "dependencies": {
+ "safe-buffer": "~5.2.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string-width": {
+ "version": "4.2.3",
+ "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+ "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+ "dependencies": {
+ "emoji-regex": "^8.0.0",
+ "is-fullwidth-code-point": "^3.0.0",
+ "strip-ansi": "^6.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string-width-cjs": {
+ "name": "string-width",
+ "version": "4.2.3",
+ "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+ "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+ "dependencies": {
+ "emoji-regex": "^8.0.0",
+ "is-fullwidth-code-point": "^3.0.0",
+ "strip-ansi": "^6.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string-width-cjs/node_modules/ansi-regex": {
+ "version": "5.0.1",
+ "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+ "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string-width-cjs/node_modules/is-fullwidth-code-point": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+ "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string-width-cjs/node_modules/strip-ansi": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+ "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+ "dependencies": {
+ "ansi-regex": "^5.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string-width/node_modules/ansi-regex": {
+ "version": "5.0.1",
+ "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+ "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string-width/node_modules/is-fullwidth-code-point": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+ "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/string-width/node_modules/strip-ansi": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+ "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+ "dependencies": {
+ "ansi-regex": "^5.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/strip-ansi": {
+ "version": "7.1.2",
+ "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.2.tgz",
+ "integrity": "sha512-gmBGslpoQJtgnMAvOVqGZpEz9dyoKTCzy2nfz/n8aIFhN/jCE/rCmcxabB6jOOHV+0WNnylOxaxBQPSvcWklhA==",
+ "dependencies": {
+ "ansi-regex": "^6.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/strip-ansi-cjs": {
+ "name": "strip-ansi",
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+ "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+ "dependencies": {
+ "ansi-regex": "^5.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
+ "version": "5.0.1",
+ "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+ "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/strip-final-newline": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/strip-final-newline/-/strip-final-newline-3.0.0.tgz",
+ "integrity": "sha512-dOESqjYr96iWYylGObzd39EuNTa5VJxyvVAEm5Jnh7KGo75V43Hk1odPQkNDyXNmUR6k+gEiDVXnjB8HJ3crXw==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/strip-json-comments": {
+ "version": "3.1.1",
+ "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+ "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+ "engines": {
+ "node": ">=8"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/supports-preserve-symlinks-flag": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/supports-preserve-symlinks-flag/-/supports-preserve-symlinks-flag-1.0.0.tgz",
+ "integrity": "sha512-ot0WnXS9fgdkgIcePe6RHNk1WA8+muPa6cSjeR3V8K27q9BB1rTE3R1p7Hv0z1ZyAc8s6Vvv8DIyWf681MAt0w==",
+ "engines": {
+ "node": ">= 0.4"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/ljharb"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/tar": {
+ "version": "6.2.1",
+ "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
+ "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
+ "dependencies": {
+ "chownr": "^2.0.0",
+ "fs-minipass": "^2.0.0",
+ "minipass": "^5.0.0",
+ "minizlib": "^2.1.1",
+ "mkdirp": "^1.0.3",
+ "yallist": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/tar/node_modules/fs-minipass": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-2.1.0.tgz",
+ "integrity": "sha512-V/JgOLFCS+R6Vcq0slCuaeWEdNC3ouDlJMNIsacH2VtALiu9mV4LPrHc5cDl8k5aw6J8jwgWWpiTo5RYhmIzvg==",
+ "dependencies": {
+ "minipass": "^3.0.0"
+ },
+ "engines": {
+ "node": ">= 8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/tar/node_modules/fs-minipass/node_modules/minipass": {
+ "version": "3.3.6",
+ "resolved": "https://registry.npmjs.org/minipass/-/minipass-3.3.6.tgz",
+ "integrity": "sha512-DxiNidxSEK+tHG6zOIklvNOwm3hvCrbUrdtzY74U6HKTJxvIDfOUL5W5P2Ghd3DTkhhKPYGqeNUIh5qcM4YBfw==",
+ "dependencies": {
+ "yallist": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/tar/node_modules/minipass": {
+ "version": "5.0.0",
+ "resolved": "https://registry.npmjs.org/minipass/-/minipass-5.0.0.tgz",
+ "integrity": "sha512-3FnjYuehv9k6ovOEbyOswadCDPX1piCfhV8ncmYtHOjuPwylVWsghTLo7rabjC3Rx5xD4HDx8Wm1xnMF7S5qFQ==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/tar/node_modules/mkdirp": {
+ "version": "1.0.4",
+ "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-1.0.4.tgz",
+ "integrity": "sha512-vVqVZQyf3WLx2Shd0qJ9xuvqgAyKPLAiqITEtqW0oIUjzo3PePDd6fW9iFz30ef7Ysp/oiWqbhszeGWW2T6Gzw==",
+ "bin": {
+ "mkdirp": "bin/cmd.js"
+ },
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/tar/node_modules/yallist": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/yallist/-/yallist-4.0.0.tgz",
+ "integrity": "sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A=="
+ },
+ "node_modules/@ui5/cli/node_modules/terser": {
+ "version": "5.44.1",
+ "resolved": "https://registry.npmjs.org/terser/-/terser-5.44.1.tgz",
+ "integrity": "sha512-t/R3R/n0MSwnnazuPpPNVO60LX0SKL45pyl9YlvxIdkH0Of7D5qM2EVe+yASRIlY5pZ73nclYJfNANGWPwFDZw==",
+ "dependencies": {
+ "@jridgewell/source-map": "^0.3.3",
+ "acorn": "^8.15.0",
+ "commander": "^2.20.0",
+ "source-map-support": "~0.5.20"
+ },
+ "bin": {
+ "terser": "bin/terser"
+ },
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/titleize": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/titleize/-/titleize-3.0.0.tgz",
+ "integrity": "sha512-KxVu8EYHDPBdUYdKZdKtU2aj2XfEx9AfjXxE/Aj0vT06w2icA09Vus1rh6eSu1y01akYg6BjIK/hxyLJINoMLQ==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/to-regex-range": {
+ "version": "5.0.1",
+ "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+ "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+ "dependencies": {
+ "is-number": "^7.0.0"
+ },
+ "engines": {
+ "node": ">=8.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/toidentifier": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/toidentifier/-/toidentifier-1.0.1.tgz",
+ "integrity": "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==",
+ "engines": {
+ "node": ">=0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/tuf-js": {
+ "version": "2.2.1",
+ "resolved": "https://registry.npmjs.org/tuf-js/-/tuf-js-2.2.1.tgz",
+ "integrity": "sha512-GwIJau9XaA8nLVbUXsN3IlFi7WmQ48gBUrl3FTkkL/XLu/POhBzfmX9hd33FNMX1qAsfl6ozO1iMmW9NC8YniA==",
+ "dependencies": {
+ "@tufjs/models": "2.0.1",
+ "debug": "^4.3.4",
+ "make-fetch-happen": "^13.0.1"
+ },
+ "engines": {
+ "node": "^16.14.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/type-is": {
+ "version": "1.6.18",
+ "resolved": "https://registry.npmjs.org/type-is/-/type-is-1.6.18.tgz",
+ "integrity": "sha512-TkRKr9sUTxEH8MdfuCSP7VizJyzRNMjj2J2do2Jr3Kym598JVdEksuzPQCnlFPW4ky9Q+iA+ma9BGm06XQBy8g==",
+ "dependencies": {
+ "media-typer": "0.3.0",
+ "mime-types": "~2.1.24"
+ },
+ "engines": {
+ "node": ">= 0.6"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/typedarray-to-buffer": {
+ "version": "3.1.5",
+ "resolved": "https://registry.npmjs.org/typedarray-to-buffer/-/typedarray-to-buffer-3.1.5.tgz",
+ "integrity": "sha512-zdu8XMNEDepKKR+XYOXAVPtWui0ly0NtohUscw+UmaHiAWT8hrV1rr//H6V+0DvJ3OQ19S979M0laLfX8rm82Q==",
+ "dependencies": {
+ "is-typedarray": "^1.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/uc.micro": {
+ "version": "2.1.0",
+ "resolved": "https://registry.npmjs.org/uc.micro/-/uc.micro-2.1.0.tgz",
+ "integrity": "sha512-ARDJmphmdvUk6Glw7y9DQ2bFkKBHwQHLi2lsaH6PPmz/Ka9sFOBsBluozhDltWmnv9u/cF6Rt87znRTPV+yp/A=="
+ },
+ "node_modules/@ui5/cli/node_modules/underscore": {
+ "version": "1.13.7",
+ "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.13.7.tgz",
+ "integrity": "sha512-GMXzWtsc57XAtguZgaQViUOzs0KTkk8ojr3/xAxXLITqf/3EMwxC0inyETfDFjH/Krbhuep0HNbbjI9i/q3F3g=="
+ },
+ "node_modules/@ui5/cli/node_modules/unique-filename": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-3.0.0.tgz",
+ "integrity": "sha512-afXhuC55wkAmZ0P18QsVE6kp8JaxrEokN2HGIoIVv2ijHQd419H0+6EigAFcIzXeMIkcIkNBpB3L/DXB3cTS/g==",
+ "dependencies": {
+ "unique-slug": "^4.0.0"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/unique-slug": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-4.0.0.tgz",
+ "integrity": "sha512-WrcA6AyEfqDX5bWige/4NQfPZMtASNVxdmWR76WESYQVAACSgWcR6e9i0mofqqBxYFtL4oAxPIptY73/0YE1DQ==",
+ "dependencies": {
+ "imurmurhash": "^0.1.4"
+ },
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/unique-string": {
+ "version": "3.0.0",
+ "resolved": "https://registry.npmjs.org/unique-string/-/unique-string-3.0.0.tgz",
+ "integrity": "sha512-VGXBUVwxKMBUznyffQweQABPRRW1vHZAbadFZud4pLFAqRGvv/96vafgjWFqzourzr8YonlQiPgH0YCJfawoGQ==",
+ "dependencies": {
+ "crypto-random-string": "^4.0.0"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/unpipe": {
+ "version": "1.0.0",
+ "resolved": "https://registry.npmjs.org/unpipe/-/unpipe-1.0.0.tgz",
+ "integrity": "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/untildify": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/untildify/-/untildify-4.0.0.tgz",
+ "integrity": "sha512-KK8xQ1mkzZeg9inewmFVDNkg3l5LUhoq9kN6iWYB/CC9YMG8HA+c1Q8HwDe6dEX7kErrEVNVBO3fWsVq5iDgtw==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/update-notifier": {
+ "version": "6.0.2",
+ "resolved": "https://registry.npmjs.org/update-notifier/-/update-notifier-6.0.2.tgz",
+ "integrity": "sha512-EDxhTEVPZZRLWYcJ4ZXjGFN0oP7qYvbXWzEgRm/Yql4dHX5wDbvh89YHP6PK1lzZJYrMtXUuZZz8XGK+U6U1og==",
+ "dependencies": {
+ "boxen": "^7.0.0",
+ "chalk": "^5.0.1",
+ "configstore": "^6.0.0",
+ "has-yarn": "^3.0.0",
+ "import-lazy": "^4.0.0",
+ "is-ci": "^3.0.1",
+ "is-installed-globally": "^0.4.0",
+ "is-npm": "^6.0.0",
+ "is-yarn-global": "^0.4.0",
+ "latest-version": "^7.0.0",
+ "pupa": "^3.1.0",
+ "semver": "^7.3.7",
+ "semver-diff": "^4.0.0",
+ "xdg-basedir": "^5.1.0"
+ },
+ "engines": {
+ "node": ">=14.16"
+ },
+ "funding": {
+ "url": "https://github.com/yeoman/update-notifier?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/uri-js": {
+ "version": "4.4.1",
+ "resolved": "https://registry.npmjs.org/uri-js/-/uri-js-4.4.1.tgz",
+ "integrity": "sha512-7rKUyy33Q1yc98pQ1DAmLtwX109F7TIfWlW1Ydo8Wl1ii1SeHieeh0HHfPeL2fMXK6z0s8ecKs9frCuLJvndBg==",
+ "dependencies": {
+ "punycode": "^2.1.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/util-deprecate": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/util-deprecate/-/util-deprecate-1.0.2.tgz",
+ "integrity": "sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw=="
+ },
+ "node_modules/@ui5/cli/node_modules/utils-merge": {
+ "version": "1.0.1",
+ "resolved": "https://registry.npmjs.org/utils-merge/-/utils-merge-1.0.1.tgz",
+ "integrity": "sha512-pMZTvIkT1d+TFGvDOqodOclx0QWkkgi6Tdoa8gC8ffGAAqz9pzPTZWAybbsHHoED/ztMtkv/VoYTYyShUn81hA==",
+ "engines": {
+ "node": ">= 0.4.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/validate-npm-package-license": {
+ "version": "3.0.4",
+ "resolved": "https://registry.npmjs.org/validate-npm-package-license/-/validate-npm-package-license-3.0.4.tgz",
+ "integrity": "sha512-DpKm2Ui/xN7/HQKCtpZxoRWBhZ9Z0kqtygG8XCgNQ8ZlDnxuQmWhj566j8fN4Cu3/JmbhsDo7fcAJq4s9h27Ew==",
+ "dependencies": {
+ "spdx-correct": "^3.0.0",
+ "spdx-expression-parse": "^3.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/validate-npm-package-license/node_modules/spdx-expression-parse": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/spdx-expression-parse/-/spdx-expression-parse-3.0.1.tgz",
+ "integrity": "sha512-cbqHunsQWnJNE6KhVSMsMeH5H/L9EpymbzqTQ3uLwNCLZ1Q481oWaofqH7nO6V07xlXwY6PhQdQ2IedWx/ZK4Q==",
+ "dependencies": {
+ "spdx-exceptions": "^2.1.0",
+ "spdx-license-ids": "^3.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/validate-npm-package-name": {
+ "version": "5.0.1",
+ "resolved": "https://registry.npmjs.org/validate-npm-package-name/-/validate-npm-package-name-5.0.1.tgz",
+ "integrity": "sha512-OljLrQ9SQdOUqTaQxqL5dEfZWrXExyyWsozYlAWFawPVNuD83igl7uJD2RTkNMbniIYgt8l81eCJGIdQF7avLQ==",
+ "engines": {
+ "node": "^14.17.0 || ^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/vary": {
+ "version": "1.1.2",
+ "resolved": "https://registry.npmjs.org/vary/-/vary-1.1.2.tgz",
+ "integrity": "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg==",
+ "engines": {
+ "node": ">= 0.8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/walk-up-path": {
+ "version": "3.0.1",
+ "resolved": "https://registry.npmjs.org/walk-up-path/-/walk-up-path-3.0.1.tgz",
+ "integrity": "sha512-9YlCL/ynK3CTlrSRrDxZvUauLzAswPCrsaCgilqFevUYpeEW0/3ScEjaa3kbW/T0ghhkEr7mv+fpjqn1Y1YuTA=="
+ },
+ "node_modules/@ui5/cli/node_modules/wbuf": {
+ "version": "1.7.3",
+ "resolved": "https://registry.npmjs.org/wbuf/-/wbuf-1.7.3.tgz",
+ "integrity": "sha512-O84QOnr0icsbFGLS0O3bI5FswxzRr8/gHwWkDlQFskhSPryQXvrTMxjxGP4+iWYoauLoBvfDpkrOauZ+0iZpDA==",
+ "dependencies": {
+ "minimalistic-assert": "^1.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/which": {
+ "version": "4.0.0",
+ "resolved": "https://registry.npmjs.org/which/-/which-4.0.0.tgz",
+ "integrity": "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg==",
+ "dependencies": {
+ "isexe": "^3.1.1"
+ },
+ "bin": {
+ "node-which": "bin/which.js"
+ },
+ "engines": {
+ "node": "^16.13.0 || >=18.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/widest-line": {
+ "version": "4.0.1",
+ "resolved": "https://registry.npmjs.org/widest-line/-/widest-line-4.0.1.tgz",
+ "integrity": "sha512-o0cyEG0e8GPzT4iGHphIOh0cJOV8fivsXxddQasHPHfoZf1ZexrfeA21w2NaEN1RHE+fXlfISmOE8R9N3u3Qig==",
+ "dependencies": {
+ "string-width": "^5.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/widest-line/node_modules/emoji-regex": {
+ "version": "9.2.2",
+ "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+ "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
+ },
+ "node_modules/@ui5/cli/node_modules/widest-line/node_modules/string-width": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+ "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+ "dependencies": {
+ "eastasianwidth": "^0.2.0",
+ "emoji-regex": "^9.2.2",
+ "strip-ansi": "^7.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/workerpool": {
+ "version": "6.5.1",
+ "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-6.5.1.tgz",
+ "integrity": "sha512-Fs4dNYcsdpYSAfVxhnl1L5zTksjvOJxtC5hzMNl+1t9B8hTJTdKDyZ5ju7ztgPy+ft9tBFXoOlDNiOT9WUXZlA=="
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi": {
+ "version": "8.1.0",
+ "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+ "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+ "dependencies": {
+ "ansi-styles": "^6.1.0",
+ "string-width": "^5.0.1",
+ "strip-ansi": "^7.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi-cjs": {
+ "name": "wrap-ansi",
+ "version": "7.0.0",
+ "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+ "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+ "dependencies": {
+ "ansi-styles": "^4.0.0",
+ "string-width": "^4.1.0",
+ "strip-ansi": "^6.0.0"
+ },
+ "engines": {
+ "node": ">=10"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
+ "version": "5.0.1",
+ "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+ "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi-cjs/node_modules/ansi-styles": {
+ "version": "4.3.0",
+ "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+ "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+ "dependencies": {
+ "color-convert": "^2.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ },
+ "funding": {
+ "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi-cjs/node_modules/color-convert": {
+ "version": "2.0.1",
+ "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+ "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+ "dependencies": {
+ "color-name": "~1.1.4"
+ },
+ "engines": {
+ "node": ">=7.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi-cjs/node_modules/color-name": {
+ "version": "1.1.4",
+ "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+ "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
+ "version": "6.0.1",
+ "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+ "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+ "dependencies": {
+ "ansi-regex": "^5.0.1"
+ },
+ "engines": {
+ "node": ">=8"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi/node_modules/emoji-regex": {
+ "version": "9.2.2",
+ "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+ "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
+ },
+ "node_modules/@ui5/cli/node_modules/wrap-ansi/node_modules/string-width": {
+ "version": "5.1.2",
+ "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+ "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+ "dependencies": {
+ "eastasianwidth": "^0.2.0",
+ "emoji-regex": "^9.2.2",
+ "strip-ansi": "^7.0.1"
+ },
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/wrappy": {
+ "version": "1.0.2",
+ "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+ "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="
+ },
+ "node_modules/@ui5/cli/node_modules/xdg-basedir": {
+ "version": "5.1.0",
+ "resolved": "https://registry.npmjs.org/xdg-basedir/-/xdg-basedir-5.1.0.tgz",
+ "integrity": "sha512-GCPAHLvrIH13+c0SuacwvRYj2SxJXQ4kaVTT5xgL3kPrz56XxkF21IGhjSE1+W0aw7gpBWRGXLCPnPby6lSpmQ==",
+ "engines": {
+ "node": ">=12"
+ },
+ "funding": {
+ "url": "https://github.com/sponsors/sindresorhus"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/xml2js": {
+ "version": "0.6.2",
+ "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.6.2.tgz",
+ "integrity": "sha512-T4rieHaC1EXcES0Kxxj4JWgaUQHDk+qwHcYOCFHfiwKz7tOVPLq7Hjq9dM1WCMhylqMEfP7hMcOIChvotiZegA==",
+ "dependencies": {
+ "sax": ">=0.6.0",
+ "xmlbuilder": "~11.0.0"
+ },
+ "engines": {
+ "node": ">=4.0.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/xml2js/node_modules/xmlbuilder": {
+ "version": "11.0.1",
+ "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-11.0.1.tgz",
+ "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==",
+ "engines": {
+ "node": ">=4.0"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/xmlcreate": {
+ "version": "2.0.4",
+ "resolved": "https://registry.npmjs.org/xmlcreate/-/xmlcreate-2.0.4.tgz",
+ "integrity": "sha512-nquOebG4sngPmGPICTS5EnxqhKbCmz5Ox5hsszI2T6U5qdrJizBc+0ilYSEjTSzU0yZcmvppztXe/5Al5fUwdg=="
+ },
+ "node_modules/@ui5/cli/node_modules/y18n": {
+ "version": "5.0.8",
+ "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+ "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+ "engines": {
+ "node": ">=10"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/yaml-ast-parser": {
+ "version": "0.0.43",
+ "resolved": "https://registry.npmjs.org/yaml-ast-parser/-/yaml-ast-parser-0.0.43.tgz",
+ "integrity": "sha512-2PTINUwsRqSd+s8XxKaJWQlUuEMHJQyEuh2edBbW8KNJz0SJPwUSD2zRWqezFEdN7IzAgeuYHFUCF7o8zRdZ0A=="
+ },
+ "node_modules/@ui5/cli/node_modules/yargs": {
+ "version": "17.7.2",
+ "resolved": "https://registry.npmjs.org/yargs/-/yargs-17.7.2.tgz",
+ "integrity": "sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==",
+ "dependencies": {
+ "cliui": "^8.0.1",
+ "escalade": "^3.1.1",
+ "get-caller-file": "^2.0.5",
+ "require-directory": "^2.1.1",
+ "string-width": "^4.2.3",
+ "y18n": "^5.0.5",
+ "yargs-parser": "^21.1.1"
+ },
+ "engines": {
+ "node": ">=12"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/yargs-parser": {
+ "version": "21.1.1",
+ "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-21.1.1.tgz",
+ "integrity": "sha512-tVpsJW7DdjecAiFpbIB1e3qxIQsE6NoPc5/eTdrbbIC4h0LVsWhnoa3g+m2HclBIujHzsxZ4VJVA+GUuc2/LBw==",
+ "engines": {
+ "node": ">=12"
+ }
+ },
+ "node_modules/@ui5/cli/node_modules/yesno": {
+ "version": "0.4.0",
+ "resolved": "https://registry.npmjs.org/yesno/-/yesno-0.4.0.tgz",
+ "integrity": "sha512-tdBxmHvbXPBKYIg81bMCB7bVeDmHkRzk5rVJyYYXurwKkHq/MCd8rz4HSJUP7hW0H2NlXiq8IFiWvYKEHhlotA=="
+ }
+ }
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package.json b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package.json
new file mode 100644
index 00000000..e67073b7
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package.json
@@ -0,0 +1,8 @@
+{
+ "name": "sap-ui5-xss",
+ "version": "1.0.0",
+ "main": "index.js",
+ "dependencies": {
+ "@ui5/cli": "^3.0.7"
+ }
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/ui5.yaml b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/ui5.yaml
new file mode 100644
index 00000000..beb2ff69
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/ui5.yaml
@@ -0,0 +1,7 @@
+specVersion: '3.0'
+metadata:
+ name: sap-ui5-xss
+type: application
+framework:
+ name: SAPUI5
+ version: "1.115.0"
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/Component.js b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/Component.js
new file mode 100644
index 00000000..2f390a84
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/Component.js
@@ -0,0 +1,12 @@
+sap.ui.define([
+ "sap/ui/core/UIComponent"
+], function(UIComponent) {
+ "use strict";
+ return UIComponent.extend("codeql-sap-js.Component", {
+ metadata: {
+ manifest: "json"
+ },
+
+ init: function() { }
+ })
+})
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js
new file mode 100644
index 00000000..c32cd814
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js
@@ -0,0 +1,35 @@
+sap.ui.define([
+ "sap/ui/core/mvc/Controller",
+ "sap/ui/model/json/JSONModel",
+ "sap/ui/core/EventBus"
+], function(Controller, JSONModel, EventBus) {
+ "use strict";
+ return Controller.extend("codeql-sap-js.controller.App1", {
+ /*
+ * 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
+ * 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
+ * 3. XSS.controller's method `doSomething2`: set HTML's content
+ */
+ onInit: function() {
+ let oData = {
+ input: null,
+ output1: null
+ };
+ let oModel = new JSONModel(oData);
+ this.getView().setModel(oModel);
+ this.bus = EventBus.getInstance();
+ this.bus.subscribe("xssChannel", "xss", this.doSomething2, this);
+ },
+
+ doSomething1() {
+ let oInput = this.getView().byId("input");
+ let value = oInput.getValue();
+ this.bus.publish("xssChannel", "xss", { message: value });
+ },
+
+ doSomething2(channel, event, model) {
+ let oHtmlOutput = this.getView().byId("htmlOutput");
+ oHtmlOutput.setContent(model.message);
+ }
+ });
+});
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js
new file mode 100644
index 00000000..f801e502
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js
@@ -0,0 +1,35 @@
+sap.ui.define([
+ "sap/ui/core/mvc/Controller",
+ "sap/ui/model/json/JSONModel",
+ "sap/ui/core/EventBus"
+], function(Controller, JSONModel, EventBus) {
+ "use strict";
+ return Controller.extend("codeql-sap-js.controller.App2", {
+ /*
+ * 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
+ * 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
+ * 3. XSS.controller's method `doSomething2`: set HTML's content
+ */
+ onInit: function() {
+ let oData = {
+ input: null,
+ output1: null
+ };
+ let oModel = new JSONModel(oData);
+ this.getView().setModel(oModel);
+ this.bus = sap.ui.getCore().getEventBus();
+ this.bus.subscribe("xssChannel", "xss", this.doSomething2, this);
+ },
+
+ doSomething1() {
+ let oInput = this.getView().byId("input");
+ let value = oInput.getValue();
+ this.bus.publish("xssChannel", "xss", { message: value });
+ },
+
+ doSomething2(channel, event, model) {
+ let oHtmlOutput = this.getView().byId("htmlOutput");
+ oHtmlOutput.setContent(model.message);
+ }
+ });
+});
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js
new file mode 100644
index 00000000..1e16c1fd
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js
@@ -0,0 +1,29 @@
+sap.ui.define([
+ "sap/ui/core/mvc/Controller",
+ "sap/ui/model/json/JSONModel",
+ "sap/ui/core/EventBus"
+], function(Controller, JSONModel, EventBus) {
+ "use strict";
+ return Controller.extend("codeql-sap-js.controller.App3", {
+ /*
+ * 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
+ * 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
+ * 3. XSS.controller's method `doSomething2`: set HTML's content
+ */
+ onInit: function() {
+ let oData = {
+ input: null,
+ output1: null
+ };
+ let oModel = new JSONModel(oData);
+ this.getView().setModel(oModel);
+ this.bus = this.getOwnerComponent().getEventBus();
+ },
+
+ doSomething1() {
+ let oInput = this.getView().byId("input");
+ let value = oInput.getValue();
+ this.bus.publish("xssChannel", "xss", { message: value });
+ }
+ });
+});
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js
new file mode 100644
index 00000000..600b1328
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js
@@ -0,0 +1,29 @@
+sap.ui.define([
+ "sap/ui/core/mvc/Controller",
+ "sap/ui/model/json/JSONModel",
+ "sap/ui/core/EventBus"
+], function(Controller, JSONModel, EventBus) {
+ "use strict";
+ return Controller.extend("codeql-sap-js.controller.App4", {
+ /*
+ * 1. XSS.controller's method `doSomething1`: publish event "xss" with data pulled in
+ * 2. XSS.controller's method `onInit`: subscribe to event "xss" with handler `doSomething2`
+ * 3. XSS.controller's method `doSomething2`: set HTML's content
+ */
+ onInit: function() {
+ let oData = {
+ input: null,
+ output1: null
+ };
+ let oModel = new JSONModel(oData);
+ this.getView().setModel(oModel);
+ this.bus = this.getOwnerComponent().getEventBus();
+ this.bus.subscribe("xssChannel", "xss", this.doSomething2, this);
+ },
+
+ doSomething2(channel, event, model) {
+ let oHtmlOutput = this.getView().byId("htmlOutput");
+ oHtmlOutput.setContent(model.message);
+ }
+ });
+});
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/app.controller.js b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/app.controller.js
new file mode 100644
index 00000000..7ae85694
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/app.controller.js
@@ -0,0 +1,8 @@
+sap.ui.define([
+ "sap/ui/core/mvc/Controller",
+], function(Controller) {
+ "use strict";
+ return Controller.extend("codeql-sap-js.controller.App", {
+ onInit: function() { }
+ });
+});
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.html b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.html
new file mode 100644
index 00000000..0d9daa38
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.html
@@ -0,0 +1,21 @@
+
+
+
+
+
+
+ SAPUI5 XSS
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.js b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.js
new file mode 100644
index 00000000..7a66697f
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.js
@@ -0,0 +1,11 @@
+sap.ui.define([
+ "sap/ui/core/mvc/XMLView"
+], function (XMLView) {
+ "use strict";
+ XMLView.create({
+ viewName: "codeql-sap-js.view.app"
+ }).then(function (oView) {
+ oView.placeAt("content");
+ });
+
+});
\ No newline at end of file
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/manifest.json b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/manifest.json
new file mode 100644
index 00000000..dbccaa59
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/manifest.json
@@ -0,0 +1,94 @@
+{
+ "_version": "0.0.1",
+ "sap.app": {
+ "id": "codeql-sap-js",
+ "type": "application",
+ "applicationVersion": {
+ "version": "0.0.1"
+ },
+ "title": "{{appTitle}}",
+ "description": "{{appDescription}}",
+ "dataSources": {
+ "someDataSource": {
+ "uri": "some/path/to/dataSource",
+ "type": "OData",
+ "settings": {
+ "odataVersion": "2.0"
+ }
+ }
+ }
+ },
+ "sap.ui": {
+ "technology": "UI5"
+ },
+ "sap.ui5": {
+ "rootView": "codeql-sap-js.controller.App",
+ "dependencies": {
+ "minUI5Version": "1.30",
+ "libs": {
+ "sap.m": {},
+ "sap.ui.layout": {}
+ }
+ },
+
+ "models": {
+ "someRemoteModel": {
+ "dataSource": "someDataSource",
+ "settings": {
+ "defaultBindingMode": "TwoWay"
+ }
+ }
+ },
+ "config": {
+ "someDataSource": "some/path/to/dataSource"
+ },
+ "routing": {
+ "config": {
+ "routerClass": "sap.m.routing.Router",
+ "viewType": "XML",
+ "async": true,
+ "viewPath": "codeql-sap-js.view"
+ },
+ "routes": [
+ {
+ "pattern": "somePattern1",
+ "name": "someName1",
+ "target": "someTarget1"
+ },
+ {
+ "pattern": "somePattern2",
+ "name": "someName2",
+ "target": "someTarget2"
+ },
+ {
+ "pattern": "somePattern3",
+ "name": "someName3",
+ "target": "someTarget3"
+ },
+ {
+ "pattern": "somePattern4",
+ "name": "someName4",
+ "target": "someTarget4"
+ }
+ ],
+ "targets": {
+ "someTarget1": {
+ "viewName": "App1",
+ "viewLevel": 1
+ },
+ "someTarget2": {
+ "viewName": "App2",
+ "viewLevel": 1
+ },
+ "someTarget3": {
+ "viewName": "App3",
+ "viewLevel": 1
+ },
+ "someTarget4": {
+ "viewName": "App4",
+ "viewLevel": 1
+ }
+ }
+ }
+ }
+}
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App1.view.xml b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App1.view.xml
new file mode 100644
index 00000000..930355a2
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App1.view.xml
@@ -0,0 +1,13 @@
+
+
+
+
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App2.view.xml b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App2.view.xml
new file mode 100644
index 00000000..c772ccc8
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App2.view.xml
@@ -0,0 +1,13 @@
+
+
+
+
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App3.view.xml b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App3.view.xml
new file mode 100644
index 00000000..fa7b3882
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App3.view.xml
@@ -0,0 +1,11 @@
+
+
+
+
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App4.view.xml b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App4.view.xml
new file mode 100644
index 00000000..a1361e42
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App4.view.xml
@@ -0,0 +1,7 @@
+
+
diff --git a/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/app.view.xml b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/app.view.xml
new file mode 100644
index 00000000..345d88b4
--- /dev/null
+++ b/javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/app.view.xml
@@ -0,0 +1,9 @@
+
+
+
+
+
+
${getUserName(id) || \"Unknown name\"}
`;\n\t// ...\n\tres.send(prefix + userHtml + suffix);\n});\n\n```\nSanitizing the user-controlled data for `\"` helps prevent the vulnerability:\n\n\n```javascript\nvar app = require('express')();\n\napp.get('/user/:id', function(req, res) {\n\tlet id = req.params.id;\n\tid = id.replace(/<|>|&|\"/g, \"\"); // GOOD\n\tlet userHtml = `${getUserName(id) || \"Unknown name\"}
`;\n\t// ...\n\tres.send(prefix + userHtml + suffix);\n});\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [Types of Cross-Site](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n","markdown":"# Incomplete HTML attribute sanitization\nSanitizing untrusted input for HTML meta-characters is a common technique for preventing cross-site scripting attacks. Usually, this is done by escaping `<`, `>`, `&` and `\"`. However, the context in which the sanitized value is used decides the characters that need to be sanitized.\n\nAs a consequence, some programs only sanitize `<` and `>` since those are the most common dangerous characters. The lack of sanitization for `\"` is problematic when an incompletely sanitized value is used as an HTML attribute in a string that later is parsed as HTML.\n\n\n## Recommendation\nSanitize all relevant HTML meta-characters when constructing HTML dynamically, and pay special attention to where the sanitized value is used.\n\nAn even safer alternative is to design the application so that sanitization is not needed, for instance by using HTML templates that are explicit about the values they treat as HTML.\n\n\n## Example\nThe following example code writes part of an HTTP request (which is controlled by the user) to an HTML attribute of the server response. The user-controlled value is, however, not sanitized for `\"`. This leaves the website vulnerable to cross-site scripting since an attacker can use a string like `\" onclick=\"alert(42)` to inject JavaScript code into the response.\n\n\n```javascript\nvar app = require('express')();\n\napp.get('/user/:id', function(req, res) {\n\tlet id = req.params.id;\n\tid = id.replace(/<|>/g, \"\"); // BAD\n\tlet userHtml = `${getUserName(id) || \"Unknown name\"}
`;\n\t// ...\n\tres.send(prefix + userHtml + suffix);\n});\n\n```\nSanitizing the user-controlled data for `\"` helps prevent the vulnerability:\n\n\n```javascript\nvar app = require('express')();\n\napp.get('/user/:id', function(req, res) {\n\tlet id = req.params.id;\n\tid = id.replace(/<|>|&|\"/g, \"\"); // GOOD\n\tlet userHtml = `${getUserName(id) || \"Unknown name\"}
`;\n\t// ...\n\tres.send(prefix + userHtml + suffix);\n});\n\n```\n\n## References\n* OWASP: [DOM based XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html).\n* OWASP: [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* OWASP [Types of Cross-Site](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* Wikipedia: [Cross-site scripting](http://en.wikipedia.org/wiki/Cross-site_scripting).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-20](https://cwe.mitre.org/data/definitions/20.html).\n"},"properties":{"tags":["security","external/cwe/cwe-079","external/cwe/cwe-116","external/cwe/cwe-020"],"description":"Writing incompletely sanitized values to HTML\n attribute strings can lead to a cross-site\n scripting vulnerability.","id":"js/incomplete-html-attribute-sanitization","kind":"path-problem","name":"Incomplete HTML attribute sanitization","precision":"high","problem.severity":"warning","security-severity":"6.1"}},{"id":"js/incomplete-multi-character-sanitization","name":"js/incomplete-multi-character-sanitization","shortDescription":{"text":"Incomplete multi-character sanitization"},"fullDescription":{"text":"A sanitizer that removes a sequence of characters may reintroduce the dangerous sequence."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Incomplete multi-character sanitization\nSanitizing untrusted input is a common technique for preventing injection attacks and other security vulnerabilities. Regular expressions are often used to perform this sanitization. However, when the regular expression matches multiple consecutive characters, replacing it just once can result in the unsafe text reappearing in the sanitized input.\n\nAttackers can exploit this issue by crafting inputs that, when sanitized with an ineffective regular expression, still contain malicious code or content. This can lead to code execution, data exposure, or other vulnerabilities.\n\n\n## Recommendation\nTo prevent this issue, it is highly recommended to use a well-tested sanitization library whenever possible. These libraries are more likely to handle corner cases and ensure effective sanitization.\n\nIf a library is not an option, you can consider alternative strategies to fix the issue. For example, applying the regular expression replacement repeatedly until no more replacements can be performed, or rewriting the regular expression to match single characters instead of the entire unsafe text.\n\n\n## Example\nConsider the following JavaScript code that aims to remove all HTML comment start and end tags:\n\n```javascript\n\nstr.replace(/\n```\n```javascript\nvar input = oModel.getProperty(\"/input\");\njQuery.sap.log.debug(input); // user input is logged as is\n```\n2. A second component sends log entries to a remote URL without further validation.\n```javascript\nconst http = new XMLHttpRequest();\nconst url = \"https://some.remote.server/location\";\nhttp.open(\"POST\", url);\nhttp.send(Log.getLogEntries()[0].message); // log entry is forwarded to a remote URL\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP UI5 Documentation: [namespace `sap/base/Log`](https://sapui5.hana.ondemand.com/sdk/#api/module:sap/base/Log).\n","markdown":"# UI5 Log injection in outbound network request\n\nSending user-controlled log data to a remote URL without further validation may lead to uncontrolled information exposure and to injection vulnerabilities. It may be an indication of malicious backdoor code that has been implanted into an otherwise trusted code base.\n\nUI5 applications can retrieve logs for further processing using `sap/base/Log.getLogEntries`, define custom listeners using `sap/base/Log.addLogListener` or directly display logs using the `sap/ui/vk/Notifications` control.\n\nThis query identifies instances where log entries from user input are forwarded to a remote URL. \n\n## Recommendation\n\nAvoid processing log entries that originate from user-controlled sources. Ensure that any log data is properly sanitized.\n\n## Example\n\nThe following example demonstrates a vulnerable code snippet:\n\n1. The UI5 application logs what the user submitted via the `sap.m.Input` control.\n```xml\n \n```\n```javascript\nvar input = oModel.getProperty(\"/input\");\njQuery.sap.log.debug(input); // user input is logged as is\n```\n2. A second component sends log entries to a remote URL without further validation.\n```javascript\nconst http = new XMLHttpRequest();\nconst url = \"https://some.remote.server/location\";\nhttp.open(\"POST\", url);\nhttp.send(Log.getLogEntries()[0].message); // log entry is forwarded to a remote URL\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP UI5 Documentation: [namespace `sap/base/Log`](https://sapui5.hana.ondemand.com/sdk/#api/module:sap/base/Log).\n"},"properties":{"tags":["security","external/cwe/cwe-117"],"description":"Building log entries from user-controlled sources is vulnerable to\n insertion of forged log entries by a malicious user.","id":"js/ui5-log-injection-to-http","kind":"path-problem","name":"UI5 Log injection in outbound network request","precision":"medium","problem.severity":"warning","security-severity":"6.5"}},{"id":"js/ui5-unsafe-log-access","name":"js/ui5-unsafe-log-access","shortDescription":{"text":"Access to user-controlled UI5 Logs"},"fullDescription":{"text":"Log entries from user-controlled sources should not be further processed."},"defaultConfiguration":{"enabled":true,"level":"warning"},"help":{"text":"# Access to user-controlled UI5 Logs\n\nProcessing user-controlled log entries can lead to injection vulnerabilities, where an attacker can manipulate user input to affect the application excution.\n\nUI5 applications can retrieve logs for further processing using `sap/base/Log.getLogEntries`, define custom listeners using `sap/base/Log.addLogListener` or directly display logs using the `sap/ui/vk/Notifications` control.\n\nThis query identifies instances where user-controlled log entries are accessed in a UI5 application. \n\n## Recommendation\n\nAvoid accessing log entries that originate from user-controlled sources. Ensure that any log data is properly sanitized.\n\n## Example\n\nThe following example demonstrates a vulnerable code snippet:\n\n1. The UI5 application logs what the user submitted via the `sap.m.Input` control.\n```xml\n \n```\n```javascript\nvar input = oModel.getProperty(\"/input\");\njQuery.sap.log.debug(input); // user input is logged as is\n```\n2. A second component retrieves log entries to further process them.\n```javascript\nlet message = Log.getLogEntries()[0].message; //access to user controlled logs\ndo_smth(message);\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP UI5 Documentation: [namespace `sap/base/Log`](https://sapui5.hana.ondemand.com/sdk/#api/module:sap/base/Log).\n","markdown":"# Access to user-controlled UI5 Logs\n\nProcessing user-controlled log entries can lead to injection vulnerabilities, where an attacker can manipulate user input to affect the application excution.\n\nUI5 applications can retrieve logs for further processing using `sap/base/Log.getLogEntries`, define custom listeners using `sap/base/Log.addLogListener` or directly display logs using the `sap/ui/vk/Notifications` control.\n\nThis query identifies instances where user-controlled log entries are accessed in a UI5 application. \n\n## Recommendation\n\nAvoid accessing log entries that originate from user-controlled sources. Ensure that any log data is properly sanitized.\n\n## Example\n\nThe following example demonstrates a vulnerable code snippet:\n\n1. The UI5 application logs what the user submitted via the `sap.m.Input` control.\n```xml\n \n```\n```javascript\nvar input = oModel.getProperty(\"/input\");\njQuery.sap.log.debug(input); // user input is logged as is\n```\n2. A second component retrieves log entries to further process them.\n```javascript\nlet message = Log.getLogEntries()[0].message; //access to user controlled logs\ndo_smth(message);\n```\n\n## References\n\n- OWASP: [Log Injection](https://owasp.org/www-community/attacks/Log_Injection).\n- OWASP: [Log Injection Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html).\n- SAP UI5 Documentation: [namespace `sap/base/Log`](https://sapui5.hana.ondemand.com/sdk/#api/module:sap/base/Log).\n"},"properties":{"tags":["security","external/cwe/cwe-117"],"description":"Log entries from user-controlled sources should not be further processed.","id":"js/ui5-unsafe-log-access","kind":"path-problem","name":"Access to user-controlled UI5 Logs","precision":"medium","problem.severity":"warning","security-severity":"5"}},{"id":"js/ui5-formula-injection","name":"js/ui5-formula-injection","shortDescription":{"text":"UI5 Formula Injection"},"fullDescription":{"text":"Saving data from an uncontrolled remote source using filesystem or local storage leads to disclosure of sensitive information or forgery of entry."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Formula injection\n\nUI5 applications that save local data, fetched from an uncontrolled remote source, into a CSV file format using generic APIs such as [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save) are vulnerable to formula injection, or CSV injection.\n\n## Recommendation\n\n### Escape the leading special characters\n\nCSV cells containing leading special characters such as an equal sign (`=`) may be interpreted as spreadsheet formulas. To prevent them from being interpreted these prefixes should be escaped by surrounding the prefixes with single quotes in order to keep them as literal strings.\n\n### Use a dedicated API function\n\nManual construction of a CSV file using string concatenation is prone to mistakes that can lead to security issues. Instead, a dedicated library function should be used. For example, if the target being exported is a [`sap.m.Table`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.m.Table) and the resulting file is to intended to be opened using a spreadsheet program anyways, then using one of the API functions provided by [`sap.ui.export.Spreadsheet`](https://sapui5.hana.ondemand.com/#/entity/sap.ui.export.Spreadsheet) is the preferred method of achieving the same exporting functionality.\n\n## Example\n\nThe following controller is exporting a CSV file obtained from an event parameter by surrounding it in a pair of semicolons (`;`) as CSV separators.\n\n``` javascript\nsap.ui.define([\n \"sap/ui/core/Controller\",\n \"sap/ui/core/util/File\"\n ], function(Controller, File) {\n return Controller.extend(\"vulnerable.controller.app\", {\n onSomeEvent: function(oEvent) {\n let response = oEvent.getProperty(\"someProperty\").someField;\n let csvRow = \";\" + response + \";\";\n File.save(csvRow, \"someFile\", \"csv\", \"text/csv\", \"utf-8\");\n }\n });\n });\n```\n\n## References\n\n- OWASP: [CSV Injection](https://owasp.org/www-community/attacks/CSV_Injection).\n- Common Weakness Enumeration: [CWE-1236](https://cwe.mitre.org/data/definitions/1236.html).\n- SAP UI5 API Reference: [`sap.ui.export.Spreadsheet`](https://sapui5.hana.ondemand.com/#/entity/sap.ui.export.Spreadsheet).\n- SAP UI5 API Reference: [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save).\n","markdown":"# Formula injection\n\nUI5 applications that save local data, fetched from an uncontrolled remote source, into a CSV file format using generic APIs such as [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save) are vulnerable to formula injection, or CSV injection.\n\n## Recommendation\n\n### Escape the leading special characters\n\nCSV cells containing leading special characters such as an equal sign (`=`) may be interpreted as spreadsheet formulas. To prevent them from being interpreted these prefixes should be escaped by surrounding the prefixes with single quotes in order to keep them as literal strings.\n\n### Use a dedicated API function\n\nManual construction of a CSV file using string concatenation is prone to mistakes that can lead to security issues. Instead, a dedicated library function should be used. For example, if the target being exported is a [`sap.m.Table`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.m.Table) and the resulting file is to intended to be opened using a spreadsheet program anyways, then using one of the API functions provided by [`sap.ui.export.Spreadsheet`](https://sapui5.hana.ondemand.com/#/entity/sap.ui.export.Spreadsheet) is the preferred method of achieving the same exporting functionality.\n\n## Example\n\nThe following controller is exporting a CSV file obtained from an event parameter by surrounding it in a pair of semicolons (`;`) as CSV separators.\n\n``` javascript\nsap.ui.define([\n \"sap/ui/core/Controller\",\n \"sap/ui/core/util/File\"\n ], function(Controller, File) {\n return Controller.extend(\"vulnerable.controller.app\", {\n onSomeEvent: function(oEvent) {\n let response = oEvent.getProperty(\"someProperty\").someField;\n let csvRow = \";\" + response + \";\";\n File.save(csvRow, \"someFile\", \"csv\", \"text/csv\", \"utf-8\");\n }\n });\n });\n```\n\n## References\n\n- OWASP: [CSV Injection](https://owasp.org/www-community/attacks/CSV_Injection).\n- Common Weakness Enumeration: [CWE-1236](https://cwe.mitre.org/data/definitions/1236.html).\n- SAP UI5 API Reference: [`sap.ui.export.Spreadsheet`](https://sapui5.hana.ondemand.com/#/entity/sap.ui.export.Spreadsheet).\n- SAP UI5 API Reference: [`sap.ui.core.util.File.save`](https://sapui5.hana.ondemand.com/sdk/#/api/sap.ui.core.util.File%23methods/sap.ui.core.util.File.save).\n"},"properties":{"tags":["security","external/cwe/cwe-1236"],"description":"Saving data from an uncontrolled remote source using filesystem or local storage\n leads to disclosure of sensitive information or forgery of entry.","id":"js/ui5-formula-injection","kind":"path-problem","name":"UI5 Formula Injection","precision":"medium","problem.severity":"error","security-severity":"7.8"}},{"id":"js/ui5-xss","name":"js/ui5-xss","shortDescription":{"text":"UI5 Client-side cross-site scripting"},"fullDescription":{"text":"Writing user input directly to a UI5 View allows for a cross-site scripting vulnerability."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Client-side cross-site scripting\n\nReceiving text from the user, most notably through a control, and rendering it as HTML in another control can lead to a cross-site scripting vulnerability.\n\n## Recommendation\n\n### Preventing XSS Involving User Defined Control\n\nIf the XSS attack vector includes a user-defined control, then we can mitigate the issue by sanitizing the user-provided input in the implementation of the control:\n- Where possible, define the property type to something other than `string` or `any`. If a value should be used, then opt for the `enum` type which only allows a predefined set of strings.\n- Use escaping functions in `sap.base.security`. Relevant sanitizers include `encodeXML` and `encodeHTML`.\n- When using API with `apiVersion: 2` (Semantic Rendering), do not use `RenderManager.unsafeHtml` unless the control property `sanitizeContent` is set to `true`.\n- When using the now-deprecated older API with `RenderManager.write` or `RenderManager.writeAttribute`, use their respective counterparts `RenderManager.writeEscaped` and `RenderManager.writeAttributeEscaped` which sanitizes their rendered contents.\n\n### Preventing XSS Not Involving User Defined Control\n\nAn XSS attack vector can still exist even when no user-defined control is used. In this case, a model property or a control property act as an intermediate step when external data is passed in.\nIn this case, the UI5 application should not use the property as is, but should sanitize the contents before reading it. Such sanitization can take place in the controller or in the view declaration using expression bindings.\n\n## Example\n\n### Custom Control with Custom Rendering Method\n\nThis custom control `vulnerable.control.xss` calls `unsafeHtml` on a given `RenderManager` instance in its static renderer function. Since its `text` property is an unrestricted string type, it can point to a string with contents that can be interpreted as HTML. If it is the case, `unsafeHtml` will render the string, running a possibly embedded JavaScript code in it.\n\n```javascript\nsap.ui.define([\"sap/ui/core/Control\"], function (Control) {\n return Control.extend(\"vulnerable.control.xss\", {\n metadata: { properties: { text: { type: \"string\" } } },\n renderer: {\n apiVersion: 2,\n render: function (oRm, oControl) {\n oRm.openStart(\"div\", oControl);\n oRm.unsafeHtml(oControl.getText()); // sink\n oRm.close(\"div\");\n }\n }\n });\n})\n```\n\nThis is the same custom control without the possibility of XSS using several means of sanitization: The property `text` is enforced to a non-string type, hence disallows unrestricted strings (This is espcially applicable if the expected input is a number anyways). Also, the `sap.base.security.encodeXML` function is used to escape HTML control characters.\n\n```javascript\nsap.ui.define([\"sap/ui/core/Control\", \"sap/base/security/encodeXML\"], function (Control, encodeXML) {\n return Control.extend(\"vulnerable.control.xss\", {\n metadata: { properties: { text: { type: \"int\" } } }, // constrain the type\n renderer: {\n apiVersion: 2,\n render: function (oRm, oControl) {\n oRm.openStart(\"div\", oControl);\n oRm.unsafeHtml(encodeXML(oControl.getText()); // encode using security functions\n oRm.close(\"div\");\n }\n }\n });\n})\n```\n\n### Library Control\n\nThis example contains only library controls that are not user-defined. The untrusted user input flows from `sap.m.Input` and directly flows out via `sap.ui.core.HTML` through the model property `input` as declared in the `onInit` method of the controller.\n\n``` xml\n\" + clientData + \"
\");\n$.response.status = $.net.http.OK;\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Cross-Site Scripting\n](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/0e1c9fff826a4583be715386578fffc7.html).\n* OWASP: [Types of Cross-site Scripting](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* OWASP: [Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n\n","markdown":"# Reflected Cross-site Scripting\n\nIncluding a text, received from a client browser typically through an XSJS request parameter, to be rendered as HTML in a request body may execute arbitrary JavaScript code on the client.\n\n## Recommendation\n\nThe XSJS application should always validate or sanitize the submitted string from a client before including it into a response body to be rendered in a client browser.\n\n### Validate the input string\n\nValidate the submitted input by looking for a sensitive HTML tag such as ``. The pattern may be encoded to a regular expression and matched against the input; If there is a match, then the XSJS application may decide to abort the process and instead return an HTTP code stating that the application rejected the request (e.g. `$.net.FORBIDDEN`). XSJS does not provide a function to reliably perform the above, therefore using a third-party library is recommended.\n\n### Sanitize the input string\n\n#### Server-side sanitization\n\nThe XSJS application may instead allow any user input, but sanitize it before it integrates it into the response body. This is achieved by escaping special characters that are treated as part of the HTML syntax, such as `\"`, `&`, `'`, `<`, and `>`. Since XSJS does not provide a function to escape these, using a third-party library is recommended.\n\n#### Client-side sanitization\n\nAlternatively, if SAP UI5 is used on the frontend, there are client-side escaping mechanisms such as `sap.base.security.encodeXML` and `sap.base.security.encodeHTML`. If `sap.ui.core.HTML` is used in the frontend view, consider setting its `sanitizeContent` property explicitly to `true`, since its default value is `false`.\n\n## Example\n\nThe following XSJS application sets the response body directly to a string received from a user without any validation or sanitization. The header's content type is set as an HTML document, which allows for any embedded JavaScript to be run in the request body. Note that even if `clientData` was not enclosed in a `div`, the vulnerability would still exist.\n\n``` javascript\nlet clientData = requestParameters.get(\"someParameter\");\n$.response.contentType = \"text/html\";\n$.response.setBody(\"\" + clientData + \"
\");\n$.response.status = $.net.http.OK;\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Cross-Site Scripting\n](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/0e1c9fff826a4583be715386578fffc7.html).\n* OWASP: [Types of Cross-site Scripting](https://owasp.org/www-community/Types_of_Cross-Site_Scripting).\n* OWASP: [Cross Site Scripting Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n\n"},"properties":{"tags":["security"],"description":"Including uncontrolled value into a response body and setting it to\n a scriptable MIME type allows for cross-site scripting vulnerability.","id":"js/xsjs-reflected-xss","kind":"path-problem","name":"XSJS Reflected XSS","precision":"medium","problem.severity":"error","security-severity":"7.8"}},{"id":"js/xsjs-url-redirect","name":"js/xsjs-url-redirect","shortDescription":{"text":"XSJS URL Redirect"},"fullDescription":{"text":"Setting the `location` response header to an uncontrolled value allows for redirection to an arbitrary URL."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# URL Redirect\n\nAn HTTP response sent by an XSJS server whose value of the `location` header is dependent on a user input can redirect the client to an arbitrary location on the web by a malicious actor. For example, the redirected URL may point to a carefully imitated webpage of a genuine one, thus may lure a victim to submit its sign-in credentials.\n\n## Recommendation\n\nAvoid setting the entirety of URL or the domain part of it, which is obtained in any way from an external user, to the `location` header value, to keep redirection within the organization's domain. The URL to redirect the user to may be safely restricted by following one or more of the below strategies.\n\n### Redirect to a URL from an internal allow-list\n\nSelect the URL from a predefined allow-list that is kept internal. It may be shared across organizations, but should be kept confidential to any external actors.\n\n### Hardcode the domain part of the URL\n\nIf the URL to redirect the user to needs to be dependent upon a remote value, consider parameterizing only the request parameter portion and hardcode the rest of it, including the domain part. This way the redirection is kept within the organization.\n\n### Use a server-side template engine\n\nThere can be a single URL to which all redirection of the same type can happen where the redirected page can be customized to the customer with the help from a template engine. The details of the page can be filled from the server-side, not the client side through a request parameter. This way the URL does not need to be parameterized in any way while also filling the need for a customized redirect page.\n\n## Example\n\nThe following XSJS application sets the entire value of the location of its response to some URL retrieved from a request parameter.\n\n``` javascript\nlet someParameterValue = requestParameters.get(\"someParameter\");\n$.response.status = $.net.http.OK;\n$.response.headers.set(\"location\", someParameterValue);\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Invalid Redirection](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/8c5ec75c27f543cb8b4c65c337b285ae.html).\n* Mozilla: [Location](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Location).\n* OWASP: [XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-601](https://cwe.mitre.org/data/definitions/601.html).\n* SAP XSJS Documentation: [$.web.WebRequest](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.web.WebRequest.html).\n* SAP XSJS Documentation: [$.web.WebResponse](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.web.WebResponse.html).\n","markdown":"# URL Redirect\n\nAn HTTP response sent by an XSJS server whose value of the `location` header is dependent on a user input can redirect the client to an arbitrary location on the web by a malicious actor. For example, the redirected URL may point to a carefully imitated webpage of a genuine one, thus may lure a victim to submit its sign-in credentials.\n\n## Recommendation\n\nAvoid setting the entirety of URL or the domain part of it, which is obtained in any way from an external user, to the `location` header value, to keep redirection within the organization's domain. The URL to redirect the user to may be safely restricted by following one or more of the below strategies.\n\n### Redirect to a URL from an internal allow-list\n\nSelect the URL from a predefined allow-list that is kept internal. It may be shared across organizations, but should be kept confidential to any external actors.\n\n### Hardcode the domain part of the URL\n\nIf the URL to redirect the user to needs to be dependent upon a remote value, consider parameterizing only the request parameter portion and hardcode the rest of it, including the domain part. This way the redirection is kept within the organization.\n\n### Use a server-side template engine\n\nThere can be a single URL to which all redirection of the same type can happen where the redirected page can be customized to the customer with the help from a template engine. The details of the page can be filled from the server-side, not the client side through a request parameter. This way the URL does not need to be parameterized in any way while also filling the need for a customized redirect page.\n\n## Example\n\nThe following XSJS application sets the entire value of the location of its response to some URL retrieved from a request parameter.\n\n``` javascript\nlet someParameterValue = requestParameters.get(\"someParameter\");\n$.response.status = $.net.http.OK;\n$.response.headers.set(\"location\", someParameterValue);\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Invalid Redirection](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/8c5ec75c27f543cb8b4c65c337b285ae.html).\n* Mozilla: [Location](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Location).\n* OWASP: [XSS Unvalidated Redirects and Forwards Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html).\n* Common Weakness Enumeration: [CWE-79](https://cwe.mitre.org/data/definitions/79.html).\n* Common Weakness Enumeration: [CWE-116](https://cwe.mitre.org/data/definitions/116.html).\n* Common Weakness Enumeration: [CWE-601](https://cwe.mitre.org/data/definitions/601.html).\n* SAP XSJS Documentation: [$.web.WebRequest](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.web.WebRequest.html).\n* SAP XSJS Documentation: [$.web.WebResponse](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.web.WebResponse.html).\n"},"properties":{"tags":["security"],"description":"Setting the `location` response header to an uncontrolled value\n allows for redirection to an arbitrary URL.","id":"js/xsjs-url-redirect","kind":"path-problem","name":"XSJS URL Redirect","precision":"medium","problem.severity":"error","security-severity":"6.1"}},{"id":"js/xsjs-sql-injection","name":"js/xsjs-sql-injection","shortDescription":{"text":"XSJS SQL injection"},"fullDescription":{"text":"Directly concatenating an uncontrolled value with an SQL query allows for an SQL injection vulnerability."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# SQL Injection\n\nParameterizing an SQL statement in an unsafe way by directly concatenating the parameter to the statement body may allow arbitrary SQL code fragments to be included to the statement, resulting in possibly destructive behavior.\n\n## Recommendation\n\n### Use XSJS APIs that prepares SQL statements\n\nThere are two versions of API to communicate with SAP HANA, and both APIs provide means of preparing SQL statements that not only facilitates code reuse but also protects the parameterize statement from SQL injections.\n\nThese functions take as first argument an SQL string with placeholders represented as a question mark surrounded with parentheses (`(?)`), and the rest of the arguments consist of JavaScript expressions whose values are filled into the position of the respective placeholders.\n\n#### Using the older API (`$.db`)\n\nIf you are using the older API that belongs to `$.db`, consider replacing string concatentation with `$.db.executeQuery`. For example, the following XSJS application substitutes the value of `someParameterValue1` and `someParameterValue2` into the position of the first and second placeholder positions, respectively.\n\n``` javascript\nlet query = \"INSERT INTO (?) (COL1) VALUES (?)\";\n\nlet dbConnection = $.db.getConnection();\ndbConnection.executeQuery(query, someParameterValue1, someParameterValue2);\n```\n\n#### Using the newer API (`$.hdb`)\n\nIf you are using the newer API that belongs to `$.hdb`, consider replacing string concatentation with `$.hdb.Connection.prepareStatement` followed by `$.db.PreparedStatement.executeUpdate`. For example, the following XSJS application substitues the value of `someParameterValue1` and `someParameterValue2` into the position of the first and second placeholder positions, respectively. After preparation, the application executes the prepared statement and then commits it to the SAP HANA database.\n\n``` javascript\nlet query = \"INSERT INTO (?) (COL1) VALUES (?)\";\nlet dbConnection = $.db.getConnection();\nlet preparedStatement = dbConnection.prepareStatement(query, someParameterValue1, someParameterValue2);\npreparedStatement.executeUpdate();\ndbConnection.commit();\n```\n\n## Example\n\nEach of the following XSJS applications directly concatenates the values of two request paremeters with fragments of an SQL query and executes it.\n\n#### Using the older API (`$.db`)\n\n``` javascript\nlet someParameterValue1 = JSON.parse(requestParameters.get(\"someParameter1\"));\nlet someParameterValue2 = JSON.parse(requestParameters.get(\"someParameter2\"));\nlet query = \"INSERT INTO \" + someParameterValue1 + \".ENTITY (COL1) VALUES (\" + someParameterValue2 + \")\";\n\nlet dbConnection = $.db.getConnection();\nlet preparedStatement = dbConnection.prepareStatement(query);\npreparedStatement.executeUpdate();\ndbConnection.commit();\n```\n\n#### Using the newer API (`$.hdb`)\n\n``` javascript\nlet someParameterValue1 = JSON.parse(requestParameters.get(\"someParameter1\"));\nlet someParameterValue2 = JSON.parse(requestParameters.get(\"someParameter2\"));\nlet query = \"INSERT INTO \" + someParameterValue1 + \" (COL1) VALUES (\" + someParameterValue2 + \")\";\n\nlet dbConnection = $.db.getConnection();\ndbConnection.executeQuery(query);\ndbConnection.commit();\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Injection Flaws\n](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/3e9a0491d2af4b908081fbbee12bc8ba.html).\n* OWASP: [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection).\n* Common Weakness Enumeration: [CWE-89](https://cwe.mitre.org/data/definitions/89.html).\n* Common Weakness Enumeration: [CWE-943](https://cwe.mitre.org/data/definitions/943.html).\n","markdown":"# SQL Injection\n\nParameterizing an SQL statement in an unsafe way by directly concatenating the parameter to the statement body may allow arbitrary SQL code fragments to be included to the statement, resulting in possibly destructive behavior.\n\n## Recommendation\n\n### Use XSJS APIs that prepares SQL statements\n\nThere are two versions of API to communicate with SAP HANA, and both APIs provide means of preparing SQL statements that not only facilitates code reuse but also protects the parameterize statement from SQL injections.\n\nThese functions take as first argument an SQL string with placeholders represented as a question mark surrounded with parentheses (`(?)`), and the rest of the arguments consist of JavaScript expressions whose values are filled into the position of the respective placeholders.\n\n#### Using the older API (`$.db`)\n\nIf you are using the older API that belongs to `$.db`, consider replacing string concatentation with `$.db.executeQuery`. For example, the following XSJS application substitutes the value of `someParameterValue1` and `someParameterValue2` into the position of the first and second placeholder positions, respectively.\n\n``` javascript\nlet query = \"INSERT INTO (?) (COL1) VALUES (?)\";\n\nlet dbConnection = $.db.getConnection();\ndbConnection.executeQuery(query, someParameterValue1, someParameterValue2);\n```\n\n#### Using the newer API (`$.hdb`)\n\nIf you are using the newer API that belongs to `$.hdb`, consider replacing string concatentation with `$.hdb.Connection.prepareStatement` followed by `$.db.PreparedStatement.executeUpdate`. For example, the following XSJS application substitues the value of `someParameterValue1` and `someParameterValue2` into the position of the first and second placeholder positions, respectively. After preparation, the application executes the prepared statement and then commits it to the SAP HANA database.\n\n``` javascript\nlet query = \"INSERT INTO (?) (COL1) VALUES (?)\";\nlet dbConnection = $.db.getConnection();\nlet preparedStatement = dbConnection.prepareStatement(query, someParameterValue1, someParameterValue2);\npreparedStatement.executeUpdate();\ndbConnection.commit();\n```\n\n## Example\n\nEach of the following XSJS applications directly concatenates the values of two request paremeters with fragments of an SQL query and executes it.\n\n#### Using the older API (`$.db`)\n\n``` javascript\nlet someParameterValue1 = JSON.parse(requestParameters.get(\"someParameter1\"));\nlet someParameterValue2 = JSON.parse(requestParameters.get(\"someParameter2\"));\nlet query = \"INSERT INTO \" + someParameterValue1 + \".ENTITY (COL1) VALUES (\" + someParameterValue2 + \")\";\n\nlet dbConnection = $.db.getConnection();\nlet preparedStatement = dbConnection.prepareStatement(query);\npreparedStatement.executeUpdate();\ndbConnection.commit();\n```\n\n#### Using the newer API (`$.hdb`)\n\n``` javascript\nlet someParameterValue1 = JSON.parse(requestParameters.get(\"someParameter1\"));\nlet someParameterValue2 = JSON.parse(requestParameters.get(\"someParameter2\"));\nlet query = \"INSERT INTO \" + someParameterValue1 + \" (COL1) VALUES (\" + someParameterValue2 + \")\";\n\nlet dbConnection = $.db.getConnection();\ndbConnection.executeQuery(query);\ndbConnection.commit();\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* SAP: [Server-Side JavaScript: Injection Flaws\n](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/3e9a0491d2af4b908081fbbee12bc8ba.html).\n* OWASP: [SQL Injection](https://owasp.org/www-community/attacks/SQL_Injection).\n* Common Weakness Enumeration: [CWE-89](https://cwe.mitre.org/data/definitions/89.html).\n* Common Weakness Enumeration: [CWE-943](https://cwe.mitre.org/data/definitions/943.html).\n"},"properties":{"tags":["security"],"description":"Directly concatenating an uncontrolled value with an SQL query allows\n for an SQL injection vulnerability.","id":"js/xsjs-sql-injection","kind":"path-problem","name":"XSJS SQL injection","precision":"medium","problem.severity":"error","security-severity":"8.8"}},{"id":"js/xsjs-zip-slip","name":"js/xsjs-zip-slip","shortDescription":{"text":"XSJS Zip Slip"},"fullDescription":{"text":"Saving an entry of a zip archive into a file with its stated path allows for a path traversal and writing to an arbitrary location."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# Zip Slip\n\nA zip archive received from a remote location may contain arbitrary paths which, when translated to an absolute path, may escape the directory where it is extracted. Such paths may include one or more `../` to traverse the directory tree upwards to write to an arbitrary location, such as the root directory (`/`) or a sensitive path like `/usr/local/`. A sophisticated attack may also attempt to overwrite an existing file by making the filename identical as that of the target file.\n\n## Recommendation\n\nValidate the path of each zip entry before writing them to a file. Several different tactics may be used to prevent the path traversal by one or more of `../` occuring in a zip entry's path.\n\n### Check if the path string contains `../`\n\nA naive but effective way to validate the path of a zip entry is to check if its path, converted to string, contains any occurrences of `../`. If a path does have one, then it can be suspected that the creator of the zip archive is attempting a path traversal attack.\n\n### Resolve the path and check if the target directory is its prefix \n\nA more sophisticated way is to use a JavaScript library function that can be used to check if a substring is a prefix of a string. For example, the following XSJS application uses `String.indexOf(substring)` to check if the name of the directory is indeed the directory resolved by `path.join(prefix, suffix)`. If the absolute path obtained by the `join` function does not start with the target folder's name, the `entryPath` contains bits such as `../` that traverses the path.\n\n``` javascript\nvar zipArchive = new $.util.Zip(requestBody.asArrayBuffer());\nvar targetFolderName = \"unzipped\";\n\nfor (var entryPath in zipArchive) {\n var targetFilePath = require(\"path\").join(targetFolderName, entryPath)\n if (targetFilePath.indexOf(targetFolderName) === 0) {\n require(\"fs\").createWriteStream(targetFilePath).write(zip[entryPath]);\n }\n}\n```\n\n### Example\n\nThis XSJS application simply appends the path of each entry to a target directory name and a separator then saves it to a file with the concatenated path, thereby skipping any validation on it.\n\n``` javascript\nvar zipArchive = new $.util.Zip(requestBody.asArrayBuffer());\nvar targetFolderName = \"unzipped\";\n\nfor (var entryPath in zipArchive) {\n var targetFilePath = targetFolderName + \"/\" + entryPath;\n require(\"fs\").createWriteStream(targetFilePath).write(zip[entryPath]);\n}\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).\n* SAP XSJS Documentation: [$.util.Zip](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.util.Zip.html).\n* Common Weakness Enumeration: [CWE-23](https://cwe.mitre.org/data/definitions/23.html).\n* Common Weakness Enumeration: [CWE-59](https://cwe.mitre.org/data/definitions/59.html).\n","markdown":"# Zip Slip\n\nA zip archive received from a remote location may contain arbitrary paths which, when translated to an absolute path, may escape the directory where it is extracted. Such paths may include one or more `../` to traverse the directory tree upwards to write to an arbitrary location, such as the root directory (`/`) or a sensitive path like `/usr/local/`. A sophisticated attack may also attempt to overwrite an existing file by making the filename identical as that of the target file.\n\n## Recommendation\n\nValidate the path of each zip entry before writing them to a file. Several different tactics may be used to prevent the path traversal by one or more of `../` occuring in a zip entry's path.\n\n### Check if the path string contains `../`\n\nA naive but effective way to validate the path of a zip entry is to check if its path, converted to string, contains any occurrences of `../`. If a path does have one, then it can be suspected that the creator of the zip archive is attempting a path traversal attack.\n\n### Resolve the path and check if the target directory is its prefix \n\nA more sophisticated way is to use a JavaScript library function that can be used to check if a substring is a prefix of a string. For example, the following XSJS application uses `String.indexOf(substring)` to check if the name of the directory is indeed the directory resolved by `path.join(prefix, suffix)`. If the absolute path obtained by the `join` function does not start with the target folder's name, the `entryPath` contains bits such as `../` that traverses the path.\n\n``` javascript\nvar zipArchive = new $.util.Zip(requestBody.asArrayBuffer());\nvar targetFolderName = \"unzipped\";\n\nfor (var entryPath in zipArchive) {\n var targetFilePath = require(\"path\").join(targetFolderName, entryPath)\n if (targetFilePath.indexOf(targetFolderName) === 0) {\n require(\"fs\").createWriteStream(targetFilePath).write(zip[entryPath]);\n }\n}\n```\n\n### Example\n\nThis XSJS application simply appends the path of each entry to a target directory name and a separator then saves it to a file with the concatenated path, thereby skipping any validation on it.\n\n``` javascript\nvar zipArchive = new $.util.Zip(requestBody.asArrayBuffer());\nvar targetFolderName = \"unzipped\";\n\nfor (var entryPath in zipArchive) {\n var targetFilePath = targetFolderName + \"/\" + entryPath;\n require(\"fs\").createWriteStream(targetFilePath).write(zip[entryPath]);\n}\n```\n\n## References\n\n* SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/b5e65421b48c48fa87312a6023f4c414.html).\n* OWASP: [Path Traversal](https://owasp.org/www-community/attacks/Path_Traversal).\n* SAP XSJS Documentation: [$.util.Zip](https://help.sap.com/doc/3de842783af24336b6305a3c0223a369/2.0.03/en-US/$.util.Zip.html).\n* Common Weakness Enumeration: [CWE-23](https://cwe.mitre.org/data/definitions/23.html).\n* Common Weakness Enumeration: [CWE-59](https://cwe.mitre.org/data/definitions/59.html).\n"},"properties":{"tags":["security"],"description":"Saving an entry of a zip archive into a file with its stated path\n allows for a path traversal and writing to an arbitrary location.","id":"js/xsjs-zip-slip","kind":"path-problem","name":"XSJS Zip Slip","precision":"medium","problem.severity":"error","security-severity":"7.5"}},{"id":"js/xsjs-disabled-csrf-protection","name":"js/xsjs-disabled-csrf-protection","shortDescription":{"text":"Disabled XSJS CSRF protection"},"fullDescription":{"text":"Disabling CSRF protection makes the application vulnerable to a Cross-Site Request Forgery (CSRF) attack."},"defaultConfiguration":{"enabled":true,"level":"error"},"help":{"text":"# CSRF protection disabled in HANA XS application\n\nThis XS application is not protected against CSRF (cross-site request forgery) because it either disables the protection or fails to enable the protection explicitly.\n\n## Overview\n\nA web server that receives a request from a client without verifying that it was intentionally sent might be vulnerable to Cross Site Request Forgery (CSRF). An attacker can trick a client into making an unintended request to the web server that will be treated as an authentic request. This can be done via a URL, image load, `XMLHttpRequest`, etc. and can result in exposure of data or unintended code execution.\n\n## Recommendation\n\nSAP’s recommendation is to use CSRF protection for any request that could be processed by a browser client by normal users.\n- If `XS Advanced` is used, CSRF protection is configured with the `\"csrfProtection\"` property of `xs-app.json`. It is **enabled by default and should not be disabled.**\n- If `XS Classic` is used, CSRF protection is configured with the `\"prevent_xsrf\"` property of `.xsaccess`. It is **disabled by default and should be enabled explicitly.**\n\n## Example\n\nThe following `xs-app.json` fragment disables CSRF protection of the application it configures.\n\n```json\n\"routes\": [\n {\n \"source\": \"/bad/(.*)\",\n \"destination\": \"srv_api\",\n \"csrfProtection\": false,\n ...\n },\n ...\n]\n```\n\n## References\n\n- SAP: [XS Advanced Application Router Configuration Syntax](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03#loioa9fc5c220d744180850996e2f5d34d6c__section_N101F7_N10016_N10001), relavant to XS Classic applications.\n- SAP: [Application-Access File Keyword Options, prevent_xsrf](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod), relevant to XS Advanced applications.\n- SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/e8a6bc904c0c48a182288604f467e84a.html).\n- Common Weakness Enumeration: [CWE-352](https://cwe.mitre.org/data/definitions/352.html).\n- OWASP: [Cross-Site Request Forgery (CSRF)](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)).\n","markdown":"# CSRF protection disabled in HANA XS application\n\nThis XS application is not protected against CSRF (cross-site request forgery) because it either disables the protection or fails to enable the protection explicitly.\n\n## Overview\n\nA web server that receives a request from a client without verifying that it was intentionally sent might be vulnerable to Cross Site Request Forgery (CSRF). An attacker can trick a client into making an unintended request to the web server that will be treated as an authentic request. This can be done via a URL, image load, `XMLHttpRequest`, etc. and can result in exposure of data or unintended code execution.\n\n## Recommendation\n\nSAP’s recommendation is to use CSRF protection for any request that could be processed by a browser client by normal users.\n- If `XS Advanced` is used, CSRF protection is configured with the `\"csrfProtection\"` property of `xs-app.json`. It is **enabled by default and should not be disabled.**\n- If `XS Classic` is used, CSRF protection is configured with the `\"prevent_xsrf\"` property of `.xsaccess`. It is **disabled by default and should be enabled explicitly.**\n\n## Example\n\nThe following `xs-app.json` fragment disables CSRF protection of the application it configures.\n\n```json\n\"routes\": [\n {\n \"source\": \"/bad/(.*)\",\n \"destination\": \"srv_api\",\n \"csrfProtection\": false,\n ...\n },\n ...\n]\n```\n\n## References\n\n- SAP: [XS Advanced Application Router Configuration Syntax](https://help.sap.com/docs/SAP_HANA_PLATFORM/b3d0daf2a98e49ada00bf31b7ca7a42e/a9fc5c220d744180850996e2f5d34d6c.html?version=2.0.03#loioa9fc5c220d744180850996e2f5d34d6c__section_N101F7_N10016_N10001), relavant to XS Classic applications.\n- SAP: [Application-Access File Keyword Options, prevent_xsrf](https://help.sap.com/docs/SAP_HANA_PLATFORM/4505d0bdaf4948449b7f7379d24d0f0d/5f77e58ec01b46f6b64ee1e2afe3ead7.html#authenticationmethod), relevant to XS Advanced applications.\n- SAP: [Server-Side JavaScript Security Considerations](https://help.sap.com/docs/SAP_HANA_PLATFORM/d89d4595fae647eabc14002c0340a999/e8a6bc904c0c48a182288604f467e84a.html).\n- Common Weakness Enumeration: [CWE-352](https://cwe.mitre.org/data/definitions/352.html).\n- OWASP: [Cross-Site Request Forgery (CSRF)](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)).\n"},"properties":{"tags":["security","external/cwe/cwe-352"],"description":"Disabling CSRF protection makes the application vulnerable to a Cross-Site Request Forgery (CSRF) attack.","id":"js/xsjs-disabled-csrf-protection","kind":"problem","name":"Disabled XSJS CSRF protection","precision":"high","problem.severity":"error","security-severity":"8.8"}}],"locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/xsjs/src/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/xsjs/src/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}]},{"name":"advanced-security/javascript-sap-xsjs-models","semanticVersion":"2.3.0","locations":[{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/.github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/","description":{"text":"The QL pack root directory."},"properties":{"tags":["CodeQL/LocalPackRoot"]}},{"uri":"file:///home/runner/work/codeql-sap-js/codeql-sap-js/.github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/qlpack.yml","description":{"text":"The QL pack definition file."},"properties":{"tags":["CodeQL/LocalPackDefinitionFile"]}}],"properties":{"isCodeQLModelPack":true}}]},"invocations":[{"toolExecutionNotifications":[{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/codeStyles/Project.xml","uriBaseId":"%SRCROOT%","index":4}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/inspectionProfiles/Project_Default.xml","uriBaseId":"%SRCROOT%","index":5}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-419af57a6ca03c33e081f24fe025fd9562eb8de8ad926dd10c59ce86d3bfee92/node_modules/@sap/cds-dk/node_modules/xml-js/bin/test.xml","uriBaseId":"%SRCROOT%","index":6}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/codeStyles/codeStyleConfig.xml","uriBaseId":"%SRCROOT%","index":7}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/modules.xml","uriBaseId":"%SRCROOT%","index":8}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/vcs.xml","uriBaseId":"%SRCROOT%","index":9}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/xml-js/bin/test.xml","uriBaseId":"%SRCROOT%","index":10}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/codeql-config.yaml","uriBaseId":"%SRCROOT%","index":11}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":12}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":13}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/ui5.model.yml","uriBaseId":"%SRCROOT%","index":14}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":15}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":16}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/xsjs.model.yml","uriBaseId":"%SRCROOT%","index":17}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/additional-sources.model.yml","uriBaseId":"%SRCROOT%","index":18}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":19}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":20}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/cds-extractor-dist-bundle.yml","uriBaseId":"%SRCROOT%","index":21}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/code_scanning.yml","uriBaseId":"%SRCROOT%","index":22}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/codeql-ql.yml","uriBaseId":"%SRCROOT%","index":23}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/run-codeql-unit-tests-javascript.yml","uriBaseId":"%SRCROOT%","index":24}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/update-codeql.yml","uriBaseId":"%SRCROOT%","index":25}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"cds-extractor-marker.js","uriBaseId":"%SRCROOT%","index":26}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"codeql-workspace.yml","uriBaseId":"%SRCROOT%","index":27}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/codeql-extractor.yml","uriBaseId":"%SRCROOT%","index":28}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/.prettierrc.js","uriBaseId":"%SRCROOT%","index":29}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/cds-extractor.ts","uriBaseId":"%SRCROOT%","index":30}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/dist/cds-extractor.bundle.js","uriBaseId":"%SRCROOT%","index":31}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/esbuild.config.mjs","uriBaseId":"%SRCROOT%","index":32}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/eslint.config.mjs","uriBaseId":"%SRCROOT%","index":33}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/jest.config.js","uriBaseId":"%SRCROOT%","index":34}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/package-lock.json","uriBaseId":"%SRCROOT%","index":35}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/package.json","uriBaseId":"%SRCROOT%","index":36}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/command.ts","uriBaseId":"%SRCROOT%","index":37}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/compile.ts","uriBaseId":"%SRCROOT%","index":38}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/graph.ts","uriBaseId":"%SRCROOT%","index":39}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/index.ts","uriBaseId":"%SRCROOT%","index":40}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/project.ts","uriBaseId":"%SRCROOT%","index":41}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/retry.ts","uriBaseId":"%SRCROOT%","index":42}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/types.ts","uriBaseId":"%SRCROOT%","index":43}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/validator.ts","uriBaseId":"%SRCROOT%","index":44}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/version.ts","uriBaseId":"%SRCROOT%","index":45}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/functions.ts","uriBaseId":"%SRCROOT%","index":46}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/graph.ts","uriBaseId":"%SRCROOT%","index":47}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/index.ts","uriBaseId":"%SRCROOT%","index":48}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/types.ts","uriBaseId":"%SRCROOT%","index":49}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/codeql.ts","uriBaseId":"%SRCROOT%","index":50}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/constants.ts","uriBaseId":"%SRCROOT%","index":51}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/diagnostics.ts","uriBaseId":"%SRCROOT%","index":52}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/environment.ts","uriBaseId":"%SRCROOT%","index":53}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/filesystem.ts","uriBaseId":"%SRCROOT%","index":54}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/cdsExtractorLog.ts","uriBaseId":"%SRCROOT%","index":55}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/index.ts","uriBaseId":"%SRCROOT%","index":56}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/statusReport.ts","uriBaseId":"%SRCROOT%","index":57}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/types.ts","uriBaseId":"%SRCROOT%","index":58}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/cacheInstaller.ts","uriBaseId":"%SRCROOT%","index":59}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/index.ts","uriBaseId":"%SRCROOT%","index":60}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/projectInstaller.ts","uriBaseId":"%SRCROOT%","index":61}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/types.ts","uriBaseId":"%SRCROOT%","index":62}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/versionResolver.ts","uriBaseId":"%SRCROOT%","index":63}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/utils.ts","uriBaseId":"%SRCROOT%","index":64}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/cds-extractor.test.ts","uriBaseId":"%SRCROOT%","index":65}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/jest.setup.ts","uriBaseId":"%SRCROOT%","index":66}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/command.test.ts","uriBaseId":"%SRCROOT%","index":67}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/compile.test.ts","uriBaseId":"%SRCROOT%","index":68}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/graph.test.ts","uriBaseId":"%SRCROOT%","index":69}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/index.test.ts","uriBaseId":"%SRCROOT%","index":70}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/project.test.ts","uriBaseId":"%SRCROOT%","index":71}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/retry.test.ts","uriBaseId":"%SRCROOT%","index":72}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/validator.test.ts","uriBaseId":"%SRCROOT%","index":73}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/version.test.ts","uriBaseId":"%SRCROOT%","index":74}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/build-graph.test.ts","uriBaseId":"%SRCROOT%","index":75}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/files-to-compile.test.ts","uriBaseId":"%SRCROOT%","index":76}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/monorepo-support.test.ts","uriBaseId":"%SRCROOT%","index":77}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/project-aware-compilation.test.ts","uriBaseId":"%SRCROOT%","index":78}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/self-parser.test.ts","uriBaseId":"%SRCROOT%","index":79}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/subdirectory-detection.test.ts","uriBaseId":"%SRCROOT%","index":80}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/codeql.test.ts","uriBaseId":"%SRCROOT%","index":81}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/diagnostics.test.ts","uriBaseId":"%SRCROOT%","index":82}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/environment.test.ts","uriBaseId":"%SRCROOT%","index":83}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/filesystem.test.ts","uriBaseId":"%SRCROOT%","index":84}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/cdsExtractorLog.test.ts","uriBaseId":"%SRCROOT%","index":85}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/performanceTrackingIntegration.test.ts","uriBaseId":"%SRCROOT%","index":86}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/statusReport.test.ts","uriBaseId":"%SRCROOT%","index":87}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/cacheInstaller.test.ts","uriBaseId":"%SRCROOT%","index":88}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/types.test.ts","uriBaseId":"%SRCROOT%","index":89}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/index.test.ts","uriBaseId":"%SRCROOT%","index":90}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/projectInstaller.test.ts","uriBaseId":"%SRCROOT%","index":91}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/types.test.ts","uriBaseId":"%SRCROOT%","index":92}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/versionResolver.test.ts","uriBaseId":"%SRCROOT%","index":93}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/utils.test.ts","uriBaseId":"%SRCROOT%","index":94}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/tsconfig.json","uriBaseId":"%SRCROOT%","index":95}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/validate-bundle.js","uriBaseId":"%SRCROOT%","index":96}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":97}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":98}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":99}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":100}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":101}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":102}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":103}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":104}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":105}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":106}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/package.json","uriBaseId":"%SRCROOT%","index":107}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/server.js","uriBaseId":"%SRCROOT%","index":108}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":109}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":110}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":111}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":112}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds","uriBaseId":"%SRCROOT%","index":113}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":114}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":115}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.js","uriBaseId":"%SRCROOT%","index":116}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/package.json","uriBaseId":"%SRCROOT%","index":117}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/server.js","uriBaseId":"%SRCROOT%","index":118}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":119}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":120}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":121}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":122}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds","uriBaseId":"%SRCROOT%","index":123}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/model.cds.json","uriBaseId":"%SRCROOT%","index":124}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/server.js","uriBaseId":"%SRCROOT%","index":125}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/package.json","uriBaseId":"%SRCROOT%","index":126}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds","uriBaseId":"%SRCROOT%","index":127}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.js","uriBaseId":"%SRCROOT%","index":128}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds","uriBaseId":"%SRCROOT%","index":129}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.js","uriBaseId":"%SRCROOT%","index":130}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":131}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":132}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/package.json","uriBaseId":"%SRCROOT%","index":133}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/server.js","uriBaseId":"%SRCROOT%","index":134}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":135}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":136}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":137}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":138}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds","uriBaseId":"%SRCROOT%","index":139}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/model.cds.json","uriBaseId":"%SRCROOT%","index":140}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/package.json","uriBaseId":"%SRCROOT%","index":141}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/server.js","uriBaseId":"%SRCROOT%","index":142}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds","uriBaseId":"%SRCROOT%","index":143}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.js","uriBaseId":"%SRCROOT%","index":144}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds","uriBaseId":"%SRCROOT%","index":145}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.js","uriBaseId":"%SRCROOT%","index":146}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds","uriBaseId":"%SRCROOT%","index":147}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/model.cds.json","uriBaseId":"%SRCROOT%","index":148}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package-lock.json","uriBaseId":"%SRCROOT%","index":149}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package.json","uriBaseId":"%SRCROOT%","index":150}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/server.js","uriBaseId":"%SRCROOT%","index":151}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/privileged-user.js","uriBaseId":"%SRCROOT%","index":152}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":154}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":155}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":157}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":158}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/server.js","uriBaseId":"%SRCROOT%","index":160}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":161}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":162}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":163}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":164}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":165}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":166}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json","uriBaseId":"%SRCROOT%","index":167}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/server.js","uriBaseId":"%SRCROOT%","index":168}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":169}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":170}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":171}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":172}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":173}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":174}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json","uriBaseId":"%SRCROOT%","index":175}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/server.js","uriBaseId":"%SRCROOT%","index":176}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":177}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":178}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":179}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds","uriBaseId":"%SRCROOT%","index":180}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/package.json","uriBaseId":"%SRCROOT%","index":181}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/model.cds.json","uriBaseId":"%SRCROOT%","index":182}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":183}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds","uriBaseId":"%SRCROOT%","index":184}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds","uriBaseId":"%SRCROOT%","index":185}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.js","uriBaseId":"%SRCROOT%","index":186}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds","uriBaseId":"%SRCROOT%","index":187}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/model.cds.json","uriBaseId":"%SRCROOT%","index":188}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/server.js","uriBaseId":"%SRCROOT%","index":189}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/package.json","uriBaseId":"%SRCROOT%","index":190}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/server.js","uriBaseId":"%SRCROOT%","index":191}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds","uriBaseId":"%SRCROOT%","index":192}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.js","uriBaseId":"%SRCROOT%","index":193}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds","uriBaseId":"%SRCROOT%","index":194}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.js","uriBaseId":"%SRCROOT%","index":195}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds","uriBaseId":"%SRCROOT%","index":196}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/package.json","uriBaseId":"%SRCROOT%","index":197}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/server.js","uriBaseId":"%SRCROOT%","index":198}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.js","uriBaseId":"%SRCROOT%","index":200}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":201}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/model.cds.json","uriBaseId":"%SRCROOT%","index":202}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":203}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":204}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":205}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":206}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":207}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":208}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":209}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":210}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":211}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":212}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":213}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":214}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":215}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":216}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":218}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":219}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":220}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":221}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":222}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":224}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":226}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":227}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":228}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":229}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":230}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":232}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/model.cds.json","uriBaseId":"%SRCROOT%","index":235}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.js","uriBaseId":"%SRCROOT%","index":236}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds","uriBaseId":"%SRCROOT%","index":237}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.js","uriBaseId":"%SRCROOT%","index":238}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":239}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":240}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":241}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":242}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/BindingStringParser/test.js","uriBaseId":"%SRCROOT%","index":243}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.js","uriBaseId":"%SRCROOT%","index":244}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":245}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.html","uriBaseId":"%SRCROOT%","index":246}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.json","uriBaseId":"%SRCROOT%","index":247}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.xml","uriBaseId":"%SRCROOT%","index":248}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/JsonParser/test.js","uriBaseId":"%SRCROOT%","index":249}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/attachDisplay_detachDisplay/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":250}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/binding_path/binding1.xml","uriBaseId":"%SRCROOT%","index":251}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/binding_path/bindingComposite.xml","uriBaseId":"%SRCROOT%","index":252}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/dynamic_write_to_html_content/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":253}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/multiple_models/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":254}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/property_getter_setter/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":255}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/sink/sink1.xml","uriBaseId":"%SRCROOT%","index":256}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/models/source/source1.xml","uriBaseId":"%SRCROOT%","index":257}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":258}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/index.html","uriBaseId":"%SRCROOT%","index":259}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":260}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":261}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/index.html","uriBaseId":"%SRCROOT%","index":262}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-deny-all/index.html","uriBaseId":"%SRCROOT%","index":263}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-deny-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":264}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":265}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":266}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":267}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":268}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":269}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":270}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":271}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":272}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":273}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":274}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":275}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":276}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":278}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":279}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":280}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":281}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":282}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":283}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":284}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":285}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":286}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":287}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":288}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":289}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":291}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":292}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":293}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":294}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":295}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":296}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":297}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":298}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":299}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":300}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":301}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":302}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":303}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":304}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":305}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":306}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":307}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":308}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/package-lock.json","uriBaseId":"%SRCROOT%","index":309}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/ui5.yaml","uriBaseId":"%SRCROOT%","index":310}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/package.json","uriBaseId":"%SRCROOT%","index":311}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.html","uriBaseId":"%SRCROOT%","index":313}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.js","uriBaseId":"%SRCROOT%","index":314}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":315}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":316}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":317}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/package-lock.json","uriBaseId":"%SRCROOT%","index":318}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/package.json","uriBaseId":"%SRCROOT%","index":319}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/ui5.yaml","uriBaseId":"%SRCROOT%","index":320}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.html","uriBaseId":"%SRCROOT%","index":322}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.js","uriBaseId":"%SRCROOT%","index":323}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":324}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/package-lock.json","uriBaseId":"%SRCROOT%","index":326}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/package.json","uriBaseId":"%SRCROOT%","index":327}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/ui5.yaml","uriBaseId":"%SRCROOT%","index":328}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.html","uriBaseId":"%SRCROOT%","index":330}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":331}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":332}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":333}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/package-lock.json","uriBaseId":"%SRCROOT%","index":334}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.js","uriBaseId":"%SRCROOT%","index":335}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/ui5.yaml","uriBaseId":"%SRCROOT%","index":336}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":337}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.html","uriBaseId":"%SRCROOT%","index":338}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.js","uriBaseId":"%SRCROOT%","index":339}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/package.json","uriBaseId":"%SRCROOT%","index":340}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":341}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":342}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":343}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/package-lock.json","uriBaseId":"%SRCROOT%","index":344}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/package.json","uriBaseId":"%SRCROOT%","index":345}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/ui5.yaml","uriBaseId":"%SRCROOT%","index":346}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.html","uriBaseId":"%SRCROOT%","index":348}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.js","uriBaseId":"%SRCROOT%","index":349}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":350}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/package-lock.json","uriBaseId":"%SRCROOT%","index":352}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/package.json","uriBaseId":"%SRCROOT%","index":353}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/ui5.yaml","uriBaseId":"%SRCROOT%","index":354}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.js","uriBaseId":"%SRCROOT%","index":356}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.html","uriBaseId":"%SRCROOT%","index":357}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":358}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":362}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":363}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":364}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":365}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":366}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":367}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":368}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":369}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":370}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":371}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":372}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":373}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":374}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":375}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":376}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":377}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":378}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":379}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":380}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":381}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":383}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":384}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":385}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":386}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":387}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":388}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":389}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":390}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":391}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":392}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":393}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":394}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/.eslintrc.json","uriBaseId":"%SRCROOT%","index":396}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/package-lock.json","uriBaseId":"%SRCROOT%","index":397}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/package.json","uriBaseId":"%SRCROOT%","index":398}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/ui5.yaml","uriBaseId":"%SRCROOT%","index":399}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/Component.js","uriBaseId":"%SRCROOT%","index":400}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/index.html","uriBaseId":"%SRCROOT%","index":403}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":404}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/model/todoitems.json","uriBaseId":"%SRCROOT%","index":405}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/AllJourneys.js","uriBaseId":"%SRCROOT%","index":406}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/FilterJourney.js","uriBaseId":"%SRCROOT%","index":407}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/SearchJourney.js","uriBaseId":"%SRCROOT%","index":408}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/TodoListJourney.js","uriBaseId":"%SRCROOT%","index":409}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/arrangements/Startup.js","uriBaseId":"%SRCROOT%","index":410}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.html","uriBaseId":"%SRCROOT%","index":411}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.js","uriBaseId":"%SRCROOT%","index":412}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/pages/App.js","uriBaseId":"%SRCROOT%","index":413}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.html","uriBaseId":"%SRCROOT%","index":414}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":415}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/AllTests.js","uriBaseId":"%SRCROOT%","index":416}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/controller/App.controller.js","uriBaseId":"%SRCROOT%","index":417}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.html","uriBaseId":"%SRCROOT%","index":418}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.js","uriBaseId":"%SRCROOT%","index":419}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/util/Helper.js","uriBaseId":"%SRCROOT%","index":420}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":421}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/package-lock.json","uriBaseId":"%SRCROOT%","index":422}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/package.json","uriBaseId":"%SRCROOT%","index":423}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/ui5.yaml","uriBaseId":"%SRCROOT%","index":424}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":426}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.html","uriBaseId":"%SRCROOT%","index":427}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.js","uriBaseId":"%SRCROOT%","index":428}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":429}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/package-lock.json","uriBaseId":"%SRCROOT%","index":431}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/package.json","uriBaseId":"%SRCROOT%","index":432}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/ui5.yaml","uriBaseId":"%SRCROOT%","index":433}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":434}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":435}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.html","uriBaseId":"%SRCROOT%","index":436}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.js","uriBaseId":"%SRCROOT%","index":437}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":438}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/package-lock.json","uriBaseId":"%SRCROOT%","index":440}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/ui5.yaml","uriBaseId":"%SRCROOT%","index":441}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":442}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":443}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/package.json","uriBaseId":"%SRCROOT%","index":444}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.html","uriBaseId":"%SRCROOT%","index":445}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.js","uriBaseId":"%SRCROOT%","index":446}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":447}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":449}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":450}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":451}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":452}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":453}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":454}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":455}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":456}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":457}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":458}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":459}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":460}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":461}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":462}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":463}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":464}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":465}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":466}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/package-lock.json","uriBaseId":"%SRCROOT%","index":467}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/package.json","uriBaseId":"%SRCROOT%","index":468}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/ui5.yaml","uriBaseId":"%SRCROOT%","index":469}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.html","uriBaseId":"%SRCROOT%","index":471}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.js","uriBaseId":"%SRCROOT%","index":472}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":473}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package-lock.json","uriBaseId":"%SRCROOT%","index":475}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package.json","uriBaseId":"%SRCROOT%","index":476}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/ui5.yaml","uriBaseId":"%SRCROOT%","index":477}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/Component.js","uriBaseId":"%SRCROOT%","index":478}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js","uriBaseId":"%SRCROOT%","index":482}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":483}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.html","uriBaseId":"%SRCROOT%","index":484}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.js","uriBaseId":"%SRCROOT%","index":485}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":486}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App1.view.xml","uriBaseId":"%SRCROOT%","index":487}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App2.view.xml","uriBaseId":"%SRCROOT%","index":488}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App3.view.xml","uriBaseId":"%SRCROOT%","index":489}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App4.view.xml","uriBaseId":"%SRCROOT%","index":490}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":491}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/package-lock.json","uriBaseId":"%SRCROOT%","index":492}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/package.json","uriBaseId":"%SRCROOT%","index":493}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":494}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":495}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":496}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":497}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":498}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":500}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":501}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":502}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":504}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":505}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":506}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/package-lock.json","uriBaseId":"%SRCROOT%","index":508}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/package.json","uriBaseId":"%SRCROOT%","index":509}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/ui5.yaml","uriBaseId":"%SRCROOT%","index":510}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":511}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.html","uriBaseId":"%SRCROOT%","index":512}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.js","uriBaseId":"%SRCROOT%","index":513}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":514}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":515}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/package-lock.json","uriBaseId":"%SRCROOT%","index":516}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/package.json","uriBaseId":"%SRCROOT%","index":517}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/ui5.yaml","uriBaseId":"%SRCROOT%","index":518}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":519}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/model.json","uriBaseId":"%SRCROOT%","index":520}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.html","uriBaseId":"%SRCROOT%","index":521}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.js","uriBaseId":"%SRCROOT%","index":522}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":523}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":524}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/package-lock.json","uriBaseId":"%SRCROOT%","index":525}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/package.json","uriBaseId":"%SRCROOT%","index":526}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":527}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":528}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":529}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":530}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":531}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":532}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/package-lock.json","uriBaseId":"%SRCROOT%","index":533}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/package.json","uriBaseId":"%SRCROOT%","index":534}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":535}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssBase.js","uriBaseId":"%SRCROOT%","index":536}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":537}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":538}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":539}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":540}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":541}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":542}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":543}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/package-lock.json","uriBaseId":"%SRCROOT%","index":544}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/package.json","uriBaseId":"%SRCROOT%","index":545}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":546}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":547}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":548}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":549}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":550}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":551}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/package-lock.json","uriBaseId":"%SRCROOT%","index":552}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/package.json","uriBaseId":"%SRCROOT%","index":553}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":554}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":555}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":556}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":557}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":558}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":559}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/package-lock.json","uriBaseId":"%SRCROOT%","index":560}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/package.json","uriBaseId":"%SRCROOT%","index":561}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/ui5.yaml","uriBaseId":"%SRCROOT%","index":562}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":563}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":564}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":565}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.html","uriBaseId":"%SRCROOT%","index":566}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.js","uriBaseId":"%SRCROOT%","index":567}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":568}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":569}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/package-lock.json","uriBaseId":"%SRCROOT%","index":570}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/package.json","uriBaseId":"%SRCROOT%","index":571}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/ui5.yaml","uriBaseId":"%SRCROOT%","index":572}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":573}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":574}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":575}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.html","uriBaseId":"%SRCROOT%","index":576}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.js","uriBaseId":"%SRCROOT%","index":577}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":578}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":579}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/package.json","uriBaseId":"%SRCROOT%","index":580}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/package-lock.json","uriBaseId":"%SRCROOT%","index":581}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":582}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":583}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":584}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":585}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":586}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":588}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":589}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/.eslintrc.json","uriBaseId":"%SRCROOT%","index":590}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package-lock.json","uriBaseId":"%SRCROOT%","index":591}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package.json","uriBaseId":"%SRCROOT%","index":592}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/public/index.html","uriBaseId":"%SRCROOT%","index":593}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/App.tsx","uriBaseId":"%SRCROOT%","index":594}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/index.tsx","uriBaseId":"%SRCROOT%","index":595}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":596}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":597}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":598}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":599}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":600}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":601}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/.xsaccess","uriBaseId":"%SRCROOT%","index":602}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess","uriBaseId":"%SRCROOT%","index":603}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/missing_auth/.xsaccess","uriBaseId":"%SRCROOT%","index":604}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/service.xsjs","uriBaseId":"%SRCROOT%","index":605}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":606}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":611}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/qlpack.yml","uriBaseId":"%SRCROOT%","index":612}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"qlt.conf.json","uriBaseId":"%SRCROOT%","index":613}}}],"message":{"text":""},"level":"none","descriptor":{"id":"js/diagnostics/successfully-extracted-files","index":0,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":104},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":110},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":111},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds","uriBaseId":"%SRCROOT%","index":113},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":114},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":119},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":121},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds","uriBaseId":"%SRCROOT%","index":123},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds","uriBaseId":"%SRCROOT%","index":127},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds","uriBaseId":"%SRCROOT%","index":129},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":131},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":135},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":137},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds","uriBaseId":"%SRCROOT%","index":139},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds","uriBaseId":"%SRCROOT%","index":143},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds","uriBaseId":"%SRCROOT%","index":145},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds","uriBaseId":"%SRCROOT%","index":147},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":155},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":157},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":162},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":163},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":166},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":169},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":171},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":173},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":177},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds","uriBaseId":"%SRCROOT%","index":180},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":183},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds","uriBaseId":"%SRCROOT%","index":184},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds","uriBaseId":"%SRCROOT%","index":185},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds","uriBaseId":"%SRCROOT%","index":187},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds","uriBaseId":"%SRCROOT%","index":192},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds","uriBaseId":"%SRCROOT%","index":194},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds","uriBaseId":"%SRCROOT%","index":196},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":201},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":207},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":208},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":210},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":214},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":216},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":218},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":222},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":224},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":226},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":229},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":232},"region":{"startLine":1,"endColumn":2}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds with error Error: Unexpected token"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds with error Error: Unexpected token"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds","uriBaseId":"%SRCROOT%","index":237},"region":{"startLine":1,"startColumn":2,"endColumn":3}}}],"message":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds with error Error: Expected u found a"},"level":"error","descriptor":{"id":"js/diagnostics/extraction-errors","index":1,"toolComponent":{"index":1}},"properties":{"formattedMessage":{"text":"Extraction failed in /home/runner/work/codeql-sap-js/codeql-sap-js/javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds with error Error: Expected u found a"}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/Component.js","uriBaseId":"%SRCROOT%","index":400}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":109}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.js","uriBaseId":"%SRCROOT%","index":238}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":285}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/server.js","uriBaseId":"%SRCROOT%","index":198}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/SearchJourney.js","uriBaseId":"%SRCROOT%","index":408}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/server.js","uriBaseId":"%SRCROOT%","index":151}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/server.js","uriBaseId":"%SRCROOT%","index":176}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":563}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/FilterJourney.js","uriBaseId":"%SRCROOT%","index":407}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/esbuild.config.mjs","uriBaseId":"%SRCROOT%","index":32}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":443}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":215}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":179}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":385}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":435}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":461}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":332}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssBase.js","uriBaseId":"%SRCROOT%","index":536}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":161}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":549}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":294}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":547}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":583}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":376}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":555}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/arrangements/Startup.js","uriBaseId":"%SRCROOT%","index":410}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/pages/App.js","uriBaseId":"%SRCROOT%","index":413}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/server.js","uriBaseId":"%SRCROOT%","index":191}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/eslint.config.mjs","uriBaseId":"%SRCROOT%","index":33}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":565}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":206}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":342}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":574}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/Component.js","uriBaseId":"%SRCROOT%","index":478}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.js","uriBaseId":"%SRCROOT%","index":577}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":170}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.js","uriBaseId":"%SRCROOT%","index":128}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":316}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":297}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.js","uriBaseId":"%SRCROOT%","index":437}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.js","uriBaseId":"%SRCROOT%","index":244}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":307}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":519}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":278}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/TodoListJourney.js","uriBaseId":"%SRCROOT%","index":409}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":228}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.js","uriBaseId":"%SRCROOT%","index":339}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":136}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":367}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":541}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js","uriBaseId":"%SRCROOT%","index":482}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.js","uriBaseId":"%SRCROOT%","index":144}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/JsonParser/test.js","uriBaseId":"%SRCROOT%","index":249}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":112}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":272}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":538}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.js","uriBaseId":"%SRCROOT%","index":356}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":495}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":221}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":539}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":483}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":511}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":537}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":303}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":164}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":573}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":497}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/server.js","uriBaseId":"%SRCROOT%","index":108}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":551}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.js","uriBaseId":"%SRCROOT%","index":195}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/server.js","uriBaseId":"%SRCROOT%","index":168}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":172}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/server.js","uriBaseId":"%SRCROOT%","index":189}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":415}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":269}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":505}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":530}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.js","uriBaseId":"%SRCROOT%","index":146}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.js","uriBaseId":"%SRCROOT%","index":513}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.js","uriBaseId":"%SRCROOT%","index":314}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":295}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.js","uriBaseId":"%SRCROOT%","index":522}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":557}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":373}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":209}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":564}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":462}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":528}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.js","uriBaseId":"%SRCROOT%","index":236}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/.prettierrc.js","uriBaseId":"%SRCROOT%","index":29}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.js","uriBaseId":"%SRCROOT%","index":335}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":213}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/validate-bundle.js","uriBaseId":"%SRCROOT%","index":96}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.js","uriBaseId":"%SRCROOT%","index":567}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.js","uriBaseId":"%SRCROOT%","index":200}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/server.js","uriBaseId":"%SRCROOT%","index":160}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":122}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/AllTests.js","uriBaseId":"%SRCROOT%","index":416}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":374}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":178}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":288}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":391}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/server.js","uriBaseId":"%SRCROOT%","index":118}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":453}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/jest.config.js","uriBaseId":"%SRCROOT%","index":34}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":337}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":138}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.js","uriBaseId":"%SRCROOT%","index":349}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":270}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/util/Helper.js","uriBaseId":"%SRCROOT%","index":420}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":120}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.js","uriBaseId":"%SRCROOT%","index":446}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/privileged-user.js","uriBaseId":"%SRCROOT%","index":152}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.js","uriBaseId":"%SRCROOT%","index":116}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":280}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":455}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":365}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":452}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/server.js","uriBaseId":"%SRCROOT%","index":125}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":204}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.js","uriBaseId":"%SRCROOT%","index":428}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.js","uriBaseId":"%SRCROOT%","index":323}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":585}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":434}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/lib/BindingStringParser/test.js","uriBaseId":"%SRCROOT%","index":243}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":442}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/controller/App.controller.js","uriBaseId":"%SRCROOT%","index":417}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.js","uriBaseId":"%SRCROOT%","index":419}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":464}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.js","uriBaseId":"%SRCROOT%","index":472}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.js","uriBaseId":"%SRCROOT%","index":193}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":393}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":575}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.js","uriBaseId":"%SRCROOT%","index":485}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.js","uriBaseId":"%SRCROOT%","index":186}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":383}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":426}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/dist/cds-extractor.bundle.js","uriBaseId":"%SRCROOT%","index":31}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/AllJourneys.js","uriBaseId":"%SRCROOT%","index":406}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/server.js","uriBaseId":"%SRCROOT%","index":134}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.js","uriBaseId":"%SRCROOT%","index":412}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.js","uriBaseId":"%SRCROOT%","index":130}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":304}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/server.js","uriBaseId":"%SRCROOT%","index":142}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/javascript","index":0},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/cds-extractor-dist-bundle.yml","uriBaseId":"%SRCROOT%","index":21}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/codeql-ql.yml","uriBaseId":"%SRCROOT%","index":23}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/run-codeql-unit-tests-javascript.yml","uriBaseId":"%SRCROOT%","index":24}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/update-codeql.yml","uriBaseId":"%SRCROOT%","index":25}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":".github/workflows/code_scanning.yml","uriBaseId":"%SRCROOT%","index":22}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/actions","index":1},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/projectInstaller.ts","uriBaseId":"%SRCROOT%","index":61}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/files-to-compile.test.ts","uriBaseId":"%SRCROOT%","index":76}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/graph.ts","uriBaseId":"%SRCROOT%","index":39}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/projectInstaller.test.ts","uriBaseId":"%SRCROOT%","index":91}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/compile.test.ts","uriBaseId":"%SRCROOT%","index":68}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/cds-extractor.test.ts","uriBaseId":"%SRCROOT%","index":65}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/graph.ts","uriBaseId":"%SRCROOT%","index":47}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/project.ts","uriBaseId":"%SRCROOT%","index":41}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/cds-extractor.ts","uriBaseId":"%SRCROOT%","index":30}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/index.ts","uriBaseId":"%SRCROOT%","index":56}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/command.ts","uriBaseId":"%SRCROOT%","index":37}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/diagnostics.ts","uriBaseId":"%SRCROOT%","index":52}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/index.test.ts","uriBaseId":"%SRCROOT%","index":70}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/statusReport.ts","uriBaseId":"%SRCROOT%","index":57}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/App.tsx","uriBaseId":"%SRCROOT%","index":594}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/cacheInstaller.test.ts","uriBaseId":"%SRCROOT%","index":88}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/validator.ts","uriBaseId":"%SRCROOT%","index":44}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/types.test.ts","uriBaseId":"%SRCROOT%","index":89}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/statusReport.test.ts","uriBaseId":"%SRCROOT%","index":87}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/index.test.ts","uriBaseId":"%SRCROOT%","index":90}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/types.ts","uriBaseId":"%SRCROOT%","index":58}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/index.tsx","uriBaseId":"%SRCROOT%","index":595}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/codeql.ts","uriBaseId":"%SRCROOT%","index":50}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/index.ts","uriBaseId":"%SRCROOT%","index":60}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/version.test.ts","uriBaseId":"%SRCROOT%","index":74}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/logging/cdsExtractorLog.ts","uriBaseId":"%SRCROOT%","index":55}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/command.test.ts","uriBaseId":"%SRCROOT%","index":67}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/constants.ts","uriBaseId":"%SRCROOT%","index":51}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/performanceTrackingIntegration.test.ts","uriBaseId":"%SRCROOT%","index":86}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/types.ts","uriBaseId":"%SRCROOT%","index":62}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/validator.test.ts","uriBaseId":"%SRCROOT%","index":73}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/monorepo-support.test.ts","uriBaseId":"%SRCROOT%","index":77}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/build-graph.test.ts","uriBaseId":"%SRCROOT%","index":75}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/utils.ts","uriBaseId":"%SRCROOT%","index":64}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/types.ts","uriBaseId":"%SRCROOT%","index":49}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/compile.ts","uriBaseId":"%SRCROOT%","index":38}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/project-aware-compilation.test.ts","uriBaseId":"%SRCROOT%","index":78}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/index.ts","uriBaseId":"%SRCROOT%","index":48}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/subdirectory-detection.test.ts","uriBaseId":"%SRCROOT%","index":80}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/retry.test.ts","uriBaseId":"%SRCROOT%","index":72}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/jest.setup.ts","uriBaseId":"%SRCROOT%","index":66}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/logging/cdsExtractorLog.test.ts","uriBaseId":"%SRCROOT%","index":85}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/diagnostics.test.ts","uriBaseId":"%SRCROOT%","index":82}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/retry.ts","uriBaseId":"%SRCROOT%","index":42}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/utils.test.ts","uriBaseId":"%SRCROOT%","index":94}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/types.ts","uriBaseId":"%SRCROOT%","index":43}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/index.ts","uriBaseId":"%SRCROOT%","index":40}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/project.test.ts","uriBaseId":"%SRCROOT%","index":71}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/parser/self-parser.test.ts","uriBaseId":"%SRCROOT%","index":79}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/cds/compiler/graph.test.ts","uriBaseId":"%SRCROOT%","index":69}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/environment.test.ts","uriBaseId":"%SRCROOT%","index":83}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/versionResolver.test.ts","uriBaseId":"%SRCROOT%","index":93}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/environment.ts","uriBaseId":"%SRCROOT%","index":53}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/compiler/version.ts","uriBaseId":"%SRCROOT%","index":45}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/versionResolver.ts","uriBaseId":"%SRCROOT%","index":63}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/packageManager/types.test.ts","uriBaseId":"%SRCROOT%","index":92}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/packageManager/cacheInstaller.ts","uriBaseId":"%SRCROOT%","index":59}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/cds/parser/functions.ts","uriBaseId":"%SRCROOT%","index":46}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/src/filesystem.ts","uriBaseId":"%SRCROOT%","index":54}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/codeql.test.ts","uriBaseId":"%SRCROOT%","index":81}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"extractors/cds/tools/test/src/filesystem.test.ts","uriBaseId":"%SRCROOT%","index":84}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/typescript","index":2},"properties":{"formattedMessage":{"text":""}}},{"locations":[{"physicalLocation":{"artifactLocation":{"uri":"scripts/CreateTestsFromYaml.py","uriBaseId":"%SRCROOT%","index":615}}}],"message":{"text":""},"level":"none","descriptor":{"id":"cli/expected-extracted-files/python","index":3},"properties":{"formattedMessage":{"text":""}}},{"message":{"text":"On the Linux (amd64; 6.11.0-1018-azure) platform.","markdown":"On the Linux (amd64; 6.11.0-1018-azure) platform."},"level":"none","timeUtc":"2025-12-15T19:16:21.521110429Z","descriptor":{"id":"cli/platform","index":4},"properties":{"attributes":{"arch":"amd64","name":"Linux","version":"6.11.0-1018-azure"},"visibility":{"statusPage":false,"telemetry":true}}},{"message":{"text":""},"level":"none","timeUtc":"2025-12-15T19:16:14.851Z","descriptor":{"id":"codeql-action/bundle-download-telemetry","index":5},"properties":{"attributes":{"combinedDurationMs":13239,"compressionMethod":"gzip","downloadDurationMs":2909,"extractionDurationMs":10330,"streamExtraction":false,"toolsUrl":"https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.23.8/codeql-bundle-linux64.tar.gz"},"visibility":{"statusPage":false,"telemetry":true}}}],"executionSuccessful":true}],"artifacts":[{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2}},{"location":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/codeStyles/Project.xml","uriBaseId":"%SRCROOT%","index":4}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/inspectionProfiles/Project_Default.xml","uriBaseId":"%SRCROOT%","index":5}},{"location":{"uri":".cds-extractor-cache/cds-419af57a6ca03c33e081f24fe025fd9562eb8de8ad926dd10c59ce86d3bfee92/node_modules/@sap/cds-dk/node_modules/xml-js/bin/test.xml","uriBaseId":"%SRCROOT%","index":6}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/codeStyles/codeStyleConfig.xml","uriBaseId":"%SRCROOT%","index":7}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/modules.xml","uriBaseId":"%SRCROOT%","index":8}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/encoding/node_modules/iconv-lite/.idea/vcs.xml","uriBaseId":"%SRCROOT%","index":9}},{"location":{"uri":".cds-extractor-cache/cds-5821ca4a7405c17bc03fe9c833aa52212563b6d17f24eb61f8af574bf1095ef1/node_modules/@sap/cds-dk/node_modules/xml-js/bin/test.xml","uriBaseId":"%SRCROOT%","index":10}},{"location":{"uri":".github/codeql/codeql-config.yaml","uriBaseId":"%SRCROOT%","index":11}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":12}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":13}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/ui5/ext/ext/ui5.model.yml","uriBaseId":"%SRCROOT%","index":14}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":15}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":16}},{"location":{"uri":".github/codeql/extensions/javascript/frameworks/xsjs/ext/ext/xsjs.model.yml","uriBaseId":"%SRCROOT%","index":17}},{"location":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/additional-sources.model.yml","uriBaseId":"%SRCROOT%","index":18}},{"location":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":19}},{"location":{"uri":".github/codeql/extensions/javascript/heuristic-models/ext/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":20}},{"location":{"uri":".github/workflows/cds-extractor-dist-bundle.yml","uriBaseId":"%SRCROOT%","index":21}},{"location":{"uri":".github/workflows/code_scanning.yml","uriBaseId":"%SRCROOT%","index":22}},{"location":{"uri":".github/workflows/codeql-ql.yml","uriBaseId":"%SRCROOT%","index":23}},{"location":{"uri":".github/workflows/run-codeql-unit-tests-javascript.yml","uriBaseId":"%SRCROOT%","index":24}},{"location":{"uri":".github/workflows/update-codeql.yml","uriBaseId":"%SRCROOT%","index":25}},{"location":{"uri":"cds-extractor-marker.js","uriBaseId":"%SRCROOT%","index":26}},{"location":{"uri":"codeql-workspace.yml","uriBaseId":"%SRCROOT%","index":27}},{"location":{"uri":"extractors/cds/codeql-extractor.yml","uriBaseId":"%SRCROOT%","index":28}},{"location":{"uri":"extractors/cds/tools/.prettierrc.js","uriBaseId":"%SRCROOT%","index":29}},{"location":{"uri":"extractors/cds/tools/cds-extractor.ts","uriBaseId":"%SRCROOT%","index":30}},{"location":{"uri":"extractors/cds/tools/dist/cds-extractor.bundle.js","uriBaseId":"%SRCROOT%","index":31}},{"location":{"uri":"extractors/cds/tools/esbuild.config.mjs","uriBaseId":"%SRCROOT%","index":32}},{"location":{"uri":"extractors/cds/tools/eslint.config.mjs","uriBaseId":"%SRCROOT%","index":33}},{"location":{"uri":"extractors/cds/tools/jest.config.js","uriBaseId":"%SRCROOT%","index":34}},{"location":{"uri":"extractors/cds/tools/package-lock.json","uriBaseId":"%SRCROOT%","index":35}},{"location":{"uri":"extractors/cds/tools/package.json","uriBaseId":"%SRCROOT%","index":36}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/command.ts","uriBaseId":"%SRCROOT%","index":37}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/compile.ts","uriBaseId":"%SRCROOT%","index":38}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/graph.ts","uriBaseId":"%SRCROOT%","index":39}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/index.ts","uriBaseId":"%SRCROOT%","index":40}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/project.ts","uriBaseId":"%SRCROOT%","index":41}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/retry.ts","uriBaseId":"%SRCROOT%","index":42}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/types.ts","uriBaseId":"%SRCROOT%","index":43}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/validator.ts","uriBaseId":"%SRCROOT%","index":44}},{"location":{"uri":"extractors/cds/tools/src/cds/compiler/version.ts","uriBaseId":"%SRCROOT%","index":45}},{"location":{"uri":"extractors/cds/tools/src/cds/parser/functions.ts","uriBaseId":"%SRCROOT%","index":46}},{"location":{"uri":"extractors/cds/tools/src/cds/parser/graph.ts","uriBaseId":"%SRCROOT%","index":47}},{"location":{"uri":"extractors/cds/tools/src/cds/parser/index.ts","uriBaseId":"%SRCROOT%","index":48}},{"location":{"uri":"extractors/cds/tools/src/cds/parser/types.ts","uriBaseId":"%SRCROOT%","index":49}},{"location":{"uri":"extractors/cds/tools/src/codeql.ts","uriBaseId":"%SRCROOT%","index":50}},{"location":{"uri":"extractors/cds/tools/src/constants.ts","uriBaseId":"%SRCROOT%","index":51}},{"location":{"uri":"extractors/cds/tools/src/diagnostics.ts","uriBaseId":"%SRCROOT%","index":52}},{"location":{"uri":"extractors/cds/tools/src/environment.ts","uriBaseId":"%SRCROOT%","index":53}},{"location":{"uri":"extractors/cds/tools/src/filesystem.ts","uriBaseId":"%SRCROOT%","index":54}},{"location":{"uri":"extractors/cds/tools/src/logging/cdsExtractorLog.ts","uriBaseId":"%SRCROOT%","index":55}},{"location":{"uri":"extractors/cds/tools/src/logging/index.ts","uriBaseId":"%SRCROOT%","index":56}},{"location":{"uri":"extractors/cds/tools/src/logging/statusReport.ts","uriBaseId":"%SRCROOT%","index":57}},{"location":{"uri":"extractors/cds/tools/src/logging/types.ts","uriBaseId":"%SRCROOT%","index":58}},{"location":{"uri":"extractors/cds/tools/src/packageManager/cacheInstaller.ts","uriBaseId":"%SRCROOT%","index":59}},{"location":{"uri":"extractors/cds/tools/src/packageManager/index.ts","uriBaseId":"%SRCROOT%","index":60}},{"location":{"uri":"extractors/cds/tools/src/packageManager/projectInstaller.ts","uriBaseId":"%SRCROOT%","index":61}},{"location":{"uri":"extractors/cds/tools/src/packageManager/types.ts","uriBaseId":"%SRCROOT%","index":62}},{"location":{"uri":"extractors/cds/tools/src/packageManager/versionResolver.ts","uriBaseId":"%SRCROOT%","index":63}},{"location":{"uri":"extractors/cds/tools/src/utils.ts","uriBaseId":"%SRCROOT%","index":64}},{"location":{"uri":"extractors/cds/tools/test/cds-extractor.test.ts","uriBaseId":"%SRCROOT%","index":65}},{"location":{"uri":"extractors/cds/tools/test/jest.setup.ts","uriBaseId":"%SRCROOT%","index":66}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/command.test.ts","uriBaseId":"%SRCROOT%","index":67}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/compile.test.ts","uriBaseId":"%SRCROOT%","index":68}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/graph.test.ts","uriBaseId":"%SRCROOT%","index":69}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/index.test.ts","uriBaseId":"%SRCROOT%","index":70}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/project.test.ts","uriBaseId":"%SRCROOT%","index":71}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/retry.test.ts","uriBaseId":"%SRCROOT%","index":72}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/validator.test.ts","uriBaseId":"%SRCROOT%","index":73}},{"location":{"uri":"extractors/cds/tools/test/src/cds/compiler/version.test.ts","uriBaseId":"%SRCROOT%","index":74}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/build-graph.test.ts","uriBaseId":"%SRCROOT%","index":75}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/files-to-compile.test.ts","uriBaseId":"%SRCROOT%","index":76}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/monorepo-support.test.ts","uriBaseId":"%SRCROOT%","index":77}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/project-aware-compilation.test.ts","uriBaseId":"%SRCROOT%","index":78}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/self-parser.test.ts","uriBaseId":"%SRCROOT%","index":79}},{"location":{"uri":"extractors/cds/tools/test/src/cds/parser/subdirectory-detection.test.ts","uriBaseId":"%SRCROOT%","index":80}},{"location":{"uri":"extractors/cds/tools/test/src/codeql.test.ts","uriBaseId":"%SRCROOT%","index":81}},{"location":{"uri":"extractors/cds/tools/test/src/diagnostics.test.ts","uriBaseId":"%SRCROOT%","index":82}},{"location":{"uri":"extractors/cds/tools/test/src/environment.test.ts","uriBaseId":"%SRCROOT%","index":83}},{"location":{"uri":"extractors/cds/tools/test/src/filesystem.test.ts","uriBaseId":"%SRCROOT%","index":84}},{"location":{"uri":"extractors/cds/tools/test/src/logging/cdsExtractorLog.test.ts","uriBaseId":"%SRCROOT%","index":85}},{"location":{"uri":"extractors/cds/tools/test/src/logging/performanceTrackingIntegration.test.ts","uriBaseId":"%SRCROOT%","index":86}},{"location":{"uri":"extractors/cds/tools/test/src/logging/statusReport.test.ts","uriBaseId":"%SRCROOT%","index":87}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/cacheInstaller.test.ts","uriBaseId":"%SRCROOT%","index":88}},{"location":{"uri":"extractors/cds/tools/test/src/logging/types.test.ts","uriBaseId":"%SRCROOT%","index":89}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/index.test.ts","uriBaseId":"%SRCROOT%","index":90}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/projectInstaller.test.ts","uriBaseId":"%SRCROOT%","index":91}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/types.test.ts","uriBaseId":"%SRCROOT%","index":92}},{"location":{"uri":"extractors/cds/tools/test/src/packageManager/versionResolver.test.ts","uriBaseId":"%SRCROOT%","index":93}},{"location":{"uri":"extractors/cds/tools/test/src/utils.test.ts","uriBaseId":"%SRCROOT%","index":94}},{"location":{"uri":"extractors/cds/tools/tsconfig.json","uriBaseId":"%SRCROOT%","index":95}},{"location":{"uri":"extractors/cds/tools/validate-bundle.js","uriBaseId":"%SRCROOT%","index":96}},{"location":{"uri":"javascript/frameworks/cap/ext/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":97}},{"location":{"uri":"javascript/frameworks/cap/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":98}},{"location":{"uri":"javascript/frameworks/cap/ext/qlpack.yml","uriBaseId":"%SRCROOT%","index":99}},{"location":{"uri":"javascript/frameworks/cap/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":100}},{"location":{"uri":"javascript/frameworks/cap/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":101}},{"location":{"uri":"javascript/frameworks/cap/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":102}},{"location":{"uri":"javascript/frameworks/cap/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":103}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":104}},{"location":{"uri":"javascript/frameworks/cap/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":105}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":106}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/package.json","uriBaseId":"%SRCROOT%","index":107}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/server.js","uriBaseId":"%SRCROOT%","index":108}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":109}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":110}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":111}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":112}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.cds","uriBaseId":"%SRCROOT%","index":113}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":114}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":115}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-cds-authz/srv/service3.js","uriBaseId":"%SRCROOT%","index":116}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/package.json","uriBaseId":"%SRCROOT%","index":117}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/server.js","uriBaseId":"%SRCROOT%","index":118}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":119}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":120}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":121}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":122}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/db/schema.cds","uriBaseId":"%SRCROOT%","index":123}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/model.cds.json","uriBaseId":"%SRCROOT%","index":124}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/server.js","uriBaseId":"%SRCROOT%","index":125}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/package.json","uriBaseId":"%SRCROOT%","index":126}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.cds","uriBaseId":"%SRCROOT%","index":127}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service1.js","uriBaseId":"%SRCROOT%","index":128}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.cds","uriBaseId":"%SRCROOT%","index":129}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-js-authz-cds-serve/srv/service2.js","uriBaseId":"%SRCROOT%","index":130}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/db/schema.cds","uriBaseId":"%SRCROOT%","index":131}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/model.cds.json","uriBaseId":"%SRCROOT%","index":132}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/package.json","uriBaseId":"%SRCROOT%","index":133}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/server.js","uriBaseId":"%SRCROOT%","index":134}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.cds","uriBaseId":"%SRCROOT%","index":135}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service1.js","uriBaseId":"%SRCROOT%","index":136}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.cds","uriBaseId":"%SRCROOT%","index":137}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/entities-with-no-authz/entities-exposed-with-no-authz/srv/service2.js","uriBaseId":"%SRCROOT%","index":138}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/db/schema.cds","uriBaseId":"%SRCROOT%","index":139}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/model.cds.json","uriBaseId":"%SRCROOT%","index":140}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/package.json","uriBaseId":"%SRCROOT%","index":141}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/server.js","uriBaseId":"%SRCROOT%","index":142}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.cds","uriBaseId":"%SRCROOT%","index":143}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.js","uriBaseId":"%SRCROOT%","index":144}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.cds","uriBaseId":"%SRCROOT%","index":145}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.js","uriBaseId":"%SRCROOT%","index":146}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/db/schema.cds","uriBaseId":"%SRCROOT%","index":147}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/model.cds.json","uriBaseId":"%SRCROOT%","index":148}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package-lock.json","uriBaseId":"%SRCROOT%","index":149}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/package.json","uriBaseId":"%SRCROOT%","index":150}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/server.js","uriBaseId":"%SRCROOT%","index":151}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/privileged-user.js","uriBaseId":"%SRCROOT%","index":152}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":154}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":155}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":157}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":158}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/server.js","uriBaseId":"%SRCROOT%","index":160}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":161}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":162}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":163}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":164}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":165}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":166}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json","uriBaseId":"%SRCROOT%","index":167}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/server.js","uriBaseId":"%SRCROOT%","index":168}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":169}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":170}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":171}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":172}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/db/schema.cds","uriBaseId":"%SRCROOT%","index":173}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/model.cds.json","uriBaseId":"%SRCROOT%","index":174}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json","uriBaseId":"%SRCROOT%","index":175}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/server.js","uriBaseId":"%SRCROOT%","index":176}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.cds","uriBaseId":"%SRCROOT%","index":177}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service1.js","uriBaseId":"%SRCROOT%","index":178}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.js","uriBaseId":"%SRCROOT%","index":179}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/db/schema.cds","uriBaseId":"%SRCROOT%","index":180}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/package.json","uriBaseId":"%SRCROOT%","index":181}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/model.cds.json","uriBaseId":"%SRCROOT%","index":182}},{"location":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/srv/service2.cds","uriBaseId":"%SRCROOT%","index":183}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.cds","uriBaseId":"%SRCROOT%","index":184}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.cds","uriBaseId":"%SRCROOT%","index":185}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service2.js","uriBaseId":"%SRCROOT%","index":186}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/db/schema.cds","uriBaseId":"%SRCROOT%","index":187}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/model.cds.json","uriBaseId":"%SRCROOT%","index":188}},{"location":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/server.js","uriBaseId":"%SRCROOT%","index":189}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/package.json","uriBaseId":"%SRCROOT%","index":190}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/server.js","uriBaseId":"%SRCROOT%","index":191}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.cds","uriBaseId":"%SRCROOT%","index":192}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service1.js","uriBaseId":"%SRCROOT%","index":193}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.cds","uriBaseId":"%SRCROOT%","index":194}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-not-depending-on-request/srv/service2.js","uriBaseId":"%SRCROOT%","index":195}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/db/schema.cds","uriBaseId":"%SRCROOT%","index":196}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/package.json","uriBaseId":"%SRCROOT%","index":197}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/server.js","uriBaseId":"%SRCROOT%","index":198}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.js","uriBaseId":"%SRCROOT%","index":200}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":201}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/model.cds.json","uriBaseId":"%SRCROOT%","index":202}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":203}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":204}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":205}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":206}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":207}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":208}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-complete-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":209}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":210}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":211}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":212}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":213}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":214}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":215}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":216}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":218}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":219}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":220}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":221}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":222}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":224}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/db/schema.cds","uriBaseId":"%SRCROOT%","index":226}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/package.json","uriBaseId":"%SRCROOT%","index":227}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/server.js","uriBaseId":"%SRCROOT%","index":228}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.cds","uriBaseId":"%SRCROOT%","index":229}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/model.cds.json","uriBaseId":"%SRCROOT%","index":230}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.cds","uriBaseId":"%SRCROOT%","index":232}},{"location":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233}},{"location":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234}},{"location":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/model.cds.json","uriBaseId":"%SRCROOT%","index":235}},{"location":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure-js-all-sinks/sensitive-exposure-heuristic-source.js","uriBaseId":"%SRCROOT%","index":236}},{"location":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds","uriBaseId":"%SRCROOT%","index":237}},{"location":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.js","uriBaseId":"%SRCROOT%","index":238}},{"location":{"uri":"javascript/frameworks/ui5/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":239}},{"location":{"uri":"javascript/frameworks/ui5/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":240}},{"location":{"uri":"javascript/frameworks/ui5/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":241}},{"location":{"uri":"javascript/frameworks/ui5/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":242}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/BindingStringParser/test.js","uriBaseId":"%SRCROOT%","index":243}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.js","uriBaseId":"%SRCROOT%","index":244}},{"location":{"uri":"javascript/frameworks/ui5/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":245}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.html","uriBaseId":"%SRCROOT%","index":246}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.json","uriBaseId":"%SRCROOT%","index":247}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/Bindings/test.view.xml","uriBaseId":"%SRCROOT%","index":248}},{"location":{"uri":"javascript/frameworks/ui5/test/lib/JsonParser/test.js","uriBaseId":"%SRCROOT%","index":249}},{"location":{"uri":"javascript/frameworks/ui5/test/models/attachDisplay_detachDisplay/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":250}},{"location":{"uri":"javascript/frameworks/ui5/test/models/binding_path/binding1.xml","uriBaseId":"%SRCROOT%","index":251}},{"location":{"uri":"javascript/frameworks/ui5/test/models/binding_path/bindingComposite.xml","uriBaseId":"%SRCROOT%","index":252}},{"location":{"uri":"javascript/frameworks/ui5/test/models/dynamic_write_to_html_content/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":253}},{"location":{"uri":"javascript/frameworks/ui5/test/models/multiple_models/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":254}},{"location":{"uri":"javascript/frameworks/ui5/test/models/property_getter_setter/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":255}},{"location":{"uri":"javascript/frameworks/ui5/test/models/sink/sink1.xml","uriBaseId":"%SRCROOT%","index":256}},{"location":{"uri":"javascript/frameworks/ui5/test/models/source/source1.xml","uriBaseId":"%SRCROOT%","index":257}},{"location":{"uri":"javascript/frameworks/ui5/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":258}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/index.html","uriBaseId":"%SRCROOT%","index":259}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":260}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":261}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/index.html","uriBaseId":"%SRCROOT%","index":262}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-deny-all/index.html","uriBaseId":"%SRCROOT%","index":263}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-deny-all/ui5.yaml","uriBaseId":"%SRCROOT%","index":264}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":265}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":266}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":267}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":268}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":269}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":270}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":271}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":272}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":273}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":274}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":275}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":276}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":278}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":279}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":280}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":281}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":282}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":283}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":284}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":285}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":286}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":287}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":288}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":289}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":291}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":292}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":293}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":294}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":295}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":296}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":297}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":298}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":299}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":300}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":301}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":302}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":303}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":304}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":305}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":306}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":307}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":308}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/package-lock.json","uriBaseId":"%SRCROOT%","index":309}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/ui5.yaml","uriBaseId":"%SRCROOT%","index":310}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/package.json","uriBaseId":"%SRCROOT%","index":311}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.html","uriBaseId":"%SRCROOT%","index":313}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/index.js","uriBaseId":"%SRCROOT%","index":314}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":315}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":316}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":317}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/package-lock.json","uriBaseId":"%SRCROOT%","index":318}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/package.json","uriBaseId":"%SRCROOT%","index":319}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/ui5.yaml","uriBaseId":"%SRCROOT%","index":320}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.html","uriBaseId":"%SRCROOT%","index":322}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/index.js","uriBaseId":"%SRCROOT%","index":323}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":324}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/package-lock.json","uriBaseId":"%SRCROOT%","index":326}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/package.json","uriBaseId":"%SRCROOT%","index":327}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/ui5.yaml","uriBaseId":"%SRCROOT%","index":328}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.html","uriBaseId":"%SRCROOT%","index":330}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":331}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":332}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":333}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/package-lock.json","uriBaseId":"%SRCROOT%","index":334}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/index.js","uriBaseId":"%SRCROOT%","index":335}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/ui5.yaml","uriBaseId":"%SRCROOT%","index":336}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":337}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.html","uriBaseId":"%SRCROOT%","index":338}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/index.js","uriBaseId":"%SRCROOT%","index":339}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/package.json","uriBaseId":"%SRCROOT%","index":340}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":341}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":342}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module-imported/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":343}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/package-lock.json","uriBaseId":"%SRCROOT%","index":344}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/package.json","uriBaseId":"%SRCROOT%","index":345}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/ui5.yaml","uriBaseId":"%SRCROOT%","index":346}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.html","uriBaseId":"%SRCROOT%","index":348}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/index.js","uriBaseId":"%SRCROOT%","index":349}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":350}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/package-lock.json","uriBaseId":"%SRCROOT%","index":352}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/package.json","uriBaseId":"%SRCROOT%","index":353}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/ui5.yaml","uriBaseId":"%SRCROOT%","index":354}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.js","uriBaseId":"%SRCROOT%","index":356}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/index.html","uriBaseId":"%SRCROOT%","index":357}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":358}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":362}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":363}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":364}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":365}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":366}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":367}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":368}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":369}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":370}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":371}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":372}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":373}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":374}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":375}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":376}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":377}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":378}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":379}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":380}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":381}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":383}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":384}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":385}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":386}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":387}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":388}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":389}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":390}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":391}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":392}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":393}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":394}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/.eslintrc.json","uriBaseId":"%SRCROOT%","index":396}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/package-lock.json","uriBaseId":"%SRCROOT%","index":397}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/package.json","uriBaseId":"%SRCROOT%","index":398}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/ui5.yaml","uriBaseId":"%SRCROOT%","index":399}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/Component.js","uriBaseId":"%SRCROOT%","index":400}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/index.html","uriBaseId":"%SRCROOT%","index":403}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":404}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/model/todoitems.json","uriBaseId":"%SRCROOT%","index":405}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/AllJourneys.js","uriBaseId":"%SRCROOT%","index":406}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/FilterJourney.js","uriBaseId":"%SRCROOT%","index":407}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/SearchJourney.js","uriBaseId":"%SRCROOT%","index":408}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/TodoListJourney.js","uriBaseId":"%SRCROOT%","index":409}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/arrangements/Startup.js","uriBaseId":"%SRCROOT%","index":410}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.html","uriBaseId":"%SRCROOT%","index":411}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/opaTests.qunit.js","uriBaseId":"%SRCROOT%","index":412}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/integration/pages/App.js","uriBaseId":"%SRCROOT%","index":413}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.html","uriBaseId":"%SRCROOT%","index":414}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":415}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/AllTests.js","uriBaseId":"%SRCROOT%","index":416}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/controller/App.controller.js","uriBaseId":"%SRCROOT%","index":417}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.html","uriBaseId":"%SRCROOT%","index":418}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/unit/unitTests.qunit.js","uriBaseId":"%SRCROOT%","index":419}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/util/Helper.js","uriBaseId":"%SRCROOT%","index":420}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/view/App.view.xml","uriBaseId":"%SRCROOT%","index":421}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/package-lock.json","uriBaseId":"%SRCROOT%","index":422}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/package.json","uriBaseId":"%SRCROOT%","index":423}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/ui5.yaml","uriBaseId":"%SRCROOT%","index":424}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":426}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.html","uriBaseId":"%SRCROOT%","index":427}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/index.js","uriBaseId":"%SRCROOT%","index":428}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":429}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/package-lock.json","uriBaseId":"%SRCROOT%","index":431}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/package.json","uriBaseId":"%SRCROOT%","index":432}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/ui5.yaml","uriBaseId":"%SRCROOT%","index":433}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":434}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":435}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.html","uriBaseId":"%SRCROOT%","index":436}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/index.js","uriBaseId":"%SRCROOT%","index":437}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":438}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/package-lock.json","uriBaseId":"%SRCROOT%","index":440}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/ui5.yaml","uriBaseId":"%SRCROOT%","index":441}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":442}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":443}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/package.json","uriBaseId":"%SRCROOT%","index":444}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.html","uriBaseId":"%SRCROOT%","index":445}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/index.js","uriBaseId":"%SRCROOT%","index":446}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":447}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":449}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/package.json","uriBaseId":"%SRCROOT%","index":450}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":451}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":452}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":453}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":454}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":455}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":456}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":457}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/package-lock.json","uriBaseId":"%SRCROOT%","index":458}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/package.json","uriBaseId":"%SRCROOT%","index":459}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/ui5.yaml","uriBaseId":"%SRCROOT%","index":460}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":461}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":462}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.html","uriBaseId":"%SRCROOT%","index":463}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/index.js","uriBaseId":"%SRCROOT%","index":464}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":465}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":466}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/package-lock.json","uriBaseId":"%SRCROOT%","index":467}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/package.json","uriBaseId":"%SRCROOT%","index":468}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/ui5.yaml","uriBaseId":"%SRCROOT%","index":469}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.html","uriBaseId":"%SRCROOT%","index":471}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/index.js","uriBaseId":"%SRCROOT%","index":472}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":473}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package-lock.json","uriBaseId":"%SRCROOT%","index":475}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/package.json","uriBaseId":"%SRCROOT%","index":476}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/ui5.yaml","uriBaseId":"%SRCROOT%","index":477}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/Component.js","uriBaseId":"%SRCROOT%","index":478}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js","uriBaseId":"%SRCROOT%","index":482}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":483}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.html","uriBaseId":"%SRCROOT%","index":484}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/index.js","uriBaseId":"%SRCROOT%","index":485}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":486}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App1.view.xml","uriBaseId":"%SRCROOT%","index":487}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App2.view.xml","uriBaseId":"%SRCROOT%","index":488}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App3.view.xml","uriBaseId":"%SRCROOT%","index":489}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/App4.view.xml","uriBaseId":"%SRCROOT%","index":490}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":491}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/package-lock.json","uriBaseId":"%SRCROOT%","index":492}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/package.json","uriBaseId":"%SRCROOT%","index":493}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":494}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":495}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":496}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":497}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":498}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/package-lock.json","uriBaseId":"%SRCROOT%","index":500}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/package.json","uriBaseId":"%SRCROOT%","index":501}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/ui5.yaml","uriBaseId":"%SRCROOT%","index":502}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.html","uriBaseId":"%SRCROOT%","index":504}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/index.js","uriBaseId":"%SRCROOT%","index":505}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":506}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/package-lock.json","uriBaseId":"%SRCROOT%","index":508}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/package.json","uriBaseId":"%SRCROOT%","index":509}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/ui5.yaml","uriBaseId":"%SRCROOT%","index":510}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":511}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.html","uriBaseId":"%SRCROOT%","index":512}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/index.js","uriBaseId":"%SRCROOT%","index":513}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":514}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-oneway/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":515}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/package-lock.json","uriBaseId":"%SRCROOT%","index":516}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/package.json","uriBaseId":"%SRCROOT%","index":517}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/ui5.yaml","uriBaseId":"%SRCROOT%","index":518}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":519}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/model.json","uriBaseId":"%SRCROOT%","index":520}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.html","uriBaseId":"%SRCROOT%","index":521}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/index.js","uriBaseId":"%SRCROOT%","index":522}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":523}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":524}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/package-lock.json","uriBaseId":"%SRCROOT%","index":525}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/package.json","uriBaseId":"%SRCROOT%","index":526}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":527}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":528}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":529}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":530}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":531}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":532}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/package-lock.json","uriBaseId":"%SRCROOT%","index":533}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/package.json","uriBaseId":"%SRCROOT%","index":534}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":535}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssBase.js","uriBaseId":"%SRCROOT%","index":536}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":537}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":538}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":539}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":540}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":541}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":542}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":543}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/package-lock.json","uriBaseId":"%SRCROOT%","index":544}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/package.json","uriBaseId":"%SRCROOT%","index":545}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":546}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":547}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":548}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":549}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":550}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":551}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/package-lock.json","uriBaseId":"%SRCROOT%","index":552}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/package.json","uriBaseId":"%SRCROOT%","index":553}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/ui5.yaml","uriBaseId":"%SRCROOT%","index":554}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":555}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.html","uriBaseId":"%SRCROOT%","index":556}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/index.js","uriBaseId":"%SRCROOT%","index":557}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":558}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":559}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/package-lock.json","uriBaseId":"%SRCROOT%","index":560}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/package.json","uriBaseId":"%SRCROOT%","index":561}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/ui5.yaml","uriBaseId":"%SRCROOT%","index":562}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":563}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":564}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":565}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.html","uriBaseId":"%SRCROOT%","index":566}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/index.js","uriBaseId":"%SRCROOT%","index":567}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":568}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":569}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/package-lock.json","uriBaseId":"%SRCROOT%","index":570}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/package.json","uriBaseId":"%SRCROOT%","index":571}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/ui5.yaml","uriBaseId":"%SRCROOT%","index":572}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":573}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":574}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":575}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.html","uriBaseId":"%SRCROOT%","index":576}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/index.js","uriBaseId":"%SRCROOT%","index":577}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":578}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":579}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/package.json","uriBaseId":"%SRCROOT%","index":580}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/package-lock.json","uriBaseId":"%SRCROOT%","index":581}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/ui5.yaml","uriBaseId":"%SRCROOT%","index":582}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":583}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.html","uriBaseId":"%SRCROOT%","index":584}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/index.js","uriBaseId":"%SRCROOT%","index":585}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/manifest.json","uriBaseId":"%SRCROOT%","index":586}},{"location":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":588}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":589}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/.eslintrc.json","uriBaseId":"%SRCROOT%","index":590}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package-lock.json","uriBaseId":"%SRCROOT%","index":591}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package.json","uriBaseId":"%SRCROOT%","index":592}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/public/index.html","uriBaseId":"%SRCROOT%","index":593}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/App.tsx","uriBaseId":"%SRCROOT%","index":594}},{"location":{"uri":"javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/index.tsx","uriBaseId":"%SRCROOT%","index":595}},{"location":{"uri":"javascript/frameworks/xsjs/lib/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":596}},{"location":{"uri":"javascript/frameworks/xsjs/lib/qlpack.yml","uriBaseId":"%SRCROOT%","index":597}},{"location":{"uri":"javascript/frameworks/xsjs/src/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":598}},{"location":{"uri":"javascript/frameworks/xsjs/src/qlpack.yml","uriBaseId":"%SRCROOT%","index":599}},{"location":{"uri":"javascript/frameworks/xsjs/test/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":600}},{"location":{"uri":"javascript/frameworks/xsjs/test/qlpack.yml","uriBaseId":"%SRCROOT%","index":601}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/.xsaccess","uriBaseId":"%SRCROOT%","index":602}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess","uriBaseId":"%SRCROOT%","index":603}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/missing_auth/.xsaccess","uriBaseId":"%SRCROOT%","index":604}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/service.xsjs","uriBaseId":"%SRCROOT%","index":605}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":606}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609}},{"location":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610}},{"location":{"uri":"javascript/heuristic-models/tests/codeql-pack.lock.yml","uriBaseId":"%SRCROOT%","index":611}},{"location":{"uri":"javascript/heuristic-models/tests/qlpack.yml","uriBaseId":"%SRCROOT%","index":612}},{"location":{"uri":"qlt.conf.json","uriBaseId":"%SRCROOT%","index":613}},{"location":{"uri":"file:/opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/javascript/tools/data/externs/web/window.js","index":614}},{"location":{"uri":"scripts/CreateTestsFromYaml.py","uriBaseId":"%SRCROOT%","index":615}}],"results":[{"ruleId":"js/missing-rate-limiting","rule":{"id":"js/missing-rate-limiting","index":10,"toolComponent":{"index":1}},"message":{"text":"This route handler performs [a database access](1), but is not rate-limited."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":781,"startColumn":23,"endLine":784,"endColumn":6}}}],"partialFingerprints":{"primaryLocationLineHash":"ac6d3bdd3d52ea9b:1","primaryLocationStartColumnFingerprint":"18"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":7,"endLine":783,"endColumn":9}},"message":{"text":"a database access"}}]},{"ruleId":"js/xss","rule":{"id":"js/xss","index":33,"toolComponent":{"index":1}},"message":{"text":"Cross-site scripting vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":4,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"6311a9ed7e4091a4:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"jQuery. ... param\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":4,"startColumn":20,"endColumn":25}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}}}]},{"ruleId":"js/xss","rule":{"id":"js/xss","index":33,"toolComponent":{"index":1}},"message":{"text":"Cross-site scripting vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":11,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"8e517fc6fdf32a1a:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":11,"startColumn":20,"endColumn":25}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/xss","rule":{"id":"js/xss","index":33,"toolComponent":{"index":1}},"message":{"text":"Cross-site scripting vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":19,"startColumn":20,"endColumn":26}}}],"partialFingerprints":{"primaryLocationLineHash":"c51cf11a085c01f4:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":39,"endColumn":44}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":18,"endColumn":45}},"message":{"text":"jQuery. ... (value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":9,"endColumn":15}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":19,"startColumn":20,"endColumn":26}},"message":{"text":"value1"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/xss","rule":{"id":"js/xss","index":33,"toolComponent":{"index":1}},"message":{"text":"Cross-site scripting vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":27,"startColumn":20,"endColumn":26}}}],"partialFingerprints":{"primaryLocationLineHash":"e309bf8540256a05:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":26,"startColumn":39,"endColumn":44}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":26,"startColumn":18,"endColumn":45}},"message":{"text":"jQuery. ... (value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":26,"startColumn":9,"endColumn":15}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":27,"startColumn":20,"endColumn":26}},"message":{"text":"value1"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/sql-injection","rule":{"id":"js/sql-injection","index":34,"toolComponent":{"index":1}},"message":{"text":"This query string depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"e7f0d59b4cbe0ccc:1","primaryLocationStartColumnFingerprint":"11"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}},"message":{"text":"user-provided value"}}]},{"ruleId":"js/log-injection","rule":{"id":"js/log-injection","index":99,"toolComponent":{"index":1}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":7,"startColumn":18,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"be9a18716e55d497:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}},"message":{"text":"jQuery. ... param\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":7,"startColumn":34,"endColumn":39}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":7,"startColumn":18,"endColumn":41}},"message":{"text":"`[INFO] ... value}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}}}]},{"ruleId":"js/log-injection","rule":{"id":"js/log-injection","index":99,"toolComponent":{"index":1}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":15,"startColumn":18,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"be9a18716e55d497:2","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}},"message":{"text":"req.url"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":13,"endColumn":37}},"message":{"text":"url.par ... , true)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":9,"endColumn":10}},"message":{"text":"q"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":14,"startColumn":17,"endColumn":18}},"message":{"text":"q"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":14,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":15,"startColumn":34,"endColumn":39}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":15,"startColumn":18,"endColumn":41}},"message":{"text":"`[INFO] ... value}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}}}]},{"ruleId":"js/log-injection","rule":{"id":"js/log-injection","index":99,"toolComponent":{"index":1}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":24,"startColumn":18,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"e197b363f9dc3962:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}},"message":{"text":"req.url"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":13,"endColumn":37}},"message":{"text":"url.par ... , true)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":9,"endColumn":10}},"message":{"text":"q"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":22,"startColumn":17,"endColumn":18}},"message":{"text":"q"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":22,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":23,"startColumn":39,"endColumn":44}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":23,"startColumn":18,"endColumn":45}},"message":{"text":"jQuery. ... (value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":23,"startColumn":9,"endColumn":15}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":24,"startColumn":34,"endColumn":40}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":24,"startColumn":18,"endColumn":42}},"message":{"text":"`[INFO] ... alue1}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}}}]},{"ruleId":"js/log-injection","rule":{"id":"js/log-injection","index":99,"toolComponent":{"index":1}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3},"region":{"startLine":5,"startColumn":17,"endColumn":33}}}],"partialFingerprints":{"primaryLocationLineHash":"45280b24f3d81287:1","primaryLocationStartColumnFingerprint":"12"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3},"region":{"startLine":5,"startColumn":17,"endColumn":33}},"message":{"text":"user-provided value"}}]},{"ruleId":"js/ui5-path-injection","rule":{"id":"js/ui5-path-injection","index":0,"toolComponent":{"index":4}},"message":{"text":"The path of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":374},"region":{"startLine":17,"startColumn":43,"endColumn":61}}}],"partialFingerprints":{"primaryLocationLineHash":"68e5ff83e2198ff5:1","primaryLocationStartColumnFingerprint":"26"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":379},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":373},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":374},"region":{"startLine":8,"startColumn":23,"endColumn":38}},"message":{"text":"{ type: \"int\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":374},"region":{"startLine":17,"startColumn":43,"endColumn":61}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":379},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":379},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-path-injection","rule":{"id":"js/ui5-path-injection","index":0,"toolComponent":{"index":4}},"message":{"text":"The path of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":23,"startColumn":43,"endColumn":55}}}],"partialFingerprints":{"primaryLocationLineHash":"b79de9dff4d8f842:1","primaryLocationStartColumnFingerprint":"26"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":387},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":383},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":9,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":15,"startColumn":29,"endColumn":47}},"message":{"text":"oControl.getText()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":15,"startColumn":21,"endColumn":26}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":17,"startColumn":53,"endColumn":58}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":17,"startColumn":46,"endColumn":59}},"message":{"text":"String(value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":17,"startColumn":36,"endColumn":60}},"message":{"text":"encodeX ... value))"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":17,"startColumn":21,"endColumn":33}},"message":{"text":"xssSanitized"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":382},"region":{"startLine":23,"startColumn":43,"endColumn":55}},"message":{"text":"xssSanitized"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":387},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":387},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-path-injection","rule":{"id":"js/ui5-path-injection","index":0,"toolComponent":{"index":4}},"message":{"text":"The path of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":391},"region":{"startLine":16,"startColumn":39,"endColumn":67}}}],"partialFingerprints":{"primaryLocationLineHash":"de27f6d546a116e8:1","primaryLocationStartColumnFingerprint":"26"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":391},"region":{"startLine":10,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":391},"region":{"startLine":16,"startColumn":39,"endColumn":67}},"message":{"text":"oModel. ... input')"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5PathInjection/path-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":395},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-clickjacking","rule":{"id":"js/ui5-clickjacking","index":1,"toolComponent":{"index":4}},"message":{"text":"Possible clickjacking vulnerability due to missing frame options."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-default-all/index.html","uriBaseId":"%SRCROOT%","index":262},"region":{"startLine":2,"endColumn":16}}}],"partialFingerprints":{"primaryLocationLineHash":"7fe81114896a63c:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/ui5-clickjacking","rule":{"id":"js/ui5-clickjacking","index":1,"toolComponent":{"index":4}},"message":{"text":"Possible clickjacking vulnerability due to missing frame options."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/index.html","uriBaseId":"%SRCROOT%","index":403},"region":{"startLine":2,"endColumn":16}}}],"partialFingerprints":{"primaryLocationLineHash":"df700c15dad274b2:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/ui5-clickjacking","rule":{"id":"js/ui5-clickjacking","index":1,"toolComponent":{"index":4}},"message":{"text":"Possible clickjacking vulnerability due to window\\[ ... onfig\"\\] being set to `allow`."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/index.html","uriBaseId":"%SRCROOT%","index":259},"region":{"startLine":9,"startColumn":9,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"6152b8f74a1abdf5:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/ui5-clickjacking","rule":{"id":"js/ui5-clickjacking","index":1,"toolComponent":{"index":4}},"message":{"text":"Possible clickjacking vulnerability due to data-sap-ui-frameOptions=allow being set to `allow`."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Clickjacking/clickjacking-allow-all/index.html","uriBaseId":"%SRCROOT%","index":259},"region":{"startLine":28,"startColumn":34,"endColumn":66}}}],"partialFingerprints":{"primaryLocationLineHash":"b01bd23ca3666824:1","primaryLocationStartColumnFingerprint":"25"}},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":11,"startColumn":19,"endColumn":26}}}],"partialFingerprints":{"primaryLocationLineHash":"83472515fe67207a:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":7,"startColumn":23,"endColumn":42}},"message":{"text":"Log.getLogEntries()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":7,"startColumn":13,"endColumn":20}},"message":{"text":"message"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":11,"startColumn":19,"endColumn":26}},"message":{"text":"message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":24,"startColumn":23,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"de5157ed7a614f91:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":8,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":14,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":14,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":17,"startColumn":19,"endColumn":24}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":20,"startColumn":33,"endColumn":42}},"message":{"text":"oLogEntry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":24,"startColumn":23,"endColumn":32}},"message":{"text":"oLogEntry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":24,"startColumn":23,"endColumn":40}},"message":{"text":"oLogEntry.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":332},"region":{"startLine":13,"startColumn":19,"endColumn":36}}}],"partialFingerprints":{"primaryLocationLineHash":"d67a8ded95b9934b:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":332},"region":{"startLine":9,"startColumn":29,"endColumn":38}},"message":{"text":"oLogEntry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":332},"region":{"startLine":13,"startColumn":19,"endColumn":28}},"message":{"text":"oLogEntry"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":332},"region":{"startLine":13,"startColumn":19,"endColumn":36}},"message":{"text":"oLogEntry.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":13,"startColumn":19,"endColumn":33}}}],"partialFingerprints":{"primaryLocationLineHash":"84768bf2b1d6e5a5:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":9,"startColumn":29,"endColumn":35}},"message":{"text":"oEvent"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":13,"startColumn":19,"endColumn":25}},"message":{"text":"oEvent"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":13,"startColumn":19,"endColumn":33}},"message":{"text":"oEvent.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-log-injection-to-http","rule":{"id":"js/ui5-log-injection-to-http","index":2,"toolComponent":{"index":4}},"message":{"text":"Outbound network request depends on [user-provided](1) log data."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":11,"startColumn":19,"endColumn":26}}}],"partialFingerprints":{"primaryLocationLineHash":"83472515fe67207a:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":7,"startColumn":23,"endColumn":42}},"message":{"text":"Log.getLogEntries()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":7,"startColumn":13,"endColumn":20}},"message":{"text":"message"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":11,"startColumn":19,"endColumn":26}},"message":{"text":"message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351},"region":{"startLine":5,"startColumn":9,"endLine":24,"endColumn":10}}}],"partialFingerprints":{"primaryLocationLineHash":"fad475448f62563d:1","primaryLocationStartColumnFingerprint":"-139"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351},"region":{"startLine":6,"startColumn":5,"endLine":8,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":15,"startColumn":25,"endColumn":53}},"message":{"text":"oModel. ... input')"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":15,"startColumn":17,"endColumn":22}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":17,"startColumn":34,"endColumn":39}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351},"region":{"startLine":6,"startColumn":5,"endLine":8,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":351},"region":{"startLine":6,"startColumn":5,"endLine":8,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-notifications/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":347},"region":{"startLine":17,"startColumn":34,"endColumn":39}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":316},"region":{"startLine":7,"startColumn":23,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"20e0edf06769f248:1","primaryLocationStartColumnFingerprint":"14"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":317},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-getLogEntries/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":312},"region":{"startLine":18,"startColumn":30,"endColumn":35}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":20,"startColumn":33,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"eb64edf724fde59e:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":8,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":14,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":14,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":17,"startColumn":19,"endColumn":24}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":325},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-js-object/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":321},"region":{"startLine":17,"startColumn":19,"endColumn":24}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":332},"region":{"startLine":9,"startColumn":29,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"eb64edf724fde59e:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":333},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-http-log-listener-sap-module/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":329},"region":{"startLine":18,"startColumn":30,"endColumn":35}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":9,"startColumn":29,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"e10e4681e4f3a5f2:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}}}]},{"ruleId":"js/ui5-unsafe-log-access","rule":{"id":"js/ui5-unsafe-log-access","index":3,"toolComponent":{"index":4}},"message":{"text":"Accessed log entries depend on [user-provided data](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/LogEntriesToHttp.js","uriBaseId":"%SRCROOT%","index":360},"region":{"startLine":7,"startColumn":23,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"20e0edf06769f248:1","primaryLocationStartColumnFingerprint":"14"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided data"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}}}]},{"ruleId":"js/ui5-formula-injection","rule":{"id":"js/ui5-formula-injection","index":4,"toolComponent":{"index":4}},"message":{"text":"The content of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":270},"region":{"startLine":17,"startColumn":27,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"41899ff1a967017d:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":275},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":269},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":270},"region":{"startLine":8,"startColumn":23,"endColumn":38}},"message":{"text":"{ type: \"int\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":270},"region":{"startLine":17,"startColumn":27,"endColumn":45}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":275},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-property-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":275},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-formula-injection","rule":{"id":"js/ui5-formula-injection","index":4,"toolComponent":{"index":4}},"message":{"text":"The content of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":23,"startColumn":27,"endColumn":39}}}],"partialFingerprints":{"primaryLocationLineHash":"9afa5fd07ee36af6:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":283},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":278},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":9,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":15,"startColumn":29,"endColumn":47}},"message":{"text":"oControl.getText()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":15,"startColumn":21,"endColumn":26}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":17,"startColumn":53,"endColumn":58}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":17,"startColumn":46,"endColumn":59}},"message":{"text":"String(value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":17,"startColumn":36,"endColumn":60}},"message":{"text":"encodeX ... value))"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":17,"startColumn":21,"endColumn":33}},"message":{"text":"xssSanitized"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":277},"region":{"startLine":23,"startColumn":27,"endColumn":39}},"message":{"text":"xssSanitized"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":283},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-custom-control-sanitized/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":283},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-formula-injection","rule":{"id":"js/ui5-formula-injection","index":4,"toolComponent":{"index":4}},"message":{"text":"The content of a saved file depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":285},"region":{"startLine":16,"startColumn":23,"endColumn":51}}}],"partialFingerprints":{"primaryLocationLineHash":"e701acdf85af03b4:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":285},"region":{"startLine":10,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":285},"region":{"startLine":16,"startColumn":23,"endColumn":51}},"message":{"text":"oModel. ... input')"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":16,"startColumn":31,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"3bb21c52eb38cf8:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":11,"startColumn":11,"endColumn":22}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":21,"endColumn":49}},"message":{"text":"oModel. ... input\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":17,"startColumn":13,"endColumn":18}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":355},"region":{"startLine":18,"startColumn":30,"endColumn":35}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":9,"startColumn":29,"endColumn":35}},"message":{"text":"oEvent"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":16,"startColumn":31,"endColumn":37}},"message":{"text":"oEvent"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/utils/CustomLogListener.js","uriBaseId":"%SRCROOT%","index":359},"region":{"startLine":16,"startColumn":31,"endColumn":45}},"message":{"text":"oEvent.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/log-entry-flows-to-sinks/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":361},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":5,"startColumn":27,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"92dbc37bdafc7694:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"jQuery. ... param\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":5,"startColumn":27,"endColumn":32}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":12,"startColumn":27,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"faa1832c387d2ee5:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":12,"startColumn":27,"endColumn":32}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":20,"startColumn":27,"endColumn":33}}}],"partialFingerprints":{"primaryLocationLineHash":"8291f53a2e235d15:1","primaryLocationStartColumnFingerprint":"22"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"documen ... .search"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":9,"endColumn":14}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":39,"endColumn":44}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":18,"endColumn":45}},"message":{"text":"jQuery. ... (value)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":18,"startColumn":9,"endColumn":15}},"message":{"text":"value1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":20,"startColumn":27,"endColumn":33}},"message":{"text":"value1"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402},"region":{"startLine":132,"startColumn":7,"endLine":134,"endColumn":16}}}],"partialFingerprints":{"primaryLocationLineHash":"63ace7b071639814:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":23,"startColumn":25,"endColumn":48}},"message":{"text":"oSearch ... Value()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":23,"startColumn":11,"endColumn":22}},"message":{"text":"searchValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":27,"startColumn":34,"endColumn":45}},"message":{"text":"searchValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402},"region":{"startLine":17,"startColumn":13,"endColumn":31}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402},"region":{"startLine":133,"startColumn":8,"endColumn":27}},"message":{"text":"oControl.getTitle()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controls/Book.js","uriBaseId":"%SRCROOT%","index":402},"region":{"startLine":132,"startColumn":7,"endLine":134,"endColumn":16}},"message":{"text":"\"T ...
\""}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":23,"startColumn":25,"endColumn":48}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/controller/App.Controller.js","uriBaseId":"%SRCROOT%","index":401},"region":{"startLine":23,"startColumn":25,"endColumn":48}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425},"region":{"startLine":14,"startColumn":23,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"fc87b07640e9d85:1","primaryLocationStartColumnFingerprint":"10"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":426},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425},"region":{"startLine":7,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":425},"region":{"startLine":14,"startColumn":23,"endColumn":41}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api1/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":430},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":434},"region":{"startLine":14,"startColumn":32,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"352d5eac262ae765:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":435},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":434},"region":{"startLine":7,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":434},"region":{"startLine":14,"startColumn":32,"endColumn":50}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-api2/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":439},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":442},"region":{"startLine":14,"startColumn":28,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"352d5ec8b0c3bb0d:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":443},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":442},"region":{"startLine":7,"startColumn":19,"endColumn":37}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":442},"region":{"startLine":14,"startColumn":28,"endColumn":46}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-custom-control-jquery/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":448},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":27,"startColumn":36,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"8ceecee7055f4fa2:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":26,"startColumn":25,"endColumn":42}},"message":{"text":"oInput.getValue()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":26,"startColumn":17,"endColumn":22}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":27,"startColumn":36,"endColumn":41}},"message":{"text":"value"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":26,"startColumn":25,"endColumn":42}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":26,"startColumn":25,"endColumn":42}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":32,"startColumn":30,"endColumn":43}}}],"partialFingerprints":{"primaryLocationLineHash":"2550a22178eb38c8:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":26,"startColumn":19,"endColumn":36}},"message":{"text":"oInput.getValue()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":26,"startColumn":11,"endColumn":16}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":27,"startColumn":56,"endColumn":61}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":27,"startColumn":45,"endColumn":63}},"message":{"text":"{ message: value }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":30,"startColumn":34,"endColumn":39}},"message":{"text":"model"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":32,"startColumn":30,"endColumn":35}},"message":{"text":"model"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":32,"startColumn":30,"endColumn":43}},"message":{"text":"model.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":26,"startColumn":19,"endColumn":36}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App1.controller.js","uriBaseId":"%SRCROOT%","index":479},"region":{"startLine":26,"startColumn":19,"endColumn":36}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":32,"startColumn":30,"endColumn":43}}}],"partialFingerprints":{"primaryLocationLineHash":"2550a22178eb38c8:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":26,"startColumn":19,"endColumn":36}},"message":{"text":"oInput.getValue()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":26,"startColumn":11,"endColumn":16}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":27,"startColumn":56,"endColumn":61}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":27,"startColumn":45,"endColumn":63}},"message":{"text":"{ message: value }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":30,"startColumn":34,"endColumn":39}},"message":{"text":"model"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":32,"startColumn":30,"endColumn":35}},"message":{"text":"model"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":32,"startColumn":30,"endColumn":43}},"message":{"text":"model.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":26,"startColumn":19,"endColumn":36}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App2.controller.js","uriBaseId":"%SRCROOT%","index":480},"region":{"startLine":26,"startColumn":19,"endColumn":36}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":26,"startColumn":30,"endColumn":43}}}],"partialFingerprints":{"primaryLocationLineHash":"2550a22178eb38c8:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481},"region":{"startLine":25,"startColumn":19,"endColumn":36}},"message":{"text":"oInput.getValue()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481},"region":{"startLine":25,"startColumn":11,"endColumn":16}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481},"region":{"startLine":26,"startColumn":56,"endColumn":61}},"message":{"text":"value"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481},"region":{"startLine":26,"startColumn":45,"endColumn":63}},"message":{"text":"{ message: value }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":24,"startColumn":34,"endColumn":39}},"message":{"text":"model"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":26,"startColumn":30,"endColumn":35}},"message":{"text":"model"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App4.controller.js","uriBaseId":"%SRCROOT%","index":482},"region":{"startLine":26,"startColumn":30,"endColumn":43}},"message":{"text":"model.message"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481},"region":{"startLine":25,"startColumn":19,"endColumn":36}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-eventbus-with-data/webapp/controller/App3.controller.js","uriBaseId":"%SRCROOT%","index":481},"region":{"startLine":25,"startColumn":19,"endColumn":36}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":538},"region":{"startLine":8,"startColumn":28,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"353ad97f4bff4eae:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":543},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":539},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssBase.js","uriBaseId":"%SRCROOT%","index":536},"region":{"startLine":5,"startColumn":15,"endColumn":33}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":538},"region":{"startLine":8,"startColumn":28,"endColumn":46}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":543},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-indirect-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":543},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":563},"region":{"startLine":8,"startColumn":28,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"353ad97f4bff4eae:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":569},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":565},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":564},"region":{"startLine":7,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/control/renderer.js","uriBaseId":"%SRCROOT%","index":563},"region":{"startLine":8,"startColumn":28,"endColumn":46}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":569},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":569},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":574},"region":{"startLine":8,"startColumn":28,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"353ad97f4bff4eae:1","primaryLocationStartColumnFingerprint":"15"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":579},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":575},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xss.js","uriBaseId":"%SRCROOT%","index":573},"region":{"startLine":7,"startColumn":23,"endColumn":41}},"message":{"text":"{ type: \"string\" }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/control/xssRenderer.js","uriBaseId":"%SRCROOT%","index":574},"region":{"startLine":8,"startColumn":28,"endColumn":46}},"message":{"text":"oControl.getText()"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":579},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-separate-renderer-byname/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":579},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":551},"region":{"startLine":21,"startColumn":22,"endColumn":32}}}],"partialFingerprints":{"primaryLocationLineHash":"93df5ec84a8a106e:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":551},"region":{"startLine":18,"startColumn":20,"endColumn":30}},"message":{"text":"/input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":547},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":551},"region":{"startLine":21,"startColumn":22,"endColumn":32}},"message":{"text":"/input"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":551},"region":{"startLine":18,"startColumn":20,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-js-view/webapp/view/app.view.js","uriBaseId":"%SRCROOT%","index":551},"region":{"startLine":18,"startColumn":20,"endColumn":30}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":8,"startColumn":5,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"74b35e217af6aa05:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":285},"region":{"startLine":10,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":8,"startColumn":5,"endColumn":50}},"message":{"text":"content={/input}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5FormulaInjection/formula-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":290},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":9,"startColumn":5,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"9caa0f252fbe2993:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":31,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":9,"startColumn":25,"endColumn":53}},"message":{"text":"oModel. ... input')"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":9,"startColumn":17,"endColumn":22}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":10,"startColumn":44,"endColumn":49}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":32,"startColumn":17,"endColumn":30}},"message":{"text":"output1: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":9,"startColumn":5,"endColumn":40}},"message":{"text":"content={/output1}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":17,"startColumn":5,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"2963bbd458e69924:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":18,"startColumn":31,"endColumn":60}},"message":{"text":"oEvent. ... Value()"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":18,"startColumn":17,"endColumn":28}},"message":{"text":"sInputValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":19,"startColumn":44,"endColumn":55}},"message":{"text":"sInputValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":34,"startColumn":17,"endColumn":30}},"message":{"text":"output3: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":474},"region":{"startLine":17,"startColumn":5,"endColumn":40}},"message":{"text":"content={/output3}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":18,"startColumn":31,"endColumn":60}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-event-handlers/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":470},"region":{"startLine":18,"startColumn":31,"endColumn":60}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":30,"startColumn":5,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"711f70e4b3e36d36:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":27,"startColumn":5,"endLine":29,"endColumn":30}},"message":{"text":"value={/input0}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":495},"region":{"startLine":9,"startColumn":17,"endColumn":29}},"message":{"text":"input0: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":30,"startColumn":5,"endColumn":38}},"message":{"text":"content={/input0}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":27,"startColumn":5,"endLine":29,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":27,"startColumn":5,"endLine":29,"endColumn":30}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":45,"startColumn":5,"endColumn":60}}}],"partialFingerprints":{"primaryLocationLineHash":"8d13cc83b72acee:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":42,"startColumn":5,"endLine":44,"endColumn":30}},"message":{"text":"value={/input3}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":495},"region":{"startLine":12,"startColumn":17,"endColumn":29}},"message":{"text":"input3: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":45,"startColumn":5,"endColumn":60}},"message":{"text":"content={/input3}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":42,"startColumn":5,"endLine":44,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":42,"startColumn":5,"endLine":44,"endColumn":30}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":50,"startColumn":5,"endColumn":82}}}],"partialFingerprints":{"primaryLocationLineHash":"4698f735d8a1f320:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":47,"startColumn":5,"endLine":49,"endColumn":30}},"message":{"text":"value={/input4}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":495},"region":{"startLine":13,"startColumn":17,"endColumn":29}},"message":{"text":"input4: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":50,"startColumn":5,"endColumn":82}},"message":{"text":"content={/input4}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":47,"startColumn":5,"endLine":49,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":47,"startColumn":5,"endLine":49,"endColumn":30}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":58,"startColumn":5,"endColumn":66}}}],"partialFingerprints":{"primaryLocationLineHash":"bb503c8d5e14583a:1","primaryLocationStartColumnFingerprint":"0"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":499},"region":{"startLine":58,"startColumn":5,"endColumn":66}},"message":{"text":"user-provided value"}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":8,"startColumn":5,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"1406455ac263a2d9:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503},"region":{"startLine":12,"startColumn":26,"endColumn":46}},"message":{"text":"new JSONModel(oData)"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":8,"startColumn":5,"endColumn":38}},"message":{"text":"content={/output}"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503},"region":{"startLine":15,"startColumn":25,"endColumn":53}},"message":{"text":"oModel. ... input')"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503},"region":{"startLine":15,"startColumn":17,"endColumn":22}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503},"region":{"startLine":16,"startColumn":43,"endColumn":48}},"message":{"text":"input"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":503},"region":{"startLine":10,"startColumn":17,"endColumn":29}},"message":{"text":"output: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":8,"startColumn":5,"endColumn":38}},"message":{"text":"content={/output}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-control-df/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":507},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":524},"region":{"startLine":8,"startColumn":5,"endColumn":37}}}],"partialFingerprints":{"primaryLocationLineHash":"97b29ed20ac04ff0:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":524},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":519},"region":{"startLine":8,"startColumn":40,"endColumn":63}},"message":{"text":"\"contro ... l.json\""}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":524},"region":{"startLine":8,"startColumn":5,"endColumn":37}},"message":{"text":"content={/input}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":524},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-external-model/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":524},"region":{"startLine":5,"startColumn":5,"endLine":7,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":532},"region":{"startLine":8,"startColumn":11,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"5edd24be658b61a4:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":532},"region":{"startLine":5,"startColumn":11,"endColumn":32}},"message":{"text":"data-value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":528},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":532},"region":{"startLine":8,"startColumn":11,"endColumn":34}},"message":{"text":"data-content={/input}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":532},"region":{"startLine":5,"startColumn":11,"endColumn":32}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-html-view/webapp/view/app.view.html","uriBaseId":"%SRCROOT%","index":532},"region":{"startLine":5,"startColumn":11,"endColumn":32}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1).\nXSS vulnerability due to [user-provided value](2)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":22,"startColumn":5,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"6e0d8f690e30e24a:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":8,"startColumn":5,"endLine":10,"endColumn":27}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":583},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":22,"startColumn":5,"endColumn":38}},"message":{"text":"content={/input}"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":15,"startColumn":5,"endLine":18,"endColumn":29}},"message":{"text":"value={/input}"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":583},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":22,"startColumn":5,"endColumn":38}},"message":{"text":"content={/input}"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":8,"startColumn":5,"endLine":10,"endColumn":27}},"message":{"text":"user-provided value"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":15,"startColumn":5,"endLine":18,"endColumn":29}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":8,"startColumn":5,"endLine":10,"endColumn":27}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-webc-control/webapp/view/app.view.xml","uriBaseId":"%SRCROOT%","index":587},"region":{"startLine":15,"startColumn":5,"endLine":18,"endColumn":29}}}]},{"ruleId":"js/ui5-xss","rule":{"id":"js/ui5-xss","index":5,"toolComponent":{"index":4}},"message":{"text":"XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":559},"region":{"startLine":13,"startColumn":15,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"91ab068baa94c999:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":559},"region":{"startLine":9,"startColumn":13,"endColumn":23}},"message":{"text":"\"value\": \"{/input}\""}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/controller/app.controller.js","uriBaseId":"%SRCROOT%","index":555},"region":{"startLine":9,"startColumn":17,"endColumn":28}},"message":{"text":"input: null"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":559},"region":{"startLine":13,"startColumn":15,"endColumn":25}},"message":{"text":"\"content\": \"{/input}\""}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":559},"region":{"startLine":9,"startColumn":13,"endColumn":23}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-json-view/webapp/view/app.view.json","uriBaseId":"%SRCROOT%","index":559},"region":{"startLine":9,"startColumn":13,"endColumn":23}}}]},{"ruleId":"js/cap-log-injection","rule":{"id":"js/cap-log-injection","index":0,"toolComponent":{"index":8}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":9,"startColumn":32,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"7c291d40b7c61d4f:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":35,"endColumn":43}},"message":{"text":"msg.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":15,"endColumn":32}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":17,"endColumn":30}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":9,"startColumn":32,"endColumn":45}},"message":{"text":"messageToPass"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":35,"endColumn":43}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service1-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":217},"region":{"startLine":7,"startColumn":35,"endColumn":43}}}]},{"ruleId":"js/cap-log-injection","rule":{"id":"js/cap-log-injection","index":0,"toolComponent":{"index":8}},"message":{"text":"Log entry depends on a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":9,"startColumn":32,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"7c291d40b7c61d4f:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":39,"endColumn":47}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":19,"endColumn":36}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":21,"endColumn":34}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":9,"startColumn":38,"endColumn":51}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":9,"startColumn":36,"endColumn":53}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":6,"startColumn":29,"endColumn":32}},"message":{"text":"msg"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":7,"startColumn":35,"endColumn":38}},"message":{"text":"msg"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":7,"startColumn":15,"endColumn":32}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":7,"startColumn":17,"endColumn":30}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":225},"region":{"startLine":9,"startColumn":32,"endColumn":45}},"message":{"text":"messageToPass"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":39,"endColumn":47}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-with-service2-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":223},"region":{"startLine":7,"startColumn":39,"endColumn":47}}}]},{"ruleId":"js/cap-log-injection","rule":{"id":"js/cap-log-injection","index":0,"toolComponent":{"index":8}},"message":{"text":"Log entry depends on a [user-provided value](1).\nLog entry depends on a [user-provided value](2)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":9,"startColumn":32,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"7c291d40b7c61d4f:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":39,"endColumn":47}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":19,"endColumn":36}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":21,"endColumn":34}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":9,"startColumn":38,"endColumn":51}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":9,"startColumn":36,"endColumn":53}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":6,"startColumn":29,"endColumn":32}},"message":{"text":"msg"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":7,"startColumn":35,"endColumn":38}},"message":{"text":"msg"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":7,"startColumn":15,"endColumn":32}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":7,"startColumn":17,"endColumn":30}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":9,"startColumn":32,"endColumn":45}},"message":{"text":"messageToPass"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":7,"startColumn":35,"endColumn":43}},"message":{"text":"msg.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":7,"startColumn":15,"endColumn":32}},"message":{"text":"{ messageToPass }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":7,"startColumn":17,"endColumn":30}},"message":{"text":"messageToPass"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":9,"startColumn":32,"endColumn":45}},"message":{"text":"messageToPass"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":39,"endColumn":47}},"message":{"text":"user-provided value"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":7,"startColumn":35,"endColumn":43}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service1.js","uriBaseId":"%SRCROOT%","index":231},"region":{"startLine":7,"startColumn":39,"endColumn":47}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-without-protocol-none/srv/service2.js","uriBaseId":"%SRCROOT%","index":233},"region":{"startLine":7,"startColumn":35,"endColumn":43}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":15,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"77d560033d30e171:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":48,"endColumn":58}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":14,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":15,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":13,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"8ebfcdb6d8e3226a:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":20,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":20,"startColumn":48,"endColumn":58}},"message":{"text":"`ID=` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":20,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":20,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":21,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":19,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"d00fe3143fd387fc:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":26,"startColumn":54,"endColumn":56}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":26,"startColumn":48,"endColumn":58}},"message":{"text":"`ID=${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":26,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":26,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":27,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":25,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":38,"startColumn":7,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"29bf643a411d8976:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":38,"startColumn":42,"endColumn":44}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":38,"startColumn":33,"endColumn":44}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":37,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":38,"startColumn":33,"endColumn":44}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":43,"startColumn":7,"endColumn":45}}}],"partialFingerprints":{"primaryLocationLineHash":"ef21b26f64e7e417:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":43,"startColumn":42,"endColumn":44}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":43,"startColumn":33,"endColumn":44}},"message":{"text":"`ID =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":42,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":43,"startColumn":33,"endColumn":44}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":48,"startColumn":7,"endColumn":44}}}],"partialFingerprints":{"primaryLocationLineHash":"9d03b555ff929ea0:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":48,"startColumn":39,"endColumn":41}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":48,"startColumn":33,"endColumn":43}},"message":{"text":"`ID=${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":47,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":48,"startColumn":33,"endColumn":43}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":7,"endColumn":78}}}],"partialFingerprints":{"primaryLocationLineHash":"b7f3fae4cc5d3224:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":49,"endColumn":55}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":33,"endColumn":55}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":75,"endColumn":77}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":63,"endColumn":77}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":72,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":33,"endColumn":55}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":73,"startColumn":63,"endColumn":77}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":7,"endColumn":78}}}],"partialFingerprints":{"primaryLocationLineHash":"6a3ab8595760f6c0:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":49,"endColumn":55}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":33,"endColumn":55}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":75,"endColumn":77}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":63,"endColumn":77}},"message":{"text":"`col1 = ` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":77,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":33,"endColumn":55}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":78,"startColumn":63,"endColumn":77}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":7,"endColumn":78}}}],"partialFingerprints":{"primaryLocationLineHash":"342691d0eacbdb40:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":49,"endColumn":55}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":33,"endColumn":55}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":73,"endColumn":75}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":63,"endColumn":77}},"message":{"text":"`col1 = ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":82,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":33,"endColumn":55}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":83,"startColumn":63,"endColumn":77}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":88,"startColumn":7,"endColumn":76}}}],"partialFingerprints":{"primaryLocationLineHash":"e84c1b8cf5608a54:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":88,"startColumn":49,"endColumn":55}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":88,"startColumn":33,"endColumn":55}},"message":{"text":"\"col1 = ... amount"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":87,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":88,"startColumn":33,"endColumn":55}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":123,"startColumn":7,"endColumn":47}}}],"partialFingerprints":{"primaryLocationLineHash":"c8e83fb2aff22206:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":123,"startColumn":44,"endColumn":46}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":123,"startColumn":35,"endColumn":46}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":122,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":123,"startColumn":35,"endColumn":46}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":128,"startColumn":7,"endColumn":47}}}],"partialFingerprints":{"primaryLocationLineHash":"980ed798eb9fd08f:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":128,"startColumn":44,"endColumn":46}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":128,"startColumn":35,"endColumn":46}},"message":{"text":"`ID =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":127,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":128,"startColumn":35,"endColumn":46}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":133,"startColumn":7,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"580b744db9ff8fbe:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":133,"startColumn":43,"endColumn":45}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":133,"startColumn":35,"endColumn":47}},"message":{"text":"`ID = ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":132,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":133,"startColumn":35,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":13,"endColumn":58}}}],"partialFingerprints":{"primaryLocationLineHash":"d28f5758e8f2b020:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":55,"endColumn":57}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":47,"endColumn":57}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":13,"endColumn":58}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":7,"endColumn":58}},"message":{"text":"await S ... \" + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":143,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":145,"startColumn":7,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":13,"endColumn":58}}}],"partialFingerprints":{"primaryLocationLineHash":"39e9cbf3cbd9ae3c:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":55,"endColumn":57}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":47,"endColumn":57}},"message":{"text":"`ID=` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":13,"endColumn":58}},"message":{"text":"SELECT. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":7,"endColumn":58}},"message":{"text":"await S ... ` + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":149,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":151,"startColumn":7,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":13,"endColumn":58}}}],"partialFingerprints":{"primaryLocationLineHash":"b86271478f0d53f6:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":53,"endColumn":55}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":47,"endColumn":57}},"message":{"text":"`ID=${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":13,"endColumn":58}},"message":{"text":"SELECT. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":7,"endColumn":58}},"message":{"text":"await S ... ${id}`)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":155,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":157,"startColumn":7,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":13,"endColumn":88}}}],"partialFingerprints":{"primaryLocationLineHash":"12cb305ba21e438f:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":66,"endColumn":68}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":47,"endColumn":68}},"message":{"text":"\"col1 = ... \" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":13,"endColumn":88}},"message":{"text":"UPDATE. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":7,"endColumn":88}},"message":{"text":"await U ... \" + id)"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":85,"endColumn":87}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":76,"endColumn":87}},"message":{"text":"\"ID =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":13,"endColumn":88}},"message":{"text":"UPDATE. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":7,"endColumn":88}},"message":{"text":"await U ... \" + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":185,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":187,"startColumn":7,"endColumn":88}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":13,"endColumn":88}}}],"partialFingerprints":{"primaryLocationLineHash":"16a5323b901d361b:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":66,"endColumn":68}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":47,"endColumn":68}},"message":{"text":"\"col1 = ... \" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":13,"endColumn":88}},"message":{"text":"UPDATE. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":7,"endColumn":88}},"message":{"text":"await U ... ` + id)"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":85,"endColumn":87}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":76,"endColumn":87}},"message":{"text":"`ID =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":13,"endColumn":88}},"message":{"text":"UPDATE. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":7,"endColumn":88}},"message":{"text":"await U ... ` + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":191,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":193,"startColumn":7,"endColumn":88}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":13,"endColumn":89}}}],"partialFingerprints":{"primaryLocationLineHash":"ec3b26f51764a997:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":66,"endColumn":68}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":47,"endColumn":68}},"message":{"text":"\"col1 = ... \" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":13,"endColumn":89}},"message":{"text":"UPDATE. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":7,"endColumn":89}},"message":{"text":"await U ... ${id}`)"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":84,"endColumn":86}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":76,"endColumn":88}},"message":{"text":"`ID = ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":13,"endColumn":89}},"message":{"text":"UPDATE. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":7,"endColumn":89}},"message":{"text":"await U ... ${id}`)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":197,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":199,"startColumn":7,"endColumn":89}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":13,"endColumn":87}}}],"partialFingerprints":{"primaryLocationLineHash":"1ab4a8658ea07927:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":66,"endColumn":68}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":47,"endColumn":68}},"message":{"text":"\"col1 = ... \" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":13,"endColumn":87}},"message":{"text":"UPDATE. ... ${id}`"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":7,"endColumn":87}},"message":{"text":"await U ... ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":203,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":205,"startColumn":7,"endColumn":87}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":13,"endColumn":59}}}],"partialFingerprints":{"primaryLocationLineHash":"c191f9b82574b477:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":47,"endColumn":58}},"message":{"text":"\"ID =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":13,"endColumn":59}},"message":{"text":"DELETE. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":7,"endColumn":59}},"message":{"text":"await D ... \" + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":227,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":229,"startColumn":7,"endColumn":59}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":13,"endColumn":59}}}],"partialFingerprints":{"primaryLocationLineHash":"28ec6e53085bb293:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":47,"endColumn":58}},"message":{"text":"`ID =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":13,"endColumn":59}},"message":{"text":"DELETE. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":7,"endColumn":59}},"message":{"text":"await D ... ` + id)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":233,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":235,"startColumn":7,"endColumn":59}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":13,"endColumn":60}}}],"partialFingerprints":{"primaryLocationLineHash":"a76513a6cb8f584d:1","primaryLocationStartColumnFingerprint":"6"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":55,"endColumn":57}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":47,"endColumn":59}},"message":{"text":"`ID = ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":13,"endColumn":60}},"message":{"text":"DELETE. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":7,"endColumn":60}},"message":{"text":"await D ... ${id}`)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":239,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":241,"startColumn":7,"endColumn":60}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":254,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"e396e28dff49f821:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":253,"startColumn":63,"endColumn":65}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":253,"startColumn":55,"endColumn":65}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":253,"startColumn":21,"endColumn":66}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":253,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":254,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":252,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":259,"startColumn":7,"endColumn":53}}}],"partialFingerprints":{"primaryLocationLineHash":"4710d78c10aa291b:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":259,"startColumn":50,"endColumn":52}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":259,"startColumn":41,"endColumn":52}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":258,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":259,"startColumn":41,"endColumn":52}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":7,"endColumn":86}}}],"partialFingerprints":{"primaryLocationLineHash":"6f850daa3f58c276:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":57,"endColumn":63}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":41,"endColumn":63}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":83,"endColumn":85}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":71,"endColumn":85}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":268,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":41,"endColumn":63}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":269,"startColumn":71,"endColumn":85}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":284,"startColumn":7,"endColumn":55}}}],"partialFingerprints":{"primaryLocationLineHash":"b9f8b15603ad6b38:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":284,"startColumn":52,"endColumn":54}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":284,"startColumn":43,"endColumn":54}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":283,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":284,"startColumn":43,"endColumn":54}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":292,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"d576c66caddc969a:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":291,"startColumn":63,"endColumn":65}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":291,"startColumn":55,"endColumn":65}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":291,"startColumn":21,"endColumn":66}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":291,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":292,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":289,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":298,"startColumn":7,"endColumn":57}}}],"partialFingerprints":{"primaryLocationLineHash":"3b0cd005704d307:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":298,"startColumn":54,"endColumn":56}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":298,"startColumn":45,"endColumn":56}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":296,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":298,"startColumn":45,"endColumn":56}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":7,"endColumn":90}}}],"partialFingerprints":{"primaryLocationLineHash":"a2422d95f31b0028:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":61,"endColumn":67}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":45,"endColumn":67}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":87,"endColumn":89}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":75,"endColumn":89}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":308,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":45,"endColumn":67}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":310,"startColumn":75,"endColumn":89}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":328,"startColumn":7,"endColumn":59}}}],"partialFingerprints":{"primaryLocationLineHash":"53b68a547e06f5f5:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":328,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":328,"startColumn":47,"endColumn":58}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":326,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":328,"startColumn":47,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":336,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"ef4fafb0cb633d3e:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":335,"startColumn":72,"endColumn":74}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":335,"startColumn":28,"endColumn":74}},"message":{"text":"\"SELECT ... =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":335,"startColumn":21,"endColumn":75}},"message":{"text":"cds.ql( ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":335,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":336,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":333,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":343,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"70bf4adf3ece4680:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":342,"startColumn":72,"endColumn":74}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":342,"startColumn":28,"endColumn":74}},"message":{"text":"`SELECT ... =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":342,"startColumn":21,"endColumn":75}},"message":{"text":"cds.ql( ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":342,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":343,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":340,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":350,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"b17718767883cb21:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":349,"startColumn":71,"endColumn":73}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":349,"startColumn":28,"endColumn":75}},"message":{"text":"`SELECT ... ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":349,"startColumn":21,"endColumn":76}},"message":{"text":"cds.ql( ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":349,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":350,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":347,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":364,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"a684f52297f0c4e5:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":363,"startColumn":72,"endColumn":74}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":363,"startColumn":35,"endColumn":74}},"message":{"text":"\"SELECT ... =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":363,"startColumn":21,"endColumn":75}},"message":{"text":"cds.par ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":363,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":364,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":362,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":370,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"d550e0002cd278da:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":369,"startColumn":72,"endColumn":74}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":369,"startColumn":35,"endColumn":74}},"message":{"text":"`SELECT ... =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":369,"startColumn":21,"endColumn":75}},"message":{"text":"cds.par ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":369,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":370,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":368,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":376,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"6a27aa8587353580:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":375,"startColumn":71,"endColumn":73}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":375,"startColumn":35,"endColumn":75}},"message":{"text":"`SELECT ... ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":375,"startColumn":21,"endColumn":76}},"message":{"text":"cds.par ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":375,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":376,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":374,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":389,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"69fde7291c8fc74e:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":388,"startColumn":62,"endColumn":64}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":388,"startColumn":25,"endColumn":64}},"message":{"text":"\"SELECT ... =\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":388,"startColumn":21,"endColumn":65}},"message":{"text":"CQL(\"SE ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":388,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":389,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":387,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":395,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"98c9d206b1717b43:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":394,"startColumn":62,"endColumn":64}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":394,"startColumn":25,"endColumn":64}},"message":{"text":"`SELECT ... =` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":394,"startColumn":21,"endColumn":65}},"message":{"text":"CQL(`SE ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":394,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":395,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":393,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":401,"startColumn":15,"endColumn":20}}}],"partialFingerprints":{"primaryLocationLineHash":"d013e7d9793c061d:1","primaryLocationStartColumnFingerprint":"8"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":400,"startColumn":61,"endColumn":63}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":400,"startColumn":25,"endColumn":65}},"message":{"text":"`SELECT ... ${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":400,"startColumn":21,"endColumn":66}},"message":{"text":"CQL(`SE ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":400,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":401,"startColumn":15,"endColumn":20}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":399,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":415,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"3fb9a1da0acd43ae:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":414,"startColumn":58,"endColumn":60}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":414,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":415,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":412,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":422,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"80716f714482c84f:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":421,"startColumn":58,"endColumn":60}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":421,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":422,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":419,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":429,"startColumn":20,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"442267e255b8b54f:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":428,"startColumn":57,"endColumn":59}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":428,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":429,"startColumn":20,"endColumn":25}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":426,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":438,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"9e2cec8d31f74921:1","primaryLocationStartColumnFingerprint":"7"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":436,"startColumn":63,"endColumn":65}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":436,"startColumn":55,"endColumn":65}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":436,"startColumn":21,"endColumn":66}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":436,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":438,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":434,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":446,"startColumn":9,"endColumn":53}}}],"partialFingerprints":{"primaryLocationLineHash":"73ba3ff2097c8fd1:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":446,"startColumn":50,"endColumn":52}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":446,"startColumn":41,"endColumn":52}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":443,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":446,"startColumn":41,"endColumn":52}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":9,"endColumn":86}}}],"partialFingerprints":{"primaryLocationLineHash":"b6b098d76a485f57:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":57,"endColumn":63}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":41,"endColumn":63}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":83,"endColumn":85}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":71,"endColumn":85}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":459,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":41,"endColumn":63}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":462,"startColumn":71,"endColumn":85}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":486,"startColumn":9,"endColumn":55}}}],"partialFingerprints":{"primaryLocationLineHash":"930f7b78e736551b:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":486,"startColumn":52,"endColumn":54}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":486,"startColumn":43,"endColumn":54}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":483,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":486,"startColumn":43,"endColumn":54}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":495,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"cd8266cd9539b760:1","primaryLocationStartColumnFingerprint":"7"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":493,"startColumn":63,"endColumn":65}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":493,"startColumn":55,"endColumn":65}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":493,"startColumn":21,"endColumn":66}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":493,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":495,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":492,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":502,"startColumn":9,"endColumn":53}}}],"partialFingerprints":{"primaryLocationLineHash":"5298b55f76bd7434:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":502,"startColumn":50,"endColumn":52}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":502,"startColumn":41,"endColumn":52}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":500,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":502,"startColumn":41,"endColumn":52}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":9,"endColumn":86}}}],"partialFingerprints":{"primaryLocationLineHash":"f72e0c4e0d3cd372:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":57,"endColumn":63}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":41,"endColumn":63}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":83,"endColumn":85}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":71,"endColumn":85}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":514,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":41,"endColumn":63}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":516,"startColumn":71,"endColumn":85}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":537,"startColumn":9,"endColumn":55}}}],"partialFingerprints":{"primaryLocationLineHash":"d38ceeef8a2ac936:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":537,"startColumn":52,"endColumn":54}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":537,"startColumn":43,"endColumn":54}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":535,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":537,"startColumn":43,"endColumn":54}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":546,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"e46cd48130ebf859:1","primaryLocationStartColumnFingerprint":"7"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":544,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":544,"startColumn":48,"endColumn":58}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":544,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":544,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":546,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":543,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":553,"startColumn":9,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"ecbeb50b953c6892:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":553,"startColumn":43,"endColumn":45}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":553,"startColumn":34,"endColumn":45}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":551,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":553,"startColumn":34,"endColumn":45}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":9,"endColumn":79}}}],"partialFingerprints":{"primaryLocationLineHash":"558b998facd3da37:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":50,"endColumn":56}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":34,"endColumn":56}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":76,"endColumn":78}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":64,"endColumn":78}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":565,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":34,"endColumn":56}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":567,"startColumn":64,"endColumn":78}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":588,"startColumn":9,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"91becd2fa07cdcc9:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":588,"startColumn":45,"endColumn":47}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":588,"startColumn":36,"endColumn":47}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":586,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":588,"startColumn":36,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":597,"startColumn":16,"endColumn":21}}}],"partialFingerprints":{"primaryLocationLineHash":"fb574234cc9e3952:1","primaryLocationStartColumnFingerprint":"7"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":595,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":595,"startColumn":48,"endColumn":58}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":595,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":595,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":597,"startColumn":16,"endColumn":21}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":594,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":604,"startColumn":9,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"ecbeb50b995e8367:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":604,"startColumn":43,"endColumn":45}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":604,"startColumn":34,"endColumn":45}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":602,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":604,"startColumn":34,"endColumn":45}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":9,"endColumn":79}}}],"partialFingerprints":{"primaryLocationLineHash":"558b998facd3da37:2","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":50,"endColumn":56}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":34,"endColumn":56}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":76,"endColumn":78}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":64,"endColumn":78}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":616,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":34,"endColumn":56}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":618,"startColumn":64,"endColumn":78}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":639,"startColumn":9,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"91becd2fa09975ba:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":639,"startColumn":45,"endColumn":47}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":639,"startColumn":36,"endColumn":47}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":637,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":639,"startColumn":36,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":647,"startColumn":18,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"1e42917dcc40a599:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":646,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":646,"startColumn":48,"endColumn":58}},"message":{"text":"\"ID=\" + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":646,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... \" + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":646,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":647,"startColumn":18,"endColumn":23}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":645,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":653,"startColumn":18,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"e6651c34faab8e22:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":652,"startColumn":56,"endColumn":58}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":652,"startColumn":48,"endColumn":58}},"message":{"text":"`ID=` + id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":652,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... ` + id)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":652,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":653,"startColumn":18,"endColumn":23}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":651,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":659,"startColumn":18,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"35109df28cbbc5c:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":658,"startColumn":54,"endColumn":56}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":658,"startColumn":48,"endColumn":58}},"message":{"text":"`ID=${id}`"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":658,"startColumn":21,"endColumn":59}},"message":{"text":"SELECT. ... ${id}`)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":658,"startColumn":13,"endColumn":18}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":659,"startColumn":18,"endColumn":23}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":657,"startColumn":22,"endColumn":30}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":670,"startColumn":7,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"efbe9cdee9ed72b8:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":670,"startColumn":45,"endColumn":47}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":670,"startColumn":36,"endColumn":47}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":669,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":670,"startColumn":36,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":675,"startColumn":7,"endColumn":48}}}],"partialFingerprints":{"primaryLocationLineHash":"3a884df2f960d319:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":675,"startColumn":45,"endColumn":47}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":675,"startColumn":36,"endColumn":47}},"message":{"text":"`ID =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":674,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":675,"startColumn":36,"endColumn":47}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":680,"startColumn":7,"endColumn":47}}}],"partialFingerprints":{"primaryLocationLineHash":"693c1ad544283ec3:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":680,"startColumn":42,"endColumn":44}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":680,"startColumn":36,"endColumn":46}},"message":{"text":"`ID=${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":679,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":680,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":7,"endColumn":81}}}],"partialFingerprints":{"primaryLocationLineHash":"737ffeac7015e49f:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":52,"endColumn":58}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":36,"endColumn":58}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":78,"endColumn":80}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":66,"endColumn":80}},"message":{"text":"\"col1 = \" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":704,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":36,"endColumn":58}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":705,"startColumn":66,"endColumn":80}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":7,"endColumn":80}}}],"partialFingerprints":{"primaryLocationLineHash":"68fb2832260c17eb:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":52,"endColumn":58}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":36,"endColumn":58}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":77,"endColumn":79}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":66,"endColumn":79}},"message":{"text":"`col1 =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":709,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":36,"endColumn":58}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":710,"startColumn":66,"endColumn":79}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1).\nThis CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":7,"endColumn":81}}}],"partialFingerprints":{"primaryLocationLineHash":"c05bb3983bd0ec24:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":52,"endColumn":58}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":36,"endColumn":58}},"message":{"text":"\"col1 = ... amount"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":76,"endColumn":78}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":66,"endColumn":80}},"message":{"text":"`col1 = ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":714,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":36,"endColumn":58}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":715,"startColumn":66,"endColumn":80}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":720,"startColumn":7,"endColumn":79}}}],"partialFingerprints":{"primaryLocationLineHash":"a5013b756880128f:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":30,"endColumn":38}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":13,"endColumn":27}},"message":{"text":"{ id, amount }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":19,"endColumn":25}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":720,"startColumn":52,"endColumn":58}},"message":{"text":"amount"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":720,"startColumn":36,"endColumn":58}},"message":{"text":"\"col1 = ... amount"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":30,"endColumn":38}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":719,"startColumn":30,"endColumn":38}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":720,"startColumn":36,"endColumn":58}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":755,"startColumn":7,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"aa17f3fb0e89ad00:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":755,"startColumn":47,"endColumn":49}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":755,"startColumn":38,"endColumn":49}},"message":{"text":"\"ID =\" + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":754,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":755,"startColumn":38,"endColumn":49}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":760,"startColumn":7,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"52425ca44df0fb9c:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":760,"startColumn":47,"endColumn":49}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":760,"startColumn":38,"endColumn":49}},"message":{"text":"`ID =` + id"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":759,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":760,"startColumn":38,"endColumn":49}}}]},{"ruleId":"js/cap-sql-injection","rule":{"id":"js/cap-sql-injection","index":1,"toolComponent":{"index":8}},"message":{"text":"This CQL query contains a string concatenation with a [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":765,"startColumn":7,"endColumn":51}}}],"partialFingerprints":{"primaryLocationLineHash":"abfa3b0ed80d2aef:1","primaryLocationStartColumnFingerprint":"0"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":22,"endColumn":30}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":13,"endColumn":19}},"message":{"text":"{ id }"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":15,"endColumn":17}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":765,"startColumn":46,"endColumn":48}},"message":{"text":"id"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":765,"startColumn":38,"endColumn":50}},"message":{"text":"`ID = ${id}`"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":22,"endColumn":30}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":764,"startColumn":22,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":765,"startColumn":38,"endColumn":50}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":22,"startColumn":36,"endColumn":42}}}],"partialFingerprints":{"primaryLocationLineHash":"d2d019c78ead4486:1","primaryLocationStartColumnFingerprint":"23"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":12,"startColumn":38,"endColumn":52}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":12,"startColumn":28,"endColumn":53}},"message":{"text":"decodeU ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":12,"startColumn":19,"endColumn":25}},"message":{"text":"taint1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":22,"startColumn":36,"endColumn":42}},"message":{"text":"taint1"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":24,"startColumn":40,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"808bce90854ae867:1","primaryLocationStartColumnFingerprint":"27"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":14,"startColumn":47,"endColumn":61}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":14,"startColumn":28,"endColumn":62}},"message":{"text":"decodeU ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":14,"startColumn":19,"endColumn":25}},"message":{"text":"taint2"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":24,"startColumn":40,"endColumn":46}},"message":{"text":"taint2"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":26,"startColumn":34,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"afb5d6b9785b49d5:1","primaryLocationStartColumnFingerprint":"21"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":16,"startColumn":34,"endColumn":48}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":16,"startColumn":28,"endColumn":49}},"message":{"text":"local(u ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":16,"startColumn":19,"endColumn":25}},"message":{"text":"taint3"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":26,"startColumn":34,"endColumn":40}},"message":{"text":"taint3"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":28,"startColumn":34,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"bb2ecd3739649840:1","primaryLocationStartColumnFingerprint":"21"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":18,"startColumn":34,"endColumn":48}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":18,"startColumn":28,"endColumn":49}},"message":{"text":"isdir(u ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":18,"startColumn":19,"endColumn":25}},"message":{"text":"taint4"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":28,"startColumn":34,"endColumn":40}},"message":{"text":"taint4"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":30,"startColumn":40,"endColumn":46}}}],"partialFingerprints":{"primaryLocationLineHash":"63e729e91fdc10d2:1","primaryLocationStartColumnFingerprint":"27"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}},"message":{"text":"req.params"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":19,"endColumn":33}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":20,"startColumn":35,"endColumn":49}},"message":{"text":"userinputthree"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":20,"startColumn":28,"endColumn":50}},"message":{"text":"isfile( ... tthree)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":20,"startColumn":19,"endColumn":25}},"message":{"text":"taint5"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":30,"startColumn":40,"endColumn":46}},"message":{"text":"taint5"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":10,"startColumn":36,"endColumn":46}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":31,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"84f3986f7255c726:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":31,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":33,"startColumn":38,"endColumn":47}}}],"partialFingerprints":{"primaryLocationLineHash":"7f1379ebf3dd2fef:1","primaryLocationStartColumnFingerprint":"25"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":33,"startColumn":38,"endColumn":47}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file read."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":34,"startColumn":24,"endColumn":33}}}],"partialFingerprints":{"primaryLocationLineHash":"45cd294f7937b77e:1","primaryLocationStartColumnFingerprint":"11"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":34,"startColumn":24,"endColumn":33}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":36,"startColumn":44,"endColumn":53}}}],"partialFingerprints":{"primaryLocationLineHash":"15c5f129eb53b929:1","primaryLocationStartColumnFingerprint":"31"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":36,"startColumn":44,"endColumn":53}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in tainted data being written to a file."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":37,"startColumn":25,"endColumn":37}}}],"partialFingerprints":{"primaryLocationLineHash":"f976670d2acc6fb9:1","primaryLocationStartColumnFingerprint":"12"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":9,"startColumn":34,"endColumn":45}},"message":{"text":"req.headers"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":9,"startColumn":19,"endColumn":31}},"message":{"text":"userinputtwo"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":37,"startColumn":25,"endColumn":37}},"message":{"text":"userinputtwo"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":9,"startColumn":34,"endColumn":45}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":38,"startColumn":25,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"7608589b7693ec5e:1","primaryLocationStartColumnFingerprint":"12"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":38,"startColumn":25,"endColumn":34}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":40,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"9efda1281fa0866d:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":40,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":41,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"66f493d838c437b1:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":41,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":43,"startColumn":25,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"8f73a0930e234a4e:1","primaryLocationStartColumnFingerprint":"12"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":43,"startColumn":25,"endColumn":34}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":44,"startColumn":25,"endColumn":34}}}],"partialFingerprints":{"primaryLocationLineHash":"d6c22993642b7f91:1","primaryLocationStartColumnFingerprint":"12"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":44,"startColumn":25,"endColumn":34}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":46,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"a8a6e2d6350921ee:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":46,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":47,"startColumn":26,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"434bdd8f18e7c7d:1","primaryLocationStartColumnFingerprint":"13"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":47,"startColumn":26,"endColumn":35}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":49,"startColumn":22,"endColumn":31}}}],"partialFingerprints":{"primaryLocationLineHash":"8ecbfdc82d65a76d:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":49,"startColumn":22,"endColumn":31}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-path-injection","rule":{"id":"js/cap-path-injection","index":2,"toolComponent":{"index":8}},"message":{"text":"This CDS utils usage relies on user-provided value and can result in unrestricted file operations."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":50,"startColumn":22,"endColumn":31}}}],"partialFingerprints":{"primaryLocationLineHash":"62c405a97e577740:1","primaryLocationStartColumnFingerprint":"9"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}},"message":{"text":"req.data"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":19,"endColumn":28}},"message":{"text":"userinput"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":50,"startColumn":22,"endColumn":31}},"message":{"text":"userinput"}}}]}]}],"relatedLocations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/path-traversal/pathinjection.js","uriBaseId":"%SRCROOT%","index":234},"region":{"startLine":8,"startColumn":31,"endColumn":39}}}]},{"ruleId":"js/cap-non-prod-auth-strategy","rule":{"id":"js/cap-non-prod-auth-strategy","index":3,"toolComponent":{"index":8}},"message":{"text":"Current authentication strategy contains [credentials of mocked users](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159},"region":{"startLine":17,"startColumn":18,"endLine":32,"endColumn":10}}}],"partialFingerprints":{"primaryLocationLineHash":"189356aa691178ee:1","primaryLocationStartColumnFingerprint":"9"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159},"region":{"startLine":17,"startColumn":18,"endLine":32,"endColumn":10}},"message":{"text":"credentials of mocked users"}}]},{"ruleId":"js/cap-non-prod-auth-strategy","rule":{"id":"js/cap-non-prod-auth-strategy","index":3,"toolComponent":{"index":8}},"message":{"text":"Non-production authentication strategy [basic](1) is used."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159},"region":{"startLine":16,"startColumn":17,"endColumn":24}}}],"partialFingerprints":{"primaryLocationLineHash":"8ec70b5c261c793b:1","primaryLocationStartColumnFingerprint":"8"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/basic-authentication/package.json","uriBaseId":"%SRCROOT%","index":159},"region":{"startLine":16,"startColumn":17,"endColumn":24}},"message":{"text":"basic"}}]},{"ruleId":"js/cap-non-prod-auth-strategy","rule":{"id":"js/cap-non-prod-auth-strategy","index":3,"toolComponent":{"index":8}},"message":{"text":"Non-production authentication strategy [dummy](1) is used."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json","uriBaseId":"%SRCROOT%","index":167},"region":{"startLine":15,"startColumn":15,"endColumn":22}}}],"partialFingerprints":{"primaryLocationLineHash":"2a27bf058be4572:1","primaryLocationStartColumnFingerprint":"8"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/dummy-authentication/package.json","uriBaseId":"%SRCROOT%","index":167},"region":{"startLine":15,"startColumn":15,"endColumn":22}},"message":{"text":"dummy"}}]},{"ruleId":"js/cap-non-prod-auth-strategy","rule":{"id":"js/cap-non-prod-auth-strategy","index":3,"toolComponent":{"index":8}},"message":{"text":"Non-production authentication strategy [mocked](1) is used."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json","uriBaseId":"%SRCROOT%","index":175},"region":{"startLine":21,"startColumn":15,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"2af5230c91e6a4cd:1","primaryLocationStartColumnFingerprint":"8"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/nonprod-authn-strategy/mocked-authentication/package.json","uriBaseId":"%SRCROOT%","index":175},"region":{"startLine":21,"startColumn":15,"endColumn":23}},"message":{"text":"mocked"}}]},{"ruleId":"js/cap-default-user-is-privileged","rule":{"id":"js/cap-default-user-is-privileged","index":4,"toolComponent":{"index":8}},"message":{"text":"The default user is being overridden to a privileged user."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service1.js","uriBaseId":"%SRCROOT%","index":144},"region":{"startLine":14,"startColumn":7,"endColumn":43}}}],"partialFingerprints":{"primaryLocationLineHash":"2c0c554bf5b5f7d:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/cap-default-user-is-privileged","rule":{"id":"js/cap-default-user-is-privileged","index":4,"toolComponent":{"index":8}},"message":{"text":"The default user is being overridden to a privileged user."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/server.js","uriBaseId":"%SRCROOT%","index":142},"region":{"startLine":8,"endColumn":37}}}],"partialFingerprints":{"primaryLocationLineHash":"b6ec748aef5ccec4:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/cap-default-user-is-privileged","rule":{"id":"js/cap-default-user-is-privileged","index":4,"toolComponent":{"index":8}},"message":{"text":"The default user is being overridden to a privileged user."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/default-is-privileged/srv/service2.js","uriBaseId":"%SRCROOT%","index":146},"region":{"startLine":12,"startColumn":5,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"ee143e9aad9c9a16:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156},"region":{"startLine":18,"startColumn":21,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"383e73b4014710f9:1","primaryLocationStartColumnFingerprint":"12"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":18,"startColumn":24,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"62915c8622048073:1","primaryLocationStartColumnFingerprint":"11"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.js","uriBaseId":"%SRCROOT%","index":156},"region":{"startLine":35,"startColumn":21,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"383e73b4014710f9:2","primaryLocationStartColumnFingerprint":"12"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":33,"startColumn":24,"endColumn":50}}}],"partialFingerprints":{"primaryLocationLineHash":"8c5c989d244a1f09:1","primaryLocationStartColumnFingerprint":"11"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":50,"startColumn":25,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"faab9436420ec8fd:1","primaryLocationStartColumnFingerprint":"12"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that requires authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":67,"startColumn":25,"endColumn":40}}}],"partialFingerprints":{"primaryLocationLineHash":"8eb12b95cf4128eb:1","primaryLocationStartColumnFingerprint":"12"}},{"ruleId":"js/cap-unnecessarily-granted-privileged-access-rights","rule":{"id":"js/cap-unnecessarily-granted-privileged-access-rights","index":5,"toolComponent":{"index":8}},"message":{"text":"This entity is accessed with unnecessarily privileged rights that may require authorization."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.js","uriBaseId":"%SRCROOT%","index":153},"region":{"startLine":83,"startColumn":24,"endColumn":38}}}],"partialFingerprints":{"primaryLocationLineHash":"9343d25bdd5ba748:1","primaryLocationStartColumnFingerprint":"11"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS entity `Service1.Service1Entity1` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":6,"startColumn":10,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"3984db8d11cdcda4:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service1.send2` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":18,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"28b66b32406f07ba:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service1.send3` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":23,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"a5382f0f9fda534:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service1.send4` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":28,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"ebf09aafb38c42ae:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service1.send5` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service1.cds","uriBaseId":"%SRCROOT%","index":154},"region":{"startLine":33,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"65cd9b8a9955401b:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS entity `Service2.Service2Entity1` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":155},"region":{"startLine":6,"startColumn":10,"endColumn":25}}}],"partialFingerprints":{"primaryLocationLineHash":"b02237ac8be3c990:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service2.send1` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/bad-authn-authz/misused-privileged-user/unnecessarily-granted-privileged-access-rights/srv/service2.cds","uriBaseId":"%SRCROOT%","index":155},"region":{"startLine":13,"startColumn":10,"endColumn":15}}}],"partialFingerprints":{"primaryLocationLineHash":"d2bdf8ef231dddd1:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS service `Service` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199},"region":{"startLine":3,"startColumn":9,"endColumn":16}}}],"partialFingerprints":{"primaryLocationLineHash":"a2294454385cb916:1","primaryLocationStartColumnFingerprint":"8"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS entity `Service.ServiceEntity` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199},"region":{"startLine":5,"startColumn":10,"endColumn":23}}}],"partialFingerprints":{"primaryLocationLineHash":"d5a18811944e0c6:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-entity-exposed-without-authentication","rule":{"id":"js/cap-entity-exposed-without-authentication","index":6,"toolComponent":{"index":8}},"message":{"text":"The CDS action `Service.send` is exposed without any authentication."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/loginjection/log-injection-type-sanitized/srv/service.cds","uriBaseId":"%SRCROOT%","index":199},"region":{"startLine":8,"startColumn":10,"endColumn":14}}}],"partialFingerprints":{"primaryLocationLineHash":"e6b459744cc3d70d:1","primaryLocationStartColumnFingerprint":"7"}},{"ruleId":"js/cap-sensitive-log","rule":{"id":"js/cap-sensitive-log","index":7,"toolComponent":{"index":8}},"message":{"text":"Log entry depends on the [name](1) field which is annotated as potentially sensitive."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.js","uriBaseId":"%SRCROOT%","index":238},"region":{"startLine":9,"startColumn":32,"endColumn":43}}}],"partialFingerprints":{"primaryLocationLineHash":"c2d27f652a20308e:1","primaryLocationStartColumnFingerprint":"23"},"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/sensitive-exposure/sensitive-exposure.cds","uriBaseId":"%SRCROOT%","index":237},"region":{"startLine":4,"startColumn":5,"endColumn":9}},"message":{"text":"name"}}]},{"ruleId":"js/xsjs-broken-authentication","rule":{"id":"js/xsjs-broken-authentication","index":0,"toolComponent":{"index":9}},"message":{"text":"Authentication should not be disabled."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess","uriBaseId":"%SRCROOT%","index":603},"region":{"startLine":3,"startColumn":23,"endColumn":27}}}],"partialFingerprints":{"primaryLocationLineHash":"a900cae7399fb257:1","primaryLocationStartColumnFingerprint":"18"}},{"ruleId":"js/xsjs-broken-authentication","rule":{"id":"js/xsjs-broken-authentication","index":0,"toolComponent":{"index":9}},"message":{"text":"Authentication is missing from the configuration."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/missing_auth/.xsaccess","uriBaseId":"%SRCROOT%","index":604},"region":{"startLine":1,"endLine":4,"endColumn":2}}}],"partialFingerprints":{"primaryLocationLineHash":"b57c6bae252883be:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/xsjs-broken-authentication","rule":{"id":"js/xsjs-broken-authentication","index":0,"toolComponent":{"index":9}},"message":{"text":"Authentication should not be disabled."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":606},"region":{"startLine":3,"startColumn":29,"endColumn":35}}}],"partialFingerprints":{"primaryLocationLineHash":"7c987b52e21935f7:1","primaryLocationStartColumnFingerprint":"24"}},{"ruleId":"js/xsjs-broken-authentication","rule":{"id":"js/xsjs-broken-authentication","index":0,"toolComponent":{"index":9}},"message":{"text":"Authentication should not be disabled."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":606},"region":{"startLine":15,"startColumn":35,"endColumn":41}}}],"partialFingerprints":{"primaryLocationLineHash":"f2aa90ab66c52c3c:1","primaryLocationStartColumnFingerprint":"22"}},{"ruleId":"js/xsjs-reflected-xss","rule":{"id":"js/xsjs-reflected-xss","index":1,"toolComponent":{"index":9}},"message":{"text":"Reflected XSS vulnerability due to [user-provided value](1)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":13,"startColumn":22,"endColumn":66}}}],"partialFingerprints":{"primaryLocationLineHash":"a31830db0e0a3d3c:1","primaryLocationStartColumnFingerprint":"19"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":11,"startColumn":29,"endColumn":68}},"message":{"text":"request ... eter1\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":11,"startColumn":7,"endColumn":26}},"message":{"text":"someParameterValue1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":13,"startColumn":46,"endColumn":65}},"message":{"text":"someParameterValue1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":3,"startColumn":34,"endColumn":51}},"message":{"text":"requestParameters"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":4,"startColumn":20,"endColumn":37}},"message":{"text":"requestParameters"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":4,"startColumn":10,"endColumn":48}},"message":{"text":"\"\" ...
\""}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":13,"startColumn":22,"endColumn":66}},"message":{"text":"request ... Value1)"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":11,"startColumn":29,"endColumn":68}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":11,"startColumn":29,"endColumn":68}}}]},{"ruleId":"js/xsjs-url-redirect","rule":{"id":"js/xsjs-url-redirect","index":2,"toolComponent":{"index":9}},"message":{"text":"[This URL](1) depends on a [user-provided value](2)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":9,"startColumn":38,"endColumn":56}}}],"partialFingerprints":{"primaryLocationLineHash":"f02e3e17e12824b3:1","primaryLocationStartColumnFingerprint":"35"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":7,"startColumn":28,"endColumn":66}},"message":{"text":"request ... meter\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":7,"startColumn":7,"endColumn":25}},"message":{"text":"someParameterValue"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":9,"startColumn":38,"endColumn":56}},"message":{"text":"someParameterValue"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":9,"startColumn":38,"endColumn":56}},"message":{"text":"This URL"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":7,"startColumn":28,"endColumn":66}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":7,"startColumn":28,"endColumn":66}}}]},{"ruleId":"js/xsjs-sql-injection","rule":{"id":"js/xsjs-sql-injection","index":3,"toolComponent":{"index":9}},"message":{"text":"This query depends on a [user-provided value](1).\nThis query depends on a [user-provided value](2)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":13,"startColumn":57,"endColumn":62}}}],"partialFingerprints":{"primaryLocationLineHash":"65aa43aa4e46559c:1","primaryLocationStartColumnFingerprint":"54"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":8,"startColumn":40,"endColumn":79}},"message":{"text":"request ... eter1\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":8,"startColumn":29,"endColumn":80}},"message":{"text":"JSON.pa ... ter1\"))"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":8,"startColumn":7,"endColumn":26}},"message":{"text":"someParameterValue1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":10,"startColumn":32,"endColumn":51}},"message":{"text":"someParameterValue1"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":10,"startColumn":7,"endColumn":12}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":13,"startColumn":57,"endColumn":62}},"message":{"text":"query"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":9,"startColumn":40,"endColumn":79}},"message":{"text":"request ... eter2\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":9,"startColumn":29,"endColumn":80}},"message":{"text":"JSON.pa ... ter2\"))"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":9,"startColumn":7,"endColumn":26}},"message":{"text":"someParameterValue2"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":10,"startColumn":82,"endColumn":101}},"message":{"text":"someParameterValue2"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":10,"startColumn":7,"endColumn":12}},"message":{"text":"query"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":13,"startColumn":57,"endColumn":62}},"message":{"text":"query"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":8,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":9,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":8,"startColumn":40,"endColumn":79}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":9,"startColumn":40,"endColumn":79}}}]},{"ruleId":"js/xsjs-zip-slip","rule":{"id":"js/xsjs-zip-slip","index":4,"toolComponent":{"index":9}},"message":{"text":"The path of [this zip file](1) being saved depends on a [user-provided value](2).\nThe path of [this zip file](1) being saved depends on a [user-provided value](3).\nThe path of [this zip file](1) being saved depends on a [user-provided value](4).\nThe path of [this zip file](1) being saved depends on a [user-provided value](5).\nThe path of [this zip file](1) being saved depends on a [user-provided value](6).\nThe path of [this zip file](1) being saved depends on a [user-provided value](7).\nThe path of [this zip file](1) being saved depends on a [user-provided value](8).\nThe path of [this zip file](1) being saved depends on a [user-provided value](9).\nThe path of [this zip file](1) being saved depends on a [user-provided value](10).\nThe path of [this zip file](1) being saved depends on a [user-provided value](11).\nThe path of [this zip file](1) being saved depends on a [user-provided value](12).\nThe path of [this zip file](1) being saved depends on a [user-provided value](13).\nThe path of [this zip file](1) being saved depends on a [user-provided value](14).\nThe path of [this zip file](1) being saved depends on a [user-provided value](15).\nThe path of [this zip file](1) being saved depends on a [user-provided value](16).\nThe path of [this zip file](1) being saved depends on a [user-provided value](17).\nThe path of [this zip file](1) being saved depends on a [user-provided value](18).\nThe path of [this zip file](1) being saved depends on a [user-provided value](19).\nThe path of [this zip file](1) being saved depends on a [user-provided value](20).\nThe path of [this zip file](1) being saved depends on a [user-provided value](21).\nThe path of [this zip file](1) being saved depends on a [user-provided value](22).\nThe path of [this zip file](1) being saved depends on a [user-provided value](23).\nThe path of [this zip file](1) being saved depends on a [user-provided value](24).\nThe path of [this zip file](1) being saved depends on a [user-provided value](25).\nThe path of [this zip file](1) being saved depends on a [user-provided value](26).\nThe path of [this zip file](1) being saved depends on a [user-provided value](27).\nThe path of [this zip file](1) being saved depends on a [user-provided value](28).\nThe path of [this zip file](1) being saved depends on a [user-provided value](29).\nThe path of [this zip file](1) being saved depends on a [user-provided value](30).\nThe path of [this zip file](1) being saved depends on a [user-provided value](31).\nThe path of [this zip file](1) being saved depends on a [user-provided value](32).\nThe path of [this zip file](1) being saved depends on a [user-provided value](33).\nThe path of [this zip file](1) being saved depends on a [user-provided value](34).\nThe path of [this zip file](1) being saved depends on a [user-provided value](35).\nThe path of [this zip file](1) being saved depends on a [user-provided value](36).\nThe path of [this zip file](1) being saved depends on a [user-provided value](37).\nThe path of [this zip file](1) being saved depends on a [user-provided value](38).\nThe path of [this zip file](1) being saved depends on a [user-provided value](39).\nThe path of [this zip file](1) being saved depends on a [user-provided value](40).\nThe path of [this zip file](1) being saved depends on a [user-provided value](41).\nThe path of [this zip file](1) being saved depends on a [user-provided value](42).\nThe path of [this zip file](1) being saved depends on a [user-provided value](43)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":12,"startColumn":37,"endColumn":51}}}],"partialFingerprints":{"primaryLocationLineHash":"54d432c04bb48c9c:1","primaryLocationStartColumnFingerprint":"32"},"codeFlows":[{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}},"message":{"text":"jQuery. ... param\")"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":7,"startColumn":20,"endColumn":63}},"message":{"text":"new $.u ... ffer())"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":7,"startColumn":7,"endColumn":17}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":10,"startColumn":25,"endColumn":35}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":65,"endColumn":74}},"message":{"text":"entryPath"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":26,"endColumn":75}},"message":{"text":"require ... ryPath)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":9,"endColumn":23}},"message":{"text":"targetFilePath"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"targetFilePath"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}},"message":{"text":"req.url"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":7,"startColumn":20,"endColumn":63}},"message":{"text":"new $.u ... ffer())"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":7,"startColumn":7,"endColumn":17}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":10,"startColumn":25,"endColumn":35}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":65,"endColumn":74}},"message":{"text":"entryPath"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":26,"endColumn":75}},"message":{"text":"require ... ryPath)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":9,"endColumn":23}},"message":{"text":"targetFilePath"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"targetFilePath"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}},"message":{"text":"req.url"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":7,"startColumn":20,"endColumn":63}},"message":{"text":"new $.u ... ffer())"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":7,"startColumn":7,"endColumn":17}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":10,"startColumn":25,"endColumn":35}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":65,"endColumn":74}},"message":{"text":"entryPath"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":26,"endColumn":75}},"message":{"text":"require ... ryPath)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":9,"endColumn":23}},"message":{"text":"targetFilePath"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"targetFilePath"}}}]}]},{"threadFlows":[{"locations":[{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}},"message":{"text":"req2.params.category"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":7,"startColumn":20,"endColumn":63}},"message":{"text":"new $.u ... ffer())"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":7,"startColumn":7,"endColumn":17}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":10,"startColumn":25,"endColumn":35}},"message":{"text":"zipArchive"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":65,"endColumn":74}},"message":{"text":"entryPath"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":26,"endColumn":75}},"message":{"text":"require ... ryPath)"}},"taxa":[{"id":"Config","properties":{"CodeQL/DataflowRole":"step"}}]},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":11,"startColumn":9,"endColumn":23}},"message":{"text":"targetFilePath"}}},{"location":{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"targetFilePath"}}}]}]}],"relatedLocations":[{"id":1,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":12,"startColumn":37,"endColumn":51}},"message":{"text":"this zip file"}},{"id":2,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"id":3,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}},"message":{"text":"user-provided value"}},{"id":4,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}},"message":{"text":"user-provided value"}},{"id":5,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}},"message":{"text":"user-provided value"}},{"id":6,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":3,"startColumn":17,"endColumn":51}},"message":{"text":"user-provided value"}},{"id":7,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"id":8,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":10,"startColumn":17,"endColumn":34}},"message":{"text":"user-provided value"}},{"id":9,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"id":10,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":17,"startColumn":17,"endColumn":34}},"message":{"text":"user-provided value"}},{"id":11,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":41}},"message":{"text":"user-provided value"}},{"id":12,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/avoid-duplicate-alerts/XssTest.js","uriBaseId":"%SRCROOT%","index":1},"region":{"startLine":25,"startColumn":17,"endColumn":34}},"message":{"text":"user-provided value"}},{"id":13,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":415},"region":{"startLine":6,"startColumn":18,"endColumn":26}},"message":{"text":"user-provided value"}},{"id":14,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5Xss/xss-book-example/webapp/test/testsuite.qunit.js","uriBaseId":"%SRCROOT%","index":415},"region":{"startLine":6,"startColumn":49,"endColumn":57}},"message":{"text":"user-provided value"}},{"id":15,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":11,"startColumn":29,"endColumn":68}},"message":{"text":"user-provided value"}},{"id":16,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":11,"startColumn":29,"endColumn":50}},"message":{"text":"user-provided value"}},{"id":17,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":21,"startColumn":29,"endColumn":68}},"message":{"text":"user-provided value"}},{"id":18,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":21,"startColumn":29,"endColumn":50}},"message":{"text":"user-provided value"}},{"id":19,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":31,"startColumn":29,"endColumn":68}},"message":{"text":"user-provided value"}},{"id":20,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSReflectedXss/XSJSReflectedXss.xsjs","uriBaseId":"%SRCROOT%","index":607},"region":{"startLine":31,"startColumn":29,"endColumn":50}},"message":{"text":"user-provided value"}},{"id":21,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":8,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":22,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":8,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":23,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":9,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":24,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":9,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":25,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":23,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":26,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":23,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":27,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":24,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":28,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":24,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":29,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":37,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":30,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":37,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":31,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":38,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":32,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":38,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":33,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":52,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":34,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":52,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":35,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":53,"startColumn":40,"endColumn":79}},"message":{"text":"user-provided value"}},{"id":36,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSSqlInjection/XSJSSqlInjection.xsjs","uriBaseId":"%SRCROOT%","index":608},"region":{"startLine":53,"startColumn":40,"endColumn":61}},"message":{"text":"user-provided value"}},{"id":37,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":7,"startColumn":28,"endColumn":66}},"message":{"text":"user-provided value"}},{"id":38,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":7,"startColumn":28,"endColumn":49}},"message":{"text":"user-provided value"}},{"id":39,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":16,"startColumn":28,"endColumn":66}},"message":{"text":"user-provided value"}},{"id":40,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSUrlRedirect/XSJSUrlRedirect.xsjs","uriBaseId":"%SRCROOT%","index":609},"region":{"startLine":16,"startColumn":28,"endColumn":49}},"message":{"text":"user-provided value"}},{"id":41,"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSZipSlip/XSJSZipSlip.xsjs","uriBaseId":"%SRCROOT%","index":610},"region":{"startLine":1,"startColumn":19,"endColumn":33}},"message":{"text":"user-provided value"}},{"id":42,"physicalLocation":{"artifactLocation":{"uri":"javascript/heuristic-models/tests/Sources/test.js","uriBaseId":"%SRCROOT%","index":3},"region":{"startLine":5,"startColumn":17,"endColumn":33}},"message":{"text":"user-provided value"}},{"id":43,"physicalLocation":{"artifactLocation":{"uri":"file:/opt/hostedtoolcache/CodeQL/2.23.8/x64/codeql/javascript/tools/data/externs/web/window.js","index":614},"region":{"startLine":56,"startColumn":5,"endColumn":13}},"message":{"text":"user-provided value"}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":6,"startColumn":17,"endColumn":51}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":13,"startColumn":23,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/ui5/test/queries/UI5LogInjection/avoid-duplicate-alerts/LogInjectionTest.js","uriBaseId":"%SRCROOT%","index":2},"region":{"startLine":21,"startColumn":23,"endColumn":30}}},{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/cap/test/queries/cqlinjection/srv/service1.js","uriBaseId":"%SRCROOT%","index":0},"region":{"startLine":782,"startColumn":18,"endColumn":38}}}]},{"ruleId":"js/xsjs-disabled-csrf-protection","rule":{"id":"js/xsjs-disabled-csrf-protection","index":5,"toolComponent":{"index":9}},"message":{"text":"CSRF protection is missing from the configuration."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/exposed/.xsaccess","uriBaseId":"%SRCROOT%","index":603},"region":{"startLine":1,"endLine":4,"endColumn":2}}}],"partialFingerprints":{"primaryLocationLineHash":"c1675fd626f895bf:1","primaryLocationStartColumnFingerprint":"0"}},{"ruleId":"js/xsjs-disabled-csrf-protection","rule":{"id":"js/xsjs-disabled-csrf-protection","index":5,"toolComponent":{"index":9}},"message":{"text":"CSRF protection should not be disabled."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"javascript/frameworks/xsjs/test/queries/XSJSAccess/service/xs-app.json","uriBaseId":"%SRCROOT%","index":606},"region":{"startLine":14,"startColumn":31,"endColumn":36}}}],"partialFingerprints":{"primaryLocationLineHash":"c66a379bed25dd74:1","primaryLocationStartColumnFingerprint":"18"}}],"newlineSequences":["\r\n","\n","
","
"],"columnKind":"utf16CodeUnits","properties":{"semmle.formatSpecifier":"sarif-latest","metricResults":[{"rule":{"id":"js/summary/lines-of-user-code","index":100,"toolComponent":{"index":1}},"ruleId":"js/summary/lines-of-user-code","value":18058,"baseline":11978},{"rule":{"id":"js/summary/lines-of-code","index":101,"toolComponent":{"index":1}},"ruleId":"js/summary/lines-of-code","value":26473}],"codeqlConfigSummary":{"disableDefaultQueries":false,"queries":[{"type":"builtinSuite","uses":"security-extended"},{"type":"localQuery","uses":"./javascript/frameworks/ui5/src/codeql-suites/javascript-security-extended.qls"},{"type":"localQuery","uses":"./javascript/frameworks/cap/src/codeql-suites/javascript-security-extended.qls"},{"type":"localQuery","uses":"./javascript/frameworks/xsjs/src/codeql-suites/javascript-security-extended.qls"}]},"jobRunUuid":"0db37bfb-e416-462d-a06b-0d2dc7291f2f"}}]}
\ No newline at end of file
diff --git a/javascript/frameworks/ui5/ext/ui5.model.yml b/javascript/frameworks/ui5/ext/ui5.model.yml
index fae7eeaa..b3feee0b 100644
--- a/javascript/frameworks/ui5/ext/ui5.model.yml
+++ b/javascript/frameworks/ui5/ext/ui5.model.yml
@@ -3,12 +3,17 @@ extensions:
pack: codeql/javascript-all
extensible: "typeModel"
data:
+ - ["SapUICoreInstance", "global", "Member[sap].Member[ui].Member[getCore].ReturnValue"]
- ["Control", "Control", "Instance"]
- ["Control", "sap/ui/core/Control", ""]
- ["Control", "global", "Member[sap].Member[ui].Member[core].Member[Control]"]
+ - ["Controller", "Controller", "Instance"]
+ - ["Controller", "sap/ui/core/mvc/Controller", ""]
+ - ["Component", "sap/ui/core/mvc/Component", ""]
+ - ["Component", "sap/ui/core/UIComponent", ""]
- ["Renderer", "Control", "Member[extend].Argument[1].Member[renderer]"]
- ["Renderer", "sap/ui/core/RenderManager", "Member[extend].Argument[1].Member[renderer]"]
- - ["Renderer", "sap/ui/core/Renderer", "Member[extend].Argument[1]"]
+ - ["Renderer", "sap/ui/core/Renderer", "Member[extend].Argument[1]"] # ?
- ["RenderManager", "RenderManager", "Instance"]
- ["RenderManager", "sap/ui/core/RenderManager", ""]
- ["RenderManager", "Renderer", "Parameter[0]"]
@@ -71,6 +76,31 @@ extensions:
- ["UI5ClientStorage", "global", "Member[jQuery].Member[sap].Member[storage]"]
- ["UI5ClientStorage", "sap/ui/core/util/File", ""]
- ["UI5ClientStorage", "global", "Member[sap].Member[ui].Member[core].Member[util].Member[File]"]
+ # Publishing and Subscribing to Events
+ - ["UI5EventBusInstance", "sap/ui/core/EventBus", "Member[getInstance].ReturnValue"]
+ - ["UI5EventBusPublish", "UI5EventBusInstance", "Member[publish]"]
+ - ["UI5EventBusPublishedEventData", "UI5EventBusPublish", "Argument[2]"]
+ - ["UI5EventBusSubscribe", "UI5EventBusInstance", "Member[subscribe,subscribeOnce]"]
+ - ["UI5EventSubscriptionHandlerDataParameter", "UI5EventBusSubscribe", "Argument[2].Parameter[2]"]
+ - ["SapUICoreEventBusInstance", "SapUICoreInstance", "Member[getEventBus].ReturnValue"]
+ - ["SapUICoreEventBusPublish", "SapUICoreEventBusInstance", "Member[publish]"]
+ - ["SapUICoreEventBusPublishedEventData", "SapUICoreEventBusPublish", "Argument[2]"]
+ - ["SapUICoreEventBusSubscribe", "SapUICoreEventBusInstance", "Member[subscribe,subscribeOnce]"]
+ - ["SapUICoreEventSubscriptionHandlerDataParameter", "SapUICoreEventBusSubscribe", "Argument[2].Parameter[2]"]
+ # Extend Calls
+ - ["CustomControl", "Control", "Member[extend]"]
+ - ["CustomController", "Controller", "Member[extend]"]
+ - ["CustomControllerContent", "Controller", "Member[extend].Argument[1]"]
+ - ["CustomControllerGetOwnerComponent", "CustomControllerContent", "Fuzzy.Member[getOwnerComponent].ReturnValue"]
+ - ["CustomControllerGetOwnerComponentEventBus", "CustomControllerGetOwnerComponent", "Member[getEventBus].ReturnValue"]
+ - ["CustomControllerGetOwnerComponentEventBusPublish", "CustomControllerGetOwnerComponentEventBus", "Member[publish]"]
+ - ["CustomControllerGetOwnerComponentEventBusPublishedData", "CustomControllerGetOwnerComponentEventBusPublish", "Argument[2]"]
+ - ["CustomControllerGetOwnerComponentEventBusSubscribe", "CustomControllerGetOwnerComponentEventBus", "Member[subscribe,subscribeOnce]"]
+ - ["CustomControllerGetOwnerComponentEventBusSubscriptionHandlerDataParameter", "CustomControllerGetOwnerComponentEventBusSubscribe", "Argument[2].Parameter[2]"]
+ - ["CustomComponent", "Component", "Member[extend]"]
+ - ["CustomRenderer", "Renderer", "Member[extend]"]
+ - ["ViewReference", "CustomController", "Member[getView].ReturnValue"]
+ - ["ControlReference", "ViewReference", "Member[byId].ReturnValue"]
- addsTo:
pack: codeql/javascript-all
diff --git a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll
index b12dcf43..4a3baf3e 100644
--- a/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll
+++ b/javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/RemoteFlowSources.qll
@@ -4,20 +4,47 @@ import advanced_security.javascript.frameworks.ui5.UI5View
import semmle.javascript.security.dataflow.XssThroughDomCustomizations
private import semmle.javascript.frameworks.data.internal.ApiGraphModelsExtensions
-private class DataFromRemoteControlReference extends RemoteFlowSource {
- DataFromRemoteControlReference() {
- exists(UI5Control sourceControl, string typeAlias, ControlReference controlReference |
+abstract private class RemoteControlAPISource extends SourceNode { }
+
+private class RemoteControlReference extends RemoteControlAPISource, ControlReference {
+ RemoteControlReference() {
+ exists(UI5Control sourceControl, string typeAlias |
typeModel(typeAlias, sourceControl.getImportPath(), _) and
sourceModel(typeAlias, _, "remote", _) and
- sourceControl.getAReference() = controlReference and
- (
- this = controlReference.getAMemberCall("getValue") or
- this = controlReference.getAPropertyRead("value")
- )
+ sourceControl.getAReference() = this
)
}
+}
- override string getSourceType() { result = "Data from a remote control" }
+private class RemoteControlHandlerParameter extends RemoteControlAPISource, CallNode {
+ RemoteControlHandlerParameter() {
+ exists(UI5Control sourceControl, string typeAlias, UI5Handler handler |
+ typeModel(typeAlias, sourceControl.getImportPath(), _) and
+ sourceModel(typeAlias, _, "remote", _) and
+ handler.getControl() = sourceControl and
+ this = handler.getParameter(0).getAMemberCall("getSource")
+ )
+ }
+}
+
+private class UserDataFromRemoteControlAPISource extends RemoteFlowSource {
+ UserDataFromRemoteControlAPISource() {
+ exists(RemoteControlAPISource remoteControlAPISource |
+ /*
+ * 1. The `value` or its getter of `HTML` control reference, `CodeEditor` control reference,
+ * or handler parameters.
+ */
+
+ this = remoteControlAPISource.getAPropertyRead("value") or
+ this = remoteControlAPISource.getAMemberCall("getValue") or
+ /* 2. The `getCurrentValue` method call on `CodeEditor` control reference. */
+ this = remoteControlAPISource.getAMemberCall("getCurrentValue")
+ )
+ }
+
+ override string getSourceType() {
+ result = "User-provided data fetched from an input control via JavaScript API"
+ }
}
private class InputControlInstantiation extends ElementInstantiation {
@@ -90,42 +117,23 @@ class ODataServiceModel extends UI5ExternalModel {
override string getSourceType() { result = "ODataServiceModel" }
ODataServiceModel() {
- exists(MethodCallNode setModelCall, CustomController controller |
- /*
- * 1. This flows from a DF node corresponding to the parent component's model
- * to the `this.setModel` call. e.g.
- *
- * `this.getOwnerComponent().getModel("someModelName")` as in
- * `this.getView().setModel(this.getOwnerComponent().getModel("someModelName"))`.
- */
-
- modelName = this.getArgument(0).getALocalSource().asExpr().(StringLiteral).getValue() and
+ exists(CustomController controller |
this.getCalleeName() = "getModel" and
- controller.getOwnerComponentRef().flowsTo(this.(MethodCallNode).getReceiver()) and
- this.flowsTo(setModelCall.getArgument(0)) and
- setModelCall = controller.getAViewReference().getAMemberCall("setModel") and
- /*
- * 2. The component's `manifest.json` declares the DataSource as being of OData type.
- */
-
+ modelName = this.getArgument(0).getALocalSource().getStringValue() and
controller.getOwnerComponent().getExternalModelDef(modelName).getDataSource() instanceof
- ODataDataSourceManifest
+ ODataDataSourceManifest // A component's `manifest.json` declares the data source as being of OData type.
)
or
/*
- * A constructor call to sap.ui.model.odata.v2.ODataModel or sap.ui.model.odata.v4.ODataModel.
+ * A constructor call to `sap.ui.model.odata.v2.ODataModel` or `sap.ui.model.odata.v4.ODataModel`.
*/
this instanceof NewNode and
- (
- exists(RequiredObject oDataModel |
- oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and
- oDataModel.getDependency() in [
- "sap/ui/model/odata/v2/ODataModel", "sap/ui/model/odata/v4/ODataModel"
- ]
- )
- or
- this.getCalleeName() = "ODataModel"
+ exists(RequiredObject oDataModel |
+ oDataModel.asSourceNode().flowsTo(this.getCalleeNode()) and
+ oDataModel.getDependency() in [
+ "sap/ui/model/odata/v2/ODataModel", "sap/ui/model/odata/v4/ODataModel"
+ ]
) and
modelName = "