ui5/webcomponents-react FP improvements for OOTB queries

[knewbury01]

What This PR Contributes

1. A working app test case for how ui5/webcomponents-react input types can be used for input in react apps (includes only types that have a value property)
2. A set of exclusions that prevent FPs in the out of the box query XssThroughDom.ql
3. A test for the exclusion

Future Works

• investigate if Token + Tokenizer can be Xss vectors or not (not currently excluded)
• investigate if isRefAssignedToUI5Component can be defined in a more elegant way. extending the ReactComponent would be useful, if we can find a way to identify a UI5Webcomponent (which it is not defined and only used in apps that use it)

[jeongsoolee09]

We keep the test pack at javascript/frameworks/{framework}/test/. Can you move the pack here and rename it similar to packs you see in other frameworks?

[Copilot]

Pull request overview

This PR reduces false positives in the XssThroughDom query for UI5 webcomponents-react by adding sanitizers for components that don't allow arbitrary user input. The changes introduce a comprehensive test suite demonstrating XSS patterns with various UI5 input components and excludes 14 component types that only accept predefined selections or numeric values.

Key changes:

• Added sanitizer logic to filter out false positives from UI5 webcomponents-react components that constrain user input (e.g., checkboxes, sliders, color pickers)
• Implemented API modeling for UI5 webcomponents-react using CodeQL's type tracking
• Created a comprehensive test case with 25 UI5 input components to validate the sanitizer behavior

Reviewed changes

Copilot reviewed 14 out of 15 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
javascript/frameworks/ui5/lib/advanced_security/javascript_sap_ui5_all/Customizations.qll	Imports the new Sanitizers module into the customizations
javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5WebcomponentsReact.qll	Implements API modeling for UI5 webcomponents-react with type tracking and ref attribute handling
javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Sanitizers.qll	Defines the ExcludedSource sanitizer class that filters out 14 component types that don't allow arbitrary user input
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/index.tsx	React app entry point for the test application
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/src/App.tsx	Test application demonstrating XSS patterns with 25 UI5 webcomponents, including both vulnerable and false positive cases
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/qlpack.yml	CodeQL pack configuration for the test
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/public/index.html	HTML template for the test application
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/package.json	NPM dependencies for the test application including UI5 webcomponents v2.15
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/codeql-pack.lock.yml	CodeQL pack dependency lock file
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/XssThroughDom.qlref	Query reference file
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/XssThroughDom.ql	Copy of the XssThroughDom query for testing the sanitizer customizations
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/XssThroughDom.expected	Expected test results showing 11 components flagged as vulnerable while 14 are correctly filtered out
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/README.md	Documentation explaining how to trigger XSS in the test application
javascript/frameworks/ui5-webcomponents/test/queries/xss-input-dangerouslySetInnerHTML/.eslintrc.json	ESLint configuration for the test application

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jeongsoolee09]

Second round!

[jeongsoolee09]

Probably the final round.

[jeongsoolee09]

LGTM. Don't forget to document the current limitations of isRefAssignedToUI5Component.