Xml Fragments models

[knewbury01]

What This PR Contributes

QL models and tests for Xml Fragments that are programatically instantiated. Covers both the use case of loading a fragment via the Fragment itself (Fragment.load) as well as a controller's loadFragment

Future Works

• js fragments entirely
• fragments statically associated to views (declared via <Fragment> tags and no programatic controller association (declarative views)
• consideration for the way to express whether a fragment is instantiated or not (currently built into getControllerName in XmlFragment, but this could be replaced with a similar mechanism to the placeAt dynamic model in remote flow sources, or possibly inherently in the detection of the fragment itself (ie to say a fragment is only a fragment once it is instantiated - though may be complex when there is no controller)? Technically this is also currently implicitly enforced in anything that then uses Fragment.byId to reference it, due to the implication that only instantiated fragments can be referenced this way. therefore further guarantee may not be required.

[Copilot]

Pull request overview

This PR adds support for modeling XML fragments in SAPUI5 applications to enable XSS vulnerability detection. It introduces the ability to track data flow through programmatically instantiated fragments using both Controller.loadFragment() and Fragment.load() APIs.

Key changes:

• New Fragment.qll module to model Fragment.load() API calls
• Extended UI5View.qll with XmlFragment class to handle fragment definitions
• Added two test cases demonstrating XSS detection through fragments loaded via different methods

Reviewed changes

Copilot reviewed 22 out of 24 changed files in this pull request and generated 9 comments.

File	Description
javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/Fragment.qll	New module defining FragmentLoad class to model sap.ui.core.Fragment.load() API calls and extract configuration parameters
javascript/frameworks/ui5/lib/advanced_security/javascript/frameworks/ui5/UI5View.qll	Extended with XmlFragment class (lines 690-777) to model XML fragments, their controllers, sources, and sinks; updated TUI5Control to include fragment.xml files
javascript/frameworks/ui5/test/queries/UI5Xss/xss-xml-fragment/*	Test case using Controller.loadFragment() to load a fragment with XSS source and sink
javascript/frameworks/ui5/test/queries/UI5Xss/xss-xml-fragment-load/*	Test case using Fragment.load() with explicit controller parameter to load a fragment with XSS source and sink

Files not reviewed (2)

• javascript/frameworks/ui5/test/queries/UI5Xss/xss-xml-fragment-load/package-lock.json: Language not supported
• javascript/frameworks/ui5/test/queries/UI5Xss/xss-xml-fragment/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.