@openui5/sap.ui.support 1.84.56 → 1.84.57

package/LICENSE.txt

@@ -616,7 +616,7 @@ License: MIT License
 <year> = 2018
 <copyright holders> = Michael Mclaughlin
 
-Component: lodash 4.17.23
+Component: lodash 4.18.1
 Licensor: JS Foundation and other contributors
 Website: https://github.com/lodash/lodash
 License: MIT License

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openui5/sap.ui.support",
-  "version": "1.84.56",
+  "version": "1.84.57",
   "description": "OpenUI5 UI Library sap.ui.support",
   "author": "SAP SE (https://www.sap.com)",
   "license": "Apache-2.0",
@@ -14,10 +14,10 @@
     "url": "https://github.com/SAP/openui5.git"
   },
   "dependencies": {
-    "@openui5/sap.m": "1.84.56",
-    "@openui5/sap.ui.codeeditor": "1.84.56",
-    "@openui5/sap.ui.core": "1.84.56",
-    "@openui5/sap.ui.fl": "1.84.56",
-    "@openui5/sap.ui.layout": "1.84.56"
+    "@openui5/sap.m": "1.84.57",
+    "@openui5/sap.ui.codeeditor": "1.84.57",
+    "@openui5/sap.ui.core": "1.84.57",
+    "@openui5/sap.ui.fl": "1.84.57",
+    "@openui5/sap.ui.layout": "1.84.57"
   }
 }

package/src/sap/ui/support/.library

@@ -6,7 +6,7 @@
 	<copyright>OpenUI5
  * (c) Copyright 2009-2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.</copyright>
-	<version>1.84.56</version>
+	<version>1.84.57</version>
 
 	<documentation>UI5 library: sap.ui.support</documentation>
 

package/src/sap/ui/support/RuleAnalyzer.js

@@ -32,7 +32,7 @@ sap.ui.define([
 		 * @namespace
 		 * @alias sap.ui.support.RuleAnalyzer
 		 * @author SAP SE
-		 * @version 1.84.56
+		 * @version 1.84.57
 		 * @public
 		 */
 		var RuleAnalyzer = {

package/src/sap/ui/support/jQuery.sap.support.js

@@ -32,7 +32,7 @@ sap.ui.define(["sap/ui/support/supportRules/Main",
 		 * @deprecated Since version 1.60.0. Please use sap/ui/support/RuleAnalyzer instead.
 		 * @alias jQuery.sap.support
 		 * @author SAP SE
-		 * @version 1.84.56
+		 * @version 1.84.57
 		 * @public
 		 */
 		jQuery.sap.support = {

package/src/sap/ui/support/library.js

@@ -23,7 +23,7 @@ sap.ui.define(["sap/ui/core/library"],
 	 * @namespace
 	 * @name sap.ui.support
 	 * @author SAP SE
-	 * @version 1.84.56
+	 * @version 1.84.57
 	 *
 	 * @public
 	 */
@@ -41,7 +41,7 @@ sap.ui.define(["sap/ui/core/library"],
 		controls: [],
 		elements: [],
 		noLibraryCSS: true,
-		version: "1.84.56",
+		version: "1.84.57",
 		extensions: {
 			//Configuration used for rule loading of Support Assistant
 			"sap.ui.support": {
@@ -53,7 +53,7 @@ sap.ui.define(["sap/ui/core/library"],
 	/**
 	 * Defines severity types.
 	 * @enum {string}
-	 * @since 1.84.56
+	 * @since 1.84.57
 	 * @public
 	 */
 	sap.ui.support.Severity = {
@@ -77,7 +77,7 @@ sap.ui.define(["sap/ui/core/library"],
 	/**
 	 * Defines the Audiences.
 	 * @enum {string}
-	 * @since 1.84.56
+	 * @since 1.84.57
 	 * @public
 	 */
 	sap.ui.support.Audiences = {
@@ -101,7 +101,7 @@ sap.ui.define(["sap/ui/core/library"],
 	/**
 	 * Issue Categories.
 	 * @enum {string}
-	 * @since 1.84.56
+	 * @since 1.84.57
 	 * @public
 	 */
 	sap.ui.support.Categories = {
@@ -170,7 +170,7 @@ sap.ui.define(["sap/ui/core/library"],
 	/**
 	 * Analysis history formats.
 	 * @enum {string}
-	 * @since 1.84.56
+	 * @since 1.84.57
 	 * @public
 	 */
 	sap.ui.support.HistoryFormats = {
@@ -189,7 +189,7 @@ sap.ui.define(["sap/ui/core/library"],
 	/**
 	 * Contains the available system presets.
 	 * @enum {object}
-	 * @since 1.84.56
+	 * @since 1.84.57
 	 * @public
 	 */
 	sap.ui.support.SystemPresets = {

package/src/sap/ui/support/supportRules/RuleSerializer.js

@@ -30,11 +30,11 @@ sap.ui.define([],
 					rule = serializedRule;
 				}
 
-				/* eslint-disable no-eval */
+				/* eslint-disable no-new-func */
 				if (!stringifyCheck && rule.check !== undefined) {
-					eval("rule.check = " + rule.check);
+					rule.check = new Function("return (" + rule.check + ")")();
 				}
-				/* eslint-enable no-eval */
+				/* eslint-enable no-new-func */
 
 				return rule;
 			}

package/src/sap/ui/support/supportRules/RuleSet.js

@@ -38,7 +38,7 @@ function (jQuery, library, storage, constants) {
 	 * @name sap.ui.support.RuleSet
 	 * @memberof sap.ui.support
 	 * @author SAP SE
-	 * @version 1.84.56
+	 * @version 1.84.57
 	 * @param {object} oSettings Name of the initiated
 	 * @returns {void}
 	 */

package/src/sap/ui/support/supportRules/Storage.js

@@ -22,7 +22,7 @@ sap.ui.define([
  * @name sap.ui.support.Storage
  * @alias sap.ui.support.Storage
  * @author SAP SE.
- * @version 1.84.56
+ * @version 1.84.57
  *
  * @private
  *

package/src/sap/ui/support/supportRules/WindowCommunicationBus.js

@@ -3,6 +3,7 @@
  * (c) Copyright 2009-2026 SAP SE or an SAP affiliate company.
  * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
  */
+/*global URL */
 
 /**
  * @typedef {object} EventListener
@@ -26,7 +27,7 @@ sap.ui.define([
 	 * @name sap.ui.support.WindowCommunicationBus
 	 * @memberof sap.ui.support
 	 * @author SAP SE
-	 * @version 1.84.56
+	 * @version 1.84.57
 	 * @private
 	 */
 	var WindowCommunicationBus = Object.extend("sap.ui.support.supportRules.WindowCommunicationBus", {
@@ -141,31 +142,79 @@ sap.ui.define([
 	};
 
 	/**
-	 * validate messages published from external window to application window (i.e. from tool frame to opener window)
-	 * no validation needed the other way (i.e. from opener window to tool frame)
+	 * Compare the origins of two URLs. Returns false if either value is not a valid URL.
+	 * @private
+	 * @param {string} sOriginA First URL string
+	 * @param {string} sOriginB Second URL string
+	 * @returns {boolean} true if both URLs have the same origin
+	 */
+	WindowCommunicationBus._compareOrigins = function (sOriginA, sOriginB) {
+		try {
+			return new URL(sOriginA).origin === new URL(sOriginB).origin;
+		} catch (e) {
+			return false;
+		}
+	};
+
+	/**
+	 * Validate messages received from external windows.
+	 * Both directions are validated:
+	 * - Tool frame: validates origin of messages from opener window
+	 * - Application window: validates origin, frame identifier, and URL path of messages from tool frame
 	 * @private
 	 * @method
 	 * @param {EventListener} eMessage Event fired by the channels attached to the WindowCommunicationBus
 	 * @returns {boolean} true if the message is valid
 	 */
 	WindowCommunicationBus.prototype._validate = function (eMessage) {
+		// 1. Validate origin
+		// tool frame: validate against the configured opener origin
 		if (jQuery.isEmptyObject(this._frame)) {
-			// there are no channels associated with this bus, or
-			// when loaded in a tool frame, the CommumnicationBus class will always have an empty 'frame' object.
-			// in this case, a message is sent from the opener to the tool frame and no validation is necessary
+			var sExpectedOrigin = this._oConfig.getOrigin();
+
+			if (sExpectedOrigin) {
+				return WindowCommunicationBus._compareOrigins(eMessage.origin, sExpectedOrigin);
+			}
+
 			return true;
 		}
 
-		// when a message is sent from a tool frame to the application (opener) window,
-		// the message should have the correct details, validating that it comes from a known tool frame
-		var bMatchOrigin = eMessage.origin === this._frame.origin;
-		var bMatchIdentifier = eMessage.data._frameIdentifier === this._frame.identifier;
-		// remove relative paths (if the frame src is relative to the parent)
-		var iFrameUrlQuery = this._frame.url.indexOf("?");
-		var sFrameUrl = this._frame.url.substr(0, iFrameUrlQuery).replace(/\.\.\//g, "") + this._frame.url.substr(iFrameUrlQuery);
-		var bMatchUrl = eMessage.data._origin.indexOf(sFrameUrl) > -1;
+		// application window: validate against the known tool frame origin
+		if (!WindowCommunicationBus._compareOrigins(eMessage.origin, this._frame.origin)) {
+			return false;
+		}
+
+		// 2. Validate frame identifier
+		if (eMessage.data._frameIdentifier !== this._frame.identifier) {
+			return false;
+		}
+
+		// 3. Validate URL path
+		// Compare parsed pathnames to avoid substring-matching attacks.
+		// The frame URL may be absolute or relative — strip query string and relative segments
+		// to extract the path portion, then verify the message origin's pathname ends with it.
+		try {
+			var oOriginUrl = new URL(eMessage.data._origin);
+			var iFrameUrlQuery = this._frame.url.indexOf("?");
+			var sFrameUrlWithoutQuery = this._frame.url.substring(0, iFrameUrlQuery).replace(/\.\.\//g, "").replace(/\.\//g, "");
+
+			// extract just the pathname: parse as URL if absolute, otherwise use the cleaned string as-is
+			var sFramePath;
+			try {
+				sFramePath = new URL(sFrameUrlWithoutQuery).pathname;
+			} catch (e) {
+				// relative URL — use cleaned string directly as a path suffix
+				sFramePath = sFrameUrlWithoutQuery;
+			}
+
+			if (!oOriginUrl.pathname.endsWith(sFramePath)) {
+				return false;
+			}
+		} catch (e) {
+			return false;
+		}
 
-		return bMatchOrigin && bMatchIdentifier && bMatchUrl;
+		return true;
 	};
 
 	WindowCommunicationBus.prototype._getFrameIdentifier = function () {

package/src/sap/ui/support/supportRules/ui/controllers/Analysis.controller.js

@@ -780,9 +780,9 @@ sap.ui.define([
 
 		checkFunctionString: function (functionString) {
 			try {
-				/* eslint-disable no-eval */
-				eval("var testAsignedVar = " + functionString);
-				/* eslint-enable no-eval */
+				/* eslint-disable no-new-func */
+				new Function("return (" + functionString + ")");
+				/* eslint-enable no-new-func */
 			} catch (err) {
 				MessageToast.show("Your check function contains errors, and can't be evaluated:" + err);
 				return false;

package/src/sap/ui/support/supportRules/ui/controllers/PresetsController.js

@@ -89,7 +89,7 @@ sap.ui.define([
 	 *
 	 * @extends sap.ui.support.supportRules.ui.controllers.BaseController
 	 * @author SAP SE
-	 * @version 1.84.56
+	 * @version 1.84.57
 	 * @private
 	 * @alias sap.ui.support.supportRules.ui.controllers.PresetsController
 	 */