@sap/cds-compiler 2.12.0 → 2.13.6

package/lib/edm/edmUtils.js

@@ -1,6 +1,7 @@
 'use strict';
 const { setProp } = require('../base/model');
 const { isBuiltinType, isEdmPropertyRendered } = require('../model/csnUtils');
+const { escapeString, hasControlCharacters, hasUnpairedUnicodeSurrogate } = require("../render/utils/stringEscapes");
 
 /* eslint max-statements-per-line:off */
 function validateOptions(_options)
@@ -22,7 +23,7 @@ function validateOptions(_options)
         options.odataForeignKeys = options.toOdata.odataForeignKeys;
       if(options.toOdata.odataV2PartialConstr)
         options.odataV2PartialConstr = options.toOdata.odataV2PartialConstr;
-      // global flag that indicates wether or not FKs shall be rendered in general
+      // global flag that indicates whether or not FKs shall be rendered in general
       // V2/V4 flat: yes
       // V4/struct: depending on odataForeignKeys
       options.renderForeignKeys =
@@ -123,7 +124,7 @@ function isSingleton(entityCsn) {
 
 function isEntity(artifact)
 {
-  return ['entity'].includes(artifact.kind);
+  return artifact.kind === 'entity';
 }
 
 function isParameterizedEntity(artifact) {
@@ -138,15 +139,15 @@ function isStructuredArtifact(artifact) {
 
 // Return true if 'artifact' is a real structured type (not an entity)
 function isStructuredType(artifact) {
-  return ['type'].includes(artifact.kind) && isStructuredArtifact(artifact);
+  return artifact.kind === 'type' && isStructuredArtifact(artifact);
 }
 
 function isDerivedType(artifact) {
-  return ['type'].includes(artifact.kind) && !isStructuredArtifact(artifact);
+  return artifact.kind === 'type' && !isStructuredArtifact(artifact);
 }
 
 function isActionOrFunction(artifact) {
-  return ['action', 'function'].includes(artifact.kind);
+  return artifact.kind === 'action' || artifact.kind === 'function';
 }
 
 function resolveOnConditionAndPrepareConstraints(csn, assocCsn, messageFunctions) {
@@ -179,7 +180,7 @@ function resolveOnConditionAndPrepareConstraints(csn, assocCsn, messageFunctions
       const originAssocCsn = resolveOriginAssoc(csn, (assocCsn._originalTarget || assocCsn._target), partnerPath);
       const parentName = assocCsn.$abspath[0];
       const parent = csn.definitions[parentName];
-      if(originAssocCsn) {
+      if(originAssocCsn && originAssocCsn.$abspath) {
         const originParentName = originAssocCsn.$abspath[0];
         if(parent.$mySchemaName && originAssocCsn._originalTarget !== parent && originAssocCsn._target !== parent) {
           isBacklink = false;
@@ -253,7 +254,7 @@ function resolveOnConditionAndPrepareConstraints(csn, assocCsn, messageFunctions
       {
         let lhs = expr[pos-1];
         let rhs = expr[pos+1];
-        if(['='].includes(arg))
+        if(arg === '=')
         {
           assocCsn._constraints.termCount++;
           if(lhs.ref && rhs.ref) // ref is a path
@@ -556,7 +557,7 @@ function mapCdsToEdmType(csn, messageFunctions, isV2=false, isMediaType=false)
     // other: date/time, boolean
     'cds.Date': 'Edm.Date',
     'cds.Time': 'Edm.TimeOfDay',
-    // For a very long time it was unclear wether or not to map the Date types to a different Edm Type in V2,
+    // For a very long time it was unclear whether or not to map the Date types to a different Edm Type in V2,
     // no one has ever asked about it in the meantime. The falsy if is just there to remember the eventual mapping.
     'cds.DateTime': 'Edm.DateTimeOffset', // (isV2 && false) ? 'Edm.DateTime'
     'cds.Timestamp': 'Edm.DateTimeOffset', // (isV2 && false) ? 'Edm.DateTime'
@@ -664,19 +665,111 @@ function isODataSimpleIdentifier(identifier){
   return identifier && identifier.match(regex);
 }
 
-function escapeString(str) {
-  // first regex: replace & if not followed by apos; or quot; or gt; or lt; or amp; or #
-  // Do not always escape > as it is a marker for {i18n>...} translated string values
-  let result = str;
-  if (typeof str === 'string') {
-    result = str.replace(/&(?!(?:apos|quot|[gl]t|amp);|#)/g, '&')
-      .replace(/</g, '&lt;')
-      .replace(/"/g, '&quot;')
-      .replace(/\r\n|\n/g, '&#xa;');
-    if (!result.startsWith('{i18n>') && !result.startsWith('{bi18n'))
-      result = result.replace(/>/g, '&gt;')
-  }
-  return result;
+/**
+ * Escape the given string for attribute values.  We follow the spec as
+ * described in §2.3 <https://www.w3.org/TR/xml/#NT-AttValue>:
+ *
+ *   AttValue ::=  '"' ([^<&"] | Reference)* '"'
+ *               | "'" ([^<&'] | Reference)* "'"
+ *
+ * This function assumes that the attribute value is surrounded by double quotes ("),
+ * hence single quotes are not escaped.
+ *
+ * Note that even though certain special characters such as newline (LF) are allowed,
+ * they may be normalized to something different.  For example LF is normalized
+ * to a space.  Therefore we need to escape it.
+ * See §3.3.3 <https://www.w3.org/TR/xml/#AVNormalize>.
+ *
+ * Furthermore, control characters need to be escaped, see §2.2:
+ * <https://www.w3.org/TR/xml/#charsets>
+ * We also encode LF (#xA), etc. because of XML normalization in XML parsers.
+ *
+ * @param {string} str
+ * @returns {string}
+ */
+function escapeStringForAttributeValue(str) {
+  if (typeof str !== 'string')
+    return str;
+
+  if (!/[&<"]/.test(str) && !hasControlCharacters(str) && !hasUnpairedUnicodeSurrogate(str))
+    return str;
+
+  str = escapeString(str, {
+    '&': '&amp;',
+    '<': '&lt;',
+    '"': '&quot;',
+    control: encodeNonCharacters,
+    unpairedSurrogate: encodeNonCharacters,
+  });
+
+  // Notes
+  // -----
+  // According to the specification, "§2.11: End-of-Line Handling", we should normalize line endings:
+  //    > ... by translating both the two-character sequence #xD #xA and any #xD that is not
+  //    > followed by #xA to a single #xA character.
+  // However, line endings were already normalized in the CDL parser.
+  // If we were to normalize it again, it would be work done twice, possibly resulting in
+  // unwanted normalization (once is expected, twice is not).
+  // If we were to ever change this, use this RegEx:
+  //   /\r\n?|\n/g => '&#xA;'
+
+  return str;
+}
+
+/**
+ * Escape the given string for element content.  We follow the spec as
+ * described in §3.1 <https://www.w3.org/TR/xml/#NT-content>:
+ *
+ *   content  ::= CharData? ((element | Reference | CDSect | PI | Comment) CharData?)*
+ *   CharData ::= [^<&]* - ([^<&]* ']]>' [^<&]*)
+ *
+ * i.e., we need to escape '<', '&' as well as `>` if it is preceded by `]]`.
+ * See also $2.4: “'>' MUST be replaced for compatibility reasons if it appears as ]]>”
+ *
+ * Furthermore, control characters need to be escaped, see §2.2:
+ * <https://www.w3.org/TR/xml/#charsets>
+ * We also encode LF (#xA), etc. because of XML normalization in XML parsers.
+ *
+ * In contrast to `escapeStringForAttributeValue()`, newlines do
+ * not need to be escaped.
+ *
+ * @param {string} str
+ * @returns {string}
+ */
+function escapeStringForText(str) {
+  if (typeof str !== 'string')
+    return str;
+
+  if (!/[&<>]/.test(str) && !hasControlCharacters(str) && !hasUnpairedUnicodeSurrogate(str))
+    return str;
+
+  str = escapeString(str, {
+    '&': '&amp;',
+    '<': '&lt;',
+    control: encodeNonCharacters,
+    unpairedSurrogate: encodeNonCharacters,
+  });
+
+  // Note: You can test this with <https://www.w3schools.com/xml/xml_validator.asp>:
+  //       This sequence is allowed in attribute values but not element content.
+  str = str.replace(/]]>/g, ']]&gt;');
+
+  return str;
+}
+
+/**
+ * Control characters need to be escaped, see §2.2:
+ * <https://www.w3.org/TR/xml/#charsets>
+ *
+ *   Char  ::=  #x9 | #xA | #xD | [#x20-#xD7FF] | [#xE000-#xFFFD] | [#x10000-#x10FFFF]
+ *   --> any Unicode character, excluding the surrogate blocks, FFFE, and FFFF.
+ *
+ * @param {number} codePoint
+ * @returns {string}
+ */
+function encodeNonCharacters(codePoint) {
+  const hex = codePoint.toString(16).toUpperCase();
+  return `&#x${hex};`;
 }
 
 // return the path prefix of a given name or if no prefix available 'root'
@@ -728,7 +821,8 @@ module.exports = {
   mapCdsToEdmType,
   addTypeFacets,
   isODataSimpleIdentifier,
-  escapeString,
+  escapeStringForAttributeValue,
+  escapeStringForText,
   getSchemaPrefix,
   getBaseName
 }

package/lib/gen/Dictionary.json

@@ -409,6 +409,7 @@
     "Capabilities.MediaLocationUpdateSupported": {
       "Type": "Core.Tag",
       "AppliesTo": [
+        "EntityType",
         "Property"
       ]
     },
@@ -657,7 +658,8 @@
       "Type": "Common.FieldControlType",
       "AppliesTo": [
         "Property",
-        "Record"
+        "Record",
+        "EntityType"
       ]
     },
     "Common.ExceptionCategory": {
@@ -1066,7 +1068,8 @@
     "Common.mediaUploadLink": {
       "Type": "Edm.String",
       "AppliesTo": [
-        "Property"
+        "Property",
+        "EntityType"
       ],
       "$experimental": true
     },
@@ -1279,6 +1282,7 @@
     "Core.MediaType": {
       "Type": "Edm.String",
       "AppliesTo": [
+        "EntityType",
         "Property",
         "Term",
         "TypeDefinition",
@@ -1317,6 +1321,7 @@
     "Core.AutoExpand": {
       "Type": "Core.Tag",
       "AppliesTo": [
+        "EntityType",
         "NavigationProperty",
         "Property"
       ]
@@ -1699,7 +1704,8 @@
     "UI.IsImage": {
       "Type": "Core.Tag",
       "AppliesTo": [
-        "Property"
+        "Property",
+        "EntityType"
       ],
       "$experimental": true
     },
@@ -2695,6 +2701,7 @@
         "EditAction": "Common.QualifiedName",
         "NewAction": "Common.QualifiedName",
         "AdditionalNewActions": "Collection(Common.QualifiedName)",
+        "ShareAction": "Common.QualifiedName",
         "PreparationAction": "Common.QualifiedName",
         "ValidationFunction": "Common.QualifiedName"
       }

package/lib/gen/language.checksum

@@ -1 +1 @@
-08b778f3db88cf2de248a5fbf7ed4c8a
+78ff41e0af1a8064856dea9850968eb6