@sapui5/sap.ushell 1.136.8 → 1.136.9

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@sapui5/sap.ushell",
-    "version": "1.136.8",
+    "version": "1.136.9",
     "description": "SAPUI5 Library sap.ushell",
     "homepage": "https://sap.github.io/ui5-tooling/pages/SAPUI5/",
     "keywords": [

package/src/main/js/sap/ushell/.library

@@ -2,7 +2,7 @@
 <library xmlns="http://www.sap.com/sap.ui.library.xsd">
     <name>sap.ushell</name>
     <vendor>SAP SE</vendor>
-    <version>1.136.8</version>
+    <version>1.136.9</version>
     <copyright>Copyright (c) 2009-2025 SAP SE, All Rights Reserved</copyright>
     <documentation>SAP library: sap.ushell</documentation>
 

package/src/main/js/sap/ushell/ApplicationType/wdaResolution.js

@@ -116,6 +116,22 @@ sap.ui.define([
         return oURI.search(sParams).toString();
     }
 
+    /**
+     * Sanitizes a Web Dynpro application ID to prevent path traversal attacks.
+     *
+     * @param {string} sAppId
+     *   The Web Dynpro application ID to sanitize
+     *
+     * @returns {string}
+     *   The sanitized application ID
+     *
+     * @private
+     */
+    function sanitizeAppId (sAppId) {
+        // Prevent path traversal by removing '../' sequences
+        return sAppId.replace(/\.\.\//g, "");
+    }
+
     /**
      * Creates a WDA URI object based on the provided application id and
      * configuration id of a WDA application.
@@ -161,6 +177,8 @@ sap.ui.define([
         let sUrlParameters;
         const oUrlParameters = deepExtend({}, oOtherParameters);
 
+        sApplicationId = sanitizeAppId(sApplicationId);
+
         // Add config id if provided
         if (sConfigId) {
             oUrlParameters["sap-wd-configId"] = sConfigId;

package/src/main/js/sap/ushell/Fiori20Adapter.js

@@ -5,7 +5,7 @@
  *
  * The Fiori20 adapter automatically re-styles old (Fiori 1) applications to match Fiori2 design requirements.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ui/base/Object",

package/src/main/js/sap/ushell/Fiori20AdapterTest.js

@@ -4,7 +4,7 @@
  * @fileOverview The purpose Fiori20AdapterTest in this file is to decide whether to load the Fiori20Adapter at all.
  * This file is kept small in size on purpose as it is always required in productive code even when Fiori2 adaptation is not required.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/base/Log",

package/src/main/js/sap/ushell/NWBCInterface.js

@@ -2,7 +2,7 @@
 /**
  * @fileOverview NWBCInterface for NWBC client
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/EventHub",

package/src/main/js/sap/ushell/TechnicalParameters.js

@@ -42,7 +42,7 @@
  * parameters. If the application tries to access an internal parameter (e.g.,
  * sap-ui-app-id-hint) via the API, the application receives an error message.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/URLTemplateProcessor/DefinitionParameterSetBuilder.js

@@ -4,7 +4,7 @@
  * @fileOverview Methods to build the set of parameters used by the URL template.
  *
  *
- * @version 1.136.8
+ * @version 1.136.9
  *
  * @private
  *

package/src/main/js/sap/ushell/URLTemplateProcessor/DependencyGraph.js

@@ -8,7 +8,7 @@
  * The proper order of evaluation can be determined by creating and visiting a graph that represents parameters and depending parameters
  * as nodes. This graph can be also used to detect cyclic references in the parameter set definition.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/URLTemplateProcessor/Functions.js

@@ -2,7 +2,7 @@
 
 /**
  * @file Methods to parse and execute functions defined for the URL Template parameter language.
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/URLTemplateProcessor/Resolvers.js

@@ -5,7 +5,7 @@
  * For a given context (e.g. the reference to a site, the application section from the site, parameters added during runtime, etc),
  * this module can be used to find the values associated to given URL Template parameter names.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/URLTemplateProcessor/TemplateParameterParser.js

@@ -34,7 +34,7 @@
  *     }
  *   }
  *   </pre>
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/URLTemplateProcessor/utils.js

@@ -2,7 +2,7 @@
 
 /**
  * @file Utility functions for modules of <code>URLTemplateProcessor</code>.
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/URLTemplateProcessor.js

@@ -26,7 +26,7 @@
  * The language to define parameters in the URL Template parameter set contains a minimal set of conditionals,
  * logical operators, and functions that allow to define the parameter set with a certain degree of control.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/Ui5NativeServiceFactory.js

@@ -2,7 +2,7 @@
 /**
  * @fileOverview Ui5 Native Service Factory
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 
 sap.ui.define([

package/src/main/js/sap/ushell/Ui5ServiceFactory.js

@@ -6,7 +6,7 @@
  * Exposes methods to create a UI5 Service Factory for a specific Unified Shell
  * Service.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/ClientSideTargetResolutionAdapter.js

@@ -9,7 +9,7 @@
  * <li>provide the resolveHashFragment function, a fallback method called by ClientSideTargetResolution service.</li>
  * </ul>
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/base/util/Version",

package/src/main/js/sap/ushell/adapters/cdm/CommonDataModelAdapter.js

@@ -4,7 +4,7 @@
  * @fileOverview The Unified Shell's sap.ushell.adapters.cdm.CommonDataModelAdapter for the 'CDM'
  *               platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/base/Log",

package/src/main/js/sap/ushell/adapters/cdm/ConfigurationDefaultsAdapter.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview The ConfigurationDefaults adapter for the CDM platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/bootstrap/cdm/cdm.constants",

package/src/main/js/sap/ushell/adapters/cdm/ContainerAdapter.js

@@ -2,7 +2,7 @@
 /**
  * @fileOverview The Unified Shell"s container adapter for the Common Data Model (CDM) platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/base/Log",

package/src/main/js/sap/ushell/adapters/cdm/LaunchPageAdapter.js

@@ -4,7 +4,7 @@
  * @fileOverview The Unified Shell's LaunchPageAdapter for the
  *               'CDM' platform - Version 2 (V2)
  * @deprecated since 1.100
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/adapters/cdm/_LaunchPage/readHome",

package/src/main/js/sap/ushell/adapters/cdm/PagesCommonDataModelAdapter.js

@@ -5,7 +5,7 @@
  * It combines the page data, tile data, navigation data and personalization into a CDM 3.1 site.
  * Only used on the ABAP platform and on local for testing.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/base/Log",

package/src/main/js/sap/ushell/adapters/cdm/PersonalizationAdapter.js

@@ -5,7 +5,7 @@
  *
  *
  * The CDM personalization adapter can be used to store data in the RA@ABAP platform.
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/adapters/cdm/_Personalization/internals",

package/src/main/js/sap/ushell/adapters/cdm/PersonalizationV2Adapter.js

@@ -5,7 +5,7 @@
  *
  *
  * The CDM personalization adapter can be used to store data in the RA@ABAP platform.
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "./PersonalizationAdapter"

package/src/main/js/sap/ushell/adapters/cdm/Ui5ComponentLoaderAdapter.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview The Unified Shell's Ui5ComponentLoaderAdapter for the CDM platform
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
 ], function () {

package/src/main/js/sap/ushell/adapters/cdm/_LaunchPage/modifyHome.js

@@ -2,7 +2,7 @@
 
 /**
  * @fileOverview Helper of modifying the home page data for the 'CDM' platform.
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/_LaunchPage/readCatalogs.js

@@ -2,7 +2,7 @@
 
 /**
  * @fileOverview Helper of accessing catalog data for the 'CDM' platform.
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/_LaunchPage/readHome.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview Helper of accessing Home Page data for the 'CDM' platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/_LaunchPage/uri.transform.js

@@ -4,7 +4,7 @@
  * @fileOverview Transforms relative URIs as used e.g. for data sources in the
  * manifest.json
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ui/thirdparty/URI"

package/src/main/js/sap/ushell/adapters/cdm/util/AppForInbound.js

@@ -5,7 +5,7 @@
  * Creates CDM site entries for apps with the provided data.
  * Only used on the ABAP platform and on local for testing.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/util/cdmSiteUtils.js

@@ -5,7 +5,7 @@
  * Creates CDM site entities with the provided data.
  * Only used on the ABAP platform and on local for testing.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/v3/AdapterBase.js

@@ -4,7 +4,7 @@
  * @fileOverview The Base of Unified Shell's LaunchPageAdapter for the 'CDM' platform - Version 3 (V3)
  *   and StaticGroupsContainer for Featured Group
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/adapters/cdm/v3/_LaunchPage/readHome",

package/src/main/js/sap/ushell/adapters/cdm/v3/FlpLaunchPageAdapter.js

@@ -4,7 +4,7 @@
  * @fileOverview The Unified Shell's LaunchPageAdapter for the
  *               'CDM' platform - Version 3 (V3)
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/adapters/cdm/v3/_LaunchPage/readHome",

package/src/main/js/sap/ushell/adapters/cdm/v3/LaunchPageAdapter.js

@@ -5,7 +5,7 @@
  *               'CDM' platform - Version 3 (V3)
  *
  * @deprecated since 1.100
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/adapters/cdm/v3/FlpLaunchPageAdapter"

package/src/main/js/sap/ushell/adapters/cdm/v3/StaticGroupsAdapter.js

@@ -3,7 +3,7 @@
  * @fileOverview The Unified Shell's LaunchPageAdapter for the
  *               'CDM' platform - Version 3 (V3)
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/adapters/cdm/v3/AdapterBase"

package/src/main/js/sap/ushell/adapters/cdm/v3/_LaunchPage/readApplications.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview Helper for accessing application data for the 'CDM' platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/v3/_LaunchPage/readCatalogs.js

@@ -2,7 +2,7 @@
 /**
  * @fileOverview Helper for accessing catalog data for the 'CDM' platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define( [

package/src/main/js/sap/ushell/adapters/cdm/v3/_LaunchPage/readHome.js

@@ -2,7 +2,7 @@
 /**
  * @fileOverview Helper for accessing Home Page data for the 'CDM' platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/v3/_LaunchPage/readPages.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview Helper for accessing pages data for the 'CDM' platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/v3/_LaunchPage/readUtils.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview Helper for accessing the read utils for the 'CDM' platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cdm/v3/_LaunchPage/readVisualizations.js

@@ -4,7 +4,7 @@
  *
  * TODO: Simplify function names
  *
- * @version 1.136.8
+ * @version 1.136.9
  * @private
  */
 sap.ui.define([

package/src/main/js/sap/ushell/adapters/cep/NavTargetResolutionAdapter.js

@@ -2,7 +2,7 @@
 
 /**
  * @fileoverview The NavTargetResolution adapter for SAP MyHome used in FioriLaunchpad.CEP.MyHome
- * @version 1.136.8
+ * @version 1.136.9
  * @deprecated since 1.120
  * @private
  */

package/src/main/js/sap/ushell/adapters/cep/NavTargetResolutionInternalAdapter.js

@@ -2,7 +2,7 @@
 
 /**
  * @fileoverview The NavTargetResolutionInternal adapter for SAP MyHome
- * @version 1.136.8
+ * @version 1.136.9
  * @since 1.120
  */
 

package/src/main/js/sap/ushell/adapters/cep/SearchCEPAdapter.js

@@ -2,7 +2,7 @@
 /**
  * @fileOverview The Unified Shell's Search adapter for CEP applications (client-side search).
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ui/core/Lib",

package/src/main/js/sap/ushell/adapters/cflp/UserDefaultParameterPersistenceAdapter.js

@@ -4,7 +4,7 @@
  * @fileOverview The Unified Shell's UserDefaultParameterPersistence adapter for the CFLP
  *               platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/utils/HttpClient",

package/src/main/js/sap/ushell/adapters/local/AdapterContainer.js

@@ -5,7 +5,7 @@
  *
  * The local personalization adapter can be configured to store data either in
  * the local storage (default) or in memory.
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ui/thirdparty/jquery",

package/src/main/js/sap/ushell/adapters/local/AppStateAdapter.js

@@ -5,7 +5,7 @@
  *   TODO will be replaced by true persistence within this SP!
  *   This adapter delegates to the Personalization Adapter
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/services/appstate/AppStatePersistencyMethod",

package/src/main/js/sap/ushell/adapters/local/ClientSideTargetResolutionAdapter.js

@@ -4,7 +4,7 @@
  * @fileOverview The Unified Shell's ClientSideTargetResolutionAdapter for the local
  *               platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ui/thirdparty/jquery",

package/src/main/js/sap/ushell/adapters/local/ContainerAdapter.js

@@ -2,7 +2,7 @@
 /**
  * @fileOverview The Unified Shell's container adapter for standalone demos.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/base/Log",

package/src/main/js/sap/ushell/adapters/local/FlpLaunchPageAdapter.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview The Unified Shell's page builder adapter for the 'demo' platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/base/Log",

package/src/main/js/sap/ushell/adapters/local/LaunchPageAdapter.js

@@ -4,7 +4,7 @@
  * @fileOverview The Unified Shell's page builder adapter for the 'demo' platform.
  *
  * @deprecated since 1.100
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/adapters/local/FlpLaunchPageAdapter"

package/src/main/js/sap/ushell/adapters/local/NavTargetResolutionAdapter.js

@@ -2,7 +2,7 @@
 
 /**
  * @fileOverview The NavTargetResolution adapter for the demo platform used in scube ui5appruntime.scube.
- * @version 1.136.8
+ * @version 1.136.9
  * @deprecated since 1.120
  * @private
  */

package/src/main/js/sap/ushell/adapters/local/NavTargetResolutionInternalAdapter.js

@@ -2,7 +2,7 @@
 
 /**
  * @fileOverview The NavTargetResolutionInternal adapter for the demo platform.
- * @version 1.136.8
+ * @version 1.136.9
  * @since 1.120
  * @private
  */

package/src/main/js/sap/ushell/adapters/local/PageBuildingAdapter.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview The Unified Shell's page builder adapter for the 'demo' platform.
  * It creates chip instances from chip raw data. Compared to the other platforms this adapter has restricted functionality.
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ui/core/ComponentContainer",

package/src/main/js/sap/ushell/adapters/local/PagePersistenceAdapter.js

@@ -2,7 +2,7 @@
 
 /**
  * @fileOverview PagePersistenceAdapter for the local platform.
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/utils",

package/src/main/js/sap/ushell/adapters/local/PersonalizationAdapter.js

@@ -6,7 +6,7 @@
  *
  * The local personalization adapter can be configured to store data either in
  * the local storage (default) or in memory.
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "sap/ushell/utils",

package/src/main/js/sap/ushell/adapters/local/PersonalizationV2Adapter.js

@@ -6,7 +6,7 @@
  *
  * The local personalization adapter can be configured to store data either in
  * the local storage (default) or in memory.
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
     "./PersonalizationAdapter"

package/src/main/js/sap/ushell/adapters/local/SearchAdapter.js

@@ -2,7 +2,7 @@
 /**
  * @fileOverview The Search adapter for the demo platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
 ], function () {

package/src/main/js/sap/ushell/adapters/local/SearchCEPAdapter.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview The Unified Shell's Search adapter for CEP Search
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 /*eslint-disable quote-props*/
 sap.ui.define([], function () {

package/src/main/js/sap/ushell/adapters/local/SupportTicketAdapter.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview The SupportTicket adapter for the local platform.
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
 ], function () {

package/src/main/js/sap/ushell/adapters/local/Ui5ComponentLoaderAdapter.js

@@ -3,7 +3,7 @@
 /**
  * @fileOverview The Unified Shell's Ui5ComponentLoaderAdapter for the local platform
  *
- * @version 1.136.8
+ * @version 1.136.9
  */
 sap.ui.define([
 ], function () {