DO NOT MERGE: Fix CDS extraction and scoped UI5 indexing by mbaluda · Pull Request #466 · advanced-security/codeql-sap-js

mbaluda · 2026-11-04T11:56:03Z

More reliable extraction: Better handles large file selections and filenames containing spaces or special characters, reducing failures caused by platform limits or filename interpretation. These improvements apply consistently across Windows and Unix-like systems.
Better CAP coverage: Includes CSN models even when no CDS sources are selected, alongside feature-specific models. In repositories combining Java CAP backends with JavaScript/UI5 workspaces, project boundaries are preserved so models are not mixed into the wrong project.
Analysis scope: Honors source inclusions and exclusions across CAP models, generated model data, and UI5 XML views and fragments.
More reproducible analysis: Prefers CAP compiler versions pinned in project or workspace lockfiles instead of potentially picking newer releases.

Centralize project-owned CDS and CSN selection while preserving CAP entry points, source filters, workspace boundaries, and generated extraction outputs. Share bounded, shell-safe compilation between extraction and test workflows, prefer locked compiler versions, and scope UI5 XML indexing consistently across platforms. Simplify selection fixtures and dependency documentation, retain regression coverage, and mark rebuilt bundles as generated for easier review. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Retain the default CDS globs while adding concrete CSN source includes through the literal filename and byte-limit safeguards. Add unfiltered extraction and batching regressions, and rebuild the extractor bundle. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

🔵 Needs a closer look

Mocked execution tests cannot establish native Windows command escaping and compiler behavior or multi-batch CodeQL extraction completeness, so human integration validation is needed.

No open issues 🎉

2 resolved since last review

1 file not reviewed

extractors/cds/tools/package-lock.json: Generated file

_{Review effort: Balanced}

Copilot

🟡 Changes recommended

Source-filter matching misinterprets literal characters in CDS and UI5 paths, while project discovery omits CSN-only projects, causing incorrect analysis scope.

3 open issues

1 file not reviewed

extractors/cds/tools/package-lock.json: Generated file

_{Review effort: Balanced}

+  const includePaths = [normalizedPath, ...includedSourcePaths.map(normalizePathSeparators)];
+  const matches = (raw: string, include = false): boolean => {
+    // Escape literal Unix backslashes before minimatch parses the glob.
+    const pattern = normalizePathSeparators(raw).replace(/\\/g, '\\\\').replace(/\/+$/, '');


+    const pattern = match[2]
+      .split(sep)
+      .join('/')
+      .replace(/\\/g, '\\\\')


Copilot AI balanced review requested due to automatic review settings November 4, 2026 11:56

Copilot started reviewing on behalf of mbaluda November 4, 2026 11:56

View session

github-code-quality Bot found potential problems Nov 4, 2026

View reviewed changes

Comment thread extractors/cds/tools/dist/compile-test-cds-lib.cjs Fixed

Comment thread extractors/cds/tools/dist/compile-test-cds-lib.cjs Fixed

github-advanced-security Bot found potential problems Nov 4, 2026

View reviewed changes

Comment thread extractors/cds/tools/dist/compile-test-cds-lib.cjs Fixed

mbaluda force-pushed the cds-extractor-fixes branch from 2475f81 to a0e95da Compare November 4, 2026 11:58

github-code-quality Bot found potential problems Nov 4, 2026

View reviewed changes

Comment thread extractors/cds/tools/dist/compile-test-cds-lib.cjs Fixed

Comment thread extractors/cds/tools/dist/cds-extractor.bundle.js Fixed