BlogBlogA post on somebody's own site or a community platform. Nobody edits it after publication, so it dates from the day it was written.See every one →SAP Community
Building Secure SAPUI5 Applications: Best Practices for Developers
A developer-facing rundown of secure coding habits for SAPUI5 apps: typed bindings and custom formatters to reject bad input before it reaches a handler, encodeHTML() instead of rendering untrusted HTML, keeping tokens and URLs out of local and session storage, and CSRF token handling on the ODataModel. It sets up lintingLintingCatching in the editor what would otherwise be caught at deploy time, or not at all — problems in source code and models and in the project's configuration, found by rules rather than by review.SAP and community, narrow by design with ESLint and an eslint-config-ui5 rule set to catch unsafe DOM access, eval calls and unused imports as part of CI, alongside the same input validationInput validationRejecting bad input before it reaches the database. While this can be done manually inside a handler, there are solutions in place to derive type, range, enum and mandatory checks from the model definitions.SAP and community, unassessed instinct: reject invalid input early rather than trust the backend to catch it.
Where it sits
Explains
LintingUI5LintingCatching in the editor what would otherwise be caught at deploy time, or not at all — problems in source code and models and in the project's configuration, found by rules rather than by review.Input validationInput validationRejecting bad input before it reaches the database. While this can be done manually inside a handler, there are solutions in place to derive type, range, enum and mandatory checks from the model definitions.
Source
reachable
Who is behind it
Manisha_19author
Properties
About this work
For linting
Applies in
Group by11 of 11 pieces
Piece, what it offersStill applies
Before You Upgrade S/4HANA: Static UI5 Checks with MCPBefore You Upgrade S/4HANA: Static UI5 Checks with MCPA UI5 version upgrade checked against one app by pairing two MCP servers: the ui5_version_diff tool added to mcp-sap-docs, which reads a bundle from ui5-lib-diff downloaded once at setup and filters it by version range, change type, library or query text, and @ui5/mcp-server, whose get_project_info, get_version_info, run_ui5_linter and run_manifest_validation say what the app uses and what fails. Run with a ui5-versions-upgrade.md skill on the legacy app from From SEGW and Legacy UI5 to RAP with ARC-1, from SAPUI5 1.84.59 to 1.147.2, the diff range held 985 deprecations and 961 What's New entries, and the linting and manifest validation narrowed that to findings in this app, among them jQuery.sap.require, synchronous bootstrap, the sap_belize theme, sap.m.MessagePage and an old manifest _version. The checks read the source in a local checkout and never the deployed app, so the report is a first pass: a changelog entry is not proof that a workaround can be deleted, and the app still has to be run and tested.published 2026-05-20
Declarative Programming in CAP: Less Code, More ValueDeclarative Programming in CAP: Less Code, More ValueAn argument for annotations over handlers, made from the case where it is most obvious: repetitive validation logic that could be declared instead of written. Describes what you want rather than how to get it, and lets the runtime decide the how.published 2026-02-05
Migrate your code with UI5 linter – Autofix has landedMigrate your code with UI5 linter – Autofix has landedUI5 linter v1.12.0 adds an initial autofix, reached with ui5lint --fix, and the post walks through it end to end: the tool first reports a deprecated global reference (sap.ui.model.json.JSONModel), then the fix rewrites it into the equivalent module import and local variable. This first version only handles that one class of deprecation — replacing deprecated globals with imports — with more fix types left for later releases tracked on the tool's GitHub roadmap.published 2025-03-19
Open Source UI5 Form ValidatorOpen Source UI5 Form ValidatorWalks through @learnin/ui5-validator, an open-source library the author built because UI5's standard constraints-based validation only fires on value change and cannot do batch validation on save, required-field checks across a whole view, or correlation checks between fields such as a start date against an end date. It coexists with UI5's own required attribute and message model rather than adding custom attributes, and the post shows the manifest.json wiring, a controller calling Validator#validate on save, and a registered cross-field validator comparing a fromDate and toDate DatePicker pair.actor:learnin, published 2025-02-04
CAPVAL: A project is bornCAPVAL: A project is bornThis second CAPVAL post announces CAPVAL version 2.0, made compatible with CAP v8 after breaking changes there, with the fix shown as a custom cds.middlewares.after error handler. It restates the plugin's @validation.message annotation alongside standard annotations such as @mandatory as the input validation mechanic the project builds on, and the release otherwise adds automated tests and release-automation GitHub Actions rather than new annotations.published 2024-08-26
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginExtend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL PluginThe complaint first: the built-in annotations are good for data integrity and poor at telling the user what went wrong, and there is no way to reuse a rule. capval, the plugin the post announces, adds @validation.message alongside the standard annotations rather than replacing them, and @validation.handler for a check written as a class. Published in January 2024, before the 1.2.0 line the README now pairs with @sap/cds 8.0.0 and above; the two annotations it shows are the two the README still documents.published 2024-01-09
#CAP-TechBytes Input Validation#CAP-TechBytes Input ValidationThe annotations one at a time — @mandatory, @assert.unique, @assert.range including the enum form, @assert.format — each with what it produces. Ends on error handling, which is the part that decides whether any of it is usable from a UI.Thajunniza, published 2023-07-07
#BTP #SAPCAP: Quirky Nuggets (N01-N02)#BTP #SAPCAP: Quirky Nuggets (N01-N02)Walks through two CAP gotchas: the on/before/after phases of custom event handlers, shown with an after handler whose edits only reach the result when the handler returns an object or array, never a primitive; and the @assert.unique annotation, which builds a database uniqueness constraint from the model. For Input validation, the catch is that once the constrained property is nested, @assert.unique must name it by its model dot path (assignment.type) rather than the flattened column data modelling compiles it to (assignment_type).published 2023-06-05
[Part - 1] Enrich CAP based Services with Behaviors using Annotations[Part - 1] Enrich CAP based Services with Behaviors using AnnotationsWalks through CDS annotations that add behaviour beyond CRUD: @readonly and @insertonly take away write, update or delete on an entity or element, each shown with the OData metadata it generates. @mandatory, @assert.unique, @assert.integrity, @assert.format and @assert.range then enforce input checks that @sap/cds runs on write, with the SQL or HANA constraint @assert.unique compiles to and the error code each rejection returns. It names @restrict and @requires but defers them, calling authorization too large a topic for this post.published 2023-01-28
Learn how to define constraints declaratively in your CDS modelLearn how to define constraints declaratively in your CDS modelConstraints expressed in the model rather than checked in a handler — the distinction the atlas draws between input validation the framework enforces and validation somebody writes.SAP
Everything new: Try out the latest features in CAPEverything new: Try out the latest features in CAPCAP (@sap/cds) gains the features this hands-on session works through: declarative constraints, which is the input validation concern, status flows as status transition flows, a cds REPL, extensibility through @sap/cds-oyster, and HCQL, which SAP's abstract calls CAP's native query-over-HTTP protocol, after an opening stretch of AI-driven app development. The abstract names the features and stops there; what each one does is not described. A TechEd 2026 hands-on session (Wednesday 28 October, Berlin), presented by Daniel Hutzel, Daniel Schlachter, Marc Huber and Tim Back, written here from SAP's abstract; the recording is not yet published.
Details
Graph
Lintingcapability, core and community
Input validationcapability, core and community
SAP Communitypublishing source
SAP Communitysapui5-tag
Source
Type
blog
Published on
Host
community.sap.com
Discovered via
First seen
History
- explains → applies_to on capability:linting (ui5)Door scope proposed from the title and summary, so a door page lists the piece only where it holds (docs/concepts/content-on-doors.md).
- Entered the atlasDiscovered via SAP Community · sapui5-tag.
For your agent
- Ref
content:building-secure-sapui5-applications-best-practices-for-developers- JSON
- /content/building-secure-sapui5-applications-best-practices-for-developers.json
- MCP
- Connecting an agent