@atlassian/aui 9.4.1 → 9.4.2

package/package.json

@@ -1,7 +1,7 @@
 {
     "name": "@atlassian/aui",
     "description": "Atlassian User Interface library",
-    "version": "9.4.1",
+    "version": "9.4.2",
     "author": "Atlassian Pty Ltd.",
     "homepage": "https://aui.atlassian.com",
     "license": "Apache-2.0",
@@ -38,7 +38,7 @@
         "backbone": "1.4.0",
         "css.escape": "1.5.0",
         "fancy-file-input": "2.0.4",
-        "jquery-ui": "1.12.1",
+        "jquery-ui": "1.13.0",
         "skatejs": "0.13.17",
         "skatejs-template-html": "0.0.0",
         "trim-extra-html-whitespace": "1.3.0",

package/src/js/aui/i18n.js

@@ -1,5 +1,5 @@
 import format from './format';
-import globalize from './internal/globalize';
+import { putOnI18nIfAbsent } from './internal/globalize';
 import keys from './internal/i18n/aui';
 
 /**
@@ -29,4 +29,8 @@ export {
  * aliases for I18n or export it from here using 'default'. Webpack transforms it then to
  * 'd.default.getText' and it won't match.
  **/
-globalize('I18n', I18n);
+// eslint-disable-next-line guard-for-in
+for (const property in I18n) {
+    // AUI-5431 Add to global namespace, but do not override what is set by the WRM
+    putOnI18nIfAbsent(property, I18n[property]);
+}

package/src/js/aui/internal/globalize.js

@@ -1,4 +1,11 @@
 const NAMESPACE = 'AJS';
+const I18N_OBJECT_NAME = 'I18n';
+
+function initNamespace() {
+    if (typeof window[NAMESPACE] !== 'object') {
+        window[NAMESPACE] = {};
+    }
+}
 
 /**
  * Makes given value available globally under window[name] attribute.
@@ -14,9 +21,19 @@ const NAMESPACE = 'AJS';
  * @returns exposed value
  */
 export default function globalize (name, value) {
-    if (typeof window[NAMESPACE] !== 'object') {
-        window[NAMESPACE] = {};
-    }
+    initNamespace();
 
     return window[NAMESPACE][name] = value;
 }
+
+export function putOnI18nIfAbsent (name, value) {
+    initNamespace();
+
+    if (typeof window[NAMESPACE][I18N_OBJECT_NAME] !== 'object') {
+        window[NAMESPACE][I18N_OBJECT_NAME] = {};
+    }
+
+    if (typeof window[NAMESPACE][I18N_OBJECT_NAME][name] === 'undefined') {
+        window[NAMESPACE][I18N_OBJECT_NAME][name] = value;
+    }
+}

package/src/js-vendor/jquery/plugins/jquery.form.js

@@ -136,6 +136,9 @@ $.fn.ajaxSubmit = function(options) {
 		var oldSuccess = options.success || function(){};
 		callbacks.push(function(data) {
 			var fn = options.replaceTarget ? 'replaceWith' : 'html';
+			// Validate `data` through `HTML encoding` when passed `data` is passed
+			// to `html()`, as suggested in https://github.com/jquery-form/form/issues/464
+			fn == 'html' ? data = $.parseHTML($("<div>").text(data).html()) : '';
 			$(options.target)[fn](data).each(oldSuccess, arguments);
 		});
 	}
@@ -428,7 +431,10 @@ $.fn.ajaxSubmit = function(options) {
 			return (doc && doc.documentElement && doc.documentElement.nodeName != 'parsererror') ? doc : null;
 		};
 		var parseJSON = $.parseJSON || function(s) {
-			return window['eval']('(' + s + ')');
+			// Arise an error resolvable including jquery instead of
+            // making a new function using unsanitized inputs
+            window.console.error('jquery.parseJSON is undefined');
+			return null;
 		};
 
 		var httpData = function( xhr, type, s ) { // mostly lifted from jq1.4.4