@openui5/sap.ui.core 1.105.1 → 1.105.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openui5/sap.ui.core",
-  "version": "1.105.1",
+  "version": "1.105.2",
   "description": "OpenUI5 Core Library sap.ui.core",
   "author": "SAP SE (https://www.sap.com)",
   "license": "Apache-2.0",

package/src/jquery.sap.global.js

@@ -368,7 +368,7 @@ sap.ui.define([
 	/**
 	 * Root Namespace for the jQuery plug-in provided by SAP SE.
 	 *
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @namespace
 	 * @public
 	 * @static

package/src/jquery.sap.properties.js

@@ -67,7 +67,7 @@ sap.ui.define(['jquery.sap.global', 'sap/base/util/Properties'],
 	 * {@link #setProperty} to store or change a value for a key and {@link #getKeys}
 	 * can be used to retrieve an array of all keys that are currently stored in the collection.
 	 *
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @since 0.9.0
 	 * @name jQuery.sap.util.Properties
 	 * @public

package/src/jquery.sap.resources.js

@@ -99,7 +99,7 @@ sap.ui.define([
 	 * Exception: Fallback for "zh_HK" is "zh_TW" before zh.
 	 *
 	 * @author SAP SE
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @since 0.9.0
 	 * @name jQuery.sap.util.ResourceBundle
 	 * @public

package/src/jquery.sap.script.js

@@ -267,7 +267,7 @@ sap.ui.define([
 	 * Use {@link jQuery.sap.getUriParameters} to create an instance of jQuery.sap.util.UriParameters.
 	 *
 	 * @author SAP SE
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @since 0.9.0
 	 * @name jQuery.sap.util.UriParameters
 	 * @public

package/src/jquery.sap.storage.js

@@ -37,7 +37,7 @@ sap.ui.define([
 	 * @param {string} [sIdPrefix] Prefix used for the Ids. If not set a default prefix is used.
 	 * @returns {jQuery.sap.storage.Storage}
 	 *
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @since 0.11.0
 	 * @namespace
 	 * @public
@@ -97,7 +97,7 @@ sap.ui.define([
 	 * should be deleted the method {@link #removeAll} should be used.
 	 *
 	 * @author SAP SE
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @since 0.11.0
 	 * @public
 	 * @name jQuery.sap.storage.Storage
@@ -201,7 +201,7 @@ sap.ui.define([
 	 * Enumeration of the storage types supported by {@link jQuery.sap.storage.Storage}
 	 * @enum {string}
 	 * @public
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @since 0.11.0
 	 */
 	jQuery.sap.storage.Type = Storage.Type;

package/src/sap/base/security/URLListValidator.js

@@ -7,7 +7,7 @@ sap.ui.define([], function() {
 	"use strict";
 
 	// validation regexes
-	var rBasicUrl = /^(?:([^:\/?#]+):)?((?:\/\/((?:\[[^\]]+\]|[^\/?#:]+))(?::([0-9]+))?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
+	var rBasicUrl = /^(?:([^:\/?#]+):)?((?:[\/\\]{2,}((?:\[[^\]]+\]|[^\/?#:]+))(?::([0-9]+))?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
 	var rCheckPath = /^([a-z0-9-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*$/i;
 	var rCheckQuery = /^([a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9a-f]{2})*$/i;
 	var rCheckFragment = rCheckQuery;
@@ -17,6 +17,10 @@ sap.ui.define([], function() {
 	var rCheckIPv6 = /^\[[^\]]+\]$/;
 	var rCheckValidIPv6 = /^\[(((([0-9a-f]{1,4}:){6}|(::([0-9a-f]{1,4}:){5})|(([0-9a-f]{1,4})?::([0-9a-f]{1,4}:){4})|((([0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::([0-9a-f]{1,4}:){3})|((([0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::([0-9a-f]{1,4}:){2})|((([0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:)|((([0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::))(([0-9a-f]{1,4}:[0-9a-f]{1,4})|(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])))|((([0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4})|((([0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::))\]$/i;
 	var rCheckHostName = /^([a-z0-9]([a-z0-9\-]*[a-z0-9])?\.)*[a-z0-9]([a-z0-9\-]*[a-z0-9])?$/i;
+	var rSpecialSchemeURLs = /^((?:ftp|https?|wss?):)([\s\S]+)$/;
+
+	/* eslint-disable no-control-regex */
+	var rCheckWhitespaces = /[\u0009\u000A\u000D]/;
 
 	/**
 	 * Registry to manage allowed URLs and validate against them.
@@ -95,6 +99,10 @@ sap.ui.define([], function() {
 	 * Note:
 	 * Adding the first entry to the list of allowed entries will disallow all URLs but the ones matching the newly added entry.
 	 *
+	 * <b>Note</b>:
+	 * It is strongly recommended to set a path only in combination with an origin (never set a path alone).
+	 * There's almost no case where checking only the path of a URL would allow to ensure its validity.
+	 *
 	 * @param {string} [protocol] The protocol of the URL, can be falsy to allow all protocols for an entry e.g. "", "http", "mailto"
 	 * @param {string} [host] The host of the URL, can be falsy to allow all hosts. A wildcard asterisk can be set at the beginning, e.g. "examples.com", "*.example.com"
 	 * @param {string} [port] The port of the URL, can be falsy to allow all ports, e.g. "", "8080"
@@ -132,7 +140,16 @@ sap.ui.define([], function() {
 	/**
 	 * Validates a URL. Check if it's not a script or other security issue.
 	 *
-	 * Split URL into components and check for allowed characters according to RFC 3986:
+	 * <b>Note</b>:
+	 * It is strongly recommended to validate only absolute URLs. There's almost no case
+	 * where checking only the path of a URL would allow to ensure its validity.
+	 * For compatibility reasons, this API cannot automatically resolve URLs relative to
+	 * <code>document.baseURI</code>, but callers should do so. In that case, and when the
+	 * allow list is not empty, an entry for the origin of <code>document.baseURI</code>
+	 * must be added to the allow list.
+	 *
+	 * <h3>Details</h3>
+	 * Splits the given URL into components and checks for allowed characters according to RFC 3986:
 	 *
 	 * <pre>
 	 * authority     = [ userinfo "@" ] host [ ":" port ]
@@ -244,7 +261,23 @@ sap.ui.define([], function() {
 	 */
 	oURLListValidator.validate = function(sUrl) {
 
-		var result = rBasicUrl.exec(sUrl);
+		// Test for not allowed whitespaces
+		if (typeof sUrl === "string") {
+			if (rCheckWhitespaces.test(sUrl)) {
+				return false;
+			}
+		}
+
+		// for 'special' URLs without a given base URL, the whatwg spec allows any number of slashes.
+		// As the rBasicUrl regular expression cannot handle 'special' URLs, the URL is modified upfront,
+		// if it wouldn't be recognized by the regex.
+		// See https://url.spec.whatwg.org/#scheme-state (case 2.6.)
+		var result = rSpecialSchemeURLs.exec(sUrl);
+		if (result && !/^[\/\\]{2}/.test(result[2])) {
+			sUrl = result[1] + "//" + result[2];
+		}
+
+		result = rBasicUrl.exec(sUrl);
 		if (!result) {
 			return false;
 		}

package/src/sap/base/util/restricted/_CancelablePromise.js

@@ -26,7 +26,7 @@
  * @alias module:sap/base/util/restricted/_CancelablePromise
  * @author SAP SE
  * @since 1.79
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_castArray.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_castArray
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_compact.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_compact
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_curry.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_curry
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_debounce.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_debounce
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_difference.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_difference
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_differenceBy.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_differenceBy
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_differenceWith.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_differenceWith
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_flatMap.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_flatMap
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_flatMapDeep.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_flatMapDeep
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_flatMapDepth.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_flatMapDepth
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_flatten.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_flatten
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_flattenDeep.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_flattenDeep
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_flattenDepth.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_flattenDepth
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_intersection.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_intersection
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_intersectionBy.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_intersectionBy
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_intersectionWith.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_intersectionWith
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_isEqual.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_isEqual
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_isEqualWith.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_isEqualWith
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_isNil.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_isNil
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_max.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_max
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_merge.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_merge
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_mergeWith.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_mergeWith
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_min.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_min
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_omit.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_omit
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_pick.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_pick
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_pickBy.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_pickBy
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_throttle.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_throttle
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_toArray.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_toArray
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_union.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_union
  * @author SAP SE
  * @since 1.81
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_unionBy.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_unionBy
  * @author SAP SE
  * @since 1.81
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_unionWith.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_unionWith
  * @author SAP SE
  * @since 1.81
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_uniq.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_uniq
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_uniqBy.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_uniqBy
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_uniqWith.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_uniqWith
  * @author SAP SE
  * @since 1.71
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_without.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_without
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_xor.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_xor
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_xorBy.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_xorBy
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_xorWith.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_xorWith
  * @author SAP SE
  * @since 1.80
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_zipObject.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_zipObject
  * @author SAP SE
  * @since 1.81
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/base/util/restricted/_zipObjectDeep.js

@@ -10,7 +10,7 @@
  * @alias module:sap/base/util/restricted/_zipObjectDeep
  * @author SAP SE
  * @since 1.81
- * @version 1.105.1
+ * @version 1.105.2
  * @private
  * @ui5-restricted
 */

package/src/sap/ui/Device.js

@@ -11,7 +11,7 @@
  * This API is independent from any other part of the UI5 framework. This allows it to be loaded beforehand, if it is needed, to create the UI5 bootstrap
  * dynamically depending on the capabilities of the browser or device.
  *
- * @version 1.105.1
+ * @version 1.105.2
  * @namespace
  * @name sap.ui.Device
  * @public
@@ -32,7 +32,7 @@ if (typeof window.sap.ui !== "object") {
 
 	//Skip initialization if API is already available
 	if (typeof window.sap.ui.Device === "object" || typeof window.sap.ui.Device === "function") {
-		var apiVersion = "1.105.1";
+		var apiVersion = "1.105.2";
 		window.sap.ui.Device._checkAPIVersion(apiVersion);
 		return;
 	}
@@ -105,7 +105,7 @@ if (typeof window.sap.ui !== "object") {
 
 	//Only used internal to make clear when Device API is loaded in wrong version
 	Device._checkAPIVersion = function(sVersion) {
-		var v = "1.105.1";
+		var v = "1.105.2";
 		if (v != sVersion) {
 			oLogger.log(WARNING, "Device API version differs: " + v + " <-> " + sVersion);
 		}

package/src/sap/ui/Global.js

@@ -18,7 +18,7 @@
  * sap.ui.lazyRequire("sap.ui.core.Control");
  * sap.ui.lazyRequire("sap.m.Button");
  *
- * @version 1.105.1
+ * @version 1.105.2
  * @author  SAP SE
  * @public
  */
@@ -48,7 +48,7 @@ sap.ui.define([
 	 * The <code>sap</code> namespace is automatically registered with the
 	 * OpenAjax hub if it exists.
 	 *
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @namespace
 	 * @public
 	 * @name sap
@@ -61,7 +61,7 @@ sap.ui.define([
 	 * The <code>sap.ui</code> namespace is the central OpenAjax compliant entry
 	 * point for UI related JavaScript functionality provided by SAP.
 	 *
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @namespace
 	 * @name sap.ui
 	 * @public
@@ -75,7 +75,7 @@ sap.ui.define([
 		 * The version of the SAP UI Library
 		 * @type string
 		 */
-		version: "1.105.1",
+		version: "1.105.2",
 		// buildinfo.lastchange is deprecated and is therefore defaulted to empty string
 		buildinfo : { lastchange : "", buildtime : "${buildtime}" }
 	});

package/src/sap/ui/base/Event.js

@@ -23,7 +23,7 @@ sap.ui.define(['./Object', "sap/base/assert"],
 	 * @extends sap.ui.base.Object
 	 * @implements sap.ui.base.Poolable
 	 * @author SAP SE
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @alias sap.ui.base.Event
 	 * @public
 	 */

package/src/sap/ui/base/EventProvider.js

@@ -18,7 +18,7 @@ sap.ui.define(['./Event', './Object', './ObjectPool', "sap/base/assert"],
 	 * @abstract
 	 * @extends sap.ui.base.Object
 	 * @author SAP SE
-	 * @version 1.105.1
+	 * @version 1.105.2
 	 * @public
 	 * @alias sap.ui.base.EventProvider
 	 */