@oracle/oraclejet-core-pack 20.1.2 → 20.1.3

package/oj-c/types/labelled-link/labelled-link.d.ts

@@ -42,11 +42,16 @@ export type LabelledLinkProps = ObservedGlobalProps<'aria-describedby'> & {
     containerReadonly?: boolean;
     /**
      * @description
-     * Specifies the URL that the link points to. If the href is provided, clicking the link
+     * Specifies the URL that the link points to. If a safe href is provided, clicking the link
      * will trigger the default browser behavior and will open the link. The
      * <code class="prettyprint">ojAction</code> event will not be triggered. If the href property is
      * not provided, then the default browser behavior will be prevented and the
      * <code class="prettyprint">ojAction</code> event will be triggered.
+     * <p><b>Note:</b> This value is rendered as a link
+     * <code class="prettyprint">href</code>. Applications are responsible for providing trusted
+     * URLs, choosing protocols appropriate for their use case, and enforcing any required origin or
+     * host allowlist. Unsafe URL protocols are blocked by omitting the rendered navigable href;
+     * blocked href values do not trigger <code class="prettyprint">ojAction</code>.</p>
      * @ojmetadata description "Sets the URL that the link points to."
      * @ojmetadata displayName "Href"
      * @ojmetadata help "#href"
@@ -208,8 +213,9 @@ export type LabelledLinkProps = ObservedGlobalProps<'aria-describedby'> & {
     userAssistanceDensity?: PreactLabelledLinkProps['userAssistanceDensity'];
     /**
      * @ojmetadata description "Triggered when the link is clicked, whether by keyboard, mouse,
-     * or touch events. This event is triggered only when the href is not provided. If the href
-     * is provided, clicking the link will not trigger this event."
+     * or touch events. This event is triggered only when the href is not provided. If a safe href
+     * is provided, clicking the link will not trigger this event. If an unsafe href protocol is
+     * provided, the navigable href is omitted and this event is not triggered."
      * @ojmetadata eventGroup "common"
      * @ojmetadata displayName "onOjAction"
      * @ojmetadata help "#event:action"
@@ -428,11 +434,16 @@ export interface CLabelledLinkElementSettableProperties extends JetSettablePrope
      */
     containerReadonly?: LabelledLinkProps['containerReadonly'];
     /**
-     * Specifies the URL that the link points to. If the href is provided, clicking the link
+     * Specifies the URL that the link points to. If a safe href is provided, clicking the link
      * will trigger the default browser behavior and will open the link. The
      * <code class="prettyprint">ojAction</code> event will not be triggered. If the href property is
      * not provided, then the default browser behavior will be prevented and the
      * <code class="prettyprint">ojAction</code> event will be triggered.
+     * <p><b>Note:</b> This value is rendered as a link
+     * <code class="prettyprint">href</code>. Applications are responsible for providing trusted
+     * URLs, choosing protocols appropriate for their use case, and enforcing any required origin or
+     * host allowlist. Unsafe URL protocols are blocked by omitting the rendered navigable href;
+     * blocked href values do not trigger <code class="prettyprint">ojAction</code>.</p>
      */
     href?: LabelledLinkProps['href'];
     /**

package/oj-c/types/message-banner/message-banner.d.ts

@@ -224,9 +224,12 @@ type MessageBannerProps<K extends string | number, D extends MessageBannerItem>
  * <p>The <code class="prettyprint">MessageBannerItem["sound"]</code> property is an accessibility
  * feature for playing a sound when a message is opened. This property defaults to "none", and can
  * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
- * browser supports. An accessible application must provide a way for users to enable sound on a
- * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
- * it may require adjusting the browser settings.</p>
+ * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+ * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="keyboard-section">
  *   Keyboard End User Information

package/oj-c/types/message-toast/message-toast.d.ts

@@ -242,9 +242,12 @@ type MessageToastProps<K extends string | number, D extends MessageToastItem> =
  * <p>The <code class="prettyprint">MessageToastItem["sound"]</code> property is an accessibility
  * feature for playing a sound when a message is opened. This property defaults to "none", and can
  * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
- * browser supports. An accessible application must provide a way for users to enable sound on a
- * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
- * it may require adjusting the browser settings.</p>
+ * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+ * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="keyboard-section">
  *   Keyboard End User Information

package/oj-c/types/tab-bar/DataTabBar.types.d.ts

@@ -78,6 +78,9 @@ export type TabLinkItemData<K extends string | number> = {
     tabPanelId?: string;
     /**
      * Sets the URL that the hyperlink points to. If there is no valid URL use "#" for href value to navigate to the top of the page.
+     * <p><b>Note:</b> This value is rendered as a link <code class="prettyprint">href</code>.
+     * Applications are responsible for providing trusted URLs, choosing protocols appropriate for
+     * their use case, and enforcing any required origin or host allowlist.</p>
      */
     href: string;
 };

package/oj-c/types/tab-bar/tab-bar.d.ts

@@ -87,6 +87,9 @@ export type TabLinkItemData<K extends string | number> = {
     tabPanelId?: string;
     /**
      * Sets the URL that the hyperlink points to. If there is no valid URL use "#" for href value to navigate to the top of the page.
+     * <p><b>Note:</b> This value is rendered as a link <code class="prettyprint">href</code>.
+     * Applications are responsible for providing trusted URLs, choosing protocols appropriate for
+     * their use case, and enforcing any required origin or host allowlist.</p>
      */
     href: string;
 };

package/oj-c/types/tag-cloud-item/tag-cloud-item.d.ts

@@ -35,6 +35,11 @@ export type TagCloudItemProps = {
     /**
      * @description
      * The url this item references.
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. JET does not validate whether the
+     * URL is trusted for the application. Applications are responsible for providing
+     * sanitized URLs and enforcing any required origin or host allowlist.</p>
      * @ojmetadata description "The url this item references."
      * @ojmetadata displayName "Url"
      * @ojmetadata help "#url"
@@ -103,6 +108,11 @@ export interface CTagCloudItemElementSettableProperties extends JetSettablePrope
     shortDesc?: TagCloudItemProps['shortDesc'];
     /**
      * The url this item references.
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. JET does not validate whether the
+     * URL is trusted for the application. Applications are responsible for providing
+     * sanitized URLs and enforcing any required origin or host allowlist.</p>
      */
     url?: TagCloudItemProps['url'];
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@oracle/oraclejet-core-pack",
-  "version": "20.1.2",
+  "version": "20.1.3",
   "description": "JET core components fully implemented in VDOM",
   "keywords": [
     "oraclejet"
@@ -9,11 +9,11 @@
   "oracle-exchange": "oj-c",
   "devDependencies": {},
   "dependencies": {
-    "@oracle/oraclejet": "20.1.2",
-    "@oracle/oraclejet-preact": "20.1.2",
-    "@oracle/oraclejet-selenium-driver": "20.1.2",
-    "@oracle/oraclejet-testing": "20.1.2",
-    "@oracle/oraclejet-webdriver": "20.1.2"
+    "@oracle/oraclejet": "20.1.3",
+    "@oracle/oraclejet-preact": "20.1.3",
+    "@oracle/oraclejet-selenium-driver": "20.1.3",
+    "@oracle/oraclejet-testing": "20.1.3",
+    "@oracle/oraclejet-webdriver": "20.1.3"
   },
   "peerDependencies": {
     "selenium-webdriver": ">=4.0.0"