@oracle/oraclejet 19.0.7 → 19.0.9

package/dist/js/libs/oj/debug/ojgantt-toolkit.js

@@ -3638,7 +3638,7 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
         var defaultNavigationLabel =
           gantt.getEventManager().getKeyboardDnDMode() === 'move' ? 'MoveBy' : 'ResizeBy';
         var navigationScaleDesc = DvtGanttTooltipUtils._addDatatipRow(
-          '',
+          isTabular ? [] : '',
           gantt,
           '',
           defaultNavigationLabel,
@@ -3759,7 +3759,7 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
       }
 
       // Default Tooltip Support
-      var datatip = '';
+      var datatip = isTabular ? [] : '';
       datatip = DvtGanttTooltipUtils._addRowDatatip(datatip, taskNode, isTabular);
       datatip = DvtGanttTooltipUtils._addTaskDatatip(datatip, taskNode, isTabular);
 
@@ -3768,39 +3768,32 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
 
     /**
      * Final processing for the datatip.
-     * @param {string} datatip The current datatip.
+     * @param {string|Array<Node>} datatip The current datatip.
      * @param {Gantt} gantt The owning gantt instance.
      * @param {boolean} isTabular Whether the datatip is in a table format.
-     * @return {string} The updated datatip.
+     * @return {string|Node} The updated datatip.
      * @private
      */
     _processDatatip: (datatip, gantt, isTabular) => {
       // Don't render tooltip if empty
-      if (datatip === '') return null;
-
-      // Add outer table tags
-      // Note: Unlike Charts, we're not going to create a table start tag with
-      // dvt.HtmlTooltipManager.createElement(). That method applies parsed styles
-      // to the element, but for gantt we want to directly apply the class to the element:
-      //
-      // Security note: gantt.GetStyleClass('tooltipTable') returns an internally generated class string
-      // defined in ojgantt.js (in this case, returns the string 'oj-gantt-tooltip-table')
-      //
-      // datatip contains externally provided strings, but this entire value is eventually passed to
-      // dvt.HtmlTooltipManager._showTextAtPosition(),
-      // and that method makes sure all parsable HTML tags are disabled/handled
+      if (isTabular && datatip.length === 0) return null;
+      if (!isTabular && datatip === '') return null;
+
+      // Add outer table element
       if (isTabular)
-        return '<table class="' + gantt.GetStyleClass('tooltipTable') + '">' + datatip + '</table>';
+        return dvt.HtmlTooltipManager.createElement('table', null, datatip, [
+          gantt.GetStyleClass('tooltipTable')
+        ]);
 
       return datatip;
     },
 
     /**
-     * Adds the row string to the datatip.
-     * @param {string} datatip The current datatip.
+     * Adds the row to the datatip.
+     * @param {string|Array<Node>} datatip The current datatip.
      * @param {DvtGanttTaskNode} taskNode The task node.
      * @param {boolean} isTabular Whether the datatip is in a table format.
-     * @return {string} The updated datatip.
+     * @return {string|Array<Node>} The updated datatip.
      * @private
      */
     _addRowDatatip: (datatip, taskNode, isTabular) => {
@@ -3818,11 +3811,11 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
     },
 
     /**
-     * Adds the task strings to the datatip.
-     * @param {string} datatip The current datatip.
+     * Adds the task rows to the datatip.
+     * @param {string|Array<Node>} datatip The current datatip.
      * @param {DvtGanttTaskNode} taskNode The task node.
      * @param {boolean} isTabular Whether the datatip is in a table format.
-     * @return {string} The updated datatip.
+     * @return {string|Array<Node>} The updated datatip.
      * @private
      */
     _addTaskDatatip: (datatip, taskNode, isTabular) => {
@@ -4059,15 +4052,15 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
     },
 
     /**
-     * Adds a row of item to the datatip string.
-     * @param {string} datatip The current datatip.
+     * Adds a row of item to the datatip.
+     * @param {string|Array<Node>} datatip The current datatip.
      * @param {Gantt} gantt The gantt instance.
      * @param {string} type The item type, e.g. row, start, end, label
      * @param {string} defaultLabel The bundle resource string for the default label.
      * @param {string|number} value The item value.
      * @param {boolean} isTabular Whether the datatip is in a table format.
      * @param {number} index (optional) The index of the tooltipLabel string to be used
-     * @return {string} The updated datatip.
+     * @return {string|Array<Node>} The updated datatip.
      * @private
      */
     _addDatatipRow: (datatip, gantt, type, defaultLabel, value, isTabular, index) => {
@@ -4091,35 +4084,16 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
       value = DvtGanttTooltipUtils.formatValue(gantt, type, valueFormat, value);
 
       if (isTabular) {
-        // Note: Unlike Charts, we're not going to create a td start tag with
-        // dvt.HtmlTooltipManager.createElement(). That method applies parsed styles
-        // to the element, but for gantt we want to directly apply the class to the element:
-        //
-        // Security note: gantt.GetStyleClass returns an internally generated class string
-        // defined in ojgantt.js (in this case, returns the strings 'oj-gantt-tooltip-label'
-        // and 'oj-gantt-tooltip-value' respectively in the two calls below).
-        //
-        // tooltipLabel and value contains externally provided strings, but these values are eventually passed to
-        // DvtGanttTooltipUtils._processDatatip(), which concatenates more strings to it, and the entire value is passed to
-        // dvt.HtmlTooltipManager._showTextAtPosition(),
-        // and that last method makes sure all parsable HTML tags are disabled/handled
-        var tooltipLabelClass = gantt.GetStyleClass('tooltipLabel');
-        var tooltipValueClass = gantt.GetStyleClass('tooltipValue');
-        return (
-          datatip +
-          '<tr>' +
-          '<td class="' +
-          tooltipLabelClass +
-          '">' +
-          tooltipLabel +
-          '</td>' +
-          '<td class="' +
-          tooltipValueClass +
-          '">' +
-          value +
-          '</td>' +
-          '</tr>'
-        );
+        var tds = [
+          dvt.HtmlTooltipManager.createElement('td', null, tooltipLabel, [
+            gantt.GetStyleClass('tooltipLabel')
+          ]),
+          dvt.HtmlTooltipManager.createElement('td', null, value, [
+            gantt.GetStyleClass('tooltipValue')
+          ])
+        ];
+        datatip.push(dvt.HtmlTooltipManager.createElement('tr', null, tds));
+        return datatip;
       } else {
         if (datatip.length > 0) datatip += '<br>';
 

package/dist/js/libs/oj/debug/ojgauge-toolkit.js

@@ -1411,6 +1411,12 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-axis'], function (exports, dv
         alta: dvt.JsonUtils.merge(defaultsMap['alta'], SKIN_ALTA)
       });
     }
+
+    getNoCloneObject() {
+      const noClone = super.getNoCloneObject();
+      noClone.metricLabel = { converter: true };
+      return noClone;
+    }
   }
 
   /**
@@ -1809,7 +1815,7 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-axis'], function (exports, dv
      */
     SetOptions(options) {
       // NOTE: This extra clone should be removed once we stop supporting the deprecated attrs
-      options = dvt.JsonUtils.clone(options);
+      options = dvt.JsonUtils.clone(options, null, this.Defaults.getNoCloneObject());
 
       if (options['title']) {
         options['label'] = options['title'];
@@ -4402,7 +4408,7 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-axis'], function (exports, dv
      */
     SetOptions(options) {
       // NOTE: This extra clone should be removed once we stop supporting the deprecated attrs
-      options = dvt.JsonUtils.clone(options);
+      options = dvt.JsonUtils.clone(options, null, this.Defaults.getNoCloneObject());
 
       if (options['title']) options['label'] = options['title'];
 

package/dist/js/libs/oj/debug/ojgauge.js

@@ -1020,6 +1020,13 @@ var __oj_status_meter_gauge_metadata =
         return this.element;
       },
 
+      _GetComponentNoClonePaths: function () {
+        var noClonePaths = this._super();
+        // Don't clone converter instances because their class methods must be preserved.
+        noClonePaths.metricLabel = { converter: true };
+        return noClonePaths;
+      },
+
       _GetChildStyleClasses: function () {
         var styleClasses = this._super();
         styleClasses['oj-gauge-metric-label'] = { path: 'metricLabel/style', property: 'TEXT' };

package/dist/js/libs/oj/debug/ojhtmlutils.js

@@ -20,6 +20,20 @@ define(['exports'], function (exports) { 'use strict';
    * the input to prevent unsafe content from being added to the page.</p>
    */
   const HtmlUtils = {};
+  const _ESCAPED_TAGS = [
+    'table',
+    'caption',
+    'colgroup',
+    'col',
+    'thead',
+    'tfoot',
+    'th',
+    'tbody',
+    'tr',
+    'td',
+    'template',
+    'p'
+  ];
 
   /**
    * Utility that will parse an HTML string into an array of DOM Nodes.
@@ -30,20 +44,7 @@ define(['exports'], function (exports) { 'use strict';
    */
   HtmlUtils.stringToNodeArray = function (html) {
     // escape html for the predefined tags
-    var tags = [
-      'table',
-      'caption',
-      'colgroup',
-      'col',
-      'thead',
-      'tfoot',
-      'th',
-      'tbody',
-      'tr',
-      'td',
-      'template',
-      'p'
-    ];
+    var tags = _ESCAPED_TAGS;
     var i;
 
     for (i = 0; i < tags.length; i++) {
@@ -122,25 +123,21 @@ define(['exports'], function (exports) { 'use strict';
       const BIND_REPLACE = 'oj-bind-replace-';
       if (nodeName.substr(0, 16) === BIND_REPLACE) {
         var replName = nodeName.substr(16);
-        replNode = document.createElement(replName); // @HTMLUpdateOK
-        for (j = 0; j < child.attributes.length; j++) {
-          attr = child.attributes[j];
-          replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
+        if (_ESCAPED_TAGS.indexOf(replName) !== -1) {
+          replNode = document.createElement(replName); // @HTMLUpdateOK
+          for (j = 0; j < child.attributes.length; j++) {
+            attr = child.attributes[j];
+            replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
+          }
+          var childHolder = replNode.content ? replNode.content : replNode;
+          for (j = 0; child.childNodes.length > 0; ) {
+            childHolder.appendChild(child.childNodes[0]);
+          }
+          parent.replaceChild(replNode, child);
         }
-        var childHolder = replNode.content ? replNode.content : replNode;
-        for (j = 0; child.childNodes.length > 0; ) {
-          childHolder.appendChild(child.childNodes[0]);
-        }
-        parent.replaceChild(replNode, child);
       } else if (nodeName === 'script' || nodeName === 'style') {
-        replNode = document.createElement(nodeName); // @HTMLUpdateOK
-        for (j = 0; j < child.attributes.length; j++) {
-          attr = child.attributes[j];
-          replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
-        }
-        var origHTML = child.innerHTML; // @HTMLUpdateOK
-        replNode.innerHTML = origHTML.replace(new RegExp(BIND_REPLACE, 'g'), ''); // @HTMLUpdateOK
-        parent.replaceChild(replNode, child);
+        var origText = child.textContent || '';
+        child.textContent = origText.replace(new RegExp(BIND_REPLACE, 'g'), '');
       } else if (child.nodeType === 8) {
         // comment node
         var origValue = child.nodeValue;

package/dist/js/libs/oj/debug/ojlabel.js

@@ -390,11 +390,14 @@ define(['ojs/ojcore', 'ojs/ojjquery-hammer', 'ojs/ojcomponentcore', 'ojs/ojpopup
          * and holds the help icon on a mobile device. No formatted text is available for
          * help definition attribute.</li>
          * <li><code class="prettyprint">source</code> - this is the help source url.
-         * If present, a help icon will
-         * render next to the label. For security reasons
-         *  we only support urls with protocol http: or https:.
-         * If the url doesn't comply we ignore it and throw an error.
-         * Pass in an encoded URL since we do not encode the URL.
+         * If present, a help icon will render next to the label.
+         * <p><b>Note:</b> For security, JET validates the URL protocol before navigation
+         * and currently supports <code class="prettyprint">http:</code> and
+         * <code class="prettyprint">https:</code> protocols. If the url doesn't
+         * comply we ignore it and throw an error. JET does not validate whether
+         * the URL is trusted for the application. Applications are responsible
+         * for providing sanitized URLs and enforcing any required origin or host
+         * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
          * </ul>
          *
          * @expose
@@ -1386,6 +1389,7 @@ define(['ojs/ojcore', 'ojs/ojjquery-hammer', 'ojs/ojcomponentcore', 'ojs/ojpopup
         helpIconAnchor = document.createElement('a');
         helpIconAnchor.setAttribute('tabindex', '0');
         helpIconAnchor.setAttribute('target', '_blank');
+        helpIconAnchor.setAttribute('rel', 'noopener noreferrer');
         helpIconAnchor.className =
           'oj-label-help-icon-anchor oj-label-help-icon oj-component-icon oj-clickable-icon-nocontext';
         if (source) {

package/dist/js/libs/oj/debug/ojlistview.js

@@ -1994,7 +1994,7 @@ var __oj_list_view_metadata =
                   // if event target is within listview, but not around items, e.g. the padding
                   var active = self.m_active && self.m_active.elem;
                   if (active == null && self.element.attr('tabIndex') === '0') {
-                    self.element.focus();
+                    self._initFocus(event, true);
                   } else if (active != null) {
                     self._makeFocusable(active);
                     self.HighlightActive();
@@ -5556,13 +5556,13 @@ var __oj_list_view_metadata =
        * Initialize focus by finding the first focusable item and set focus on it
        * @private
        */
-      _initFocus: function (event) {
+      _initFocus: function (event, preventScroll) {
         var items = this._getItemsCache();
         for (var i = 0; i < items.length; i++) {
           var item = $(items[i]);
           // make sure item can receive focus
           if (!this.SkipFocus(item)) {
-            this.SetCurrentItem(item, event);
+            this.SetCurrentItem(item, event, false, preventScroll);
             break;
           }
         }
@@ -7352,10 +7352,11 @@ var __oj_list_view_metadata =
        * @param {jQuery} item the item to set as active
        * @param {Event} event the event that triggers set active
        * @param {boolean=} skipFocus true if to skip focusing the item
+       * @param {boolean=} preventScroll true if prevent scroll when focus
        * @return {boolean} true if item becomes active, false for all other cases
        * @private
        */
-      _setActive: function (item, event, skipFocus) {
+      _setActive: function (item, event, skipFocus, preventScroll) {
         var active;
 
         // set key info
@@ -7414,7 +7415,7 @@ var __oj_list_view_metadata =
                 (event.originalEvent && event.originalEvent.type !== 'click') ||
                 (this._isMultipleToggleSelection() && event.shiftKey)
               ) {
-                this._focusItem(item);
+                this._focusItem(item, preventScroll);
               }
 
               // reset tabindex of previous focus item, note this has to be done after focusing on a new item
@@ -7436,7 +7437,7 @@ var __oj_list_view_metadata =
               this._makeFocusable(item);
               // make sure ul is not tabbable
               this.RemoveRootElementTabIndex();
-              this._focusItem(item);
+              this._focusItem(item, preventScroll);
             }
           }
         } else {
@@ -7458,12 +7459,12 @@ var __oj_list_view_metadata =
        * Put browser focus on item (or children of item)
        * @private
        */
-      _focusItem: function (item) {
+      _focusItem: function (item, preventScroll) {
         var elem = this.getFocusItem(item).get(0);
         if (elem) {
           try {
             this.m_inShiftingFocus = true;
-            elem.focus();
+            elem.focus({ preventScroll });
           } finally {
             this.m_inShiftingFocus = false;
           }
@@ -7520,8 +7521,8 @@ var __oj_list_view_metadata =
        * Sets the active item and bring focus to it.  Update the currentItem option.
        * @protected
        */
-      SetCurrentItem: function (item, event, skipFocus) {
-        var proceed = this.ActiveAndFocus(item, event, skipFocus);
+      SetCurrentItem: function (item, event, skipFocus, preventScroll) {
+        var proceed = this.ActiveAndFocus(item, event, skipFocus, preventScroll);
         if (proceed) {
           this._setCurrentItemOption(this.GetKey(item[0]), event, item.get(0));
         }
@@ -7531,15 +7532,17 @@ var __oj_list_view_metadata =
        * Sets the active item and bring focus to it.
        * @protected
        */
-      ActiveAndFocus: function (item, event, skipFocus) {
+      ActiveAndFocus: function (item, event, skipFocus, preventScroll) {
         // make sure that it is visible
-        this._scrollToVisible(item[0]);
+        if (!preventScroll) {
+          this._scrollToVisible(item[0]);
+        }
 
         // unhighlight any previous active item
         this.UnhighlightActive();
 
         // update active and frontier
-        var proceed = this._setActive(item, event, skipFocus);
+        var proceed = this._setActive(item, event, skipFocus, preventScroll);
 
         // highlight active
         this.HighlightActive();

package/dist/js/libs/oj/debug/ojlogger.js

@@ -25,11 +25,12 @@ define(['exports', '@oracle/oraclejet-preact/utils/UNSAFE_logger'], function (ex
    *
    * <p>If the logging options are changed at a later point, the Logger will use the modified options for the subsequent log operations.
    *
-   * <p>The logging level can be overridden via sessionStorage.setItem() call for the current browser session.
+   * <p>In debug builds, the logging level can be overridden via sessionStorage.setItem() call for the current browser session.
    * Use 'ojet.logLevel' as the key with one of the following values: 'none' (least verbose), 'error', 'warning', 'info', 'log' (most verbose).
    * Set the value in the browser console and refresh the browser in order for the value to take effect.
+   * Production builds ignore this key.
    * </p>
-   * <h3> Session storage usage : </h3>
+   * <h3> Session storage usage in debug builds : </h3>
    * <pre class="prettyprint">
    * <code>
    * // override logging level for the current session

package/dist/js/libs/oj/debug/ojmessage.js

@@ -32,6 +32,34 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
 
   const ojMessage = {};
 
+  const ALLOWED_AUDIO_URL_PROTOCOLS = ['http:', 'https:', 'data:', 'blob:'];
+
+  function encodeCssUrlControlCharacter(char) {
+    var hex = char.charCodeAt(0).toString(16).toUpperCase();
+    return '%' + (hex.length < 2 ? '0' + hex : hex);
+  }
+
+  function escapeCssUrlString(url) {
+    var escapedUrl = '';
+    var urlString = String(url);
+    for (var i = 0; i < urlString.length; i++) {
+      var char = urlString.charAt(i);
+      var charCode = char.charCodeAt(0);
+      if (char === '"' || char === '\\') {
+        escapedUrl += '\\' + char;
+      } else if (charCode <= 0x1f || charCode === 0x7f) {
+        escapedUrl += encodeCssUrlControlCharacter(char);
+      } else {
+        escapedUrl += char;
+      }
+    }
+    return escapedUrl;
+  }
+
+  function getCssUrl(url) {
+    return 'url("' + escapeCssUrlString(url) + '")';
+  }
+
   /**
    * @ojcomponent oj.ojMessage
    * @since 5.0.0
@@ -69,10 +97,13 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
    *
    * <p>The {@link oj.ojMessage#message.sound} property is an accessibility feature for playing a
    * sound when a message is opened. This property defaults to "none", and can be enabled by setting
-   * it to "defaults" or by providing URL to an audio file of a format that the browser supports. An
-   * accessible application must provide a way for users to enable sound on a settings or preferences
-   * page. Some browsers will have auto-play disabled by default, enabling it may require adjusting
-   * the browser settings.</p>
+   * it to "defaults" or by providing a URL to an audio file of a format that the browser supports.
+   * Custom sound URLs are validated before playback. Relative URLs and URLs that resolve to
+   * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+   * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+   * supported. An accessible application must provide a way for users to enable sound on a settings
+   * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+   * require adjusting the browser settings.</p>
    *
    * <h3 id="touch-section">
    *   Touch End User Information
@@ -424,9 +455,12 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
    * required for low vision users who view a zoomed section of the UI. Because messages may be shown
    * outside of the zoomed section, such users require sound to be played to notify of new messages.</p>
    *
-   * <p>This attribute can take a URL of the audio file for the custom sound to be played. The
-   * supported formats are mp3, wav and ogg. Browser support should also be considered while choosing
-   * the format of the audio file. Literal string values
+   * <p>This attribute can take a URL of the audio file for the custom sound to be played. Custom
+   * sound URLs are validated before playback. Relative URLs and URLs that resolve to
+   * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+   * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+   * supported. The supported formats are mp3, wav and ogg. Browser support should also be considered
+   * while choosing the format of the audio file. Literal string values
    * <code class="prettyprint">"defaults"</code> and <code class="prettyprint">"none"</code> can also
    * be used for this attribute. If the value is set to "none", then the sound will be disabled. If
    * the value is set to "defaults", then a default sound is played.<p>
@@ -1260,7 +1294,7 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
       return undefined;
     }
 
-    return ["url('", message.icon, "') no-repeat"].join('');
+    return getCssUrl(message.icon) + ' no-repeat';
   };
 
   MessageViewModel.prototype._computeIconClass = function () {
@@ -1493,6 +1527,13 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
   MessageViewModel.prototype._playSound = function (sound) {
     // Custom URL was specified for the sound, using <audio> element is simple and best for this case.
     if (sound !== 'defaults') {
+      try {
+        DomUtils.validateURL(sound, ALLOWED_AUDIO_URL_PROTOCOLS);
+      } catch (error) {
+        Logger.info(`JET oj-message: Invalid URL in message.sound='${sound}'. Error: ${error}`);
+        return;
+      }
+
       var audio = document.createElement('AUDIO');
       audio.src = sound;
 

package/dist/js/libs/oj/debug/ojmessagebanner.js

@@ -1357,9 +1357,12 @@ define(['exports', 'preact/jsx-runtime', 'preact/hooks', 'preact', 'ojs/ojconfig
      * <p>The <code class="prettyprint">MessageBannerItem["sound"]</code> property is an accessibility
      * feature for playing a sound when a message is opened. This property defaults to "none", and can
      * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
-     * browser supports. An accessible application must provide a way for users to enable sound on a
-     * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
-     * it may require adjusting the browser settings.</p>
+     * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+     * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+     * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+     * supported. An accessible application must provide a way for users to enable sound on a settings
+     * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+     * require adjusting the browser settings.</p>
      *
      * <h3 id="keyboard-section">
      *   Keyboard End User Information

package/dist/js/libs/oj/debug/ojmetadatautils.js

@@ -159,7 +159,15 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcustomelement-utils'], function (ex
     if (subProp) {
       const namePath = propPath.split('.');
       for (let i = 0; i < namePath.length; i++) {
-        subProp = subProp[namePath[i]];
+        const propName = namePath[i];
+        if (
+          oj.CollectionUtils._isBlockedKey(propName) ||
+          !Object.prototype.hasOwnProperty.call(subProp, propName)
+        ) {
+          subProp = undefined;
+        } else {
+          subProp = subProp[propName];
+        }
         if (i === 0) {
           prop = subProp;
         }