@oracle/oraclejet 19.0.7 → 19.0.9

package/dist/js/libs/oj/debug_esm/ojgantt-toolkit.js

@@ -5,7 +5,7 @@
  * as shown at https://oss.oracle.com/licenses/upl/
  * @ignore
  */
-import { BaseComponentDefaults, CSSStyle, Agent, Container, ToolkitUtils, Path, Stroke, PathUtils, KeyboardEvent, MouseEvent, Rect, OutputText, IconButton, Displayable, Obj, SelectionEffectUtils, ColorUtils, ResourceUtils, TouchEvent, Rectangle, AriaUtils, EventFactory, Point, EventManager, ClipPath, TextUtils, SolidFill, JsonUtils, Line, AnimFadeIn, Easing, AnimFadeOut, CustomAnimation, ParallelPlayable, Playable, Animator, Automation, SvgShapeUtils, SimpleScrollbar, LayoutUtils, Dimension, MarqueeHandler, Matrix, SelectionHandler } from 'ojs/ojdvt-toolkit';
+import { BaseComponentDefaults, CSSStyle, Agent, Container, ToolkitUtils, Path, Stroke, PathUtils, KeyboardEvent, MouseEvent, Rect, OutputText, IconButton, Displayable, Obj, SelectionEffectUtils, ColorUtils, ResourceUtils, HtmlTooltipManager, TouchEvent, Rectangle, AriaUtils, EventFactory, Point, EventManager, ClipPath, TextUtils, SolidFill, JsonUtils, Line, AnimFadeIn, Easing, AnimFadeOut, CustomAnimation, ParallelPlayable, Playable, Animator, Automation, SvgShapeUtils, SimpleScrollbar, LayoutUtils, Dimension, MarqueeHandler, Matrix, SelectionHandler } from 'ojs/ojdvt-toolkit';
 import { TimeComponent, TimeComponentEventManager, TimeComponentKeyboardHandler } from 'ojs/ojdvt-timecomponent';
 import { TimeAxisUtils as TimeAxisUtils$1, TimeAxis } from 'ojs/ojtimeaxis-toolkit';
 
@@ -3640,7 +3640,7 @@ var DvtGanttTooltipUtils = {
       var defaultNavigationLabel =
         gantt.getEventManager().getKeyboardDnDMode() === 'move' ? 'MoveBy' : 'ResizeBy';
       var navigationScaleDesc = DvtGanttTooltipUtils._addDatatipRow(
-        '',
+        isTabular ? [] : '',
         gantt,
         '',
         defaultNavigationLabel,
@@ -3761,7 +3761,7 @@ var DvtGanttTooltipUtils = {
     }
 
     // Default Tooltip Support
-    var datatip = '';
+    var datatip = isTabular ? [] : '';
     datatip = DvtGanttTooltipUtils._addRowDatatip(datatip, taskNode, isTabular);
     datatip = DvtGanttTooltipUtils._addTaskDatatip(datatip, taskNode, isTabular);
 
@@ -3770,39 +3770,32 @@ var DvtGanttTooltipUtils = {
 
   /**
    * Final processing for the datatip.
-   * @param {string} datatip The current datatip.
+   * @param {string|Array<Node>} datatip The current datatip.
    * @param {Gantt} gantt The owning gantt instance.
    * @param {boolean} isTabular Whether the datatip is in a table format.
-   * @return {string} The updated datatip.
+   * @return {string|Node} The updated datatip.
    * @private
    */
   _processDatatip: (datatip, gantt, isTabular) => {
     // Don't render tooltip if empty
-    if (datatip === '') return null;
-
-    // Add outer table tags
-    // Note: Unlike Charts, we're not going to create a table start tag with
-    // dvt.HtmlTooltipManager.createElement(). That method applies parsed styles
-    // to the element, but for gantt we want to directly apply the class to the element:
-    //
-    // Security note: gantt.GetStyleClass('tooltipTable') returns an internally generated class string
-    // defined in ojgantt.js (in this case, returns the string 'oj-gantt-tooltip-table')
-    //
-    // datatip contains externally provided strings, but this entire value is eventually passed to
-    // dvt.HtmlTooltipManager._showTextAtPosition(),
-    // and that method makes sure all parsable HTML tags are disabled/handled
+    if (isTabular && datatip.length === 0) return null;
+    if (!isTabular && datatip === '') return null;
+
+    // Add outer table element
     if (isTabular)
-      return '<table class="' + gantt.GetStyleClass('tooltipTable') + '">' + datatip + '</table>';
+      return HtmlTooltipManager.createElement('table', null, datatip, [
+        gantt.GetStyleClass('tooltipTable')
+      ]);
 
     return datatip;
   },
 
   /**
-   * Adds the row string to the datatip.
-   * @param {string} datatip The current datatip.
+   * Adds the row to the datatip.
+   * @param {string|Array<Node>} datatip The current datatip.
    * @param {DvtGanttTaskNode} taskNode The task node.
    * @param {boolean} isTabular Whether the datatip is in a table format.
-   * @return {string} The updated datatip.
+   * @return {string|Array<Node>} The updated datatip.
    * @private
    */
   _addRowDatatip: (datatip, taskNode, isTabular) => {
@@ -3820,11 +3813,11 @@ var DvtGanttTooltipUtils = {
   },
 
   /**
-   * Adds the task strings to the datatip.
-   * @param {string} datatip The current datatip.
+   * Adds the task rows to the datatip.
+   * @param {string|Array<Node>} datatip The current datatip.
    * @param {DvtGanttTaskNode} taskNode The task node.
    * @param {boolean} isTabular Whether the datatip is in a table format.
-   * @return {string} The updated datatip.
+   * @return {string|Array<Node>} The updated datatip.
    * @private
    */
   _addTaskDatatip: (datatip, taskNode, isTabular) => {
@@ -4061,15 +4054,15 @@ var DvtGanttTooltipUtils = {
   },
 
   /**
-   * Adds a row of item to the datatip string.
-   * @param {string} datatip The current datatip.
+   * Adds a row of item to the datatip.
+   * @param {string|Array<Node>} datatip The current datatip.
    * @param {Gantt} gantt The gantt instance.
    * @param {string} type The item type, e.g. row, start, end, label
    * @param {string} defaultLabel The bundle resource string for the default label.
    * @param {string|number} value The item value.
    * @param {boolean} isTabular Whether the datatip is in a table format.
    * @param {number} index (optional) The index of the tooltipLabel string to be used
-   * @return {string} The updated datatip.
+   * @return {string|Array<Node>} The updated datatip.
    * @private
    */
   _addDatatipRow: (datatip, gantt, type, defaultLabel, value, isTabular, index) => {
@@ -4093,35 +4086,16 @@ var DvtGanttTooltipUtils = {
     value = DvtGanttTooltipUtils.formatValue(gantt, type, valueFormat, value);
 
     if (isTabular) {
-      // Note: Unlike Charts, we're not going to create a td start tag with
-      // dvt.HtmlTooltipManager.createElement(). That method applies parsed styles
-      // to the element, but for gantt we want to directly apply the class to the element:
-      //
-      // Security note: gantt.GetStyleClass returns an internally generated class string
-      // defined in ojgantt.js (in this case, returns the strings 'oj-gantt-tooltip-label'
-      // and 'oj-gantt-tooltip-value' respectively in the two calls below).
-      //
-      // tooltipLabel and value contains externally provided strings, but these values are eventually passed to
-      // DvtGanttTooltipUtils._processDatatip(), which concatenates more strings to it, and the entire value is passed to
-      // dvt.HtmlTooltipManager._showTextAtPosition(),
-      // and that last method makes sure all parsable HTML tags are disabled/handled
-      var tooltipLabelClass = gantt.GetStyleClass('tooltipLabel');
-      var tooltipValueClass = gantt.GetStyleClass('tooltipValue');
-      return (
-        datatip +
-        '<tr>' +
-        '<td class="' +
-        tooltipLabelClass +
-        '">' +
-        tooltipLabel +
-        '</td>' +
-        '<td class="' +
-        tooltipValueClass +
-        '">' +
-        value +
-        '</td>' +
-        '</tr>'
-      );
+      var tds = [
+        HtmlTooltipManager.createElement('td', null, tooltipLabel, [
+          gantt.GetStyleClass('tooltipLabel')
+        ]),
+        HtmlTooltipManager.createElement('td', null, value, [
+          gantt.GetStyleClass('tooltipValue')
+        ])
+      ];
+      datatip.push(HtmlTooltipManager.createElement('tr', null, tds));
+      return datatip;
     } else {
       if (datatip.length > 0) datatip += '<br>';
 

package/dist/js/libs/oj/debug_esm/ojgauge-toolkit.js

@@ -1412,6 +1412,12 @@ class DvtGaugeDefaults extends BaseComponentDefaults {
       alta: JsonUtils.merge(defaultsMap['alta'], SKIN_ALTA)
     });
   }
+
+  getNoCloneObject() {
+    const noClone = super.getNoCloneObject();
+    noClone.metricLabel = { converter: true };
+    return noClone;
+  }
 }
 
 /**
@@ -1810,7 +1816,7 @@ class LedGauge extends DvtGauge {
    */
   SetOptions(options) {
     // NOTE: This extra clone should be removed once we stop supporting the deprecated attrs
-    options = JsonUtils.clone(options);
+    options = JsonUtils.clone(options, null, this.Defaults.getNoCloneObject());
 
     if (options['title']) {
       options['label'] = options['title'];
@@ -4403,7 +4409,7 @@ class StatusMeterGauge extends DvtGauge {
    */
   SetOptions(options) {
     // NOTE: This extra clone should be removed once we stop supporting the deprecated attrs
-    options = JsonUtils.clone(options);
+    options = JsonUtils.clone(options, null, this.Defaults.getNoCloneObject());
 
     if (options['title']) options['label'] = options['title'];
 

package/dist/js/libs/oj/debug_esm/ojgauge.js

@@ -1023,6 +1023,13 @@ oj.__registerWidget(
       return this.element;
     },
 
+    _GetComponentNoClonePaths: function () {
+      var noClonePaths = this._super();
+      // Don't clone converter instances because their class methods must be preserved.
+      noClonePaths.metricLabel = { converter: true };
+      return noClonePaths;
+    },
+
     _GetChildStyleClasses: function () {
       var styleClasses = this._super();
       styleClasses['oj-gauge-metric-label'] = { path: 'metricLabel/style', property: 'TEXT' };

package/dist/js/libs/oj/debug_esm/ojhtmlutils.js

@@ -18,6 +18,20 @@
  * the input to prevent unsafe content from being added to the page.</p>
  */
 const HtmlUtils = {};
+const _ESCAPED_TAGS = [
+  'table',
+  'caption',
+  'colgroup',
+  'col',
+  'thead',
+  'tfoot',
+  'th',
+  'tbody',
+  'tr',
+  'td',
+  'template',
+  'p'
+];
 
 /**
  * Utility that will parse an HTML string into an array of DOM Nodes.
@@ -28,20 +42,7 @@ const HtmlUtils = {};
  */
 HtmlUtils.stringToNodeArray = function (html) {
   // escape html for the predefined tags
-  var tags = [
-    'table',
-    'caption',
-    'colgroup',
-    'col',
-    'thead',
-    'tfoot',
-    'th',
-    'tbody',
-    'tr',
-    'td',
-    'template',
-    'p'
-  ];
+  var tags = _ESCAPED_TAGS;
   var i;
 
   for (i = 0; i < tags.length; i++) {
@@ -120,25 +121,21 @@ function _unescapeTag(parent) {
     const BIND_REPLACE = 'oj-bind-replace-';
     if (nodeName.substr(0, 16) === BIND_REPLACE) {
       var replName = nodeName.substr(16);
-      replNode = document.createElement(replName); // @HTMLUpdateOK
-      for (j = 0; j < child.attributes.length; j++) {
-        attr = child.attributes[j];
-        replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
+      if (_ESCAPED_TAGS.indexOf(replName) !== -1) {
+        replNode = document.createElement(replName); // @HTMLUpdateOK
+        for (j = 0; j < child.attributes.length; j++) {
+          attr = child.attributes[j];
+          replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
+        }
+        var childHolder = replNode.content ? replNode.content : replNode;
+        for (j = 0; child.childNodes.length > 0; ) {
+          childHolder.appendChild(child.childNodes[0]);
+        }
+        parent.replaceChild(replNode, child);
       }
-      var childHolder = replNode.content ? replNode.content : replNode;
-      for (j = 0; child.childNodes.length > 0; ) {
-        childHolder.appendChild(child.childNodes[0]);
-      }
-      parent.replaceChild(replNode, child);
     } else if (nodeName === 'script' || nodeName === 'style') {
-      replNode = document.createElement(nodeName); // @HTMLUpdateOK
-      for (j = 0; j < child.attributes.length; j++) {
-        attr = child.attributes[j];
-        replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
-      }
-      var origHTML = child.innerHTML; // @HTMLUpdateOK
-      replNode.innerHTML = origHTML.replace(new RegExp(BIND_REPLACE, 'g'), ''); // @HTMLUpdateOK
-      parent.replaceChild(replNode, child);
+      var origText = child.textContent || '';
+      child.textContent = origText.replace(new RegExp(BIND_REPLACE, 'g'), '');
     } else if (child.nodeType === 8) {
       // comment node
       var origValue = child.nodeValue;

package/dist/js/libs/oj/debug_esm/ojlabel.js

@@ -395,11 +395,14 @@ import { isTouchSupported, validateURL, PRESS_HOLD_THRESHOLD, recentTouchStart,
        * and holds the help icon on a mobile device. No formatted text is available for
        * help definition attribute.</li>
        * <li><code class="prettyprint">source</code> - this is the help source url.
-       * If present, a help icon will
-       * render next to the label. For security reasons
-       *  we only support urls with protocol http: or https:.
-       * If the url doesn't comply we ignore it and throw an error.
-       * Pass in an encoded URL since we do not encode the URL.
+       * If present, a help icon will render next to the label.
+       * <p><b>Note:</b> For security, JET validates the URL protocol before navigation
+       * and currently supports <code class="prettyprint">http:</code> and
+       * <code class="prettyprint">https:</code> protocols. If the url doesn't
+       * comply we ignore it and throw an error. JET does not validate whether
+       * the URL is trusted for the application. Applications are responsible
+       * for providing sanitized URLs and enforcing any required origin or host
+       * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
        * </ul>
        *
        * @expose
@@ -1391,6 +1394,7 @@ import { isTouchSupported, validateURL, PRESS_HOLD_THRESHOLD, recentTouchStart,
       helpIconAnchor = document.createElement('a');
       helpIconAnchor.setAttribute('tabindex', '0');
       helpIconAnchor.setAttribute('target', '_blank');
+      helpIconAnchor.setAttribute('rel', 'noopener noreferrer');
       helpIconAnchor.className =
         'oj-label-help-icon-anchor oj-label-help-icon oj-component-icon oj-clickable-icon-nocontext';
       if (source) {

package/dist/js/libs/oj/debug_esm/ojlistview.js

@@ -1988,7 +1988,7 @@ const _ojListView = _ListViewUtils.clazz(
                 // if event target is within listview, but not around items, e.g. the padding
                 var active = self.m_active && self.m_active.elem;
                 if (active == null && self.element.attr('tabIndex') === '0') {
-                  self.element.focus();
+                  self._initFocus(event, true);
                 } else if (active != null) {
                   self._makeFocusable(active);
                   self.HighlightActive();
@@ -5550,13 +5550,13 @@ const _ojListView = _ListViewUtils.clazz(
      * Initialize focus by finding the first focusable item and set focus on it
      * @private
      */
-    _initFocus: function (event) {
+    _initFocus: function (event, preventScroll) {
       var items = this._getItemsCache();
       for (var i = 0; i < items.length; i++) {
         var item = $(items[i]);
         // make sure item can receive focus
         if (!this.SkipFocus(item)) {
-          this.SetCurrentItem(item, event);
+          this.SetCurrentItem(item, event, false, preventScroll);
           break;
         }
       }
@@ -7346,10 +7346,11 @@ const _ojListView = _ListViewUtils.clazz(
      * @param {jQuery} item the item to set as active
      * @param {Event} event the event that triggers set active
      * @param {boolean=} skipFocus true if to skip focusing the item
+     * @param {boolean=} preventScroll true if prevent scroll when focus
      * @return {boolean} true if item becomes active, false for all other cases
      * @private
      */
-    _setActive: function (item, event, skipFocus) {
+    _setActive: function (item, event, skipFocus, preventScroll) {
       var active;
 
       // set key info
@@ -7408,7 +7409,7 @@ const _ojListView = _ListViewUtils.clazz(
               (event.originalEvent && event.originalEvent.type !== 'click') ||
               (this._isMultipleToggleSelection() && event.shiftKey)
             ) {
-              this._focusItem(item);
+              this._focusItem(item, preventScroll);
             }
 
             // reset tabindex of previous focus item, note this has to be done after focusing on a new item
@@ -7430,7 +7431,7 @@ const _ojListView = _ListViewUtils.clazz(
             this._makeFocusable(item);
             // make sure ul is not tabbable
             this.RemoveRootElementTabIndex();
-            this._focusItem(item);
+            this._focusItem(item, preventScroll);
           }
         }
       } else {
@@ -7452,12 +7453,12 @@ const _ojListView = _ListViewUtils.clazz(
      * Put browser focus on item (or children of item)
      * @private
      */
-    _focusItem: function (item) {
+    _focusItem: function (item, preventScroll) {
       var elem = this.getFocusItem(item).get(0);
       if (elem) {
         try {
           this.m_inShiftingFocus = true;
-          elem.focus();
+          elem.focus({ preventScroll });
         } finally {
           this.m_inShiftingFocus = false;
         }
@@ -7514,8 +7515,8 @@ const _ojListView = _ListViewUtils.clazz(
      * Sets the active item and bring focus to it.  Update the currentItem option.
      * @protected
      */
-    SetCurrentItem: function (item, event, skipFocus) {
-      var proceed = this.ActiveAndFocus(item, event, skipFocus);
+    SetCurrentItem: function (item, event, skipFocus, preventScroll) {
+      var proceed = this.ActiveAndFocus(item, event, skipFocus, preventScroll);
       if (proceed) {
         this._setCurrentItemOption(this.GetKey(item[0]), event, item.get(0));
       }
@@ -7525,15 +7526,17 @@ const _ojListView = _ListViewUtils.clazz(
      * Sets the active item and bring focus to it.
      * @protected
      */
-    ActiveAndFocus: function (item, event, skipFocus) {
+    ActiveAndFocus: function (item, event, skipFocus, preventScroll) {
       // make sure that it is visible
-      this._scrollToVisible(item[0]);
+      if (!preventScroll) {
+        this._scrollToVisible(item[0]);
+      }
 
       // unhighlight any previous active item
       this.UnhighlightActive();
 
       // update active and frontier
-      var proceed = this._setActive(item, event, skipFocus);
+      var proceed = this._setActive(item, event, skipFocus, preventScroll);
 
       // highlight active
       this.HighlightActive();

package/dist/js/libs/oj/debug_esm/ojlogger.js

@@ -26,11 +26,12 @@ import { error as error$1, info as info$1, warn as warn$1, log as log$1, getLogL
  *
  * <p>If the logging options are changed at a later point, the Logger will use the modified options for the subsequent log operations.
  *
- * <p>The logging level can be overridden via sessionStorage.setItem() call for the current browser session.
+ * <p>In debug builds, the logging level can be overridden via sessionStorage.setItem() call for the current browser session.
  * Use 'ojet.logLevel' as the key with one of the following values: 'none' (least verbose), 'error', 'warning', 'info', 'log' (most verbose).
  * Set the value in the browser console and refresh the browser in order for the value to take effect.
+ * Production builds ignore this key.
  * </p>
- * <h3> Session storage usage : </h3>
+ * <h3> Session storage usage in debug builds : </h3>
  * <pre class="prettyprint">
  * <code>
  * // override logging level for the current session

package/dist/js/libs/oj/debug_esm/ojmessage.js

@@ -13,7 +13,7 @@ import oj from 'ojs/ojcore-base';
 import $ from 'jquery';
 import { observable } from 'knockout';
 import { startAnimation } from 'ojs/ojanimation';
-import { isTouchSupported, getReadingDirection } from 'ojs/ojdomutils';
+import { isTouchSupported, getReadingDirection, validateURL } from 'ojs/ojdomutils';
 import { subtreeHidden } from 'ojs/ojcomponentcore';
 import { register } from 'ojs/ojcomposite';
 import Context from 'ojs/ojcontext';
@@ -24,6 +24,34 @@ import { getComponentTranslations, getTranslatedString } from 'ojs/ojtranslation
 
 const ojMessage = {};
 
+const ALLOWED_AUDIO_URL_PROTOCOLS = ['http:', 'https:', 'data:', 'blob:'];
+
+function encodeCssUrlControlCharacter(char) {
+  var hex = char.charCodeAt(0).toString(16).toUpperCase();
+  return '%' + (hex.length < 2 ? '0' + hex : hex);
+}
+
+function escapeCssUrlString(url) {
+  var escapedUrl = '';
+  var urlString = String(url);
+  for (var i = 0; i < urlString.length; i++) {
+    var char = urlString.charAt(i);
+    var charCode = char.charCodeAt(0);
+    if (char === '"' || char === '\\') {
+      escapedUrl += '\\' + char;
+    } else if (charCode <= 0x1f || charCode === 0x7f) {
+      escapedUrl += encodeCssUrlControlCharacter(char);
+    } else {
+      escapedUrl += char;
+    }
+  }
+  return escapedUrl;
+}
+
+function getCssUrl(url) {
+  return 'url("' + escapeCssUrlString(url) + '")';
+}
+
 /**
  * @ojcomponent oj.ojMessage
  * @since 5.0.0
@@ -61,10 +89,13 @@ const ojMessage = {};
  *
  * <p>The {@link oj.ojMessage#message.sound} property is an accessibility feature for playing a
  * sound when a message is opened. This property defaults to "none", and can be enabled by setting
- * it to "defaults" or by providing URL to an audio file of a format that the browser supports. An
- * accessible application must provide a way for users to enable sound on a settings or preferences
- * page. Some browsers will have auto-play disabled by default, enabling it may require adjusting
- * the browser settings.</p>
+ * it to "defaults" or by providing a URL to an audio file of a format that the browser supports.
+ * Custom sound URLs are validated before playback. Relative URLs and URLs that resolve to
+ * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="touch-section">
  *   Touch End User Information
@@ -416,9 +447,12 @@ const ojMessage = {};
  * required for low vision users who view a zoomed section of the UI. Because messages may be shown
  * outside of the zoomed section, such users require sound to be played to notify of new messages.</p>
  *
- * <p>This attribute can take a URL of the audio file for the custom sound to be played. The
- * supported formats are mp3, wav and ogg. Browser support should also be considered while choosing
- * the format of the audio file. Literal string values
+ * <p>This attribute can take a URL of the audio file for the custom sound to be played. Custom
+ * sound URLs are validated before playback. Relative URLs and URLs that resolve to
+ * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. The supported formats are mp3, wav and ogg. Browser support should also be considered
+ * while choosing the format of the audio file. Literal string values
  * <code class="prettyprint">"defaults"</code> and <code class="prettyprint">"none"</code> can also
  * be used for this attribute. If the value is set to "none", then the sound will be disabled. If
  * the value is set to "defaults", then a default sound is played.<p>
@@ -1252,7 +1286,7 @@ MessageViewModel.prototype._computeIconStyle = function () {
     return undefined;
   }
 
-  return ["url('", message.icon, "') no-repeat"].join('');
+  return getCssUrl(message.icon) + ' no-repeat';
 };
 
 MessageViewModel.prototype._computeIconClass = function () {
@@ -1485,6 +1519,13 @@ MessageViewModel.prototype._handleKeydown = function (event) {
 MessageViewModel.prototype._playSound = function (sound) {
   // Custom URL was specified for the sound, using <audio> element is simple and best for this case.
   if (sound !== 'defaults') {
+    try {
+      validateURL(sound, ALLOWED_AUDIO_URL_PROTOCOLS);
+    } catch (error) {
+      info(`JET oj-message: Invalid URL in message.sound='${sound}'. Error: ${error}`);
+      return;
+    }
+
     var audio = document.createElement('AUDIO');
     audio.src = sound;
 

package/dist/js/libs/oj/debug_esm/ojmessagebanner.js

@@ -1366,9 +1366,12 @@ var __decorate = (null && null.__decorate) || function (decorators, target, key,
  * <p>The <code class="prettyprint">MessageBannerItem["sound"]</code> property is an accessibility
  * feature for playing a sound when a message is opened. This property defaults to "none", and can
  * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
- * browser supports. An accessible application must provide a way for users to enable sound on a
- * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
- * it may require adjusting the browser settings.</p>
+ * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+ * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="keyboard-section">
  *   Keyboard End User Information

package/dist/js/libs/oj/debug_esm/ojmetadatautils.js

@@ -158,7 +158,15 @@ MetadataUtils.getComplexPropertyMetadata = function (propPath, metadata) {
   if (subProp) {
     const namePath = propPath.split('.');
     for (let i = 0; i < namePath.length; i++) {
-      subProp = subProp[namePath[i]];
+      const propName = namePath[i];
+      if (
+        oj.CollectionUtils._isBlockedKey(propName) ||
+        !Object.prototype.hasOwnProperty.call(subProp, propName)
+      ) {
+        subProp = undefined;
+      } else {
+        subProp = subProp[propName];
+      }
       if (i === 0) {
         prop = subProp;
       }