@oracle/oraclejet 19.0.8 → 19.0.9

package/dist/css/stable/oj-stable.css

@@ -342,7 +342,7 @@
 }
 
 .oj-theme-json {
-  font-family: '{"name":"stable","targetPlatform":"all","behavior":"redwood","jetReleaseVersion":"v19.0.8"}' !important;
+  font-family: '{"name":"stable","targetPlatform":"all","behavior":"redwood","jetReleaseVersion":"v19.0.9"}' !important;
 }
 
 .oj-helper-hidden-accessible {

package/dist/js/libs/oj/debug/ojL10n.js

@@ -77,7 +77,19 @@
   }
 
   function _isObject(val) {
-    return typeof val === 'object';
+    return val !== null && typeof val === 'object';
+  }
+
+  function _isPlainObject(val) {
+    return Object.prototype.toString.call(val) === '[object Object]';
+  }
+
+  /**
+   * Returns true if the key provided should be blocked from recursive bundle merges.
+   * Specifically keys that could cause prototype pollution issues are included.
+   */
+  function _isBlockedKey(key) {
+    return key === '__proto__' || key === 'constructor' || key === 'prototype';
   }
 
   /**
@@ -159,11 +171,16 @@
     var props = Object.keys(source);
     for (var i = 0; i < props.length; i++) {
       var prop = props[i];
-      if (target[prop] == null) {
-        // eslint-disable-next-line no-param-reassign
-        target[prop] = source[prop];
-      } else if (_isObject(source[prop]) && _isObject(target[prop])) {
-        _mixin(target[prop], source[prop]);
+      if (!_isBlockedKey(prop)) {
+        if (target[prop] == null) {
+          // eslint-disable-next-line no-param-reassign
+          target[prop] = _isPlainObject(source[prop]) ? {} : source[prop];
+          if (target[prop] !== source[prop]) {
+            _mixin(target[prop], source[prop]);
+          }
+        } else if (_isObject(source[prop]) && _isObject(target[prop])) {
+          _mixin(target[prop], source[prop]);
+        }
       }
     }
   }

package/dist/js/libs/oj/debug/ojavatar.js

@@ -13,6 +13,28 @@ define(['exports', 'preact/jsx-runtime', 'ojs/ojvcomponent', 'ojs/ojthemeutils',
         else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
         return c > 3 && r && Object.defineProperty(target, key, r), r;
     };
+    const encodeCssUrlControlCharacter = (char) => {
+        const hex = char.charCodeAt(0).toString(16).toUpperCase();
+        return `%${hex.length < 2 ? '0' + hex : hex}`;
+    };
+    const escapeCssUrlString = (url) => {
+        let escapedUrl = '';
+        for (let i = 0; i < url.length; i++) {
+            const char = url.charAt(i);
+            const charCode = char.charCodeAt(0);
+            if (char === '"' || char === '\\') {
+                escapedUrl += `\\${char}`;
+            }
+            else if (charCode <= 0x1f || charCode === 0x7f) {
+                escapedUrl += encodeCssUrlControlCharacter(char);
+            }
+            else {
+                escapedUrl += char;
+            }
+        }
+        return escapedUrl;
+    };
+    const getCssUrl = (url) => `url("${escapeCssUrlString(url)}")`;
     /**
      * @classdesc
      * <h3 id="avatarOverview-section">
@@ -298,7 +320,7 @@ define(['exports', 'preact/jsx-runtime', 'ojs/ojvcomponent', 'ojs/ojthemeutils',
         }
         _getInnerContent(props) {
             if (props.src && !props.iconClass) {
-                return (jsxRuntime.jsx("div", { class: "oj-avatar-background-image", style: { backgroundImage: `url("${props.src}")` } }));
+                return (jsxRuntime.jsx("div", { class: "oj-avatar-background-image", style: { backgroundImage: getCssUrl(props.src) } }));
             }
             else {
                 return jsxRuntime.jsx("div", { class: "oj-avatar-background oj-avatar-background-image" });

package/dist/js/libs/oj/debug/ojcolorpalette.js

@@ -622,9 +622,13 @@ var __oj_color_palette_metadata =
      * it shows all the time.
      * </p>
      * <p>
-     * For security reasons we only support urls with protocol 'http:' or 'https:'.
-     * If the url doesn't comply we ignore it and throw an error.
-     * Pass in an encoded URL since we do not encode the URL.</p>
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. If the url doesn't
+     * comply we ignore it and throw an error. JET does not validate whether
+     * the URL is trusted for the application. Applications are responsible
+     * for providing sanitized URLs and enforcing any required origin or host
+     * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
      *
      * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
      *
@@ -670,6 +674,8 @@ var __oj_color_palette_metadata =
      * <p>
      * To include formatted text in the help.instruction, format the string using html tags.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * For example the
      * help.instruction might look like:
      * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -800,6 +806,8 @@ var __oj_color_palette_metadata =
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the message detail, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -2001,7 +2009,7 @@ var __oj_color_palette_metadata =
           );
 
         if (label) {
-          entry.append($("<span class='oj-colorpalette-swatch-text'>" + label + '</span>')[0]); // @HTMLUpdateOK
+          entry.append($("<span class='oj-colorpalette-swatch-text'></span>").text(label)[0]); // @HTMLUpdateOK
         }
         return entry[0];
       },
@@ -2019,29 +2027,22 @@ var __oj_color_palette_metadata =
        * @private
        */
       _renderNone: function (showLabels, label, tooltip, swatchClass, selectedClass) {
-        var raw;
-
-        raw =
-          "<div class='oj-colorpalette-swatch-entry " +
-          swatchClass +
-          (showLabels ? ' oj-colorpalette-swatch-showlabel' : '') +
-          "'>" +
-          "<div class='oj-colorpalette-swatch-container'>" +
-          "<div class='oj-colorpalette-swatch " +
-          selectedClass +
-          "'" +
-          (!label ? " title='" + tooltip + "'" : '') +
-          '>' +
-          "<div class='oj-colorpalette-swatch-none-icon'>" +
-          '</div>' +
-          '</div>' +
-          '</div>';
+        // prettier-ignore
+        var entry = $("<div class='oj-colorpalette-swatch-entry'></div>")
+          .addClass(swatchClass + (showLabels ? ' oj-colorpalette-swatch-showlabel' : ''))
+          .append( // @HTMLUpdateOK
+            $("<div class='oj-colorpalette-swatch-container'></div>").append( // @HTMLUpdateOK
+              $("<div class='oj-colorpalette-swatch'></div>")
+                .attr('title', !label ? tooltip : null)
+                .addClass(selectedClass)
+                .append($("<div class='oj-colorpalette-swatch-none-icon'></div>")) // @HTMLUpdateOK
+            )
+          );
 
         if (label) {
-          raw += "<span class='oj-colorpalette-swatch-text'>" + label + '</span>';
+          entry.append($("<span class='oj-colorpalette-swatch-text'></span>").text(label)[0]); // @HTMLUpdateOK
         }
-        raw += '</div>';
-        return $(raw)[0];
+        return entry[0];
       },
 
       /**

package/dist/js/libs/oj/debug/ojcomponentcore.js

@@ -2490,6 +2490,10 @@ define(['exports', 'jqueryui-amd/widget', 'jqueryui-amd/unique-id', 'jqueryui-am
       };
       // eslint-disable-next-line no-param-reassign
       proto.getProperty = function (prop) {
+        if (oj.BaseCustomElementBridge.__IsBlockedPropertyPath(prop)) {
+          return undefined;
+        }
+
         var bridge = ojcustomelementUtils.CustomElementUtils.getElementBridge(this);
         var meta = MetadataUtils.getPropertyMetadata(prop, ojcustomelementRegistry.getElementProperties(this));
 
@@ -6445,38 +6449,40 @@ define(['exports', 'jqueryui-amd/widget', 'jqueryui-amd/unique-id', 'jqueryui-am
       var keys = Object.keys(source);
       for (var i = 0; i < keys.length; i++) {
         var key = keys[i];
-        var path;
-        if (ignoreSubkeys == null) {
-          path = null;
-        } else if (basePath == null) {
-          path = key;
-        } else {
-          path = basePath + '.' + key;
-        }
-        // Ignore all sources when the current path is registered in ignoreSubkeys
-        if (ignoreSubkeys == null || !ignoreSubkeys[path]) {
-          var value = source[key];
-          if (value !== undefined) {
-            if ($.isPlainObject(value)) {
-              const plainObjectTarget = $.isPlainObject(target[key]);
-              // If merging an object onto a non-object and avoidClones is set, just replace target with value
-              if (!plainObjectTarget && avoidClones) {
-                // eslint-disable-next-line no-param-reassign
-                target[key] = value;
+        if (!oj.CollectionUtils._isBlockedKey(key)) {
+          var path;
+          if (ignoreSubkeys == null) {
+            path = null;
+          } else if (basePath == null) {
+            path = key;
+          } else {
+            path = basePath + '.' + key;
+          }
+          // Ignore all sources when the current path is registered in ignoreSubkeys
+          if (ignoreSubkeys == null || !ignoreSubkeys[path]) {
+            var value = source[key];
+            if (value !== undefined) {
+              if ($.isPlainObject(value)) {
+                const plainObjectTarget = $.isPlainObject(target[key]);
+                // If merging an object onto a non-object and avoidClones is set, just replace target with value
+                if (!plainObjectTarget && avoidClones) {
+                  // eslint-disable-next-line no-param-reassign
+                  target[key] = value;
+                } else {
+                  var params = plainObjectTarget ? [target[key], value] : [value];
+                  // eslint-disable-next-line no-param-reassign
+                  target[key] = _mergeObjectsWithExclusions(
+                    {},
+                    params,
+                    ignoreSubkeys,
+                    path,
+                    avoidClones
+                  );
+                }
               } else {
-                var params = plainObjectTarget ? [target[key], value] : [value];
                 // eslint-disable-next-line no-param-reassign
-                target[key] = _mergeObjectsWithExclusions(
-                  {},
-                  params,
-                  ignoreSubkeys,
-                  path,
-                  avoidClones
-                );
+                target[key] = value;
               }
-            } else {
-              // eslint-disable-next-line no-param-reassign
-              target[key] = value;
             }
           }
         }

package/dist/js/libs/oj/debug/ojcontext.js

@@ -223,15 +223,16 @@ define(['ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojcustomelement-registry'], func
    * @ojtsexportastype Context
    * @since 2.1.0
    * @classdesc Framework service for querying the busy state of components on the page.
-   * <h3> Session storage usage : </h3>
+   * <h3> Session storage usage in debug builds : </h3>
    * <pre class="prettyprint">
    * <code>
    * // enable BusyContext tracing of BusyState creation
    * sessionStorage.setItem('ojet.busyContextTracing', 'on');
    * </code></pre>
    *
-   * <p>Setting this key in sessionStorage will cause BusyStates to be created with an
-   * additional `stack` property containing the call stack at the time of creation.
+   * <p>In debug builds, setting this key in sessionStorage will cause BusyStates to be
+   * created with an additional `stack` property containing the call stack at the time of creation.
+   * Production builds ignore this key.
    * </p>
    */
   const BusyContext = function (hostNode, context) {
@@ -584,7 +585,7 @@ define(['ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojcustomelement-registry'], func
 
     const storageKey = 'ojet.busyContextTracing';
     let stack;
-    if (window?.sessionStorage?.getItem(storageKey) === 'on') {
+    if (true && window?.sessionStorage?.getItem(storageKey) === 'on') {
       try {
         throw new BusyStateTrace('');
       } catch (ex) {

package/dist/js/libs/oj/debug/ojcore-base.js

@@ -37,12 +37,12 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
      * @global
      * @member {string} version JET version numberr
      */
-    version: '19.0.8',
+    version: '19.0.9',
     /**
      * @global
      * @member {string} revision JET source code revision number
      */
-    revision: '2026-05-27_14-16-45',
+    revision: '2026-07-14_10-25-20',
 
     // This function is only meant to be used outside the library, so quoting the name
     // to avoid renaming is appropriate
@@ -404,6 +404,17 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
    * @private
    */
   var _DEBUG = 'DEBUG';
+  var _debug = false;
+
+  Object.defineProperty(Assert, _DEBUG, {
+    get: function () {
+      return _debug;
+    },
+    set: function (value) {
+      _debug = true && value === true;
+    },
+    enumerable: true
+  });
 
   /**
    * @private
@@ -411,12 +422,14 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
   const _NO_PROTO = "' doesn't match prototype ";
 
   /**
-   * Forces DEBUG to be set to true
+   * Forces DEBUG to be set to true in debug builds
    * @export
    * @memberof oj.Assert
    */
   Assert.forceDebug = function () {
-    Assert[_DEBUG] = true;
+    if (true) {
+      Assert[_DEBUG] = true;
+    }
   };
 
   /**

package/dist/js/libs/oj/debug/ojcorerouter.js

@@ -178,10 +178,19 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * activity that must be completed before the transition is finalized.
    * <pre class="prettyprint">
    * <code>
+   * var routeModuleMap = {
+   *   dashboard: 'dashboard',
+   *   incidents: 'incidents'
+   * };
+   *
    * router.currentState.subscribe(function (args) {
    *   var state = args.state;
-   *   var name = state.path;
    *   var complete = args.complete;
+   *   var name = routeModuleMap[state.path];
+   *   if (!name) {
+   *     complete(Promise.reject(new Error('Unknown module route')));
+   *     return;
+   *   }
    *   // Load the module and return Promise to CoreRouter
    *   complete(
    *     Promise.all([
@@ -250,6 +259,10 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * <p>
    * <h5>With RegExp as path.</h5>
    * Note that all paths matching the regular expression will be using this configuration entry.
+   * String routes with known safe names can be used to load matching modules. If RegExp,
+   * catch-all, URL-derived, or user-controlled path values are used to load modules or
+   * other resources, map the matched value to an explicit allowed resource identifier
+   * instead of using the raw matched value directly.
    * <pre class="prettyprint">
    * <code>
    * var root = new CoreRouter([
@@ -1046,7 +1059,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
 
     this.beforeStateChange = null;
     this.currentState = null;
-    this._parentRouter.childRouter = null;
+    if (this._parentRouter) {
+      this._parentRouter.childRouter = null;
+    }
 
     if (this === rootRouter) {
       window.removeEventListener('popstate', this._popstateHandler, false);
@@ -1081,7 +1096,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * can be referenced in the state.
    * @typedef {object} CoreRouter.DetailedRouteConfig
    * @property {string|RegExp} path The path of the route. This may be an exact-
-   * match string, or a regular expression.
+   * match string, or a regular expression. If application code uses a RegExp-matched
+   * path to load a module or other resource, use the route detail to provide an
+   * explicit allowed resource identifier instead of loading the raw matched path value.
    * @property {object=} detail An optional detail object which is passed to
    * the route when it is navigated to.
    * @ojsignature [{target: "Type", value: "D", for: "detail"},
@@ -1095,7 +1112,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * route.
    * @typedef {object} CoreRouter.RedirectedRouteConfig
    * @property {string|RegExp} path The path of the route. This may be an exact-
-   * match string, or a regular expression.
+   * match string, or a regular expression. If application code uses a RegExp-matched
+   * path to load a module or other resource, map it to an explicit allowed resource
+   * identifier instead of loading the raw matched path value.
    * @property {string=} redirect An optional name of a route to which paths matching
    * this route will redirect. The redirected route's path must be of type string.
    */

package/dist/js/libs/oj/debug/ojcspexpressionevaluator-internal.js

@@ -293,20 +293,33 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     }
 
     function _evaluateMember(node, contexts) {
+      var memberAccess = _getMemberAccess(node, contexts);
+      if (memberAccess.length === 0) {
+        return memberAccess;
+      }
+      var value = _getMemberValue(memberAccess);
+      return [memberAccess[0], value];
+    }
+
+    function _getMemberAccess(node, contexts) {
       var object = _evaluate(node.object, contexts);
       if (!object && node.optional) {
         // handle optional chaining operator: test?.prop
         return [];
-      } else if (node.computed) {
-        return [object, object[_evaluate(node.property, contexts)]];
       }
-      return [object, object[node.property.name]];
+      var key = node.computed ? _evaluate(node.property, contexts) : node.property.name;
+      return _getMemberAccessForKey(object, key);
     }
 
     function _evaluateObjectExpression(node, contexts) {
       return node.properties.reduce(function (acc, curr) {
         const key = ojexpparser.getKeyValue(curr.key);
-        acc[key] = _evaluateAndUnwrap(curr.value, contexts);
+        Object.defineProperty(acc, key, {
+          configurable: true,
+          enumerable: true,
+          value: _evaluateAndUnwrap(curr.value, contexts),
+          writable: true
+        });
         return acc;
       }, {});
     }
@@ -315,7 +328,7 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     function _getValue(contexts, name) {
       var target = _getContextForIdentifier(contexts, name);
       if (target) {
-        return target[name];
+        return _getMemberValue(_getMemberAccessForKey(target, name));
       }
       throw new Error('Variable ' + name + ' is undefined');
     }
@@ -324,7 +337,7 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     function _getValueWithContext(contexts, name) {
       var target = _getContextForIdentifier(contexts, name);
       if (target) {
-        return [target, target[name]];
+        return [target, _getMemberValue(_getMemberAccessForKey(target, name))];
       }
       throw new Error('Variable ' + name + ' is undefined');
     }
@@ -337,11 +350,18 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
           if (!target) {
             _throwError('Cannot assign value to undefined variable ' + name);
           }
-          target[name] = val;
+          var identifierAccess = _getMemberAccessForKey(target, name);
+          if (_isRestrictedMemberKey(identifierAccess[1])) {
+            _throwError('Assignment to member "' + identifierAccess[1] + '" is not allowed');
+          }
+          identifierAccess[0][identifierAccess[1]] = val;
           break;
         case ojexpparser.MEMBER_EXP:
-          var key = node.computed ? _evaluateAndUnwrap(node.property, contexts) : node.property.name;
-          _evaluateMember(node, contexts)[0][key] = val;
+          var memberAccess = _getMemberAccess(node, contexts);
+          if (_isRestrictedMemberKey(memberAccess[1])) {
+            _throwError('Assignment to member "' + memberAccess[1] + '" is not allowed');
+          }
+          memberAccess[0][memberAccess[1]] = val;
           break;
         default:
           _throwError('Expression of type: ' + node.type + ' not supported for assignment');
@@ -400,6 +420,94 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
       return result.join('');
     }
 
+    // Block prototype-chain escape hatches. Safe data objects can still expose these
+    // names as own, non-accessor properties, but never as inherited capabilities.
+    function _getMemberAccessForKey(object, key) {
+      var propertyKey = typeof key === 'symbol' ? key : String(key);
+      return [object, propertyKey, _validateMemberKey(object, propertyKey)];
+    }
+
+    function _validateMemberKey(object, key) {
+      if (object === Object && _isUnsafeObjectStaticMember(key)) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (_isInheritedIntrinsicPrototypeHelper(object, key)) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      }
+      if (!_isRestrictedMemberKey(key)) {
+        return null;
+      }
+      var descriptor = Object.getOwnPropertyDescriptor(Object(object), key);
+      if (!descriptor || !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (typeof descriptor.value === 'function') {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (key === 'prototype' && typeof object === 'function') {
+        _throwError('Access to member "' + key + '" is not allowed');
+      }
+      return descriptor;
+    }
+
+    function _getMemberValue(memberAccess) {
+      // For restricted keys, use the validated data-descriptor value rather than
+      // invoking a Proxy get trap that could return a different capability.
+      return memberAccess[2] ? memberAccess[2].value : memberAccess[0][memberAccess[1]];
+    }
+
+    function _isRestrictedMemberKey(propertyKey) {
+      return (
+        propertyKey === 'constructor' || propertyKey === '__proto__' || propertyKey === 'prototype'
+      );
+    }
+
+    // These legacy accessors can recover or modify an intrinsic prototype without
+    // evaluating a restricted member name. Allow applications to use an own data
+    // property with one of these names, but reject the inherited intrinsic helpers.
+    function _isInheritedIntrinsicPrototypeHelper(object, propertyKey) {
+      if (
+        propertyKey !== '__lookupGetter__' &&
+        propertyKey !== '__lookupSetter__' &&
+        propertyKey !== '__defineGetter__' &&
+        propertyKey !== '__defineSetter__'
+      ) {
+        return false;
+      }
+
+      var target = Object(object);
+      var visitedTargets = new Set();
+      while (target) {
+        // An extensible Proxy can report itself, or an earlier object, as its
+        // prototype. Treat cycles as unsafe rather than looping indefinitely.
+        if (visitedTargets.has(target)) {
+          return true;
+        }
+        visitedTargets.add(target);
+        var descriptor = Object.getOwnPropertyDescriptor(target, propertyKey);
+        if (descriptor) {
+          return (
+            (target === Object.prototype || target === Function.prototype) &&
+            typeof descriptor.value === 'function'
+          );
+        }
+        target = Object.getPrototypeOf(target);
+      }
+      return false;
+    }
+
+    // The evaluator exposes Object by default. These reflection methods can otherwise
+    // retrieve or mutate intrinsic prototypes and recover Function through descriptors.
+    function _isUnsafeObjectStaticMember(propertyKey) {
+      return (
+        propertyKey === 'assign' ||
+        propertyKey === 'create' ||
+        propertyKey === 'defineProperty' ||
+        propertyKey === 'defineProperties' ||
+        propertyKey === 'getOwnPropertyDescriptor' ||
+        propertyKey === 'getOwnPropertyDescriptors' ||
+        propertyKey === 'getPrototypeOf' ||
+        propertyKey === 'setPrototypeOf'
+      );
+    }
+
     function _getContextForIdentifier(contexts, name) {
       for (var i = 0; i < contexts.length; i++) {
         var context = contexts[i];

package/dist/js/libs/oj/debug/ojcspexpressionevaluator.js

@@ -23,10 +23,12 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
   /**
    * @class oj.CspExpressionEvaluator
    * @since 7.1.0
-   * @ojshortdesc Object representing CSP-compliant evaluator.
+   * @ojshortdesc Object representing a Content Security Policy (CSP)-compliant evaluator.
    * @ojtsmodule
    *
-   * @classdesc A class for creating CSP-compliant evaluators of JavaScript expressions
+   * @classdesc A class for creating Content Security Policy (CSP)-compliant evaluators of JavaScript expressions.
+   * Content Security Policy is a browser security mechanism that can disallow dynamically compiled code, including
+   * code generated with JavaScript Function constructors.
    * <p> The default JET expression evaluator cannot be used when Content Security Policy
    * prohibits unsafe evaluations. In order to replace the default evaluator with the JET CSP-compliant evaluator,
    * create and pass an instance of CspExpressionEvaluator class to the
@@ -34,11 +36,17 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
    * This method must be called before applying knockout bindings in the application for the first time.
    * </p>
    *
-   * <p>Any extra context required for evaluating expressions can be passed to the object constructor using <code>globalScope</code> property.</p>
+   * <p>Any extra context required for evaluating expressions can be passed to the object constructor using the <code>globalScope</code> property.
+   * Expression text must be trusted application code. This evaluator is CSP-compliant because it does not use dynamic code compilation; it is
+   * not a security sandbox. Restricting <code>globalScope</code> does not make untrusted expression text safe because expressions can access
+   * capabilities from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs. This
+   * evaluator restricts known prototype-chain access routes in its default capabilities, but applications remain responsible for the
+   * capabilities they expose.</p>
    *
    * <pre class="prettyprint">
    * <code>
-   * Config.setExpressionEvaluator(new CspExpressionEvaluator());
+   * const extraScope = { Date: Date };
+   * Config.setExpressionEvaluator(new CspExpressionEvaluator({ globalScope: extraScope }));
    * </code>
    * </pre>
    *
@@ -77,9 +85,16 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
    * <h2 id="invalidExpressions">Expression limitations:
    *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#invalidExpressions"></a>
    * </h2>
-   * <p> The following code is not supported in expressions:
+   * <p> The following syntax and behaviors are unsupported or restricted in expressions:
    * <ul>
-   *  <li>Assignment operators of any types such as <code>'='</code> or <code>'+='</code> or <code>'|='</code></li>
+   *  <li>Expression text must be trusted application code. This evaluator avoids dynamic code compilation for CSP compliance, but it is not a security sandbox. Expressions can invoke functions and access non-restricted values from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs, as well as <code>globalScope</code>.</li>
+   *  <li>To prevent prototype-chain access, access to properties named <code>'constructor'</code>, <code>'__proto__'</code>, and <code>'prototype'</code> is read-only and supported only as own, non-accessor, non-function data properties, including when accessed with bracket notation or as an identifier. A <code>'prototype'</code> property cannot be accessed on a function. For these names, a Proxy's data descriptor value is used instead of its <code>get</code> trap result.</li>
+   *  <li>Inherited <code>'__lookupGetter__'</code>, <code>'__lookupSetter__'</code>, <code>'__defineGetter__'</code>, and <code>'__defineSetter__'</code> prototype helpers are not supported. Own data properties with these names are supported.</li>
+   *  <li>An object-literal <code>'__proto__'</code> property is created as an own data property and does not change the object's prototype.</li>
+   *  <li>The default <code>Object</code> global does not support <code>assign</code> or the reflection methods <code>create</code>, <code>defineProperty</code>, <code>defineProperties</code>, <code>getOwnPropertyDescriptor</code>, <code>getOwnPropertyDescriptors</code>, <code>getPrototypeOf</code>, or <code>setPrototypeOf</code>.</li>
+   *  <li>Assignment operators of any type, such as <code>'='</code>, <code>'+='</code>, or <code>'|='</code>, are generally unsupported.
+   *    JET and Knockout may use internal assignment expressions to implement two-way binding writeback; applications should not rely on
+   *    assignment being accepted in expression text.</li>
    *  <li>Blocks of code such as <code>'if (...){}'</code></li>
    *  <li>Comma operator (,) such as <code>'(expr1, expr2)'</code></li>
    *  <li>in operator such as <code>'prop in testObject'</code></li>
@@ -94,6 +109,7 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
    * @param {Object} options
    * @param {any=} options.globalScope optional additional scope required for evaluating expressions.
    * The additional scope will be used to resolve the variables if they are not defined in the $data or $context.
+   * It is not a security boundary for untrusted expression text.
    * <pre class="prettyprint"><code>Config.setExpressionEvaluator(new CspExpressionEvaluator({globalScope:extraScope}));</code></pre>
    * @constructor
    * @final