@oracle/oraclejet 19.0.8 → 19.0.9

package/dist/js/libs/oj/debug/ojlistview.js

@@ -1994,7 +1994,7 @@ var __oj_list_view_metadata =
                   // if event target is within listview, but not around items, e.g. the padding
                   var active = self.m_active && self.m_active.elem;
                   if (active == null && self.element.attr('tabIndex') === '0') {
-                    self.element.focus();
+                    self._initFocus(event, true);
                   } else if (active != null) {
                     self._makeFocusable(active);
                     self.HighlightActive();
@@ -5556,13 +5556,13 @@ var __oj_list_view_metadata =
        * Initialize focus by finding the first focusable item and set focus on it
        * @private
        */
-      _initFocus: function (event) {
+      _initFocus: function (event, preventScroll) {
         var items = this._getItemsCache();
         for (var i = 0; i < items.length; i++) {
           var item = $(items[i]);
           // make sure item can receive focus
           if (!this.SkipFocus(item)) {
-            this.SetCurrentItem(item, event);
+            this.SetCurrentItem(item, event, false, preventScroll);
             break;
           }
         }
@@ -7352,10 +7352,11 @@ var __oj_list_view_metadata =
        * @param {jQuery} item the item to set as active
        * @param {Event} event the event that triggers set active
        * @param {boolean=} skipFocus true if to skip focusing the item
+       * @param {boolean=} preventScroll true if prevent scroll when focus
        * @return {boolean} true if item becomes active, false for all other cases
        * @private
        */
-      _setActive: function (item, event, skipFocus) {
+      _setActive: function (item, event, skipFocus, preventScroll) {
         var active;
 
         // set key info
@@ -7414,7 +7415,7 @@ var __oj_list_view_metadata =
                 (event.originalEvent && event.originalEvent.type !== 'click') ||
                 (this._isMultipleToggleSelection() && event.shiftKey)
               ) {
-                this._focusItem(item);
+                this._focusItem(item, preventScroll);
               }
 
               // reset tabindex of previous focus item, note this has to be done after focusing on a new item
@@ -7436,7 +7437,7 @@ var __oj_list_view_metadata =
               this._makeFocusable(item);
               // make sure ul is not tabbable
               this.RemoveRootElementTabIndex();
-              this._focusItem(item);
+              this._focusItem(item, preventScroll);
             }
           }
         } else {
@@ -7458,12 +7459,12 @@ var __oj_list_view_metadata =
        * Put browser focus on item (or children of item)
        * @private
        */
-      _focusItem: function (item) {
+      _focusItem: function (item, preventScroll) {
         var elem = this.getFocusItem(item).get(0);
         if (elem) {
           try {
             this.m_inShiftingFocus = true;
-            elem.focus();
+            elem.focus({ preventScroll });
           } finally {
             this.m_inShiftingFocus = false;
           }
@@ -7520,8 +7521,8 @@ var __oj_list_view_metadata =
        * Sets the active item and bring focus to it.  Update the currentItem option.
        * @protected
        */
-      SetCurrentItem: function (item, event, skipFocus) {
-        var proceed = this.ActiveAndFocus(item, event, skipFocus);
+      SetCurrentItem: function (item, event, skipFocus, preventScroll) {
+        var proceed = this.ActiveAndFocus(item, event, skipFocus, preventScroll);
         if (proceed) {
           this._setCurrentItemOption(this.GetKey(item[0]), event, item.get(0));
         }
@@ -7531,15 +7532,17 @@ var __oj_list_view_metadata =
        * Sets the active item and bring focus to it.
        * @protected
        */
-      ActiveAndFocus: function (item, event, skipFocus) {
+      ActiveAndFocus: function (item, event, skipFocus, preventScroll) {
         // make sure that it is visible
-        this._scrollToVisible(item[0]);
+        if (!preventScroll) {
+          this._scrollToVisible(item[0]);
+        }
 
         // unhighlight any previous active item
         this.UnhighlightActive();
 
         // update active and frontier
-        var proceed = this._setActive(item, event, skipFocus);
+        var proceed = this._setActive(item, event, skipFocus, preventScroll);
 
         // highlight active
         this.HighlightActive();

package/dist/js/libs/oj/debug/ojlogger.js

@@ -25,11 +25,12 @@ define(['exports', '@oracle/oraclejet-preact/utils/UNSAFE_logger'], function (ex
    *
    * <p>If the logging options are changed at a later point, the Logger will use the modified options for the subsequent log operations.
    *
-   * <p>The logging level can be overridden via sessionStorage.setItem() call for the current browser session.
+   * <p>In debug builds, the logging level can be overridden via sessionStorage.setItem() call for the current browser session.
    * Use 'ojet.logLevel' as the key with one of the following values: 'none' (least verbose), 'error', 'warning', 'info', 'log' (most verbose).
    * Set the value in the browser console and refresh the browser in order for the value to take effect.
+   * Production builds ignore this key.
    * </p>
-   * <h3> Session storage usage : </h3>
+   * <h3> Session storage usage in debug builds : </h3>
    * <pre class="prettyprint">
    * <code>
    * // override logging level for the current session

package/dist/js/libs/oj/debug/ojmessage.js

@@ -32,6 +32,34 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
 
   const ojMessage = {};
 
+  const ALLOWED_AUDIO_URL_PROTOCOLS = ['http:', 'https:', 'data:', 'blob:'];
+
+  function encodeCssUrlControlCharacter(char) {
+    var hex = char.charCodeAt(0).toString(16).toUpperCase();
+    return '%' + (hex.length < 2 ? '0' + hex : hex);
+  }
+
+  function escapeCssUrlString(url) {
+    var escapedUrl = '';
+    var urlString = String(url);
+    for (var i = 0; i < urlString.length; i++) {
+      var char = urlString.charAt(i);
+      var charCode = char.charCodeAt(0);
+      if (char === '"' || char === '\\') {
+        escapedUrl += '\\' + char;
+      } else if (charCode <= 0x1f || charCode === 0x7f) {
+        escapedUrl += encodeCssUrlControlCharacter(char);
+      } else {
+        escapedUrl += char;
+      }
+    }
+    return escapedUrl;
+  }
+
+  function getCssUrl(url) {
+    return 'url("' + escapeCssUrlString(url) + '")';
+  }
+
   /**
    * @ojcomponent oj.ojMessage
    * @since 5.0.0
@@ -69,10 +97,13 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
    *
    * <p>The {@link oj.ojMessage#message.sound} property is an accessibility feature for playing a
    * sound when a message is opened. This property defaults to "none", and can be enabled by setting
-   * it to "defaults" or by providing URL to an audio file of a format that the browser supports. An
-   * accessible application must provide a way for users to enable sound on a settings or preferences
-   * page. Some browsers will have auto-play disabled by default, enabling it may require adjusting
-   * the browser settings.</p>
+   * it to "defaults" or by providing a URL to an audio file of a format that the browser supports.
+   * Custom sound URLs are validated before playback. Relative URLs and URLs that resolve to
+   * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+   * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+   * supported. An accessible application must provide a way for users to enable sound on a settings
+   * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+   * require adjusting the browser settings.</p>
    *
    * <h3 id="touch-section">
    *   Touch End User Information
@@ -424,9 +455,12 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
    * required for low vision users who view a zoomed section of the UI. Because messages may be shown
    * outside of the zoomed section, such users require sound to be played to notify of new messages.</p>
    *
-   * <p>This attribute can take a URL of the audio file for the custom sound to be played. The
-   * supported formats are mp3, wav and ogg. Browser support should also be considered while choosing
-   * the format of the audio file. Literal string values
+   * <p>This attribute can take a URL of the audio file for the custom sound to be played. Custom
+   * sound URLs are validated before playback. Relative URLs and URLs that resolve to
+   * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+   * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+   * supported. The supported formats are mp3, wav and ogg. Browser support should also be considered
+   * while choosing the format of the audio file. Literal string values
    * <code class="prettyprint">"defaults"</code> and <code class="prettyprint">"none"</code> can also
    * be used for this attribute. If the value is set to "none", then the sound will be disabled. If
    * the value is set to "defaults", then a default sound is played.<p>
@@ -1260,7 +1294,7 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
       return undefined;
     }
 
-    return ["url('", message.icon, "') no-repeat"].join('');
+    return getCssUrl(message.icon) + ' no-repeat';
   };
 
   MessageViewModel.prototype._computeIconClass = function () {
@@ -1493,6 +1527,13 @@ define(['require', 'exports', 'ojs/ojcore', 'ojs/ojknockout', 'ojs/ojbutton', 'o
   MessageViewModel.prototype._playSound = function (sound) {
     // Custom URL was specified for the sound, using <audio> element is simple and best for this case.
     if (sound !== 'defaults') {
+      try {
+        DomUtils.validateURL(sound, ALLOWED_AUDIO_URL_PROTOCOLS);
+      } catch (error) {
+        Logger.info(`JET oj-message: Invalid URL in message.sound='${sound}'. Error: ${error}`);
+        return;
+      }
+
       var audio = document.createElement('AUDIO');
       audio.src = sound;
 

package/dist/js/libs/oj/debug/ojmessagebanner.js

@@ -1357,9 +1357,12 @@ define(['exports', 'preact/jsx-runtime', 'preact/hooks', 'preact', 'ojs/ojconfig
      * <p>The <code class="prettyprint">MessageBannerItem["sound"]</code> property is an accessibility
      * feature for playing a sound when a message is opened. This property defaults to "none", and can
      * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
-     * browser supports. An accessible application must provide a way for users to enable sound on a
-     * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
-     * it may require adjusting the browser settings.</p>
+     * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+     * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+     * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+     * supported. An accessible application must provide a way for users to enable sound on a settings
+     * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+     * require adjusting the browser settings.</p>
      *
      * <h3 id="keyboard-section">
      *   Keyboard End User Information

package/dist/js/libs/oj/debug/ojmetadatautils.js

@@ -159,7 +159,15 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcustomelement-utils'], function (ex
     if (subProp) {
       const namePath = propPath.split('.');
       for (let i = 0; i < namePath.length; i++) {
-        subProp = subProp[namePath[i]];
+        const propName = namePath[i];
+        if (
+          oj.CollectionUtils._isBlockedKey(propName) ||
+          !Object.prototype.hasOwnProperty.call(subProp, propName)
+        ) {
+          subProp = undefined;
+        } else {
+          subProp = subProp[propName];
+        }
         if (i === 0) {
           prop = subProp;
         }

package/dist/js/libs/oj/debug/ojmodel.js

@@ -948,18 +948,6 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
       }
     });
 
-    if (options && options.oauthHeader) {
-      // if there are no any headers then create a new one.
-      if (!initial[RestImpl._HEADER_PROP]) initial[RestImpl._HEADER_PROP] = {};
-      Object.keys(options.oauthHeader || {}).forEach(function (prop) {
-        if (Object.prototype.hasOwnProperty.call(options.oauthHeader, prop)) {
-          if (!Object.prototype.hasOwnProperty.call(initial[RestImpl._HEADER_PROP], prop)) {
-            initial[RestImpl._HEADER_PROP][prop] = options.oauthHeader[prop];
-          }
-        }
-      });
-    }
-
     return initial;
   };
 
@@ -3163,10 +3151,6 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
    */
   Model._internalSync = function (method, model, opt) {
     var options = opt || {};
-    // If Model/Collection has OAuth object, then create Authorization header (see RestImpl.addOptions)
-    if (model.oauth) {
-      options.oauthHeader = model.oauth.getHeader();
-    }
 
     // Make sure to transfer the data type if it's set on the calling object
     if (!options.dataType && model.dataType) {
@@ -8329,27 +8313,27 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
       } else {
         url += '?';
       }
-      url += 'limit=' + limit;
+      url += 'limit=' + encodeURIComponent(limit);
 
       if (!all) {
         if (Collection._defined(options.startIndex)) {
-          url += '&offset=' + options.startIndex;
+          url += '&offset=' + encodeURIComponent(options.startIndex);
         }
         if (options.startID) {
-          url += '&fromID=' + options.startID;
+          url += '&fromID=' + encodeURIComponent(options.startID);
         }
         if (options.since) {
-          url += '&since=' + options.since;
+          url += '&since=' + encodeURIComponent(options.since);
         }
         if (options.until) {
-          url += '&until=' + options.until;
+          url += '&until=' + encodeURIComponent(options.until);
         }
       }
       // Query
       if (options.query) {
         var queryString = Collection._getQueryString(options.query);
         if (queryString && queryString.length > 0) {
-          url += '&q=' + queryString;
+          url += '&q=' + encodeURIComponent(queryString);
         }
       }
 
@@ -8358,13 +8342,16 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
       if (comparator && oj.StringUtils.isString(comparator)) {
         var attrs = this._getSortAttrs(comparator);
         var sortDirStr = this._getSortDirStr();
+        var orderBy = '';
         var i;
         for (i = 0; i < attrs.length; i++) {
-          if (i === 0) {
-            url += '&orderBy=' + attrs[i] + ':' + sortDirStr;
-          } else {
-            url += ',' + attrs[i] + ':' + sortDirStr;
+          if (i > 0) {
+            orderBy += ',';
           }
+          orderBy += attrs[i] + ':' + sortDirStr;
+        }
+        if (orderBy.length > 0) {
+          url += '&orderBy=' + encodeURIComponent(orderBy);
         }
       }
       // Always ask for totalresults
@@ -8408,274 +8395,9 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
    */
   Collection._FETCH_SIZE_PROP = 'fetchSize';
 
-  /**
-   * @export
-   * @class OAuth
-   * @classdesc Member of Model objects. Object representing name/value pairs for a data service record
-   *
-   * @param {Object} attributes Initial set of attribute/value pairs with which to seed this OAuth object
-   * @param {string} header Actual name for the Authorization header (default 'Authorization')
-   * @example <caption>Initialize OAuth with client credentials</caption>
-   * var myOAuth = new OAuth('X-Authorization', {...Client Credentials ...});
-   *
-   * @example <caption>Initialize OAuth with access_token</caption>
-   * var myOAuth = new OAuth('X-Authorization', {...Access Token...});
-   *
-   * @example <caption>Initialize empty OAuth and set access_token</caption>
-   * var myOAuth = new OAuth();
-   * myOAuth.setAccessTokenResponse({...Access Token...});
-   *
-   * @constructor
-   * @final
-   * @since 1.0.0
-   */
-  const OAuth = function (header, attributes) {
-    OAuth._init(this, attributes || {}, header || 'Authorization');
-  };
-
-  oj._registerLegacyNamespaceProp('OAuth', OAuth);
-
-  // Subclass from oj.Object
-  oj.Object.createSubclass(OAuth, oj.Object, 'oj.OAuth');
-
-  OAuth.prototype.Init = function () {
-    OAuth.superclass.Init.call(this);
-  };
-
-  /**
-   * Calculates Authorization header based on client credentials or access_token
-   * @return {Object} OAuth 2.0 Authorization header
-   * @example <caption>Get Authorization header</caption>
-   * myOAuth.getHeader();
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.getHeader = function () {
-    var headers = {};
-    if (!this.accessTokenResponse.access_token) {
-      this.clientCredentialGrant();
-    }
-    headers[this.accessTokenRequest.auth_header] = 'Bearer ' + this.accessTokenResponse.access_token;
-    return headers;
-  };
-
-  /**
-   * Check is OAuth initialized (not null access_token).
-   * @return {boolean} true/false
-   * @example <caption>Check if OAuth initialized</caption>
-   * if(myOAuth.isInitialized()) console.log('Initialized');
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.isInitialized = function () {
-    if (this.accessTokenResponse && this.accessTokenResponse.access_token) {
-      return true;
-    }
-    return false;
-  };
-
-  /**
-   * Request for access_token(bearer token) using Client Credential Authorization Grant.
-   * Initialize response part of the OAuth object (access_token, e.t.c.)
-   * @return {undefined}
-   * @example <caption>Set/Re-set response part of the OAuth object using Client Credentials</caption>
-   * myOAuth.clientCredentialGrant();
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.clientCredentialGrant = function () {
-    var headers = {};
-    var self = this;
-    headers[self.accessTokenRequest.auth_header] =
-      'Basic ' +
-      OAuth._base64_encode(
-        self.accessTokenRequest.client_id + ':' + self.accessTokenRequest.client_secret
-      );
-
-    $.ajax({
-      type: 'POST',
-      async: false,
-      url: this.accessTokenRequest.bearer_url,
-      data: 'grant_type=client_credentials',
-      headers: headers,
-      success: function (data) {
-        self.accessTokenResponse = OAuth._initAccessToken(self.accessTokenResponse, data);
-      },
-      error: function (jqXHR) {
-        throw new Error(jqXHR.responseText);
-      }
-    });
-  };
-
-  /**
-   * Set response part of the OAuth object (access_token, e.t.c.)
-   * @param {Object} data current response
-   * @return {undefined}
-   * @example <caption>'Initialize' response part of the OAuth object with access_token</caption>
-   * myOAuth.setAccessTokenResponse({...Access Token...});
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.setAccessTokenResponse = function (data) {
-    this.accessTokenResponse = OAuth._initAccessToken(this.accessTokenResponse, data);
-  };
-
-  /**
-   * Get response part of the OAuth object (access_token, e.t.c.)
-   * @return {Object} cached response
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.getAccessTokenResponse = function () {
-    return this.accessTokenResponse;
-  };
-
-  /**
-   * Clean response part of the OAuth object (access_token, e.t.c.)
-   * Null and remove all data from response part of the OAuth object
-   * @return {undefined}
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.cleanAccessTokenResponse = function () {
-    OAuth._cleanAccessToken(this.accessTokenResponse);
-  };
-
-  /**
-   * Set request part of the OAuth object (client credentials, uri endpoint)
-   * @param {Object} data current client credentials and uri
-   * @return {undefined}
-   * @example <caption>'Initialize' request part of the OAuth object with client credentials and calculate
-   * access_token</caption>
-   * myOAuth.setAccessTokenRequest({...Client Credentials ...});
-   * myOAuth.clientCredentialGrant();
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.setAccessTokenRequest = function (data) {
-    this.accessTokenRequest = OAuth._initAccessToken(this.accessTokenRequest, data);
-  };
-
-  /**
-   * Get request part of the OAuth object (client credentials, uri endpoint)
-   * @return {Object} cached request
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.getAccessTokenRequest = function () {
-    return this.accessTokenRequest;
-  };
-
-  /**
-   * Clean request part of the OAuth object (client credentials, uri endpoint)
-   * Null and remove all data from request part of the OAuth object
-   * @return {undefined}
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.cleanAccessTokenRequest = function () {
-    OAuth._cleanAccessToken(this.accessTokenRequest);
-  };
-
-  /**
-   * @private
-   * @param {Object} oauth
-   * @param {Object} attributes
-   * @param {string|null} header
-   */
-  OAuth._init = function (oauth, attributes, header) {
-    var oa = oauth;
-    oa.Init();
-    oa.accessTokenRequest = {};
-    oa.accessTokenResponse = {};
-
-    if (attributes.access_token) {
-      // access_token has higher preference
-      oa.accessTokenResponse = OAuth._initAccessToken(oa.accessTokenResponse, attributes);
-    } else if (attributes.client_id && attributes.client_secret && attributes.bearer_url) {
-      // Client Credential Grant
-      oa.accessTokenResponse = OAuth._initAccessToken(oa.accessTokenRequest, attributes);
-    }
-    oa.accessTokenRequest.auth_header = header;
-  };
-
-  /**
-   * @private
-   * @param {Object} oauthObj - Request/Response object to deal with
-   * @param {Object} data - object to populate
-   */
-  OAuth._initAccessToken = function (oauthObj, data) {
-    var dat = data || {};
-    var obj = oauthObj || {};
-    Object.keys(dat).forEach(function (prop) {
-      if (Object.prototype.hasOwnProperty.call(dat, prop)) {
-        obj[prop] = dat[prop];
-      }
-    });
-    return obj;
-  };
-
-  /**
-   * @private
-   * @param {Object} oauthObj - Request/Response object to deal with
-   */
-  OAuth._cleanAccessToken = function (oauthObj) {
-    var obj = oauthObj || {};
-
-    Object.keys(obj).forEach(function (key) {
-      if (Object.prototype.hasOwnProperty.call(obj, key)) {
-        if (key !== 'auth_header') {
-          obj[key] = null;
-          delete obj[key];
-        }
-      }
-    });
-  };
-
-  /**
-   * @private
-   * @param {string} a The data to calculate the base64 representation from
-   * @return {string} The base64 representation
-   */
-  OAuth._base64_encode = function (a) {
-    var d;
-    var e;
-    var f;
-    var b;
-    var g = 0;
-    var h = 0;
-    var i = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
-    var c = [];
-
-    do {
-      d = a.charCodeAt(g);
-      g += 1;
-      e = a.charCodeAt(g);
-      g += 1;
-      f = a.charCodeAt(g);
-      g += 1;
-      b = (d << 16) | (e << 8) | f; // eslint-disable-line no-bitwise
-      d = (b >> 18) & 63; // eslint-disable-line no-bitwise
-      e = (b >> 12) & 63; // eslint-disable-line no-bitwise
-      f = (b >> 6) & 63; // eslint-disable-line no-bitwise
-      b &= 63; // eslint-disable-line no-bitwise
-      c[h] = i.charAt(d) + i.charAt(e) + i.charAt(f) + i.charAt(b);
-      h += 1;
-    } while (g < a.length);
-    c = c.join('');
-    d = a.length % 3;
-    return (d ? c.slice(0, d - 3) : c) + '==='.slice(d || 3);
-  };
-
   exports.Collection = Collection;
   exports.Events = Events;
   exports.Model = Model;
-  exports.OAuth = OAuth;
   exports.URLError = URLError;
   exports.ajax = ajax;
   exports.sync = sync;