@oracle/oraclejet 19.0.8 → 19.0.9

package/dist/js/libs/oj/debug_esm/ojcolorpalette.js

@@ -625,9 +625,13 @@ var __oj_color_palette_metadata =
    * it shows all the time.
    * </p>
    * <p>
-   * For security reasons we only support urls with protocol 'http:' or 'https:'.
-   * If the url doesn't comply we ignore it and throw an error.
-   * Pass in an encoded URL since we do not encode the URL.</p>
+   * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+   * currently supports <code class="prettyprint">http:</code> and
+   * <code class="prettyprint">https:</code> protocols. If the url doesn't
+   * comply we ignore it and throw an error. JET does not validate whether
+   * the URL is trusted for the application. Applications are responsible
+   * for providing sanitized URLs and enforcing any required origin or host
+   * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
    *
    * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
    *
@@ -673,6 +677,8 @@ var __oj_color_palette_metadata =
    * <p>
    * To include formatted text in the help.instruction, format the string using html tags.
    * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+   * Inline style attributes are sanitized; the retained styling is limited to color, font
+   * style, font weight, and text decoration. Use CSS classes for other styling.
    * For example the
    * help.instruction might look like:
    * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -803,6 +809,8 @@ var __oj_color_palette_metadata =
    * hints and message summary text cannot. If you use formatted text, it should be accessible
    * and make sense to the user if formatting wasn't there.
    * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+   * Inline style attributes are sanitized; the retained styling is limited to color, font
+   * style, font weight, and text decoration. Use CSS classes for other styling.
    * To format the message detail, you could do this:
    * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
    * </p>
@@ -2004,7 +2012,7 @@ var __oj_color_palette_metadata =
         );
 
       if (label) {
-        entry.append($("<span class='oj-colorpalette-swatch-text'>" + label + '</span>')[0]); // @HTMLUpdateOK
+        entry.append($("<span class='oj-colorpalette-swatch-text'></span>").text(label)[0]); // @HTMLUpdateOK
       }
       return entry[0];
     },
@@ -2022,29 +2030,22 @@ var __oj_color_palette_metadata =
      * @private
      */
     _renderNone: function (showLabels, label, tooltip, swatchClass, selectedClass) {
-      var raw;
-
-      raw =
-        "<div class='oj-colorpalette-swatch-entry " +
-        swatchClass +
-        (showLabels ? ' oj-colorpalette-swatch-showlabel' : '') +
-        "'>" +
-        "<div class='oj-colorpalette-swatch-container'>" +
-        "<div class='oj-colorpalette-swatch " +
-        selectedClass +
-        "'" +
-        (!label ? " title='" + tooltip + "'" : '') +
-        '>' +
-        "<div class='oj-colorpalette-swatch-none-icon'>" +
-        '</div>' +
-        '</div>' +
-        '</div>';
+      // prettier-ignore
+      var entry = $("<div class='oj-colorpalette-swatch-entry'></div>")
+        .addClass(swatchClass + (showLabels ? ' oj-colorpalette-swatch-showlabel' : ''))
+        .append( // @HTMLUpdateOK
+          $("<div class='oj-colorpalette-swatch-container'></div>").append( // @HTMLUpdateOK
+            $("<div class='oj-colorpalette-swatch'></div>")
+              .attr('title', !label ? tooltip : null)
+              .addClass(selectedClass)
+              .append($("<div class='oj-colorpalette-swatch-none-icon'></div>")) // @HTMLUpdateOK
+          )
+        );
 
       if (label) {
-        raw += "<span class='oj-colorpalette-swatch-text'>" + label + '</span>';
+        entry.append($("<span class='oj-colorpalette-swatch-text'></span>").text(label)[0]); // @HTMLUpdateOK
       }
-      raw += '</div>';
-      return $(raw)[0];
+      return entry[0];
     },
 
     /**

package/dist/js/libs/oj/debug_esm/ojcomponentcore.js

@@ -2503,6 +2503,10 @@ oj.CollectionUtils.copyInto(CustomElementBridge.proto, {
     };
     // eslint-disable-next-line no-param-reassign
     proto.getProperty = function (prop) {
+      if (oj.BaseCustomElementBridge.__IsBlockedPropertyPath(prop)) {
+        return undefined;
+      }
+
       var bridge = CustomElementUtils.getElementBridge(this);
       var meta = getPropertyMetadata(prop, getElementProperties(this));
 
@@ -6458,38 +6462,40 @@ function _mergeObjectsWithExclusions(target, input, ignoreSubkeys, basePath, avo
     var keys = Object.keys(source);
     for (var i = 0; i < keys.length; i++) {
       var key = keys[i];
-      var path;
-      if (ignoreSubkeys == null) {
-        path = null;
-      } else if (basePath == null) {
-        path = key;
-      } else {
-        path = basePath + '.' + key;
-      }
-      // Ignore all sources when the current path is registered in ignoreSubkeys
-      if (ignoreSubkeys == null || !ignoreSubkeys[path]) {
-        var value = source[key];
-        if (value !== undefined) {
-          if ($.isPlainObject(value)) {
-            const plainObjectTarget = $.isPlainObject(target[key]);
-            // If merging an object onto a non-object and avoidClones is set, just replace target with value
-            if (!plainObjectTarget && avoidClones) {
-              // eslint-disable-next-line no-param-reassign
-              target[key] = value;
+      if (!oj.CollectionUtils._isBlockedKey(key)) {
+        var path;
+        if (ignoreSubkeys == null) {
+          path = null;
+        } else if (basePath == null) {
+          path = key;
+        } else {
+          path = basePath + '.' + key;
+        }
+        // Ignore all sources when the current path is registered in ignoreSubkeys
+        if (ignoreSubkeys == null || !ignoreSubkeys[path]) {
+          var value = source[key];
+          if (value !== undefined) {
+            if ($.isPlainObject(value)) {
+              const plainObjectTarget = $.isPlainObject(target[key]);
+              // If merging an object onto a non-object and avoidClones is set, just replace target with value
+              if (!plainObjectTarget && avoidClones) {
+                // eslint-disable-next-line no-param-reassign
+                target[key] = value;
+              } else {
+                var params = plainObjectTarget ? [target[key], value] : [value];
+                // eslint-disable-next-line no-param-reassign
+                target[key] = _mergeObjectsWithExclusions(
+                  {},
+                  params,
+                  ignoreSubkeys,
+                  path,
+                  avoidClones
+                );
+              }
             } else {
-              var params = plainObjectTarget ? [target[key], value] : [value];
               // eslint-disable-next-line no-param-reassign
-              target[key] = _mergeObjectsWithExclusions(
-                {},
-                params,
-                ignoreSubkeys,
-                path,
-                avoidClones
-              );
+              target[key] = value;
             }
-          } else {
-            // eslint-disable-next-line no-param-reassign
-            target[key] = value;
           }
         }
       }

package/dist/js/libs/oj/debug_esm/ojcontext.js

@@ -223,15 +223,16 @@ BusyState._getTs = function () {
  * @ojtsexportastype Context
  * @since 2.1.0
  * @classdesc Framework service for querying the busy state of components on the page.
- * <h3> Session storage usage : </h3>
+ * <h3> Session storage usage in debug builds : </h3>
  * <pre class="prettyprint">
  * <code>
  * // enable BusyContext tracing of BusyState creation
  * sessionStorage.setItem('ojet.busyContextTracing', 'on');
  * </code></pre>
  *
- * <p>Setting this key in sessionStorage will cause BusyStates to be created with an
- * additional `stack` property containing the call stack at the time of creation.
+ * <p>In debug builds, setting this key in sessionStorage will cause BusyStates to be
+ * created with an additional `stack` property containing the call stack at the time of creation.
+ * Production builds ignore this key.
  * </p>
  */
 const BusyContext = function (hostNode, context) {
@@ -584,7 +585,7 @@ BusyContext.prototype.addBusyState = function (options) {
 
   const storageKey = 'ojet.busyContextTracing';
   let stack;
-  if (window?.sessionStorage?.getItem(storageKey) === 'on') {
+  if (true && window?.sessionStorage?.getItem(storageKey) === 'on') {
     try {
       throw new BusyStateTrace('');
     } catch (ex) {

package/dist/js/libs/oj/debug_esm/ojcore-base.js

@@ -38,12 +38,12 @@ const oj = {
    * @global
    * @member {string} version JET version numberr
    */
-  version: '19.0.8',
+  version: '19.0.9',
   /**
    * @global
    * @member {string} revision JET source code revision number
    */
-  revision: '2026-05-27_14-16-45',
+  revision: '2026-07-14_10-25-20',
 
   // This function is only meant to be used outside the library, so quoting the name
   // to avoid renaming is appropriate
@@ -405,6 +405,17 @@ oj._registerLegacyNamespaceProp('Assert', Assert);
  * @private
  */
 var _DEBUG = 'DEBUG';
+var _debug = false;
+
+Object.defineProperty(Assert, _DEBUG, {
+  get: function () {
+    return _debug;
+  },
+  set: function (value) {
+    _debug = true && value === true;
+  },
+  enumerable: true
+});
 
 /**
  * @private
@@ -412,12 +423,14 @@ var _DEBUG = 'DEBUG';
 const _NO_PROTO = "' doesn't match prototype ";
 
 /**
- * Forces DEBUG to be set to true
+ * Forces DEBUG to be set to true in debug builds
  * @export
  * @memberof oj.Assert
  */
 Assert.forceDebug = function () {
-  Assert[_DEBUG] = true;
+  if (true) {
+    Assert[_DEBUG] = true;
+  }
 };
 
 /**

package/dist/js/libs/oj/debug_esm/ojcorerouter.js

@@ -178,10 +178,19 @@ function getPathParam(segment) {
  * activity that must be completed before the transition is finalized.
  * <pre class="prettyprint">
  * <code>
+ * var routeModuleMap = {
+ *   dashboard: 'dashboard',
+ *   incidents: 'incidents'
+ * };
+ *
  * router.currentState.subscribe(function (args) {
  *   var state = args.state;
- *   var name = state.path;
  *   var complete = args.complete;
+ *   var name = routeModuleMap[state.path];
+ *   if (!name) {
+ *     complete(Promise.reject(new Error('Unknown module route')));
+ *     return;
+ *   }
  *   // Load the module and return Promise to CoreRouter
  *   complete(
  *     Promise.all([
@@ -250,6 +259,10 @@ function getPathParam(segment) {
  * <p>
  * <h5>With RegExp as path.</h5>
  * Note that all paths matching the regular expression will be using this configuration entry.
+ * String routes with known safe names can be used to load matching modules. If RegExp,
+ * catch-all, URL-derived, or user-controlled path values are used to load modules or
+ * other resources, map the matched value to an explicit allowed resource identifier
+ * instead of using the raw matched value directly.
  * <pre class="prettyprint">
  * <code>
  * var root = new CoreRouter([
@@ -1046,7 +1059,9 @@ CoreRouter.prototype.destroy = function () {
 
   this.beforeStateChange = null;
   this.currentState = null;
-  this._parentRouter.childRouter = null;
+  if (this._parentRouter) {
+    this._parentRouter.childRouter = null;
+  }
 
   if (this === rootRouter) {
     window.removeEventListener('popstate', this._popstateHandler, false);
@@ -1081,7 +1096,9 @@ CoreRouter.prototype.destroy = function () {
  * can be referenced in the state.
  * @typedef {object} CoreRouter.DetailedRouteConfig
  * @property {string|RegExp} path The path of the route. This may be an exact-
- * match string, or a regular expression.
+ * match string, or a regular expression. If application code uses a RegExp-matched
+ * path to load a module or other resource, use the route detail to provide an
+ * explicit allowed resource identifier instead of loading the raw matched path value.
  * @property {object=} detail An optional detail object which is passed to
  * the route when it is navigated to.
  * @ojsignature [{target: "Type", value: "D", for: "detail"},
@@ -1095,7 +1112,9 @@ CoreRouter.prototype.destroy = function () {
  * route.
  * @typedef {object} CoreRouter.RedirectedRouteConfig
  * @property {string|RegExp} path The path of the route. This may be an exact-
- * match string, or a regular expression.
+ * match string, or a regular expression. If application code uses a RegExp-matched
+ * path to load a module or other resource, map it to an explicit allowed resource
+ * identifier instead of loading the raw matched path value.
  * @property {string=} redirect An optional name of a route to which paths matching
  * this route will redirect. The redirected route's path must be of type string.
  */

package/dist/js/libs/oj/debug_esm/ojcspexpressionevaluator-internal.js

@@ -293,20 +293,33 @@ const CspExpressionEvaluatorInternal = function (options) {
   }
 
   function _evaluateMember(node, contexts) {
+    var memberAccess = _getMemberAccess(node, contexts);
+    if (memberAccess.length === 0) {
+      return memberAccess;
+    }
+    var value = _getMemberValue(memberAccess);
+    return [memberAccess[0], value];
+  }
+
+  function _getMemberAccess(node, contexts) {
     var object = _evaluate(node.object, contexts);
     if (!object && node.optional) {
       // handle optional chaining operator: test?.prop
       return [];
-    } else if (node.computed) {
-      return [object, object[_evaluate(node.property, contexts)]];
     }
-    return [object, object[node.property.name]];
+    var key = node.computed ? _evaluate(node.property, contexts) : node.property.name;
+    return _getMemberAccessForKey(object, key);
   }
 
   function _evaluateObjectExpression(node, contexts) {
     return node.properties.reduce(function (acc, curr) {
       const key = getKeyValue(curr.key);
-      acc[key] = _evaluateAndUnwrap(curr.value, contexts);
+      Object.defineProperty(acc, key, {
+        configurable: true,
+        enumerable: true,
+        value: _evaluateAndUnwrap(curr.value, contexts),
+        writable: true
+      });
       return acc;
     }, {});
   }
@@ -315,7 +328,7 @@ const CspExpressionEvaluatorInternal = function (options) {
   function _getValue(contexts, name) {
     var target = _getContextForIdentifier(contexts, name);
     if (target) {
-      return target[name];
+      return _getMemberValue(_getMemberAccessForKey(target, name));
     }
     throw new Error('Variable ' + name + ' is undefined');
   }
@@ -324,7 +337,7 @@ const CspExpressionEvaluatorInternal = function (options) {
   function _getValueWithContext(contexts, name) {
     var target = _getContextForIdentifier(contexts, name);
     if (target) {
-      return [target, target[name]];
+      return [target, _getMemberValue(_getMemberAccessForKey(target, name))];
     }
     throw new Error('Variable ' + name + ' is undefined');
   }
@@ -337,11 +350,18 @@ const CspExpressionEvaluatorInternal = function (options) {
         if (!target) {
           _throwError('Cannot assign value to undefined variable ' + name);
         }
-        target[name] = val;
+        var identifierAccess = _getMemberAccessForKey(target, name);
+        if (_isRestrictedMemberKey(identifierAccess[1])) {
+          _throwError('Assignment to member "' + identifierAccess[1] + '" is not allowed');
+        }
+        identifierAccess[0][identifierAccess[1]] = val;
         break;
       case MEMBER_EXP:
-        var key = node.computed ? _evaluateAndUnwrap(node.property, contexts) : node.property.name;
-        _evaluateMember(node, contexts)[0][key] = val;
+        var memberAccess = _getMemberAccess(node, contexts);
+        if (_isRestrictedMemberKey(memberAccess[1])) {
+          _throwError('Assignment to member "' + memberAccess[1] + '" is not allowed');
+        }
+        memberAccess[0][memberAccess[1]] = val;
         break;
       default:
         _throwError('Expression of type: ' + node.type + ' not supported for assignment');
@@ -400,6 +420,94 @@ const CspExpressionEvaluatorInternal = function (options) {
     return result.join('');
   }
 
+  // Block prototype-chain escape hatches. Safe data objects can still expose these
+  // names as own, non-accessor properties, but never as inherited capabilities.
+  function _getMemberAccessForKey(object, key) {
+    var propertyKey = typeof key === 'symbol' ? key : String(key);
+    return [object, propertyKey, _validateMemberKey(object, propertyKey)];
+  }
+
+  function _validateMemberKey(object, key) {
+    if (object === Object && _isUnsafeObjectStaticMember(key)) {
+      _throwError('Access to member "' + key + '" is not allowed');
+    } else if (_isInheritedIntrinsicPrototypeHelper(object, key)) {
+      _throwError('Access to member "' + key + '" is not allowed');
+    }
+    if (!_isRestrictedMemberKey(key)) {
+      return null;
+    }
+    var descriptor = Object.getOwnPropertyDescriptor(Object(object), key);
+    if (!descriptor || !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+      _throwError('Access to member "' + key + '" is not allowed');
+    } else if (typeof descriptor.value === 'function') {
+      _throwError('Access to member "' + key + '" is not allowed');
+    } else if (key === 'prototype' && typeof object === 'function') {
+      _throwError('Access to member "' + key + '" is not allowed');
+    }
+    return descriptor;
+  }
+
+  function _getMemberValue(memberAccess) {
+    // For restricted keys, use the validated data-descriptor value rather than
+    // invoking a Proxy get trap that could return a different capability.
+    return memberAccess[2] ? memberAccess[2].value : memberAccess[0][memberAccess[1]];
+  }
+
+  function _isRestrictedMemberKey(propertyKey) {
+    return (
+      propertyKey === 'constructor' || propertyKey === '__proto__' || propertyKey === 'prototype'
+    );
+  }
+
+  // These legacy accessors can recover or modify an intrinsic prototype without
+  // evaluating a restricted member name. Allow applications to use an own data
+  // property with one of these names, but reject the inherited intrinsic helpers.
+  function _isInheritedIntrinsicPrototypeHelper(object, propertyKey) {
+    if (
+      propertyKey !== '__lookupGetter__' &&
+      propertyKey !== '__lookupSetter__' &&
+      propertyKey !== '__defineGetter__' &&
+      propertyKey !== '__defineSetter__'
+    ) {
+      return false;
+    }
+
+    var target = Object(object);
+    var visitedTargets = new Set();
+    while (target) {
+      // An extensible Proxy can report itself, or an earlier object, as its
+      // prototype. Treat cycles as unsafe rather than looping indefinitely.
+      if (visitedTargets.has(target)) {
+        return true;
+      }
+      visitedTargets.add(target);
+      var descriptor = Object.getOwnPropertyDescriptor(target, propertyKey);
+      if (descriptor) {
+        return (
+          (target === Object.prototype || target === Function.prototype) &&
+          typeof descriptor.value === 'function'
+        );
+      }
+      target = Object.getPrototypeOf(target);
+    }
+    return false;
+  }
+
+  // The evaluator exposes Object by default. These reflection methods can otherwise
+  // retrieve or mutate intrinsic prototypes and recover Function through descriptors.
+  function _isUnsafeObjectStaticMember(propertyKey) {
+    return (
+      propertyKey === 'assign' ||
+      propertyKey === 'create' ||
+      propertyKey === 'defineProperty' ||
+      propertyKey === 'defineProperties' ||
+      propertyKey === 'getOwnPropertyDescriptor' ||
+      propertyKey === 'getOwnPropertyDescriptors' ||
+      propertyKey === 'getPrototypeOf' ||
+      propertyKey === 'setPrototypeOf'
+    );
+  }
+
   function _getContextForIdentifier(contexts, name) {
     for (var i = 0; i < contexts.length; i++) {
       var context = contexts[i];

package/dist/js/libs/oj/debug_esm/ojcspexpressionevaluator.js

@@ -24,10 +24,12 @@ import 'ojs/ojkoshared';
 /**
  * @class oj.CspExpressionEvaluator
  * @since 7.1.0
- * @ojshortdesc Object representing CSP-compliant evaluator.
+ * @ojshortdesc Object representing a Content Security Policy (CSP)-compliant evaluator.
  * @ojtsmodule
  *
- * @classdesc A class for creating CSP-compliant evaluators of JavaScript expressions
+ * @classdesc A class for creating Content Security Policy (CSP)-compliant evaluators of JavaScript expressions.
+ * Content Security Policy is a browser security mechanism that can disallow dynamically compiled code, including
+ * code generated with JavaScript Function constructors.
  * <p> The default JET expression evaluator cannot be used when Content Security Policy
  * prohibits unsafe evaluations. In order to replace the default evaluator with the JET CSP-compliant evaluator,
  * create and pass an instance of CspExpressionEvaluator class to the
@@ -35,11 +37,17 @@ import 'ojs/ojkoshared';
  * This method must be called before applying knockout bindings in the application for the first time.
  * </p>
  *
- * <p>Any extra context required for evaluating expressions can be passed to the object constructor using <code>globalScope</code> property.</p>
+ * <p>Any extra context required for evaluating expressions can be passed to the object constructor using the <code>globalScope</code> property.
+ * Expression text must be trusted application code. This evaluator is CSP-compliant because it does not use dynamic code compilation; it is
+ * not a security sandbox. Restricting <code>globalScope</code> does not make untrusted expression text safe because expressions can access
+ * capabilities from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs. This
+ * evaluator restricts known prototype-chain access routes in its default capabilities, but applications remain responsible for the
+ * capabilities they expose.</p>
  *
  * <pre class="prettyprint">
  * <code>
- * Config.setExpressionEvaluator(new CspExpressionEvaluator());
+ * const extraScope = { Date: Date };
+ * Config.setExpressionEvaluator(new CspExpressionEvaluator({ globalScope: extraScope }));
  * </code>
  * </pre>
  *
@@ -78,9 +86,16 @@ import 'ojs/ojkoshared';
  * <h2 id="invalidExpressions">Expression limitations:
  *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#invalidExpressions"></a>
  * </h2>
- * <p> The following code is not supported in expressions:
+ * <p> The following syntax and behaviors are unsupported or restricted in expressions:
  * <ul>
- *  <li>Assignment operators of any types such as <code>'='</code> or <code>'+='</code> or <code>'|='</code></li>
+ *  <li>Expression text must be trusted application code. This evaluator avoids dynamic code compilation for CSP compliance, but it is not a security sandbox. Expressions can invoke functions and access non-restricted values from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs, as well as <code>globalScope</code>.</li>
+ *  <li>To prevent prototype-chain access, access to properties named <code>'constructor'</code>, <code>'__proto__'</code>, and <code>'prototype'</code> is read-only and supported only as own, non-accessor, non-function data properties, including when accessed with bracket notation or as an identifier. A <code>'prototype'</code> property cannot be accessed on a function. For these names, a Proxy's data descriptor value is used instead of its <code>get</code> trap result.</li>
+ *  <li>Inherited <code>'__lookupGetter__'</code>, <code>'__lookupSetter__'</code>, <code>'__defineGetter__'</code>, and <code>'__defineSetter__'</code> prototype helpers are not supported. Own data properties with these names are supported.</li>
+ *  <li>An object-literal <code>'__proto__'</code> property is created as an own data property and does not change the object's prototype.</li>
+ *  <li>The default <code>Object</code> global does not support <code>assign</code> or the reflection methods <code>create</code>, <code>defineProperty</code>, <code>defineProperties</code>, <code>getOwnPropertyDescriptor</code>, <code>getOwnPropertyDescriptors</code>, <code>getPrototypeOf</code>, or <code>setPrototypeOf</code>.</li>
+ *  <li>Assignment operators of any type, such as <code>'='</code>, <code>'+='</code>, or <code>'|='</code>, are generally unsupported.
+ *    JET and Knockout may use internal assignment expressions to implement two-way binding writeback; applications should not rely on
+ *    assignment being accepted in expression text.</li>
  *  <li>Blocks of code such as <code>'if (...){}'</code></li>
  *  <li>Comma operator (,) such as <code>'(expr1, expr2)'</code></li>
  *  <li>in operator such as <code>'prop in testObject'</code></li>
@@ -95,6 +110,7 @@ import 'ojs/ojkoshared';
  * @param {Object} options
  * @param {any=} options.globalScope optional additional scope required for evaluating expressions.
  * The additional scope will be used to resolve the variables if they are not defined in the $data or $context.
+ * It is not a security boundary for untrusted expression text.
  * <pre class="prettyprint"><code>Config.setExpressionEvaluator(new CspExpressionEvaluator({globalScope:extraScope}));</code></pre>
  * @constructor
  * @final

package/dist/js/libs/oj/debug_esm/ojcustomelement-utils.js

@@ -553,7 +553,9 @@ class KoBindingUtils {
         if (attrValue != null) {
             let exp = AttributeUtils.getExpressionInfo(attrValue).expr;
             if (exp == null) {
-                exp = stringify ? `'${attrValue}'` : attrValue;
+                // Binding strings are evaluated as expressions. Serialize literal attribute
+                // values so quotes and other JavaScript syntax characters remain data.
+                exp = stringify ? JSON.stringify(attrValue) : attrValue;
             }
             return exp;
         }