@oracle/oraclejet 19.0.8 → 19.0.9

package/dist/js/libs/oj/debug_esm/ojcustomelement.js

@@ -183,6 +183,7 @@ BaseCustomElementBridge.proto = {
     // as well since we don't reflect property values back to the DOM attribute.
     const prop = AttributeUtils.attributeToPropertyName(attr);
     const bridge = CustomElementUtils.getElementBridge(this);
+    BaseCustomElementBridge.__ValidatePropertyPath(this, prop);
     if (oldValue !== newValue || bridge.State.dirtyProps.has(prop)) {
       bridge.State.dirtyProps.delete(prop.split('.')[0]);
       // Due to  where IE11 disables child inputs for a parent with the disabled attribute,
@@ -326,6 +327,10 @@ BaseCustomElementBridge.proto = {
   },
 
   GetProperty: function (element, prop, props) {
+    if (BaseCustomElementBridge.__IsBlockedPropertyPath(prop)) {
+      return undefined;
+    }
+
     var meta = getPropertyMetadata(prop, getElementProperties(element));
 
     // For event listener and non component properties, retrieve the value directly stored on the element.
@@ -380,6 +385,8 @@ BaseCustomElementBridge.proto = {
    * @return {boolean}
    */
   SaveEarlyPropertySet: function (element, prop, value) {
+    BaseCustomElementBridge.__ValidatePropertyPath(element, prop);
+
     // Do not save sets that occur during BaseCustomElementBridge.__InitProperties
     // or expression evaluation. We can process these as normal. Playback occurs before the
     // binding provider promise is resolved leading to component creation.
@@ -413,6 +420,8 @@ BaseCustomElementBridge.proto = {
   },
 
   SetProperty: function (element, prop, value, props, bOuter) {
+    BaseCustomElementBridge.__ValidatePropertyPath(element, prop);
+
     // Check value against any defined enums
     var meta = getPropertyMetadata(prop, getElementProperties(element));
     if (AttributeUtils.isEventListenerProperty(prop) || !meta) {
@@ -499,6 +508,8 @@ BaseCustomElementBridge.proto = {
   },
 
   ValidatePropertySet: function (element, property, value) {
+    BaseCustomElementBridge.__ValidatePropertyPath(element, property);
+
     var propsMeta = getElementProperties(element);
     var propMeta = getPropertyMetadata(property, propsMeta);
     var propAr = property.split('.');
@@ -631,6 +642,7 @@ BaseCustomElementBridge.proto = {
     var keys = Object.keys(props);
     for (var i = 0; i < keys.length; i++) {
       var key = keys[i];
+      BaseCustomElementBridge.__ValidatePropertyPath(elem, key);
       if (key.indexOf('.') >= 0) {
         mutationKeys.push(key);
       } else {
@@ -737,6 +749,38 @@ BaseCustomElementBridge.__ThrowTypeError = function (element, property, value, t
   );
 };
 
+/**
+ * Checks whether a property path segment could mutate Object.prototype or other prototypes.
+ * @param {string} property The property path
+ * @return {boolean} true if the path contains a blocked segment
+ * @ignore
+ */
+BaseCustomElementBridge.__IsBlockedPropertyPath = function (property) {
+  var propPath = property.split('.');
+  for (var i = 0; i < propPath.length; i++) {
+    if (oj.CollectionUtils._isBlockedKey(propPath[i])) {
+      return true;
+    }
+  }
+  return false;
+};
+
+/**
+ * Validates a property path before walking objects with dot notation.
+ * @param {Element=} element The custom element
+ * @param {string} property The property path
+ * @ignore
+ */
+BaseCustomElementBridge.__ValidatePropertyPath = function (element, property) {
+  if (BaseCustomElementBridge.__IsBlockedPropertyPath(property)) {
+    var message = `Invalid property path '${property}'.`;
+    if (element) {
+      throw new JetElementError(element, message);
+    }
+    throw new Error(message);
+  }
+};
+
 /**
  * Checks to see if there are any overlapping attribute for the given element and attribute
  * @ignore
@@ -769,6 +813,7 @@ BaseCustomElementBridge.__InitProperties = function (element, componentProps) {
     for (var i = 0; i < attrs.length; i++) {
       var attr = attrs[i];
       var property = AttributeUtils.attributeToPropertyName(attr.nodeName);
+      BaseCustomElementBridge.__ValidatePropertyPath(element, property);
 
       // See if attribute is a component property
       var meta = getPropertyMetadata(property, metaProps);
@@ -810,11 +855,14 @@ BaseCustomElementBridge.__SetProperty = function (propNameFun, componentProps, p
   var propsObj = componentProps;
   var propPath = property.split('.');
   var branchedProps;
+  BaseCustomElementBridge.__ValidatePropertyPath(null, property);
+
   // Set subproperty, initializing parent objects along the way unless the top level
   // property is not defined since setting it to an empty object will trigger a property changed
   // event. Instead, branch and set at the end. We only have listeners on top level properties
   // so setting a subproperty will not trigger a property changed event along the way.
   var topProp = propNameFun(propPath[0]);
+  BaseCustomElementBridge.__ValidatePropertyPath(null, topProp);
   if (propPath.length > 1 && !componentProps[topProp]) {
     branchedProps = {};
     propsObj = branchedProps;
@@ -823,6 +871,7 @@ BaseCustomElementBridge.__SetProperty = function (propNameFun, componentProps, p
   // Walk to the correct location
   for (var i = 0; i < propPath.length; i++) {
     var subprop = propNameFun(propPath[i]);
+    BaseCustomElementBridge.__ValidatePropertyPath(null, subprop);
     if (i === propPath.length - 1) {
       propsObj[subprop] = value;
     } else if (!propsObj[subprop]) {

package/dist/js/libs/oj/debug_esm/ojdataprovider.js

@@ -2188,8 +2188,7 @@ class FilterImpl {
                         // 2. Remove single and double quotes
                         // 3. Add word boundary and wild cards for phrase matching
                         filterValue = new RegExp(`${'\\b' +
-                            textFilterValue
-                                .replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')
+                            FilterImpl._escapeRegExp(textFilterValue)
                                 .replace(/('|")/g, '')
                                 // Avoid nested quantifiers that can trigger ReDoS.
                                 // Equivalent to original "(.*)((\\s|\\t|\\r|\\n)*)" with JS-dot behavior:
@@ -2197,12 +2196,12 @@ class FilterImpl {
                                 .replace(/(\s|\t)/g, '[^\\r\\n]*[\\s\\t\\r\\n]*')}`, 'i');
                     }
                     else if (filter['matchBy'] === 'startsWith') {
-                        filterValue = new RegExp(`^${textFilterValue.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')}`, 'i');
+                        filterValue = new RegExp(`^${FilterImpl._escapeRegExp(textFilterValue)}`, 'i');
                     }
                     else {
                         // 'contains' | 'fuzzy' | 'unknown'
                         // Escape special characters without change filter['text'] which is the original filter string by default
-                        filterValue = new RegExp(textFilterValue.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&'), 'i');
+                        filterValue = new RegExp(FilterImpl._escapeRegExp(textFilterValue), 'i');
                     }
                 }
                 else {
@@ -2273,12 +2272,27 @@ class FilterImpl {
                 const fieldAttributePath = path ? path + '.' + fieldAttribute : fieldAttribute;
                 if (!(fieldValue instanceof Object)) {
                     const operatorExpr = {};
-                    // need express co, sw and ew as regex
-                    if (op === '$sw' || op === '$ew' || op === '$co') {
-                        fieldValue = FilterImpl._fixStringExpr(op, fieldValue);
-                        op = '$regex';
+                    // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+                    // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+                    //
+                    // AttributeFilterDef object values are expanded into one criterion per field. For example,
+                    // { op: '$ew', value: { name: 'admin', value: 'foo' } } becomes an $and expression with
+                    // separate criteria for "name" and "value". The $co/$sw/$ew operators are implemented by
+                    // converting each field criterion to $regex, because FilterUtils only has a regex evaluator
+                    // for contains/starts-with/ends-with matching in this transformed expression.
+                    //
+                    // Keep the converted operator in a local variable. Mutating the shared op parameter while
+                    // processing the first field would cause later sibling fields to see "$regex" instead of the
+                    // original "$co", "$sw", or "$ew". That would skip _fixStringExpr for later fields, losing
+                    // either the $sw/$ew anchoring semantics or the regex escaping added for the ReDoS fix.
+                    // This behavior is intentionally changed/fixed as part of the security fix so every field
+                    // in an object filter preserves the original string operator semantics before regex conversion.
+                    let fieldOp = op;
+                    if (fieldOp === '$sw' || fieldOp === '$ew' || fieldOp === '$co') {
+                        fieldValue = FilterImpl._fixStringExpr(fieldOp, fieldValue);
+                        fieldOp = '$regex';
                     }
-                    operatorExpr[op] = fieldValue;
+                    operatorExpr[fieldOp] = fieldValue;
                     const fieldExpr = {};
                     fieldExpr[fieldAttributePath] = operatorExpr;
                     criteriaArray.push(fieldExpr);
@@ -2298,6 +2312,14 @@ class FilterImpl {
     }
     static _fixStringExpr(op, value) {
         if (typeof value === 'string' || value instanceof String) {
+            // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+            // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+            //
+            // $co, $sw, and $ew are public literal string matching operators, but internally they are
+            // converted to $regex and later evaluated with new RegExp(...) in FilterUtils. Without escaping,
+            // input such as ".*", "admin|", or "(a+)+$" is interpreted as regex syntax. That can change
+            // filter meaning and can also trigger excessive backtracking in the browser.
+            value = FilterImpl._escapeRegExp(value);
             if (op === '$sw') {
                 value = '^' + value;
             }
@@ -2307,6 +2329,22 @@ class FilterImpl {
         }
         return value;
     }
+    /**
+     * Escapes JavaScript regular expression metacharacters in a string so the
+     * value can be embedded in a RegExp and matched literally.
+     *
+     * This is used before building RegExp instances from literal filter text. It
+     * prefixes every JavaScript RegExp metacharacter with a backslash:
+     *   . * + - ? ^ $ { } ( ) | [ ] \
+     * The replacement string "\\$&" means "insert a backslash, then the entire
+     * matched character".
+     *
+     * @param value The string value to escape.
+     * @returns A string with every RegExp metacharacter prefixed by a backslash.
+     */
+    static _escapeRegExp(value) {
+        return value.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&');
+    }
 }
 // Bound text-filter input size to reduce regex amplification risks
 FilterImpl._MAX_TEXT_FILTER_LENGTH = 512;

package/dist/js/libs/oj/debug_esm/ojdataproviderscroller.js

@@ -2804,12 +2804,9 @@ IteratingDataProviderContentHandler.prototype._renderItemsWhenIdle = function (
       addFragmentOnRequestAnimationFrame(fragment);
     });
   } else {
-    // Chromium has an issue with requestIdleCallback when mouse wheel is used, see Chrome :
-    // https://bugs.chromium.org/p/chromium/issues/detail?id=822269
-    var options;
-    if (isMouseWheel && oj.AgentUtils.getAgentInfo().engine === oj.AgentUtils.ENGINE.BLINK) {
-      options = { timeout: 100 };
-    }
+    // Use a timeout so fetch rendering is not blocked indefinitely when the browser
+    // does not get an idle period, including scrollbar and mouse wheel scrolling.
+    var options = { timeout: 100 };
     this.m_idleCallback = window.requestIdleCallback(function (idleDeadline) {
       // no need to check for whether listview has been destroyed yet since we cancel the callback on destroy
       var timeRemaining = idleDeadline.timeRemaining();

package/dist/js/libs/oj/debug_esm/ojdatetimepicker.js

@@ -1441,6 +1441,33 @@ function _getMetaData(dayMetaData, position, params) {
   );
 }
 
+/**
+ * JET-79822 - JET - ARM5_UNCONSTRAINED- F37 - OJ-INPUT-DATE DAYFORMATTER CLASSNAME UNESCAPED IN HTML CLASS ATTRIBUTE
+ * Encodes application-supplied text before it is inserted into a generated HTML attribute string.
+ *
+ * @param {string} value value to encode
+ * @returns {string} value encoded for an HTML attribute
+ * @ignore
+ */
+function _escapeHtmlAttribute(value) {
+  return String(value).replace(/[&'"<>]/g, function (match) {
+    switch (match) {
+      case '&':
+        return '&amp;';
+      case "'":
+        return '&#39;';
+      case '"':
+        return '&quot;';
+      case '<':
+        return '&lt;';
+      case '>':
+        return '&gt;';
+      default:
+        return match;
+    }
+  });
+}
+
 /**
  * For default converter
  * @static
@@ -2829,9 +2856,13 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * it shows all the time.
      * </p>
      * <p>
-     * For security reasons we only support urls with protocol 'http:' or 'https:'.
-     * If the url doesn't comply we ignore it and throw an error.
-     * Pass in an encoded URL since we do not encode the URL.</p>
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. If the url doesn't
+     * comply we ignore it and throw an error. JET does not validate whether
+     * the URL is trusted for the application. Applications are responsible
+     * for providing sanitized URLs and enforcing any required origin or host
+     * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
      *
      * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
      *
@@ -2877,6 +2908,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * <p>
      * To include formatted text in the help.instruction, format the string using html tags.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * For example the
      * help.instruction might look like:
      * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -3007,6 +3040,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the message detail, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -3497,6 +3532,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the help.instruction, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -6845,7 +6882,7 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
               (otherMonth && daysOutsideMonth === 'hidden'
                 ? ''
                 : ' ' +
-                  daySettings[1] + // highlight custom dates
+                  _escapeHtmlAttribute(daySettings[1]) + // highlight custom dates
                   (selected ? ' ' + this._CURRENT_CLASS : '') + // highlight selected day
                   (printDate.getTime() === today.getTime() ? ' oj-datepicker-today' : '')) +
               "'" + // highlight today (if different)
@@ -11066,6 +11103,8 @@ oj.__registerWidget('oj.ojInputTime', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the help.instruction, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -14394,9 +14433,13 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * it shows all the time.
      * </p>
      * <p>
-     * For security reasons we only support urls with protocol 'http:' or 'https:'.
-     * If the url doesn't comply we ignore it and throw an error.
-     * Pass in an encoded URL since we do not encode the URL.</p>
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. If the url doesn't
+     * comply we ignore it and throw an error. JET does not validate whether
+     * the URL is trusted for the application. Applications are responsible
+     * for providing sanitized URLs and enforcing any required origin or host
+     * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
      *
      * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
      *
@@ -14442,6 +14485,8 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * <p>
      * To include formatted text in the help.instruction, format the string using html tags.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * For example the
      * help.instruction might look like:
      * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -14572,6 +14617,8 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the message detail, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>

package/dist/js/libs/oj/debug_esm/ojdomutils.js

@@ -32,7 +32,16 @@ const DomUtils = {
     SMALL: 1,
     PRE: 1
   },
-  _LEGAL_ATTRIBUTES: { class: 1, style: 1 }
+  _LEGAL_ATTRIBUTES: { class: 1, style: 1 },
+  _LEGAL_CSS_PROPERTIES: {
+    color: 1,
+    'font-style': 1,
+    'font-weight': 1,
+    'text-decoration': 1,
+    'text-decoration-line': 1
+  },
+  _ILLEGAL_CSS_VALUE_PATTERN:
+    /(?:url\s*\(|expression\s*\(|behavior\s*:|-moz-binding|@import|!important|var\s*\()/i
 };
 
 /**
@@ -53,11 +62,13 @@ DomUtils.isHTMLContent = function (content) {
 };
 
 DomUtils.cleanHtml = function (value) {
-  var offSpan = $(document.createElement('span')).get(0);
-  offSpan.innerHTML = value; // @HTMLUpdateOK safe manipulation
+  var offSpan = document.createElement('span');
+  var template = document.createElement('template');
+  template.innerHTML = value; // @HTMLUpdateOK template content is sanitized before use
   if (value && value.indexOf('\x3c') >= 0) {
-    DomUtils._cleanElementHtml(offSpan);
+    DomUtils._cleanElementHtml(template.content);
   }
+  offSpan.appendChild(template.content); // @HTMLUpdateOK appending sanitized template content
   return offSpan;
 };
 
@@ -71,22 +82,73 @@ DomUtils._cleanElementHtml = function (node) {
         var attrs = child.attributes;
         for (var i = attrs.length - 1; i >= 0; i--) {
           var attr = attrs[i];
+          var attrName = attr.name.toLowerCase();
           // jquery - the .attr() method returns undefined for attributes that have not been set.
           var childHasAttr = $(child).attr(attr.name) !== undefined;
           if (childHasAttr) {
-            if (!Object.hasOwn(DomUtils._LEGAL_ATTRIBUTES, attr.name)) {
+            if (!Object.hasOwn(DomUtils._LEGAL_ATTRIBUTES, attrName)) {
               child.removeAttribute(attr.nodeName);
+            } else if (attrName === 'style') {
+              DomUtils._sanitizeStyleAttribute(child);
             }
           }
         }
         DomUtils._cleanElementHtml(child);
-      } else if (child) {
+      } else {
         node.removeChild(child);
       }
+    } else if (child && child.nodeType === 8) {
+      node.removeChild(child);
+    }
+  }
+};
+
+DomUtils._sanitizeStyleAttribute = function (node) {
+  var cleanDeclarations = [];
+  var style = node.style;
+  var properties = Array.from(style);
+
+  for (var i = 0; i < properties.length; i++) {
+    var property = properties[i];
+    var value = style.getPropertyValue(property);
+    var cleanValue = DomUtils._getCleanHtmlCssValue(
+      property,
+      value,
+      style.getPropertyPriority(property)
+    );
+
+    if (cleanValue) {
+      cleanDeclarations.push({ property: property, value: cleanValue });
+    }
+  }
+
+  node.removeAttribute('style');
+
+  if (cleanDeclarations.length > 0) {
+    for (var j = 0; j < cleanDeclarations.length; j++) {
+      var cleanDeclaration = cleanDeclarations[j];
+      node.style.setProperty(cleanDeclaration.property, cleanDeclaration.value);
     }
   }
 };
 
+DomUtils._getCleanHtmlCssValue = function (property, value, priority) {
+  if (
+    !Object.hasOwn(DomUtils._LEGAL_CSS_PROPERTIES, property) ||
+    !value ||
+    priority ||
+    DomUtils._ILLEGAL_CSS_VALUE_PATTERN.test(value)
+  ) {
+    return null;
+  }
+
+  if (window.CSS && CSS.supports && !CSS.supports(property, value)) {
+    return null;
+  }
+
+  return value;
+};
+
 /**
  * Checks to see if the "ancestorNode" is a ancestor of "node".
  *
@@ -879,10 +941,10 @@ DomUtils.isLogicalAncestorOrSelf = function (ancestorNode, node) {
 };
 
 /**
- * Checks whether the href represents a safe URL
+ * Checks whether the href uses an allowed URL protocol.
  * @param {!string} href - HREF to test
  * @param {Array=} whitelist - optional list of the allowed protocols. Protocol name has to use lowercase letters and
- * be followed by a ':'. If the parameter is ommitted, ['http:', 'https:'] will be used
+ * be followed by a ':'. If the parameter is omitted, ['http:', 'https:'] will be used
  * @throws {Exception} an error if the HREF represents an invalid URL
  * @ignore
  */
@@ -896,10 +958,12 @@ DomUtils.validateURL = function (href, whitelist) {
   if (protocol != null) {
     protocol = protocol.toLowerCase();
   }
-  // if it isn't on the allowed list and it isn't '', throw an error.
-  // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
-  // and we want to allow hrefs like 'abc' since those are relative urls.
-  if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+  // Security issues JET-79830, JET-79570, and JET-79644 flagged the legacy
+  // empty-protocol allowance. IE11 returned '' for some relative URLs, but IE11
+  // is no longer supported. Modern browsers resolve relative URLs against the
+  // document URL before exposing the protocol, so an empty protocol is not
+  // treated as valid.
+  if (allowed.indexOf(protocol) < 0) {
     throw new Error(protocol + ' is not a valid URL protocol');
   }
 };