@oracle/oraclejet 19.0.8 → 19.0.9

package/dist/js/libs/oj/debug_esm/ojlistview.js

@@ -1988,7 +1988,7 @@ const _ojListView = _ListViewUtils.clazz(
                 // if event target is within listview, but not around items, e.g. the padding
                 var active = self.m_active && self.m_active.elem;
                 if (active == null && self.element.attr('tabIndex') === '0') {
-                  self.element.focus();
+                  self._initFocus(event, true);
                 } else if (active != null) {
                   self._makeFocusable(active);
                   self.HighlightActive();
@@ -5550,13 +5550,13 @@ const _ojListView = _ListViewUtils.clazz(
      * Initialize focus by finding the first focusable item and set focus on it
      * @private
      */
-    _initFocus: function (event) {
+    _initFocus: function (event, preventScroll) {
       var items = this._getItemsCache();
       for (var i = 0; i < items.length; i++) {
         var item = $(items[i]);
         // make sure item can receive focus
         if (!this.SkipFocus(item)) {
-          this.SetCurrentItem(item, event);
+          this.SetCurrentItem(item, event, false, preventScroll);
           break;
         }
       }
@@ -7346,10 +7346,11 @@ const _ojListView = _ListViewUtils.clazz(
      * @param {jQuery} item the item to set as active
      * @param {Event} event the event that triggers set active
      * @param {boolean=} skipFocus true if to skip focusing the item
+     * @param {boolean=} preventScroll true if prevent scroll when focus
      * @return {boolean} true if item becomes active, false for all other cases
      * @private
      */
-    _setActive: function (item, event, skipFocus) {
+    _setActive: function (item, event, skipFocus, preventScroll) {
       var active;
 
       // set key info
@@ -7408,7 +7409,7 @@ const _ojListView = _ListViewUtils.clazz(
               (event.originalEvent && event.originalEvent.type !== 'click') ||
               (this._isMultipleToggleSelection() && event.shiftKey)
             ) {
-              this._focusItem(item);
+              this._focusItem(item, preventScroll);
             }
 
             // reset tabindex of previous focus item, note this has to be done after focusing on a new item
@@ -7430,7 +7431,7 @@ const _ojListView = _ListViewUtils.clazz(
             this._makeFocusable(item);
             // make sure ul is not tabbable
             this.RemoveRootElementTabIndex();
-            this._focusItem(item);
+            this._focusItem(item, preventScroll);
           }
         }
       } else {
@@ -7452,12 +7453,12 @@ const _ojListView = _ListViewUtils.clazz(
      * Put browser focus on item (or children of item)
      * @private
      */
-    _focusItem: function (item) {
+    _focusItem: function (item, preventScroll) {
       var elem = this.getFocusItem(item).get(0);
       if (elem) {
         try {
           this.m_inShiftingFocus = true;
-          elem.focus();
+          elem.focus({ preventScroll });
         } finally {
           this.m_inShiftingFocus = false;
         }
@@ -7514,8 +7515,8 @@ const _ojListView = _ListViewUtils.clazz(
      * Sets the active item and bring focus to it.  Update the currentItem option.
      * @protected
      */
-    SetCurrentItem: function (item, event, skipFocus) {
-      var proceed = this.ActiveAndFocus(item, event, skipFocus);
+    SetCurrentItem: function (item, event, skipFocus, preventScroll) {
+      var proceed = this.ActiveAndFocus(item, event, skipFocus, preventScroll);
       if (proceed) {
         this._setCurrentItemOption(this.GetKey(item[0]), event, item.get(0));
       }
@@ -7525,15 +7526,17 @@ const _ojListView = _ListViewUtils.clazz(
      * Sets the active item and bring focus to it.
      * @protected
      */
-    ActiveAndFocus: function (item, event, skipFocus) {
+    ActiveAndFocus: function (item, event, skipFocus, preventScroll) {
       // make sure that it is visible
-      this._scrollToVisible(item[0]);
+      if (!preventScroll) {
+        this._scrollToVisible(item[0]);
+      }
 
       // unhighlight any previous active item
       this.UnhighlightActive();
 
       // update active and frontier
-      var proceed = this._setActive(item, event, skipFocus);
+      var proceed = this._setActive(item, event, skipFocus, preventScroll);
 
       // highlight active
       this.HighlightActive();

package/dist/js/libs/oj/debug_esm/ojlogger.js

@@ -26,11 +26,12 @@ import { error as error$1, info as info$1, warn as warn$1, log as log$1, getLogL
  *
  * <p>If the logging options are changed at a later point, the Logger will use the modified options for the subsequent log operations.
  *
- * <p>The logging level can be overridden via sessionStorage.setItem() call for the current browser session.
+ * <p>In debug builds, the logging level can be overridden via sessionStorage.setItem() call for the current browser session.
  * Use 'ojet.logLevel' as the key with one of the following values: 'none' (least verbose), 'error', 'warning', 'info', 'log' (most verbose).
  * Set the value in the browser console and refresh the browser in order for the value to take effect.
+ * Production builds ignore this key.
  * </p>
- * <h3> Session storage usage : </h3>
+ * <h3> Session storage usage in debug builds : </h3>
  * <pre class="prettyprint">
  * <code>
  * // override logging level for the current session

package/dist/js/libs/oj/debug_esm/ojmessage.js

@@ -13,7 +13,7 @@ import oj from 'ojs/ojcore-base';
 import $ from 'jquery';
 import { observable } from 'knockout';
 import { startAnimation } from 'ojs/ojanimation';
-import { isTouchSupported, getReadingDirection } from 'ojs/ojdomutils';
+import { isTouchSupported, getReadingDirection, validateURL } from 'ojs/ojdomutils';
 import { subtreeHidden } from 'ojs/ojcomponentcore';
 import { register } from 'ojs/ojcomposite';
 import Context from 'ojs/ojcontext';
@@ -24,6 +24,34 @@ import { getComponentTranslations, getTranslatedString } from 'ojs/ojtranslation
 
 const ojMessage = {};
 
+const ALLOWED_AUDIO_URL_PROTOCOLS = ['http:', 'https:', 'data:', 'blob:'];
+
+function encodeCssUrlControlCharacter(char) {
+  var hex = char.charCodeAt(0).toString(16).toUpperCase();
+  return '%' + (hex.length < 2 ? '0' + hex : hex);
+}
+
+function escapeCssUrlString(url) {
+  var escapedUrl = '';
+  var urlString = String(url);
+  for (var i = 0; i < urlString.length; i++) {
+    var char = urlString.charAt(i);
+    var charCode = char.charCodeAt(0);
+    if (char === '"' || char === '\\') {
+      escapedUrl += '\\' + char;
+    } else if (charCode <= 0x1f || charCode === 0x7f) {
+      escapedUrl += encodeCssUrlControlCharacter(char);
+    } else {
+      escapedUrl += char;
+    }
+  }
+  return escapedUrl;
+}
+
+function getCssUrl(url) {
+  return 'url("' + escapeCssUrlString(url) + '")';
+}
+
 /**
  * @ojcomponent oj.ojMessage
  * @since 5.0.0
@@ -61,10 +89,13 @@ const ojMessage = {};
  *
  * <p>The {@link oj.ojMessage#message.sound} property is an accessibility feature for playing a
  * sound when a message is opened. This property defaults to "none", and can be enabled by setting
- * it to "defaults" or by providing URL to an audio file of a format that the browser supports. An
- * accessible application must provide a way for users to enable sound on a settings or preferences
- * page. Some browsers will have auto-play disabled by default, enabling it may require adjusting
- * the browser settings.</p>
+ * it to "defaults" or by providing a URL to an audio file of a format that the browser supports.
+ * Custom sound URLs are validated before playback. Relative URLs and URLs that resolve to
+ * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="touch-section">
  *   Touch End User Information
@@ -416,9 +447,12 @@ const ojMessage = {};
  * required for low vision users who view a zoomed section of the UI. Because messages may be shown
  * outside of the zoomed section, such users require sound to be played to notify of new messages.</p>
  *
- * <p>This attribute can take a URL of the audio file for the custom sound to be played. The
- * supported formats are mp3, wav and ogg. Browser support should also be considered while choosing
- * the format of the audio file. Literal string values
+ * <p>This attribute can take a URL of the audio file for the custom sound to be played. Custom
+ * sound URLs are validated before playback. Relative URLs and URLs that resolve to
+ * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. The supported formats are mp3, wav and ogg. Browser support should also be considered
+ * while choosing the format of the audio file. Literal string values
  * <code class="prettyprint">"defaults"</code> and <code class="prettyprint">"none"</code> can also
  * be used for this attribute. If the value is set to "none", then the sound will be disabled. If
  * the value is set to "defaults", then a default sound is played.<p>
@@ -1252,7 +1286,7 @@ MessageViewModel.prototype._computeIconStyle = function () {
     return undefined;
   }
 
-  return ["url('", message.icon, "') no-repeat"].join('');
+  return getCssUrl(message.icon) + ' no-repeat';
 };
 
 MessageViewModel.prototype._computeIconClass = function () {
@@ -1485,6 +1519,13 @@ MessageViewModel.prototype._handleKeydown = function (event) {
 MessageViewModel.prototype._playSound = function (sound) {
   // Custom URL was specified for the sound, using <audio> element is simple and best for this case.
   if (sound !== 'defaults') {
+    try {
+      validateURL(sound, ALLOWED_AUDIO_URL_PROTOCOLS);
+    } catch (error) {
+      info(`JET oj-message: Invalid URL in message.sound='${sound}'. Error: ${error}`);
+      return;
+    }
+
     var audio = document.createElement('AUDIO');
     audio.src = sound;
 

package/dist/js/libs/oj/debug_esm/ojmessagebanner.js

@@ -1366,9 +1366,12 @@ var __decorate = (null && null.__decorate) || function (decorators, target, key,
  * <p>The <code class="prettyprint">MessageBannerItem["sound"]</code> property is an accessibility
  * feature for playing a sound when a message is opened. This property defaults to "none", and can
  * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
- * browser supports. An accessible application must provide a way for users to enable sound on a
- * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
- * it may require adjusting the browser settings.</p>
+ * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+ * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="keyboard-section">
  *   Keyboard End User Information

package/dist/js/libs/oj/debug_esm/ojmetadatautils.js

@@ -158,7 +158,15 @@ MetadataUtils.getComplexPropertyMetadata = function (propPath, metadata) {
   if (subProp) {
     const namePath = propPath.split('.');
     for (let i = 0; i < namePath.length; i++) {
-      subProp = subProp[namePath[i]];
+      const propName = namePath[i];
+      if (
+        oj.CollectionUtils._isBlockedKey(propName) ||
+        !Object.prototype.hasOwnProperty.call(subProp, propName)
+      ) {
+        subProp = undefined;
+      } else {
+        subProp = subProp[propName];
+      }
       if (i === 0) {
         prop = subProp;
       }

package/dist/js/libs/oj/debug_esm/ojmodel.js

@@ -948,18 +948,6 @@ RestImpl.addOptions = function (starter, options, customOptions) {
     }
   });
 
-  if (options && options.oauthHeader) {
-    // if there are no any headers then create a new one.
-    if (!initial[RestImpl._HEADER_PROP]) initial[RestImpl._HEADER_PROP] = {};
-    Object.keys(options.oauthHeader || {}).forEach(function (prop) {
-      if (Object.prototype.hasOwnProperty.call(options.oauthHeader, prop)) {
-        if (!Object.prototype.hasOwnProperty.call(initial[RestImpl._HEADER_PROP], prop)) {
-          initial[RestImpl._HEADER_PROP][prop] = options.oauthHeader[prop];
-        }
-      }
-    });
-  }
-
   return initial;
 };
 
@@ -3163,10 +3151,6 @@ Model.prototype.sync = function (method, model, options) {
  */
 Model._internalSync = function (method, model, opt) {
   var options = opt || {};
-  // If Model/Collection has OAuth object, then create Authorization header (see RestImpl.addOptions)
-  if (model.oauth) {
-    options.oauthHeader = model.oauth.getHeader();
-  }
 
   // Make sure to transfer the data type if it's set on the calling object
   if (!options.dataType && model.dataType) {
@@ -8329,27 +8313,27 @@ Collection.prototype.GetCollectionFetchUrl = function (opt) {
     } else {
       url += '?';
     }
-    url += 'limit=' + limit;
+    url += 'limit=' + encodeURIComponent(limit);
 
     if (!all) {
       if (Collection._defined(options.startIndex)) {
-        url += '&offset=' + options.startIndex;
+        url += '&offset=' + encodeURIComponent(options.startIndex);
       }
       if (options.startID) {
-        url += '&fromID=' + options.startID;
+        url += '&fromID=' + encodeURIComponent(options.startID);
       }
       if (options.since) {
-        url += '&since=' + options.since;
+        url += '&since=' + encodeURIComponent(options.since);
       }
       if (options.until) {
-        url += '&until=' + options.until;
+        url += '&until=' + encodeURIComponent(options.until);
       }
     }
     // Query
     if (options.query) {
       var queryString = Collection._getQueryString(options.query);
       if (queryString && queryString.length > 0) {
-        url += '&q=' + queryString;
+        url += '&q=' + encodeURIComponent(queryString);
       }
     }
 
@@ -8358,13 +8342,16 @@ Collection.prototype.GetCollectionFetchUrl = function (opt) {
     if (comparator && oj.StringUtils.isString(comparator)) {
       var attrs = this._getSortAttrs(comparator);
       var sortDirStr = this._getSortDirStr();
+      var orderBy = '';
       var i;
       for (i = 0; i < attrs.length; i++) {
-        if (i === 0) {
-          url += '&orderBy=' + attrs[i] + ':' + sortDirStr;
-        } else {
-          url += ',' + attrs[i] + ':' + sortDirStr;
+        if (i > 0) {
+          orderBy += ',';
         }
+        orderBy += attrs[i] + ':' + sortDirStr;
+      }
+      if (orderBy.length > 0) {
+        url += '&orderBy=' + encodeURIComponent(orderBy);
       }
     }
     // Always ask for totalresults
@@ -8408,268 +8395,4 @@ Collection.prototype.sync = function (method, collection, options) {
  */
 Collection._FETCH_SIZE_PROP = 'fetchSize';
 
-/**
- * @export
- * @class OAuth
- * @classdesc Member of Model objects. Object representing name/value pairs for a data service record
- *
- * @param {Object} attributes Initial set of attribute/value pairs with which to seed this OAuth object
- * @param {string} header Actual name for the Authorization header (default 'Authorization')
- * @example <caption>Initialize OAuth with client credentials</caption>
- * var myOAuth = new OAuth('X-Authorization', {...Client Credentials ...});
- *
- * @example <caption>Initialize OAuth with access_token</caption>
- * var myOAuth = new OAuth('X-Authorization', {...Access Token...});
- *
- * @example <caption>Initialize empty OAuth and set access_token</caption>
- * var myOAuth = new OAuth();
- * myOAuth.setAccessTokenResponse({...Access Token...});
- *
- * @constructor
- * @final
- * @since 1.0.0
- */
-const OAuth = function (header, attributes) {
-  OAuth._init(this, attributes || {}, header || 'Authorization');
-};
-
-oj._registerLegacyNamespaceProp('OAuth', OAuth);
-
-// Subclass from oj.Object
-oj.Object.createSubclass(OAuth, oj.Object, 'oj.OAuth');
-
-OAuth.prototype.Init = function () {
-  OAuth.superclass.Init.call(this);
-};
-
-/**
- * Calculates Authorization header based on client credentials or access_token
- * @return {Object} OAuth 2.0 Authorization header
- * @example <caption>Get Authorization header</caption>
- * myOAuth.getHeader();
- *
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.getHeader = function () {
-  var headers = {};
-  if (!this.accessTokenResponse.access_token) {
-    this.clientCredentialGrant();
-  }
-  headers[this.accessTokenRequest.auth_header] = 'Bearer ' + this.accessTokenResponse.access_token;
-  return headers;
-};
-
-/**
- * Check is OAuth initialized (not null access_token).
- * @return {boolean} true/false
- * @example <caption>Check if OAuth initialized</caption>
- * if(myOAuth.isInitialized()) console.log('Initialized');
- *
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.isInitialized = function () {
-  if (this.accessTokenResponse && this.accessTokenResponse.access_token) {
-    return true;
-  }
-  return false;
-};
-
-/**
- * Request for access_token(bearer token) using Client Credential Authorization Grant.
- * Initialize response part of the OAuth object (access_token, e.t.c.)
- * @return {undefined}
- * @example <caption>Set/Re-set response part of the OAuth object using Client Credentials</caption>
- * myOAuth.clientCredentialGrant();
- *
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.clientCredentialGrant = function () {
-  var headers = {};
-  var self = this;
-  headers[self.accessTokenRequest.auth_header] =
-    'Basic ' +
-    OAuth._base64_encode(
-      self.accessTokenRequest.client_id + ':' + self.accessTokenRequest.client_secret
-    );
-
-  $.ajax({
-    type: 'POST',
-    async: false,
-    url: this.accessTokenRequest.bearer_url,
-    data: 'grant_type=client_credentials',
-    headers: headers,
-    success: function (data) {
-      self.accessTokenResponse = OAuth._initAccessToken(self.accessTokenResponse, data);
-    },
-    error: function (jqXHR) {
-      throw new Error(jqXHR.responseText);
-    }
-  });
-};
-
-/**
- * Set response part of the OAuth object (access_token, e.t.c.)
- * @param {Object} data current response
- * @return {undefined}
- * @example <caption>'Initialize' response part of the OAuth object with access_token</caption>
- * myOAuth.setAccessTokenResponse({...Access Token...});
- *
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.setAccessTokenResponse = function (data) {
-  this.accessTokenResponse = OAuth._initAccessToken(this.accessTokenResponse, data);
-};
-
-/**
- * Get response part of the OAuth object (access_token, e.t.c.)
- * @return {Object} cached response
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.getAccessTokenResponse = function () {
-  return this.accessTokenResponse;
-};
-
-/**
- * Clean response part of the OAuth object (access_token, e.t.c.)
- * Null and remove all data from response part of the OAuth object
- * @return {undefined}
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.cleanAccessTokenResponse = function () {
-  OAuth._cleanAccessToken(this.accessTokenResponse);
-};
-
-/**
- * Set request part of the OAuth object (client credentials, uri endpoint)
- * @param {Object} data current client credentials and uri
- * @return {undefined}
- * @example <caption>'Initialize' request part of the OAuth object with client credentials and calculate
- * access_token</caption>
- * myOAuth.setAccessTokenRequest({...Client Credentials ...});
- * myOAuth.clientCredentialGrant();
- *
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.setAccessTokenRequest = function (data) {
-  this.accessTokenRequest = OAuth._initAccessToken(this.accessTokenRequest, data);
-};
-
-/**
- * Get request part of the OAuth object (client credentials, uri endpoint)
- * @return {Object} cached request
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.getAccessTokenRequest = function () {
-  return this.accessTokenRequest;
-};
-
-/**
- * Clean request part of the OAuth object (client credentials, uri endpoint)
- * Null and remove all data from request part of the OAuth object
- * @return {undefined}
- * @memberof OAuth
- * @export
- */
-OAuth.prototype.cleanAccessTokenRequest = function () {
-  OAuth._cleanAccessToken(this.accessTokenRequest);
-};
-
-/**
- * @private
- * @param {Object} oauth
- * @param {Object} attributes
- * @param {string|null} header
- */
-OAuth._init = function (oauth, attributes, header) {
-  var oa = oauth;
-  oa.Init();
-  oa.accessTokenRequest = {};
-  oa.accessTokenResponse = {};
-
-  if (attributes.access_token) {
-    // access_token has higher preference
-    oa.accessTokenResponse = OAuth._initAccessToken(oa.accessTokenResponse, attributes);
-  } else if (attributes.client_id && attributes.client_secret && attributes.bearer_url) {
-    // Client Credential Grant
-    oa.accessTokenResponse = OAuth._initAccessToken(oa.accessTokenRequest, attributes);
-  }
-  oa.accessTokenRequest.auth_header = header;
-};
-
-/**
- * @private
- * @param {Object} oauthObj - Request/Response object to deal with
- * @param {Object} data - object to populate
- */
-OAuth._initAccessToken = function (oauthObj, data) {
-  var dat = data || {};
-  var obj = oauthObj || {};
-  Object.keys(dat).forEach(function (prop) {
-    if (Object.prototype.hasOwnProperty.call(dat, prop)) {
-      obj[prop] = dat[prop];
-    }
-  });
-  return obj;
-};
-
-/**
- * @private
- * @param {Object} oauthObj - Request/Response object to deal with
- */
-OAuth._cleanAccessToken = function (oauthObj) {
-  var obj = oauthObj || {};
-
-  Object.keys(obj).forEach(function (key) {
-    if (Object.prototype.hasOwnProperty.call(obj, key)) {
-      if (key !== 'auth_header') {
-        obj[key] = null;
-        delete obj[key];
-      }
-    }
-  });
-};
-
-/**
- * @private
- * @param {string} a The data to calculate the base64 representation from
- * @return {string} The base64 representation
- */
-OAuth._base64_encode = function (a) {
-  var d;
-  var e;
-  var f;
-  var b;
-  var g = 0;
-  var h = 0;
-  var i = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
-  var c = [];
-
-  do {
-    d = a.charCodeAt(g);
-    g += 1;
-    e = a.charCodeAt(g);
-    g += 1;
-    f = a.charCodeAt(g);
-    g += 1;
-    b = (d << 16) | (e << 8) | f; // eslint-disable-line no-bitwise
-    d = (b >> 18) & 63; // eslint-disable-line no-bitwise
-    e = (b >> 12) & 63; // eslint-disable-line no-bitwise
-    f = (b >> 6) & 63; // eslint-disable-line no-bitwise
-    b &= 63; // eslint-disable-line no-bitwise
-    c[h] = i.charAt(d) + i.charAt(e) + i.charAt(f) + i.charAt(b);
-    h += 1;
-  } while (g < a.length);
-  c = c.join('');
-  d = a.length % 3;
-  return (d ? c.slice(0, d - 3) : c) + '==='.slice(d || 3);
-};
-
-export { Collection, Events, Model, OAuth, URLError, ajax, sync };
+export { Collection, Events, Model, URLError, ajax, sync };