@oracle/oraclejet 20.0.4 → 20.0.6

package/dist/js/libs/oj/debug/ojcore-base.js

@@ -37,12 +37,12 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
      * @global
      * @member {string} version JET version numberr
      */
-    version: '20.0.4',
+    version: '20.0.6',
     /**
      * @global
      * @member {string} revision JET source code revision number
      */
-    revision: '2026-05-11_12-47-09',
+    revision: '2026-07-15_07-49-28',
 
     // This function is only meant to be used outside the library, so quoting the name
     // to avoid renaming is appropriate
@@ -404,6 +404,17 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
    * @private
    */
   var _DEBUG = 'DEBUG';
+  var _debug = false;
+
+  Object.defineProperty(Assert, _DEBUG, {
+    get: function () {
+      return _debug;
+    },
+    set: function (value) {
+      _debug = true && value === true;
+    },
+    enumerable: true
+  });
 
   /**
    * @private
@@ -411,12 +422,14 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
   const _NO_PROTO = "' doesn't match prototype ";
 
   /**
-   * Forces DEBUG to be set to true
+   * Forces DEBUG to be set to true in debug builds
    * @export
    * @memberof oj.Assert
    */
   Assert.forceDebug = function () {
-    Assert[_DEBUG] = true;
+    if (true) {
+      Assert[_DEBUG] = true;
+    }
   };
 
   /**
@@ -930,6 +943,17 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
   const CollectionUtils = {};
   oj._registerLegacyNamespaceProp('CollectionUtils', CollectionUtils);
 
+  /**
+   * Returns true if the key provided should be blocked from merge utilities.
+   * Specifically keys that could cause prototype pollution issues are included.
+   * @param {string} key
+   * @return {boolean}
+   * @private
+   */
+  CollectionUtils._isBlockedKey = function (key) {
+    return key === '__proto__' || key === 'constructor' || key === 'prototype';
+  };
+
   /**
    * Copies all of the properties of source into the target and returns the target
    *
@@ -959,11 +983,13 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
     const source = sources.shift();
     if (isPlain(target) && isPlain(source)) {
       Object.keys(source).forEach((key) => {
-        if (isPlain(source[key])) {
-          if (!target[key]) Object.assign(target, { [key]: {} });
-          merge(target[key], source[key]);
-        } else {
-          Object.assign(target, { [key]: source[key] });
+        if (!CollectionUtils._isBlockedKey(key)) {
+          if (isPlain(source[key])) {
+            if (!target[key]) Object.assign(target, { [key]: {} });
+            merge(target[key], source[key]);
+          } else {
+            Object.assign(target, { [key]: source[key] });
+          }
         }
       });
     }
@@ -1022,34 +1048,35 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
         } else {
           targetKey = k;
         }
-
-        var sourceVal = source[k];
-
-        var recursed = false;
-
-        if (recurse && currentLevel < maxRecursionDepth) {
-          var targetVal = target[targetKey];
-          if (
-            CollectionUtils.isPlainObject(sourceVal) &&
-            (targetVal == null || CollectionUtils.isPlainObject(targetVal))
-          ) {
-            recursed = true;
+        if (!CollectionUtils._isBlockedKey(k) && !CollectionUtils._isBlockedKey(targetKey)) {
+          var sourceVal = source[k];
+
+          var recursed = false;
+
+          if (recurse && currentLevel < maxRecursionDepth) {
+            var targetVal = target[targetKey];
+            if (
+              CollectionUtils.isPlainObject(sourceVal) &&
+              (targetVal == null || CollectionUtils.isPlainObject(targetVal))
+            ) {
+              recursed = true;
+              // eslint-disable-next-line no-param-reassign
+              target[targetKey] = targetVal || {};
+              CollectionUtils._copyIntoImpl(
+                target[targetKey],
+                sourceVal,
+                keyConverter,
+                true,
+                maxRecursionDepth,
+                currentLevel + 1
+              );
+            }
+          }
+          if (!recursed) {
             // eslint-disable-next-line no-param-reassign
-            target[targetKey] = targetVal || {};
-            CollectionUtils._copyIntoImpl(
-              target[targetKey],
-              sourceVal,
-              keyConverter,
-              true,
-              maxRecursionDepth,
-              currentLevel + 1
-            );
+            target[targetKey] = sourceVal;
           }
         }
-        if (!recursed) {
-          // eslint-disable-next-line no-param-reassign
-          target[targetKey] = sourceVal;
-        }
       }
     }
 
@@ -1296,6 +1323,11 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
 
     // postMessage "message" event listener for the setImmediate impl
     function _nextTickHandler(event) {
+      // Only process messages posted by this window from the same origin.
+      if (event.source !== window || event.origin !== window.location.origin) {
+        return;
+      }
+
       var data = event.data;
       if (!data || data.message !== 'oj-setImmediate') {
         return;
@@ -1331,7 +1363,7 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
         window.addEventListener('message', _nextTickHandler);
       }
 
-      window.postMessage({ id: id, message: 'oj-setImmediate' }, '*');
+      window.postMessage({ id: id, message: 'oj-setImmediate' }, '/');
       return id;
     }
 

package/dist/js/libs/oj/debug/ojcorerouter.js

@@ -178,10 +178,19 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * activity that must be completed before the transition is finalized.
    * <pre class="prettyprint">
    * <code>
+   * var routeModuleMap = {
+   *   dashboard: 'dashboard',
+   *   incidents: 'incidents'
+   * };
+   *
    * router.currentState.subscribe(function (args) {
    *   var state = args.state;
-   *   var name = state.path;
    *   var complete = args.complete;
+   *   var name = routeModuleMap[state.path];
+   *   if (!name) {
+   *     complete(Promise.reject(new Error('Unknown module route')));
+   *     return;
+   *   }
    *   // Load the module and return Promise to CoreRouter
    *   complete(
    *     Promise.all([
@@ -250,6 +259,10 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * <p>
    * <h5>With RegExp as path.</h5>
    * Note that all paths matching the regular expression will be using this configuration entry.
+   * String routes with known safe names can be used to load matching modules. If RegExp,
+   * catch-all, URL-derived, or user-controlled path values are used to load modules or
+   * other resources, map the matched value to an explicit allowed resource identifier
+   * instead of using the raw matched value directly.
    * <pre class="prettyprint">
    * <code>
    * var root = new CoreRouter([
@@ -478,7 +491,7 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
       let match = path;
       // If path is string, match it entirely
       if (typeof path === 'string') {
-        match = new RegExp('^' + path + '$');
+        match = new RegExp('^' + RegExp.escape(path) + '$');
       } else if (!(path instanceof RegExp)) {
         throw Error('Router path must be a string or RegExp');
       }
@@ -1046,7 +1059,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
 
     this.beforeStateChange = null;
     this.currentState = null;
-    this._parentRouter.childRouter = null;
+    if (this._parentRouter) {
+      this._parentRouter.childRouter = null;
+    }
 
     if (this === rootRouter) {
       window.removeEventListener('popstate', this._popstateHandler, false);
@@ -1081,7 +1096,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * can be referenced in the state.
    * @typedef {object} CoreRouter.DetailedRouteConfig
    * @property {string|RegExp} path The path of the route. This may be an exact-
-   * match string, or a regular expression.
+   * match string, or a regular expression. If application code uses a RegExp-matched
+   * path to load a module or other resource, use the route detail to provide an
+   * explicit allowed resource identifier instead of loading the raw matched path value.
    * @property {object=} detail An optional detail object which is passed to
    * the route when it is navigated to.
    * @ojsignature [{target: "Type", value: "D", for: "detail"},
@@ -1095,7 +1112,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * route.
    * @typedef {object} CoreRouter.RedirectedRouteConfig
    * @property {string|RegExp} path The path of the route. This may be an exact-
-   * match string, or a regular expression.
+   * match string, or a regular expression. If application code uses a RegExp-matched
+   * path to load a module or other resource, map it to an explicit allowed resource
+   * identifier instead of loading the raw matched path value.
    * @property {string=} redirect An optional name of a route to which paths matching
    * this route will redirect. The redirected route's path must be of type string.
    */

package/dist/js/libs/oj/debug/ojcspexpressionevaluator-internal.js

@@ -293,20 +293,33 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     }
 
     function _evaluateMember(node, contexts) {
+      var memberAccess = _getMemberAccess(node, contexts);
+      if (memberAccess.length === 0) {
+        return memberAccess;
+      }
+      var value = _getMemberValue(memberAccess);
+      return [memberAccess[0], value];
+    }
+
+    function _getMemberAccess(node, contexts) {
       var object = _evaluate(node.object, contexts);
       if (!object && node.optional) {
         // handle optional chaining operator: test?.prop
         return [];
-      } else if (node.computed) {
-        return [object, object[_evaluate(node.property, contexts)]];
       }
-      return [object, object[node.property.name]];
+      var key = node.computed ? _evaluate(node.property, contexts) : node.property.name;
+      return _getMemberAccessForKey(object, key);
     }
 
     function _evaluateObjectExpression(node, contexts) {
       return node.properties.reduce(function (acc, curr) {
         const key = ojexpparser.getKeyValue(curr.key);
-        acc[key] = _evaluateAndUnwrap(curr.value, contexts);
+        Object.defineProperty(acc, key, {
+          configurable: true,
+          enumerable: true,
+          value: _evaluateAndUnwrap(curr.value, contexts),
+          writable: true
+        });
         return acc;
       }, {});
     }
@@ -315,7 +328,7 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     function _getValue(contexts, name) {
       var target = _getContextForIdentifier(contexts, name);
       if (target) {
-        return target[name];
+        return _getMemberValue(_getMemberAccessForKey(target, name));
       }
       throw new Error('Variable ' + name + ' is undefined');
     }
@@ -324,7 +337,7 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     function _getValueWithContext(contexts, name) {
       var target = _getContextForIdentifier(contexts, name);
       if (target) {
-        return [target, target[name]];
+        return [target, _getMemberValue(_getMemberAccessForKey(target, name))];
       }
       throw new Error('Variable ' + name + ' is undefined');
     }
@@ -337,11 +350,18 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
           if (!target) {
             _throwError('Cannot assign value to undefined variable ' + name);
           }
-          target[name] = val;
+          var identifierAccess = _getMemberAccessForKey(target, name);
+          if (_isRestrictedMemberKey(identifierAccess[1])) {
+            _throwError('Assignment to member "' + identifierAccess[1] + '" is not allowed');
+          }
+          identifierAccess[0][identifierAccess[1]] = val;
           break;
         case ojexpparser.MEMBER_EXP:
-          var key = node.computed ? _evaluateAndUnwrap(node.property, contexts) : node.property.name;
-          _evaluateMember(node, contexts)[0][key] = val;
+          var memberAccess = _getMemberAccess(node, contexts);
+          if (_isRestrictedMemberKey(memberAccess[1])) {
+            _throwError('Assignment to member "' + memberAccess[1] + '" is not allowed');
+          }
+          memberAccess[0][memberAccess[1]] = val;
           break;
         default:
           _throwError('Expression of type: ' + node.type + ' not supported for assignment');
@@ -400,6 +420,94 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
       return result.join('');
     }
 
+    // Block prototype-chain escape hatches. Safe data objects can still expose these
+    // names as own, non-accessor properties, but never as inherited capabilities.
+    function _getMemberAccessForKey(object, key) {
+      var propertyKey = typeof key === 'symbol' ? key : String(key);
+      return [object, propertyKey, _validateMemberKey(object, propertyKey)];
+    }
+
+    function _validateMemberKey(object, key) {
+      if (object === Object && _isUnsafeObjectStaticMember(key)) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (_isInheritedIntrinsicPrototypeHelper(object, key)) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      }
+      if (!_isRestrictedMemberKey(key)) {
+        return null;
+      }
+      var descriptor = Object.getOwnPropertyDescriptor(Object(object), key);
+      if (!descriptor || !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (typeof descriptor.value === 'function') {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (key === 'prototype' && typeof object === 'function') {
+        _throwError('Access to member "' + key + '" is not allowed');
+      }
+      return descriptor;
+    }
+
+    function _getMemberValue(memberAccess) {
+      // For restricted keys, use the validated data-descriptor value rather than
+      // invoking a Proxy get trap that could return a different capability.
+      return memberAccess[2] ? memberAccess[2].value : memberAccess[0][memberAccess[1]];
+    }
+
+    function _isRestrictedMemberKey(propertyKey) {
+      return (
+        propertyKey === 'constructor' || propertyKey === '__proto__' || propertyKey === 'prototype'
+      );
+    }
+
+    // These legacy accessors can recover or modify an intrinsic prototype without
+    // evaluating a restricted member name. Allow applications to use an own data
+    // property with one of these names, but reject the inherited intrinsic helpers.
+    function _isInheritedIntrinsicPrototypeHelper(object, propertyKey) {
+      if (
+        propertyKey !== '__lookupGetter__' &&
+        propertyKey !== '__lookupSetter__' &&
+        propertyKey !== '__defineGetter__' &&
+        propertyKey !== '__defineSetter__'
+      ) {
+        return false;
+      }
+
+      var target = Object(object);
+      var visitedTargets = new Set();
+      while (target) {
+        // An extensible Proxy can report itself, or an earlier object, as its
+        // prototype. Treat cycles as unsafe rather than looping indefinitely.
+        if (visitedTargets.has(target)) {
+          return true;
+        }
+        visitedTargets.add(target);
+        var descriptor = Object.getOwnPropertyDescriptor(target, propertyKey);
+        if (descriptor) {
+          return (
+            (target === Object.prototype || target === Function.prototype) &&
+            typeof descriptor.value === 'function'
+          );
+        }
+        target = Object.getPrototypeOf(target);
+      }
+      return false;
+    }
+
+    // The evaluator exposes Object by default. These reflection methods can otherwise
+    // retrieve or mutate intrinsic prototypes and recover Function through descriptors.
+    function _isUnsafeObjectStaticMember(propertyKey) {
+      return (
+        propertyKey === 'assign' ||
+        propertyKey === 'create' ||
+        propertyKey === 'defineProperty' ||
+        propertyKey === 'defineProperties' ||
+        propertyKey === 'getOwnPropertyDescriptor' ||
+        propertyKey === 'getOwnPropertyDescriptors' ||
+        propertyKey === 'getPrototypeOf' ||
+        propertyKey === 'setPrototypeOf'
+      );
+    }
+
     function _getContextForIdentifier(contexts, name) {
       for (var i = 0; i < contexts.length; i++) {
         var context = contexts[i];

package/dist/js/libs/oj/debug/ojcspexpressionevaluator.js

@@ -23,22 +23,29 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
   /**
    * @class oj.CspExpressionEvaluator
    * @since 7.1.0
-   * @ojshortdesc Object representing CSP-compliant evaluator.
+   * @ojshortdesc Object representing a Content Security Policy (CSP)-compliant evaluator.
    * @ojtsmodule
    *
-   * @classdesc A class for creating CSP-compliant evaluators of JavaScript expressions
-   * <p> The default JET expression evaluator cannot be used when Content Security Policy
-   * prohibits unsafe evaluations. In order to replace the default evaluator with the JET CSP-compliant evaluator,
-   * create and pass an instance of CspExpressionEvaluator class to the
-   * <a href="oj.Config.html#.setExpressionEvaluator">Config.setExpressionEvaluator()</a> method.
-   * This method must be called before applying knockout bindings in the application for the first time.
+   * @classdesc A class for creating Content Security Policy (CSP)-compliant evaluators of JavaScript expressions.
+   * Content Security Policy is a browser security mechanism that can disallow dynamically compiled code, including
+   * code generated with JavaScript Function constructors.
+   * <p> Starting with JET 20.0.6, the default JET expression evaluator is CSP-compliant and uses
+   * CspExpressionEvaluator. To provide an additional global scope for evaluating expressions, create and pass a
+   * CspExpressionEvaluator instance to the <a href="oj.Config.html#.setExpressionEvaluator">Config.setExpressionEvaluator()</a>
+   * method before applying knockout bindings in the application for the first time.
    * </p>
    *
-   * <p>Any extra context required for evaluating expressions can be passed to the object constructor using <code>globalScope</code> property.</p>
+   * <p>Any extra context required for evaluating expressions can be passed to the object constructor using the <code>globalScope</code> property.
+   * Expression text must be trusted application code. This evaluator is CSP-compliant because it does not use dynamic code compilation; it is
+   * not a security sandbox. Restricting <code>globalScope</code> does not make untrusted expression text safe because expressions can access
+   * capabilities from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs. This
+   * evaluator restricts known prototype-chain access routes in its default capabilities, but applications remain responsible for the
+   * capabilities they expose.</p>
    *
    * <pre class="prettyprint">
    * <code>
-   * Config.setExpressionEvaluator(new CspExpressionEvaluator());
+   * const extraScope = { Date: Date };
+   * Config.setExpressionEvaluator(new CspExpressionEvaluator({ globalScope: extraScope }));
    * </code>
    * </pre>
    *
@@ -77,9 +84,16 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
    * <h2 id="invalidExpressions">Expression limitations:
    *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#invalidExpressions"></a>
    * </h2>
-   * <p> The following code is not supported in expressions:
+   * <p> The following syntax and behaviors are unsupported or restricted in expressions:
    * <ul>
-   *  <li>Assignment operators of any types such as <code>'='</code> or <code>'+='</code> or <code>'|='</code></li>
+   *  <li>Expression text must be trusted application code. This evaluator avoids dynamic code compilation for CSP compliance, but it is not a security sandbox. Expressions can invoke functions and access non-restricted values from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs, as well as <code>globalScope</code>.</li>
+   *  <li>To prevent prototype-chain access, access to properties named <code>'constructor'</code>, <code>'__proto__'</code>, and <code>'prototype'</code> is read-only and supported only as own, non-accessor, non-function data properties, including when accessed with bracket notation or as an identifier. A <code>'prototype'</code> property cannot be accessed on a function. For these names, a Proxy's data descriptor value is used instead of its <code>get</code> trap result.</li>
+   *  <li>Inherited <code>'__lookupGetter__'</code>, <code>'__lookupSetter__'</code>, <code>'__defineGetter__'</code>, and <code>'__defineSetter__'</code> prototype helpers are not supported. Own data properties with these names are supported.</li>
+   *  <li>An object-literal <code>'__proto__'</code> property is created as an own data property and does not change the object's prototype.</li>
+   *  <li>The default <code>Object</code> global does not support <code>assign</code> or the reflection methods <code>create</code>, <code>defineProperty</code>, <code>defineProperties</code>, <code>getOwnPropertyDescriptor</code>, <code>getOwnPropertyDescriptors</code>, <code>getPrototypeOf</code>, or <code>setPrototypeOf</code>.</li>
+   *  <li>Assignment operators of any type, such as <code>'='</code>, <code>'+='</code>, or <code>'|='</code>, are generally unsupported.
+   *    JET and Knockout may use internal assignment expressions to implement two-way binding writeback; applications should not rely on
+   *    assignment being accepted in expression text.</li>
    *  <li>Blocks of code such as <code>'if (...){}'</code></li>
    *  <li>Comma operator (,) such as <code>'(expr1, expr2)'</code></li>
    *  <li>in operator such as <code>'prop in testObject'</code></li>
@@ -94,6 +108,7 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
    * @param {Object} options
    * @param {any=} options.globalScope optional additional scope required for evaluating expressions.
    * The additional scope will be used to resolve the variables if they are not defined in the $data or $context.
+   * It is not a security boundary for untrusted expression text.
    * <pre class="prettyprint"><code>Config.setExpressionEvaluator(new CspExpressionEvaluator({globalScope:extraScope}));</code></pre>
    * @constructor
    * @final

package/dist/js/libs/oj/debug/ojcustomelement-utils.js

@@ -552,7 +552,9 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcustomelement-registry', 'ojs/ojcon
             if (attrValue != null) {
                 let exp = AttributeUtils.getExpressionInfo(attrValue).expr;
                 if (exp == null) {
-                    exp = stringify ? `'${attrValue}'` : attrValue;
+                    // Binding strings are evaluated as expressions. Serialize literal attribute
+                    // values so quotes and other JavaScript syntax characters remain data.
+                    exp = stringify ? JSON.stringify(attrValue) : attrValue;
                 }
                 return exp;
             }

package/dist/js/libs/oj/debug/ojcustomelement.js

@@ -180,6 +180,7 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
       // as well since we don't reflect property values back to the DOM attribute.
       const prop = ojcustomelementUtils.AttributeUtils.attributeToPropertyName(attr);
       const bridge = ojcustomelementUtils.CustomElementUtils.getElementBridge(this);
+      BaseCustomElementBridge.__ValidatePropertyPath(this, prop);
       if (oldValue !== newValue || bridge.State.dirtyProps.has(prop)) {
         bridge.State.dirtyProps.delete(prop.split('.')[0]);
         // Due to  where IE11 disables child inputs for a parent with the disabled attribute,
@@ -323,6 +324,10 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     },
 
     GetProperty: function (element, prop, props) {
+      if (BaseCustomElementBridge.__IsBlockedPropertyPath(prop)) {
+        return undefined;
+      }
+
       var meta = MetadataUtils.getPropertyMetadata(prop, ojcustomelementRegistry.getElementProperties(element));
 
       // For event listener and non component properties, retrieve the value directly stored on the element.
@@ -377,6 +382,8 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
      * @return {boolean}
      */
     SaveEarlyPropertySet: function (element, prop, value) {
+      BaseCustomElementBridge.__ValidatePropertyPath(element, prop);
+
       // Do not save sets that occur during BaseCustomElementBridge.__InitProperties
       // or expression evaluation. We can process these as normal. Playback occurs before the
       // binding provider promise is resolved leading to component creation.
@@ -410,6 +417,8 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     },
 
     SetProperty: function (element, prop, value, props, bOuter) {
+      BaseCustomElementBridge.__ValidatePropertyPath(element, prop);
+
       // Check value against any defined enums
       var meta = MetadataUtils.getPropertyMetadata(prop, ojcustomelementRegistry.getElementProperties(element));
       if (ojcustomelementUtils.AttributeUtils.isEventListenerProperty(prop) || !meta) {
@@ -496,6 +505,8 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     },
 
     ValidatePropertySet: function (element, property, value) {
+      BaseCustomElementBridge.__ValidatePropertyPath(element, property);
+
       var propsMeta = ojcustomelementRegistry.getElementProperties(element);
       var propMeta = MetadataUtils.getPropertyMetadata(property, propsMeta);
       var propAr = property.split('.');
@@ -628,6 +639,7 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
       var keys = Object.keys(props);
       for (var i = 0; i < keys.length; i++) {
         var key = keys[i];
+        BaseCustomElementBridge.__ValidatePropertyPath(elem, key);
         if (key.indexOf('.') >= 0) {
           mutationKeys.push(key);
         } else {
@@ -734,6 +746,38 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     );
   };
 
+  /**
+   * Checks whether a property path segment could mutate Object.prototype or other prototypes.
+   * @param {string} property The property path
+   * @return {boolean} true if the path contains a blocked segment
+   * @ignore
+   */
+  BaseCustomElementBridge.__IsBlockedPropertyPath = function (property) {
+    var propPath = property.split('.');
+    for (var i = 0; i < propPath.length; i++) {
+      if (oj.CollectionUtils._isBlockedKey(propPath[i])) {
+        return true;
+      }
+    }
+    return false;
+  };
+
+  /**
+   * Validates a property path before walking objects with dot notation.
+   * @param {Element=} element The custom element
+   * @param {string} property The property path
+   * @ignore
+   */
+  BaseCustomElementBridge.__ValidatePropertyPath = function (element, property) {
+    if (BaseCustomElementBridge.__IsBlockedPropertyPath(property)) {
+      var message = `Invalid property path '${property}'.`;
+      if (element) {
+        throw new ojcustomelementUtils.JetElementError(element, message);
+      }
+      throw new Error(message);
+    }
+  };
+
   /**
    * Checks to see if there are any overlapping attribute for the given element and attribute
    * @ignore
@@ -766,6 +810,7 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
       for (var i = 0; i < attrs.length; i++) {
         var attr = attrs[i];
         var property = ojcustomelementUtils.AttributeUtils.attributeToPropertyName(attr.nodeName);
+        BaseCustomElementBridge.__ValidatePropertyPath(element, property);
 
         // See if attribute is a component property
         var meta = MetadataUtils.getPropertyMetadata(property, metaProps);
@@ -807,11 +852,14 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     var propsObj = componentProps;
     var propPath = property.split('.');
     var branchedProps;
+    BaseCustomElementBridge.__ValidatePropertyPath(null, property);
+
     // Set subproperty, initializing parent objects along the way unless the top level
     // property is not defined since setting it to an empty object will trigger a property changed
     // event. Instead, branch and set at the end. We only have listeners on top level properties
     // so setting a subproperty will not trigger a property changed event along the way.
     var topProp = propNameFun(propPath[0]);
+    BaseCustomElementBridge.__ValidatePropertyPath(null, topProp);
     if (propPath.length > 1 && !componentProps[topProp]) {
       branchedProps = {};
       propsObj = branchedProps;
@@ -820,6 +868,7 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     // Walk to the correct location
     for (var i = 0; i < propPath.length; i++) {
       var subprop = propNameFun(propPath[i]);
+      BaseCustomElementBridge.__ValidatePropertyPath(null, subprop);
       if (i === propPath.length - 1) {
         propsObj[subprop] = value;
       } else if (!propsObj[subprop]) {