@oracle/oraclejet 20.0.4 → 20.0.6

package/dist/js/libs/oj/debug/ojdataprovider.js

@@ -2165,6 +2165,9 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
             if (filter) {
                 let op = filter.op;
                 let filterValue;
+                const textFilterValue = filter['text'] == null
+                    ? null
+                    : String(filter['text']).substring(0, FilterImpl._MAX_TEXT_FILTER_LENGTH);
                 const collationOptions = filter.collationOptions;
                 if (op === '$exists' && filter['attribute'] && filter['criterion']) {
                     // NestedFilter
@@ -2173,7 +2176,7 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
                     transformedExpr['criterion'] = FilterImpl._transformFilter(FilterFactory.getFilter({ filterDef: filter['criterion'] }));
                     return transformedExpr;
                 }
-                if (filter['text']) {
+                if (textFilterValue !== null) {
                     op = '$regex';
                 }
                 else {
@@ -2189,24 +2192,26 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
                     }
                 }
                 if (op !== '$and' && op !== '$or') {
-                    if (filter['text']) {
+                    if (textFilterValue !== null) {
                         if (filter['matchBy'] === 'phrase') {
                             // 1. Escape special characters
                             // 2. Remove single and double quotes
                             // 3. Add word boundary and wild cards for phrase matching
                             filterValue = new RegExp(`${'\\b' +
-                            filter['text']
-                                .replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')
+                            FilterImpl._escapeRegExp(textFilterValue)
                                 .replace(/('|")/g, '')
-                                .replace(/(\s|\t)/g, '(.*)((\\s|\\t|\\r|\\n)*)')}`, 'i');
+                                // Avoid nested quantifiers that can trigger ReDoS.
+                                // Equivalent to original "(.*)((\\s|\\t|\\r|\\n)*)" with JS-dot behavior:
+                                // non-newline chars followed by optional whitespace/newlines.
+                                .replace(/(\s|\t)/g, '[^\\r\\n]*[\\s\\t\\r\\n]*')}`, 'i');
                         }
                         else if (filter['matchBy'] === 'startsWith') {
-                            filterValue = new RegExp(`^${filter['text'].replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')}`, 'i');
+                            filterValue = new RegExp(`^${FilterImpl._escapeRegExp(textFilterValue)}`, 'i');
                         }
                         else {
                             // 'contains' | 'fuzzy' | 'unknown'
                             // Escape special characters without change filter['text'] which is the original filter string by default
-                            filterValue = new RegExp(filter['text'].replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&'), 'i');
+                            filterValue = new RegExp(FilterImpl._escapeRegExp(textFilterValue), 'i');
                         }
                     }
                     else {
@@ -2225,7 +2230,7 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
                         operatorExpr[op] = filterValue;
                         transformedExpr[attributeExpr] = operatorExpr;
                     }
-                    else if (filter['text']) {
+                    else if (textFilterValue !== null) {
                         // handle TextFilterDef
                         const operatorExpr = {};
                         operatorExpr[op] = filterValue;
@@ -2277,12 +2282,27 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
                     const fieldAttributePath = path ? path + '.' + fieldAttribute : fieldAttribute;
                     if (!(fieldValue instanceof Object)) {
                         const operatorExpr = {};
-                        // need express co, sw and ew as regex
-                        if (op === '$sw' || op === '$ew' || op === '$co') {
-                            fieldValue = FilterImpl._fixStringExpr(op, fieldValue);
-                            op = '$regex';
+                        // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+                        // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+                        //
+                        // AttributeFilterDef object values are expanded into one criterion per field. For example,
+                        // { op: '$ew', value: { name: 'admin', value: 'foo' } } becomes an $and expression with
+                        // separate criteria for "name" and "value". The $co/$sw/$ew operators are implemented by
+                        // converting each field criterion to $regex, because FilterUtils only has a regex evaluator
+                        // for contains/starts-with/ends-with matching in this transformed expression.
+                        //
+                        // Keep the converted operator in a local variable. Mutating the shared op parameter while
+                        // processing the first field would cause later sibling fields to see "$regex" instead of the
+                        // original "$co", "$sw", or "$ew". That would skip _fixStringExpr for later fields, losing
+                        // either the $sw/$ew anchoring semantics or the regex escaping added for the ReDoS fix.
+                        // This behavior is intentionally changed/fixed as part of the security fix so every field
+                        // in an object filter preserves the original string operator semantics before regex conversion.
+                        let fieldOp = op;
+                        if (fieldOp === '$sw' || fieldOp === '$ew' || fieldOp === '$co') {
+                            fieldValue = FilterImpl._fixStringExpr(fieldOp, fieldValue);
+                            fieldOp = '$regex';
                         }
-                        operatorExpr[op] = fieldValue;
+                        operatorExpr[fieldOp] = fieldValue;
                         const fieldExpr = {};
                         fieldExpr[fieldAttributePath] = operatorExpr;
                         criteriaArray.push(fieldExpr);
@@ -2302,6 +2322,14 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
         }
         static _fixStringExpr(op, value) {
             if (typeof value === 'string' || value instanceof String) {
+                // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+                // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+                //
+                // $co, $sw, and $ew are public literal string matching operators, but internally they are
+                // converted to $regex and later evaluated with new RegExp(...) in FilterUtils. Without escaping,
+                // input such as ".*", "admin|", or "(a+)+$" is interpreted as regex syntax. That can change
+                // filter meaning and can also trigger excessive backtracking in the browser.
+                value = FilterImpl._escapeRegExp(value);
                 if (op === '$sw') {
                     value = '^' + value;
                 }
@@ -2311,7 +2339,25 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
             }
             return value;
         }
+        /**
+         * Escapes JavaScript regular expression metacharacters in a string so the
+         * value can be embedded in a RegExp and matched literally.
+         *
+         * This is used before building RegExp instances from literal filter text. It
+         * prefixes every JavaScript RegExp metacharacter with a backslash:
+         *   . * + - ? ^ $ { } ( ) | [ ] \
+         * The replacement string "\\$&" means "insert a backslash, then the entire
+         * matched character".
+         *
+         * @param value The string value to escape.
+         * @returns A string with every RegExp metacharacter prefixed by a backslash.
+         */
+        static _escapeRegExp(value) {
+            return value.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&');
+        }
     }
+    // Bound text-filter input size to reduce regex amplification risks
+    FilterImpl._MAX_TEXT_FILTER_LENGTH = 512;
     class FilterFactory {
         static getFilter(options) {
             return new FilterImpl(options);

package/dist/js/libs/oj/debug/ojdataproviderscroller.js

@@ -2811,12 +2811,9 @@ define(['exports', 'ojs/ojcore-base', 'jquery', 'ojs/ojcontext', 'ojs/ojdatacoll
         addFragmentOnRequestAnimationFrame(fragment);
       });
     } else {
-      // Chromium has an issue with requestIdleCallback when mouse wheel is used, see Chrome :
-      // https://bugs.chromium.org/p/chromium/issues/detail?id=822269
-      var options;
-      if (isMouseWheel && oj.AgentUtils.getAgentInfo().engine === oj.AgentUtils.ENGINE.BLINK) {
-        options = { timeout: 100 };
-      }
+      // Use a timeout so fetch rendering is not blocked indefinitely when the browser
+      // does not get an idle period, including scrollbar and mouse wheel scrolling.
+      var options = { timeout: 100 };
       this.m_idleCallback = window.requestIdleCallback(function (idleDeadline) {
         // no need to check for whether listview has been destroyed yet since we cancel the callback on destroy
         var timeRemaining = idleDeadline.timeRemaining();

package/dist/js/libs/oj/debug/ojdatetimepicker.js

@@ -1426,6 +1426,33 @@ var __oj_input_date_time_metadata =
     );
   }
 
+  /**
+   * JET-79822 - JET - ARM5_UNCONSTRAINED- F37 - OJ-INPUT-DATE DAYFORMATTER CLASSNAME UNESCAPED IN HTML CLASS ATTRIBUTE
+   * Encodes application-supplied text before it is inserted into a generated HTML attribute string.
+   *
+   * @param {string} value value to encode
+   * @returns {string} value encoded for an HTML attribute
+   * @ignore
+   */
+  function _escapeHtmlAttribute(value) {
+    return String(value).replace(/[&'"<>]/g, function (match) {
+      switch (match) {
+        case '&':
+          return '&amp;';
+        case "'":
+          return '&#39;';
+        case '"':
+          return '&quot;';
+        case '<':
+          return '&lt;';
+        case '>':
+          return '&gt;';
+        default:
+          return match;
+      }
+    });
+  }
+
   /**
    * For default converter
    * @static
@@ -2815,9 +2842,13 @@ var __oj_input_date_time_metadata =
        * it shows all the time.
        * </p>
        * <p>
-       * For security reasons we only support urls with protocol 'http:' or 'https:'.
-       * If the url doesn't comply we ignore it and throw an error.
-       * Pass in an encoded URL since we do not encode the URL.</p>
+       * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+       * currently supports <code class="prettyprint">http:</code> and
+       * <code class="prettyprint">https:</code> protocols. If the url doesn't
+       * comply we ignore it and throw an error. JET does not validate whether
+       * the URL is trusted for the application. Applications are responsible
+       * for providing sanitized URLs and enforcing any required origin or host
+       * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
        *
        * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
        *
@@ -2863,6 +2894,8 @@ var __oj_input_date_time_metadata =
        * <p>
        * To include formatted text in the help.instruction, format the string using html tags.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * For example the
        * help.instruction might look like:
        * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -2993,6 +3026,8 @@ var __oj_input_date_time_metadata =
        * hints and message summary text cannot. If you use formatted text, it should be accessible
        * and make sense to the user if formatting wasn't there.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * To format the message detail, you could do this:
        * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
        * </p>
@@ -3483,6 +3518,8 @@ var __oj_input_date_time_metadata =
        * hints and message summary text cannot. If you use formatted text, it should be accessible
        * and make sense to the user if formatting wasn't there.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * To format the help.instruction, you could do this:
        * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
        * </p>
@@ -6841,7 +6878,7 @@ var __oj_input_date_time_metadata =
                 (otherMonth && daysOutsideMonth === 'hidden'
                   ? ''
                   : ' ' +
-                    daySettings[1] + // highlight custom dates
+                    _escapeHtmlAttribute(daySettings[1]) + // highlight custom dates
                     (selected ? ' ' + this._CURRENT_CLASS : '') + // highlight selected day
                     (printDate.getTime() === today.getTime() ? ' oj-datepicker-today' : '')) +
                 "'" + // highlight today (if different)
@@ -11070,6 +11107,8 @@ var __oj_input_date_time_metadata =
        * hints and message summary text cannot. If you use formatted text, it should be accessible
        * and make sense to the user if formatting wasn't there.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * To format the help.instruction, you could do this:
        * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
        * </p>
@@ -14400,9 +14439,13 @@ var __oj_input_date_time_metadata =
        * it shows all the time.
        * </p>
        * <p>
-       * For security reasons we only support urls with protocol 'http:' or 'https:'.
-       * If the url doesn't comply we ignore it and throw an error.
-       * Pass in an encoded URL since we do not encode the URL.</p>
+       * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+       * currently supports <code class="prettyprint">http:</code> and
+       * <code class="prettyprint">https:</code> protocols. If the url doesn't
+       * comply we ignore it and throw an error. JET does not validate whether
+       * the URL is trusted for the application. Applications are responsible
+       * for providing sanitized URLs and enforcing any required origin or host
+       * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
        *
        * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
        *
@@ -14448,6 +14491,8 @@ var __oj_input_date_time_metadata =
        * <p>
        * To include formatted text in the help.instruction, format the string using html tags.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * For example the
        * help.instruction might look like:
        * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -14578,6 +14623,8 @@ var __oj_input_date_time_metadata =
        * hints and message summary text cannot. If you use formatted text, it should be accessible
        * and make sense to the user if formatting wasn't there.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * To format the message detail, you could do this:
        * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
        * </p>

package/dist/js/libs/oj/debug/ojdomutils.js

@@ -33,7 +33,16 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
       SMALL: 1,
       PRE: 1
     },
-    _LEGAL_ATTRIBUTES: { class: 1, style: 1 }
+    _LEGAL_ATTRIBUTES: { class: 1, style: 1 },
+    _LEGAL_CSS_PROPERTIES: {
+      color: 1,
+      'font-style': 1,
+      'font-weight': 1,
+      'text-decoration': 1,
+      'text-decoration-line': 1
+    },
+    _ILLEGAL_CSS_VALUE_PATTERN:
+      /(?:url\s*\(|expression\s*\(|behavior\s*:|-moz-binding|@import|!important|var\s*\()/i
   };
 
   /**
@@ -54,11 +63,13 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
   };
 
   DomUtils.cleanHtml = function (value) {
-    var offSpan = $(document.createElement('span')).get(0);
-    offSpan.innerHTML = value; // @HTMLUpdateOK safe manipulation
+    var offSpan = document.createElement('span');
+    var template = document.createElement('template');
+    template.innerHTML = value; // @HTMLUpdateOK template content is sanitized before use
     if (value && value.indexOf('\x3c') >= 0) {
-      DomUtils._cleanElementHtml(offSpan);
+      DomUtils._cleanElementHtml(template.content);
     }
+    offSpan.appendChild(template.content); // @HTMLUpdateOK appending sanitized template content
     return offSpan;
   };
 
@@ -68,26 +79,77 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
     for (var count = children.length - 1; count >= 0; count--) {
       var child = children.item(count);
       if (child && child.nodeType === 1) {
-        if (DomUtils._LEGAL_ELEMENTS[child.nodeName]) {
+        if (Object.hasOwn(DomUtils._LEGAL_ELEMENTS, child.nodeName)) {
           var attrs = child.attributes;
           for (var i = attrs.length - 1; i >= 0; i--) {
             var attr = attrs[i];
+            var attrName = attr.name.toLowerCase();
             // jquery - the .attr() method returns undefined for attributes that have not been set.
             var childHasAttr = $(child).attr(attr.name) !== undefined;
             if (childHasAttr) {
-              if (!DomUtils._LEGAL_ATTRIBUTES[attr.name]) {
+              if (!Object.hasOwn(DomUtils._LEGAL_ATTRIBUTES, attrName)) {
                 child.removeAttribute(attr.nodeName);
+              } else if (attrName === 'style') {
+                DomUtils._sanitizeStyleAttribute(child);
               }
             }
           }
           DomUtils._cleanElementHtml(child);
-        } else if (child) {
+        } else {
           node.removeChild(child);
         }
+      } else if (child && child.nodeType === 8) {
+        node.removeChild(child);
+      }
+    }
+  };
+
+  DomUtils._sanitizeStyleAttribute = function (node) {
+    var cleanDeclarations = [];
+    var style = node.style;
+    var properties = Array.from(style);
+
+    for (var i = 0; i < properties.length; i++) {
+      var property = properties[i];
+      var value = style.getPropertyValue(property);
+      var cleanValue = DomUtils._getCleanHtmlCssValue(
+        property,
+        value,
+        style.getPropertyPriority(property)
+      );
+
+      if (cleanValue) {
+        cleanDeclarations.push({ property: property, value: cleanValue });
+      }
+    }
+
+    node.removeAttribute('style');
+
+    if (cleanDeclarations.length > 0) {
+      for (var j = 0; j < cleanDeclarations.length; j++) {
+        var cleanDeclaration = cleanDeclarations[j];
+        node.style.setProperty(cleanDeclaration.property, cleanDeclaration.value);
       }
     }
   };
 
+  DomUtils._getCleanHtmlCssValue = function (property, value, priority) {
+    if (
+      !Object.hasOwn(DomUtils._LEGAL_CSS_PROPERTIES, property) ||
+      !value ||
+      priority ||
+      DomUtils._ILLEGAL_CSS_VALUE_PATTERN.test(value)
+    ) {
+      return null;
+    }
+
+    if (window.CSS && CSS.supports && !CSS.supports(property, value)) {
+      return null;
+    }
+
+    return value;
+  };
+
   /**
    * Checks to see if the "ancestorNode" is a ancestor of "node".
    *
@@ -880,10 +942,10 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
   };
 
   /**
-   * Checks whether the href represents a safe URL
+   * Checks whether the href uses an allowed URL protocol.
    * @param {!string} href - HREF to test
    * @param {Array=} whitelist - optional list of the allowed protocols. Protocol name has to use lowercase letters and
-   * be followed by a ':'. If the parameter is ommitted, ['http:', 'https:'] will be used
+   * be followed by a ':'. If the parameter is omitted, ['http:', 'https:'] will be used
    * @throws {Exception} an error if the HREF represents an invalid URL
    * @ignore
    */
@@ -897,10 +959,12 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
     if (protocol != null) {
       protocol = protocol.toLowerCase();
     }
-    // if it isn't on the allowed list and it isn't '', throw an error.
-    // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
-    // and we want to allow hrefs like 'abc' since those are relative urls.
-    if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+    // Security issues JET-79830, JET-79570, and JET-79644 flagged the legacy
+    // empty-protocol allowance. IE11 returned '' for some relative URLs, but IE11
+    // is no longer supported. Modern browsers resolve relative URLs against the
+    // document URL before exposing the protocol, so an empty protocol is not
+    // treated as valid.
+    if (allowed.indexOf(protocol) < 0) {
       throw new Error(protocol + ' is not a valid URL protocol');
     }
   };

package/dist/js/libs/oj/debug/ojdvt-base.js

@@ -1543,9 +1543,7 @@ define(['ojs/ojdataprovider', 'ojs/ojcore-base', 'ojs/ojdvt-toolkit', 'ojs/ojcon
                   }
                 });
               } else {
-                processedDatum = Object.create(nodeData);
-                processedDatum._noTemplate = true;
-                processedDatum._dvtNoClone = true;
+                processedDatum = { ...nodeData, _noTemplate: true, _dvtNoClone: true };
               }
               nodeDataMap.set(nodeKey, { data: processedDatum, context: context });
             }