@oracle/oraclejet 20.0.4 → 20.0.6

package/dist/js/libs/oj/debug/ojmodel.js

@@ -948,18 +948,6 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
       }
     });
 
-    if (options && options.oauthHeader) {
-      // if there are no any headers then create a new one.
-      if (!initial[RestImpl._HEADER_PROP]) initial[RestImpl._HEADER_PROP] = {};
-      Object.keys(options.oauthHeader || {}).forEach(function (prop) {
-        if (Object.prototype.hasOwnProperty.call(options.oauthHeader, prop)) {
-          if (!Object.prototype.hasOwnProperty.call(initial[RestImpl._HEADER_PROP], prop)) {
-            initial[RestImpl._HEADER_PROP][prop] = options.oauthHeader[prop];
-          }
-        }
-      });
-    }
-
     return initial;
   };
 
@@ -3163,10 +3151,6 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
    */
   Model._internalSync = function (method, model, opt) {
     var options = opt || {};
-    // If Model/Collection has OAuth object, then create Authorization header (see RestImpl.addOptions)
-    if (model.oauth) {
-      options.oauthHeader = model.oauth.getHeader();
-    }
 
     // Make sure to transfer the data type if it's set on the calling object
     if (!options.dataType && model.dataType) {
@@ -8331,27 +8315,27 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
       } else {
         url += '?';
       }
-      url += 'limit=' + limit;
+      url += 'limit=' + encodeURIComponent(limit);
 
       if (!all) {
         if (Collection._defined(options.startIndex)) {
-          url += '&offset=' + options.startIndex;
+          url += '&offset=' + encodeURIComponent(options.startIndex);
         }
         if (options.startID) {
-          url += '&fromID=' + options.startID;
+          url += '&fromID=' + encodeURIComponent(options.startID);
         }
         if (options.since) {
-          url += '&since=' + options.since;
+          url += '&since=' + encodeURIComponent(options.since);
         }
         if (options.until) {
-          url += '&until=' + options.until;
+          url += '&until=' + encodeURIComponent(options.until);
         }
       }
       // Query
       if (options.query) {
         var queryString = Collection._getQueryString(options.query);
         if (queryString && queryString.length > 0) {
-          url += '&q=' + queryString;
+          url += '&q=' + encodeURIComponent(queryString);
         }
       }
 
@@ -8360,13 +8344,16 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
       if (comparator && oj.StringUtils.isString(comparator)) {
         var attrs = this._getSortAttrs(comparator);
         var sortDirStr = this._getSortDirStr();
+        var orderBy = '';
         var i;
         for (i = 0; i < attrs.length; i++) {
-          if (i === 0) {
-            url += '&orderBy=' + attrs[i] + ':' + sortDirStr;
-          } else {
-            url += ',' + attrs[i] + ':' + sortDirStr;
+          if (i > 0) {
+            orderBy += ',';
           }
+          orderBy += attrs[i] + ':' + sortDirStr;
+        }
+        if (orderBy.length > 0) {
+          url += '&orderBy=' + encodeURIComponent(orderBy);
         }
       }
       // Always ask for totalresults
@@ -8410,274 +8397,9 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'jquery', 'ojs/ojconfig'],
    */
   Collection._FETCH_SIZE_PROP = 'fetchSize';
 
-  /**
-   * @export
-   * @class OAuth
-   * @classdesc Member of Model objects. Object representing name/value pairs for a data service record
-   *
-   * @param {Object} attributes Initial set of attribute/value pairs with which to seed this OAuth object
-   * @param {string} header Actual name for the Authorization header (default 'Authorization')
-   * @example <caption>Initialize OAuth with client credentials</caption>
-   * var myOAuth = new OAuth('X-Authorization', {...Client Credentials ...});
-   *
-   * @example <caption>Initialize OAuth with access_token</caption>
-   * var myOAuth = new OAuth('X-Authorization', {...Access Token...});
-   *
-   * @example <caption>Initialize empty OAuth and set access_token</caption>
-   * var myOAuth = new OAuth();
-   * myOAuth.setAccessTokenResponse({...Access Token...});
-   *
-   * @constructor
-   * @final
-   * @since 1.0.0
-   */
-  const OAuth = function (header, attributes) {
-    OAuth._init(this, attributes || {}, header || 'Authorization');
-  };
-
-  oj._registerLegacyNamespaceProp('OAuth', OAuth);
-
-  // Subclass from oj.Object
-  oj.Object.createSubclass(OAuth, oj.Object, 'oj.OAuth');
-
-  OAuth.prototype.Init = function () {
-    OAuth.superclass.Init.call(this);
-  };
-
-  /**
-   * Calculates Authorization header based on client credentials or access_token
-   * @return {Object} OAuth 2.0 Authorization header
-   * @example <caption>Get Authorization header</caption>
-   * myOAuth.getHeader();
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.getHeader = function () {
-    var headers = {};
-    if (!this.accessTokenResponse.access_token) {
-      this.clientCredentialGrant();
-    }
-    headers[this.accessTokenRequest.auth_header] = 'Bearer ' + this.accessTokenResponse.access_token;
-    return headers;
-  };
-
-  /**
-   * Check is OAuth initialized (not null access_token).
-   * @return {boolean} true/false
-   * @example <caption>Check if OAuth initialized</caption>
-   * if(myOAuth.isInitialized()) console.log('Initialized');
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.isInitialized = function () {
-    if (this.accessTokenResponse && this.accessTokenResponse.access_token) {
-      return true;
-    }
-    return false;
-  };
-
-  /**
-   * Request for access_token(bearer token) using Client Credential Authorization Grant.
-   * Initialize response part of the OAuth object (access_token, e.t.c.)
-   * @return {undefined}
-   * @example <caption>Set/Re-set response part of the OAuth object using Client Credentials</caption>
-   * myOAuth.clientCredentialGrant();
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.clientCredentialGrant = function () {
-    var headers = {};
-    var self = this;
-    headers[self.accessTokenRequest.auth_header] =
-      'Basic ' +
-      OAuth._base64_encode(
-        self.accessTokenRequest.client_id + ':' + self.accessTokenRequest.client_secret
-      );
-
-    $.ajax({
-      type: 'POST',
-      async: false,
-      url: this.accessTokenRequest.bearer_url,
-      data: 'grant_type=client_credentials',
-      headers: headers,
-      success: function (data) {
-        self.accessTokenResponse = OAuth._initAccessToken(self.accessTokenResponse, data);
-      },
-      error: function (jqXHR) {
-        throw new Error(jqXHR.responseText);
-      }
-    });
-  };
-
-  /**
-   * Set response part of the OAuth object (access_token, e.t.c.)
-   * @param {Object} data current response
-   * @return {undefined}
-   * @example <caption>'Initialize' response part of the OAuth object with access_token</caption>
-   * myOAuth.setAccessTokenResponse({...Access Token...});
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.setAccessTokenResponse = function (data) {
-    this.accessTokenResponse = OAuth._initAccessToken(this.accessTokenResponse, data);
-  };
-
-  /**
-   * Get response part of the OAuth object (access_token, e.t.c.)
-   * @return {Object} cached response
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.getAccessTokenResponse = function () {
-    return this.accessTokenResponse;
-  };
-
-  /**
-   * Clean response part of the OAuth object (access_token, e.t.c.)
-   * Null and remove all data from response part of the OAuth object
-   * @return {undefined}
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.cleanAccessTokenResponse = function () {
-    OAuth._cleanAccessToken(this.accessTokenResponse);
-  };
-
-  /**
-   * Set request part of the OAuth object (client credentials, uri endpoint)
-   * @param {Object} data current client credentials and uri
-   * @return {undefined}
-   * @example <caption>'Initialize' request part of the OAuth object with client credentials and calculate
-   * access_token</caption>
-   * myOAuth.setAccessTokenRequest({...Client Credentials ...});
-   * myOAuth.clientCredentialGrant();
-   *
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.setAccessTokenRequest = function (data) {
-    this.accessTokenRequest = OAuth._initAccessToken(this.accessTokenRequest, data);
-  };
-
-  /**
-   * Get request part of the OAuth object (client credentials, uri endpoint)
-   * @return {Object} cached request
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.getAccessTokenRequest = function () {
-    return this.accessTokenRequest;
-  };
-
-  /**
-   * Clean request part of the OAuth object (client credentials, uri endpoint)
-   * Null and remove all data from request part of the OAuth object
-   * @return {undefined}
-   * @memberof OAuth
-   * @export
-   */
-  OAuth.prototype.cleanAccessTokenRequest = function () {
-    OAuth._cleanAccessToken(this.accessTokenRequest);
-  };
-
-  /**
-   * @private
-   * @param {Object} oauth
-   * @param {Object} attributes
-   * @param {string|null} header
-   */
-  OAuth._init = function (oauth, attributes, header) {
-    var oa = oauth;
-    oa.Init();
-    oa.accessTokenRequest = {};
-    oa.accessTokenResponse = {};
-
-    if (attributes.access_token) {
-      // access_token has higher preference
-      oa.accessTokenResponse = OAuth._initAccessToken(oa.accessTokenResponse, attributes);
-    } else if (attributes.client_id && attributes.client_secret && attributes.bearer_url) {
-      // Client Credential Grant
-      oa.accessTokenResponse = OAuth._initAccessToken(oa.accessTokenRequest, attributes);
-    }
-    oa.accessTokenRequest.auth_header = header;
-  };
-
-  /**
-   * @private
-   * @param {Object} oauthObj - Request/Response object to deal with
-   * @param {Object} data - object to populate
-   */
-  OAuth._initAccessToken = function (oauthObj, data) {
-    var dat = data || {};
-    var obj = oauthObj || {};
-    Object.keys(dat).forEach(function (prop) {
-      if (Object.prototype.hasOwnProperty.call(dat, prop)) {
-        obj[prop] = dat[prop];
-      }
-    });
-    return obj;
-  };
-
-  /**
-   * @private
-   * @param {Object} oauthObj - Request/Response object to deal with
-   */
-  OAuth._cleanAccessToken = function (oauthObj) {
-    var obj = oauthObj || {};
-
-    Object.keys(obj).forEach(function (key) {
-      if (Object.prototype.hasOwnProperty.call(obj, key)) {
-        if (key !== 'auth_header') {
-          obj[key] = null;
-          delete obj[key];
-        }
-      }
-    });
-  };
-
-  /**
-   * @private
-   * @param {string} a The data to calculate the base64 representation from
-   * @return {string} The base64 representation
-   */
-  OAuth._base64_encode = function (a) {
-    var d;
-    var e;
-    var f;
-    var b;
-    var g = 0;
-    var h = 0;
-    var i = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';
-    var c = [];
-
-    do {
-      d = a.charCodeAt(g);
-      g += 1;
-      e = a.charCodeAt(g);
-      g += 1;
-      f = a.charCodeAt(g);
-      g += 1;
-      b = (d << 16) | (e << 8) | f; // eslint-disable-line no-bitwise
-      d = (b >> 18) & 63; // eslint-disable-line no-bitwise
-      e = (b >> 12) & 63; // eslint-disable-line no-bitwise
-      f = (b >> 6) & 63; // eslint-disable-line no-bitwise
-      b &= 63; // eslint-disable-line no-bitwise
-      c[h] = i.charAt(d) + i.charAt(e) + i.charAt(f) + i.charAt(b);
-      h += 1;
-    } while (g < a.length);
-    c = c.join('');
-    d = a.length % 3;
-    return (d ? c.slice(0, d - 3) : c) + '==='.slice(d || 3);
-  };
-
   exports.Collection = Collection;
   exports.Events = Events;
   exports.Model = Model;
-  exports.OAuth = OAuth;
   exports.URLError = URLError;
   exports.ajax = ajax;
   exports.sync = sync;

package/dist/js/libs/oj/debug/ojmodule-element-utils.js

@@ -60,6 +60,32 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojhtmlutils'], function (exports, oj,
 
   oj._registerLegacyNamespaceProp('ModuleElementUtils', ModuleElementUtils);
 
+  function isSafeSegment(segment) {
+    return segment !== '' && segment !== '.' && segment !== '..' && /^[A-Za-z0-9_.-]+$/.test(segment);
+  }
+
+  function isSafeResourcePath(path) {
+    if (
+      typeof path !== 'string' ||
+      path === '' ||
+      path.indexOf('\\') !== -1 ||
+      path.indexOf('!') !== -1 ||
+      path.indexOf(':') !== -1 ||
+      path.charAt(0) === '/'
+    ) {
+      return false;
+    }
+    var normalizedPath = path;
+    if (normalizedPath.indexOf('./') === 0) {
+      normalizedPath = normalizedPath.substring(2);
+    }
+    return normalizedPath.split('/').every(isSafeSegment);
+  }
+
+  function rejectInvalidPath() {
+    return Promise.reject(new Error('Invalid module path'));
+  }
+
   /**
    * Utility function for creating a view to be used in configuration object for oj-module.
    * @since 5.0.0
@@ -67,6 +93,11 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojhtmlutils'], function (exports, oj,
    * @param {Object} options Options object used to create a view
    * @param {string} options.viewPath The path to the view, relative to the RequireJS baseURL.
    *                                  The text plugin will be used for loading the view.
+   *                                  The path must be a safe relative resource identifier. Except for one leading
+   *                                  <code>./</code>, it must contain nonempty slash-separated segments made only of
+   *                                  ASCII letters, digits, <code>_</code>, <code>.</code>, and <code>-</code>.
+   *                                  The <code>.</code> and <code>..</code> segments, traversal, absolute paths, URL
+   *                                  schemes, backslashes, and RequireJS plugin syntax are not supported.
    * @param {Function=} options.require An optional instance of the require() function to be used for loading the view.
    *                    By default the path is relative to the baseUrl specified for the application require calls.
    *
@@ -84,6 +115,9 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojhtmlutils'], function (exports, oj,
     if (!(options && options.viewPath)) {
       return Promise.resolve([]);
     }
+    if (!isSafeResourcePath(options.viewPath)) {
+      return rejectInvalidPath();
+    }
 
     return (
       new Promise(function (resolve, reject) {
@@ -114,6 +148,11 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojhtmlutils'], function (exports, oj,
    *
    * @param {Object} options Options object used to create a view model
    * @param {string} options.viewModelPath The path to the model, relative to the RequireJS baseURL.
+   *                  The path must be a safe relative resource identifier. Except for one leading
+   *                  <code>./</code>, it must contain nonempty slash-separated segments made only of ASCII letters,
+   *                  digits, <code>_</code>, <code>.</code>, and <code>-</code>. The <code>.</code> and
+   *                  <code>..</code> segments, traversal, absolute paths, URL schemes, backslashes, and RequireJS
+   *                  plugin syntax are not supported.
    * @param {Function=} options.require An optional instance of the require() function to be used for loading the view model.
    *                  By default the path is relative to the baseUrl specified for the application require calls.
    * @param {any=} options.params Parameters object that will be passed either to the model constructor or
@@ -142,6 +181,9 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojhtmlutils'], function (exports, oj,
     if (!(options && options.viewModelPath)) {
       return Promise.resolve(null);
     }
+    if (!isSafeResourcePath(options.viewModelPath)) {
+      return rejectInvalidPath();
+    }
 
     return new Promise(function (resolve, reject) {
       var requireFunc = options.require ? options.require : require;
@@ -182,11 +224,26 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojhtmlutils'], function (exports, oj,
    *                  The view and view model will be loaded using default paths - 'views/' and 'viewModels/'.
    *                  The path is relative to the RequireJS baseURL.
    *                  The text plugin will be used for loading the view.
+   *                  The name must be a safe relative module identifier such as <code>dashboard</code>
+   *                  or <code>orders/detail</code>. It must contain nonempty slash-separated segments made only of
+   *                  ASCII letters, digits, <code>_</code>, <code>.</code>, and <code>-</code>; a leading
+   *                  <code>./</code> is not supported. The <code>.</code> and <code>..</code> segments, traversal,
+   *                  absolute paths, URL schemes, backslashes, and RequireJS plugin syntax are not supported.
+   *                  Values derived from URLs or user input should be mapped to explicit allowed
+   *                  module names before calling this method.
    *                  Use <code>viewPath</code> and <code>viewModelPath</code>
    *                  when you want to load view and view model from different locations.
    * @param {string=} options.viewPath The path to the view, relative to the RequireJS baseURL.
    *                  The text plugin will be used for loading the view.
+   *                  The path must be a safe relative resource identifier. Except for one leading <code>./</code>,
+   *                  it must contain nonempty slash-separated segments made only of ASCII letters, digits,
+   *                  <code>_</code>, <code>.</code>, and <code>-</code>; <code>.</code> and <code>..</code>
+   *                  segments are not supported.
    * @param {string=} options.viewModelPath The path to the model, relative to the RequireJS baseURL.
+   *                  The path must be a safe relative resource identifier. Except for one leading <code>./</code>,
+   *                  it must contain nonempty slash-separated segments made only of ASCII letters, digits,
+   *                  <code>_</code>, <code>.</code>, and <code>-</code>; <code>.</code> and <code>..</code>
+   *                  segments are not supported.
    * @param {Function=} options.require An optional instance of the require() function to be used
    *                  for loading the view and view model. By default the path is relative to the baseUrl
    *                  specified for the application require calls.
@@ -210,6 +267,12 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojhtmlutils'], function (exports, oj,
     }
     var viewPath = options.viewPath || 'views/' + options.name + '.html';
     var modelPath = options.viewModelPath || (options.name ? 'viewModels/' + options.name : null);
+    if (
+      (viewPath && !isSafeResourcePath(viewPath)) ||
+      (modelPath && !isSafeResourcePath(modelPath))
+    ) {
+      return rejectInvalidPath();
+    }
     return Promise.all([
       ModuleElementUtils.createView({ viewPath: viewPath, require: options.require }),
       ModuleElementUtils.createViewModel({

package/dist/js/libs/oj/debug/ojmodule.js

@@ -33,9 +33,11 @@ define(['ojs/ojcore-base', 'knockout', 'ojs/ojlogger', 'ojs/ojcontext', 'ojs/ojc
    * Note that the default names of the {@link ModuleBinding.ConventionMethods optional lifecycle methods}
    * on the ViewModel are different from their counterparts on the {@link ojModule.LifecycleListener LifecycleListener}
    * interface
-   * @property {string} viewPath default View path. Defaults to 'text!views/'
+   * @property {string} viewPath default View path. Defaults to 'text!views/'. The final View
+   * module path must be a safe relative path using the <code>text!</code> plugin prefix.
    * @property {string} viewSuffix default View suffix. Defaults to '.html'
-   * @property {string} modelPath default Model suffix. Defaults to 'viewModels/'
+   * @property {string} modelPath default Model suffix. Defaults to 'viewModels/'. The final
+   * ViewModel module path must be a safe relative path.
    * @property {string} initializeMethod name of the initialialization method
    * (see {@link ModuleBinding.ConventionMethods#initialize definition})
    * @property {string} disposeMethod name of the dispose method
@@ -74,6 +76,39 @@ define(['ojs/ojcore-base', 'knockout', 'ojs/ojlogger', 'ojs/ojcontext', 'ojs/ojc
    */
   ModuleBinding._EMPTY_MODULE = 'oj:blank';
 
+  function isSafeSegment(segment) {
+    return segment !== '' && segment !== '.' && segment !== '..' && /^[A-Za-z0-9_.-]+$/.test(segment);
+  }
+
+  function isSafeResourcePath(path) {
+    if (
+      typeof path !== 'string' ||
+      path === '' ||
+      path.indexOf('\\') !== -1 ||
+      path.indexOf('!') !== -1 ||
+      path.indexOf(':') !== -1 ||
+      path.charAt(0) === '/'
+    ) {
+      return false;
+    }
+    var normalizedPath = path;
+    if (normalizedPath.indexOf('./') === 0) {
+      normalizedPath = normalizedPath.substring(2);
+    }
+    return normalizedPath.split('/').every(isSafeSegment);
+  }
+
+  function isSafeModuleId(type, module) {
+    var modulePath = module;
+    if (type === 'view') {
+      if (modulePath.indexOf('text!') !== 0) {
+        return false;
+      }
+      modulePath = modulePath.substring(5);
+    }
+    return isSafeResourcePath(modulePath);
+  }
+
   (function () {
     ko.bindingHandlers.ojModule = {
       init: function (element, valueAccessor, allBindingsAccessor, koViewModel, bindingContext) {
@@ -984,6 +1019,9 @@ define(['ojs/ojcore-base', 'knockout', 'ojs/ojlogger', 'ojs/ojcontext', 'ojs/ojc
     function _getOjModuleRequirePromise(_requireFunc, type, module) {
       // Note that the 'type' parameter is not used by the implementation below.
       // It is, however, used by the Webpack-specific implementation of this function.
+      if (!isSafeModuleId(type, module)) {
+        return Promise.reject(new Error('Invalid module path'));
+      }
       var requireFunc = _requireFunc || require;
       var p = new Promise(function (resolve, reject) {
         requireFunc([module], resolve, reject);

package/dist/js/libs/oj/debug/ojmodulerouter-adapter.js

@@ -51,6 +51,15 @@ define(['ojs/ojlogger', 'ojs/ojmodule-element-utils', 'ojs/ojmoduleanimations',
    *      animationCallback: animationCallback
    *    }
    * );
+   *
+   * // For RegExp routes that should load a fixed module, use pathKey to load an
+   * // explicit module name from route detail.
+   * var regexRouter = new CoreRouter([
+   *   { path: /order-[0-9]+/, detail: { module: 'orders/detail' } }
+   * ]);
+   * var regexAdapter = new ModuleRouterAdapter(regexRouter, {
+   *   pathKey: 'module'
+   * });
    * </code>
    * </pre>
    * @param {CoreRouter} router The instance of the CoreRouter, that manages application navigation for a page or a section of the page.
@@ -60,10 +69,17 @@ define(['ojs/ojlogger', 'ojs/ojmodule-element-utils', 'ojs/ojmoduleanimations',
    *                  the default path will be used - 'views/'.
    * @param {string=} options.viewModelPath The path to the model, relative to the RequireJS baseURL.
    *                  If the option is not provided the default path wil be used - 'viewModels/'.
-   * @param {string=} options.pathKey An optional key for retrieving module name from 'details' object on the router state.
+   * @param {string=} options.pathKey An optional key for retrieving module name from the 'detail' object on the router state.
    *                  By default the adapter will use the 'path' field of the router state as the name for the module.
-   *                  However when 'path' does not represent the name of the module, the name can be retrieved from 'details' object
-   *                  on the router state using specified pathKey.
+   *                  However when 'path' does not represent the name of the module, the name can be retrieved from the 'detail' object
+   *                  on the router state using specified pathKey. Blank module names produce an empty module configuration.
+   *                  Non-blank module names must be relative module identifiers made from nonempty slash-separated
+   *                  segments containing only ASCII letters, digits, <code>_</code>, <code>.</code>, and <code>-</code>,
+   *                  such as <code>dashboard</code> or <code>orders/detail</code>. A leading <code>./</code>,
+   *                  empty segments, <code>.</code> or <code>..</code> segments, backslashes, absolute paths, URL
+   *                  schemes, and traversal patterns are not supported. When a
+   *                  RegExp, catch-all, URL-derived, or user-controlled route path should not itself be the module
+   *                  name, use this option to map the matched route to an explicit allowed module name instead.
    * @param {Function=} options.require An optional instance of the require() function to be used
    *                  for loading the view and view model. By default the path is relative to the baseUrl
    *                  specified for the application require calls.
@@ -172,6 +188,17 @@ define(['ojs/ojlogger', 'ojs/ojmodule-element-utils', 'ojs/ojmoduleanimations',
       return _options.pathKey ? state.detail[_options.pathKey] : state.path;
     }
 
+    function isValidModulePath(modulePath) {
+      if (typeof modulePath !== 'string') {
+        return false;
+      }
+      return modulePath.split('/').every(function (segment) {
+        return (
+          segment !== '' && segment !== '.' && segment !== '..' && /^[A-Za-z0-9_.-]+$/.test(segment)
+        );
+      });
+    }
+
     // before state change handler
     function onBeforeStateChange(args) {
       // canExit must return a Promise resolution or rejection
@@ -185,32 +212,36 @@ define(['ojs/ojlogger', 'ojs/ojmodule-element-utils', 'ojs/ojmoduleanimations',
       var configPromise;
       var modulePath = getModulePathFromState(args ? args.state : null);
       if (modulePath) {
-        var currentModulePath = getModulePathFromState(_currentState);
-        // check if model path didn't change and we can just re-apply the parameters
-        // using parametersChanged() callback
-        if (
-          modulePath === currentModulePath &&
-          _moduleConfig().viewModel &&
-          _moduleConfig().viewModel.parametersChanged
-        ) {
-          _moduleConfig().viewModel.parametersChanged(args.state.params);
-          _currentState = args.state;
-          return;
-        }
-
-        var viewPath = _options.viewPath || 'views/';
-        var viewModelPath = _options.viewModelPath || 'viewModels/';
-        configPromise = ModuleUtils.createConfig({
-          require: _options.require,
-          viewPath: viewPath + modulePath + '.html',
-          viewModelPath: viewModelPath + modulePath,
-          params: {
-            parentRouter: _router,
-            params: args.state.params,
-            router: _router,
-            routerState: args.state
+        if (!isValidModulePath(modulePath)) {
+          configPromise = Promise.reject(new Error('Invalid module path'));
+        } else {
+          var currentModulePath = getModulePathFromState(_currentState);
+          // check if model path didn't change and we can just re-apply the parameters
+          // using parametersChanged() callback
+          if (
+            modulePath === currentModulePath &&
+            _moduleConfig().viewModel &&
+            _moduleConfig().viewModel.parametersChanged
+          ) {
+            _moduleConfig().viewModel.parametersChanged(args.state.params);
+            _currentState = args.state;
+            return;
           }
-        });
+
+          var viewPath = _options.viewPath || 'views/';
+          var viewModelPath = _options.viewModelPath || 'viewModels/';
+          configPromise = ModuleUtils.createConfig({
+            require: _options.require,
+            viewPath: viewPath + modulePath + '.html',
+            viewModelPath: viewModelPath + modulePath,
+            params: {
+              parentRouter: _router,
+              params: args.state.params,
+              router: _router,
+              routerState: args.state
+            }
+          });
+        }
       } else {
         configPromise = Promise.resolve({ view: [], viewModel: null });
       }