@oracle/oraclejet 20.0.4 → 20.0.6

package/dist/js/libs/oj/debug_esm/ojdataprovider.js

@@ -2175,6 +2175,9 @@ class FilterImpl {
         if (filter) {
             let op = filter.op;
             let filterValue;
+            const textFilterValue = filter['text'] == null
+                ? null
+                : String(filter['text']).substring(0, FilterImpl._MAX_TEXT_FILTER_LENGTH);
             const collationOptions = filter.collationOptions;
             if (op === '$exists' && filter['attribute'] && filter['criterion']) {
                 // NestedFilter
@@ -2183,7 +2186,7 @@ class FilterImpl {
                 transformedExpr['criterion'] = FilterImpl._transformFilter(FilterFactory.getFilter({ filterDef: filter['criterion'] }));
                 return transformedExpr;
             }
-            if (filter['text']) {
+            if (textFilterValue !== null) {
                 op = '$regex';
             }
             else {
@@ -2199,24 +2202,26 @@ class FilterImpl {
                 }
             }
             if (op !== '$and' && op !== '$or') {
-                if (filter['text']) {
+                if (textFilterValue !== null) {
                     if (filter['matchBy'] === 'phrase') {
                         // 1. Escape special characters
                         // 2. Remove single and double quotes
                         // 3. Add word boundary and wild cards for phrase matching
                         filterValue = new RegExp(`${'\\b' +
-                            filter['text']
-                                .replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')
+                            FilterImpl._escapeRegExp(textFilterValue)
                                 .replace(/('|")/g, '')
-                                .replace(/(\s|\t)/g, '(.*)((\\s|\\t|\\r|\\n)*)')}`, 'i');
+                                // Avoid nested quantifiers that can trigger ReDoS.
+                                // Equivalent to original "(.*)((\\s|\\t|\\r|\\n)*)" with JS-dot behavior:
+                                // non-newline chars followed by optional whitespace/newlines.
+                                .replace(/(\s|\t)/g, '[^\\r\\n]*[\\s\\t\\r\\n]*')}`, 'i');
                     }
                     else if (filter['matchBy'] === 'startsWith') {
-                        filterValue = new RegExp(`^${filter['text'].replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')}`, 'i');
+                        filterValue = new RegExp(`^${FilterImpl._escapeRegExp(textFilterValue)}`, 'i');
                     }
                     else {
                         // 'contains' | 'fuzzy' | 'unknown'
                         // Escape special characters without change filter['text'] which is the original filter string by default
-                        filterValue = new RegExp(filter['text'].replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&'), 'i');
+                        filterValue = new RegExp(FilterImpl._escapeRegExp(textFilterValue), 'i');
                     }
                 }
                 else {
@@ -2235,7 +2240,7 @@ class FilterImpl {
                     operatorExpr[op] = filterValue;
                     transformedExpr[attributeExpr] = operatorExpr;
                 }
-                else if (filter['text']) {
+                else if (textFilterValue !== null) {
                     // handle TextFilterDef
                     const operatorExpr = {};
                     operatorExpr[op] = filterValue;
@@ -2287,12 +2292,27 @@ class FilterImpl {
                 const fieldAttributePath = path ? path + '.' + fieldAttribute : fieldAttribute;
                 if (!(fieldValue instanceof Object)) {
                     const operatorExpr = {};
-                    // need express co, sw and ew as regex
-                    if (op === '$sw' || op === '$ew' || op === '$co') {
-                        fieldValue = FilterImpl._fixStringExpr(op, fieldValue);
-                        op = '$regex';
+                    // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+                    // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+                    //
+                    // AttributeFilterDef object values are expanded into one criterion per field. For example,
+                    // { op: '$ew', value: { name: 'admin', value: 'foo' } } becomes an $and expression with
+                    // separate criteria for "name" and "value". The $co/$sw/$ew operators are implemented by
+                    // converting each field criterion to $regex, because FilterUtils only has a regex evaluator
+                    // for contains/starts-with/ends-with matching in this transformed expression.
+                    //
+                    // Keep the converted operator in a local variable. Mutating the shared op parameter while
+                    // processing the first field would cause later sibling fields to see "$regex" instead of the
+                    // original "$co", "$sw", or "$ew". That would skip _fixStringExpr for later fields, losing
+                    // either the $sw/$ew anchoring semantics or the regex escaping added for the ReDoS fix.
+                    // This behavior is intentionally changed/fixed as part of the security fix so every field
+                    // in an object filter preserves the original string operator semantics before regex conversion.
+                    let fieldOp = op;
+                    if (fieldOp === '$sw' || fieldOp === '$ew' || fieldOp === '$co') {
+                        fieldValue = FilterImpl._fixStringExpr(fieldOp, fieldValue);
+                        fieldOp = '$regex';
                     }
-                    operatorExpr[op] = fieldValue;
+                    operatorExpr[fieldOp] = fieldValue;
                     const fieldExpr = {};
                     fieldExpr[fieldAttributePath] = operatorExpr;
                     criteriaArray.push(fieldExpr);
@@ -2312,6 +2332,14 @@ class FilterImpl {
     }
     static _fixStringExpr(op, value) {
         if (typeof value === 'string' || value instanceof String) {
+            // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+            // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+            //
+            // $co, $sw, and $ew are public literal string matching operators, but internally they are
+            // converted to $regex and later evaluated with new RegExp(...) in FilterUtils. Without escaping,
+            // input such as ".*", "admin|", or "(a+)+$" is interpreted as regex syntax. That can change
+            // filter meaning and can also trigger excessive backtracking in the browser.
+            value = FilterImpl._escapeRegExp(value);
             if (op === '$sw') {
                 value = '^' + value;
             }
@@ -2321,7 +2349,25 @@ class FilterImpl {
         }
         return value;
     }
+    /**
+     * Escapes JavaScript regular expression metacharacters in a string so the
+     * value can be embedded in a RegExp and matched literally.
+     *
+     * This is used before building RegExp instances from literal filter text. It
+     * prefixes every JavaScript RegExp metacharacter with a backslash:
+     *   . * + - ? ^ $ { } ( ) | [ ] \
+     * The replacement string "\\$&" means "insert a backslash, then the entire
+     * matched character".
+     *
+     * @param value The string value to escape.
+     * @returns A string with every RegExp metacharacter prefixed by a backslash.
+     */
+    static _escapeRegExp(value) {
+        return value.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&');
+    }
 }
+// Bound text-filter input size to reduce regex amplification risks
+FilterImpl._MAX_TEXT_FILTER_LENGTH = 512;
 class FilterFactory {
     static getFilter(options) {
         return new FilterImpl(options);

package/dist/js/libs/oj/debug_esm/ojdataproviderscroller.js

@@ -2814,12 +2814,9 @@ IteratingDataProviderContentHandler.prototype._renderItemsWhenIdle = function (
       addFragmentOnRequestAnimationFrame(fragment);
     });
   } else {
-    // Chromium has an issue with requestIdleCallback when mouse wheel is used, see Chrome :
-    // https://bugs.chromium.org/p/chromium/issues/detail?id=822269
-    var options;
-    if (isMouseWheel && oj.AgentUtils.getAgentInfo().engine === oj.AgentUtils.ENGINE.BLINK) {
-      options = { timeout: 100 };
-    }
+    // Use a timeout so fetch rendering is not blocked indefinitely when the browser
+    // does not get an idle period, including scrollbar and mouse wheel scrolling.
+    var options = { timeout: 100 };
     this.m_idleCallback = window.requestIdleCallback(function (idleDeadline) {
       // no need to check for whether listview has been destroyed yet since we cancel the callback on destroy
       var timeRemaining = idleDeadline.timeRemaining();

package/dist/js/libs/oj/debug_esm/ojdatetimepicker.js

@@ -1441,6 +1441,33 @@ function _getMetaData(dayMetaData, position, params) {
   );
 }
 
+/**
+ * JET-79822 - JET - ARM5_UNCONSTRAINED- F37 - OJ-INPUT-DATE DAYFORMATTER CLASSNAME UNESCAPED IN HTML CLASS ATTRIBUTE
+ * Encodes application-supplied text before it is inserted into a generated HTML attribute string.
+ *
+ * @param {string} value value to encode
+ * @returns {string} value encoded for an HTML attribute
+ * @ignore
+ */
+function _escapeHtmlAttribute(value) {
+  return String(value).replace(/[&'"<>]/g, function (match) {
+    switch (match) {
+      case '&':
+        return '&amp;';
+      case "'":
+        return '&#39;';
+      case '"':
+        return '&quot;';
+      case '<':
+        return '&lt;';
+      case '>':
+        return '&gt;';
+      default:
+        return match;
+    }
+  });
+}
+
 /**
  * For default converter
  * @static
@@ -2830,9 +2857,13 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * it shows all the time.
      * </p>
      * <p>
-     * For security reasons we only support urls with protocol 'http:' or 'https:'.
-     * If the url doesn't comply we ignore it and throw an error.
-     * Pass in an encoded URL since we do not encode the URL.</p>
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. If the url doesn't
+     * comply we ignore it and throw an error. JET does not validate whether
+     * the URL is trusted for the application. Applications are responsible
+     * for providing sanitized URLs and enforcing any required origin or host
+     * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
      *
      * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
      *
@@ -2878,6 +2909,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * <p>
      * To include formatted text in the help.instruction, format the string using html tags.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * For example the
      * help.instruction might look like:
      * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -3008,6 +3041,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the message detail, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -3498,6 +3533,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the help.instruction, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -6856,7 +6893,7 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
               (otherMonth && daysOutsideMonth === 'hidden'
                 ? ''
                 : ' ' +
-                  daySettings[1] + // highlight custom dates
+                  _escapeHtmlAttribute(daySettings[1]) + // highlight custom dates
                   (selected ? ' ' + this._CURRENT_CLASS : '') + // highlight selected day
                   (printDate.getTime() === today.getTime() ? ' oj-datepicker-today' : '')) +
               "'" + // highlight today (if different)
@@ -11085,6 +11122,8 @@ oj.__registerWidget('oj.ojInputTime', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the help.instruction, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -14415,9 +14454,13 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * it shows all the time.
      * </p>
      * <p>
-     * For security reasons we only support urls with protocol 'http:' or 'https:'.
-     * If the url doesn't comply we ignore it and throw an error.
-     * Pass in an encoded URL since we do not encode the URL.</p>
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. If the url doesn't
+     * comply we ignore it and throw an error. JET does not validate whether
+     * the URL is trusted for the application. Applications are responsible
+     * for providing sanitized URLs and enforcing any required origin or host
+     * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
      *
      * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
      *
@@ -14463,6 +14506,8 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * <p>
      * To include formatted text in the help.instruction, format the string using html tags.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * For example the
      * help.instruction might look like:
      * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -14593,6 +14638,8 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the message detail, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>

package/dist/js/libs/oj/debug_esm/ojdomutils.js

@@ -32,7 +32,16 @@ const DomUtils = {
     SMALL: 1,
     PRE: 1
   },
-  _LEGAL_ATTRIBUTES: { class: 1, style: 1 }
+  _LEGAL_ATTRIBUTES: { class: 1, style: 1 },
+  _LEGAL_CSS_PROPERTIES: {
+    color: 1,
+    'font-style': 1,
+    'font-weight': 1,
+    'text-decoration': 1,
+    'text-decoration-line': 1
+  },
+  _ILLEGAL_CSS_VALUE_PATTERN:
+    /(?:url\s*\(|expression\s*\(|behavior\s*:|-moz-binding|@import|!important|var\s*\()/i
 };
 
 /**
@@ -53,11 +62,13 @@ DomUtils.isHTMLContent = function (content) {
 };
 
 DomUtils.cleanHtml = function (value) {
-  var offSpan = $(document.createElement('span')).get(0);
-  offSpan.innerHTML = value; // @HTMLUpdateOK safe manipulation
+  var offSpan = document.createElement('span');
+  var template = document.createElement('template');
+  template.innerHTML = value; // @HTMLUpdateOK template content is sanitized before use
   if (value && value.indexOf('\x3c') >= 0) {
-    DomUtils._cleanElementHtml(offSpan);
+    DomUtils._cleanElementHtml(template.content);
   }
+  offSpan.appendChild(template.content); // @HTMLUpdateOK appending sanitized template content
   return offSpan;
 };
 
@@ -67,26 +78,77 @@ DomUtils._cleanElementHtml = function (node) {
   for (var count = children.length - 1; count >= 0; count--) {
     var child = children.item(count);
     if (child && child.nodeType === 1) {
-      if (DomUtils._LEGAL_ELEMENTS[child.nodeName]) {
+      if (Object.hasOwn(DomUtils._LEGAL_ELEMENTS, child.nodeName)) {
         var attrs = child.attributes;
         for (var i = attrs.length - 1; i >= 0; i--) {
           var attr = attrs[i];
+          var attrName = attr.name.toLowerCase();
           // jquery - the .attr() method returns undefined for attributes that have not been set.
           var childHasAttr = $(child).attr(attr.name) !== undefined;
           if (childHasAttr) {
-            if (!DomUtils._LEGAL_ATTRIBUTES[attr.name]) {
+            if (!Object.hasOwn(DomUtils._LEGAL_ATTRIBUTES, attrName)) {
               child.removeAttribute(attr.nodeName);
+            } else if (attrName === 'style') {
+              DomUtils._sanitizeStyleAttribute(child);
             }
           }
         }
         DomUtils._cleanElementHtml(child);
-      } else if (child) {
+      } else {
         node.removeChild(child);
       }
+    } else if (child && child.nodeType === 8) {
+      node.removeChild(child);
+    }
+  }
+};
+
+DomUtils._sanitizeStyleAttribute = function (node) {
+  var cleanDeclarations = [];
+  var style = node.style;
+  var properties = Array.from(style);
+
+  for (var i = 0; i < properties.length; i++) {
+    var property = properties[i];
+    var value = style.getPropertyValue(property);
+    var cleanValue = DomUtils._getCleanHtmlCssValue(
+      property,
+      value,
+      style.getPropertyPriority(property)
+    );
+
+    if (cleanValue) {
+      cleanDeclarations.push({ property: property, value: cleanValue });
+    }
+  }
+
+  node.removeAttribute('style');
+
+  if (cleanDeclarations.length > 0) {
+    for (var j = 0; j < cleanDeclarations.length; j++) {
+      var cleanDeclaration = cleanDeclarations[j];
+      node.style.setProperty(cleanDeclaration.property, cleanDeclaration.value);
     }
   }
 };
 
+DomUtils._getCleanHtmlCssValue = function (property, value, priority) {
+  if (
+    !Object.hasOwn(DomUtils._LEGAL_CSS_PROPERTIES, property) ||
+    !value ||
+    priority ||
+    DomUtils._ILLEGAL_CSS_VALUE_PATTERN.test(value)
+  ) {
+    return null;
+  }
+
+  if (window.CSS && CSS.supports && !CSS.supports(property, value)) {
+    return null;
+  }
+
+  return value;
+};
+
 /**
  * Checks to see if the "ancestorNode" is a ancestor of "node".
  *
@@ -879,10 +941,10 @@ DomUtils.isLogicalAncestorOrSelf = function (ancestorNode, node) {
 };
 
 /**
- * Checks whether the href represents a safe URL
+ * Checks whether the href uses an allowed URL protocol.
  * @param {!string} href - HREF to test
  * @param {Array=} whitelist - optional list of the allowed protocols. Protocol name has to use lowercase letters and
- * be followed by a ':'. If the parameter is ommitted, ['http:', 'https:'] will be used
+ * be followed by a ':'. If the parameter is omitted, ['http:', 'https:'] will be used
  * @throws {Exception} an error if the HREF represents an invalid URL
  * @ignore
  */
@@ -896,10 +958,12 @@ DomUtils.validateURL = function (href, whitelist) {
   if (protocol != null) {
     protocol = protocol.toLowerCase();
   }
-  // if it isn't on the allowed list and it isn't '', throw an error.
-  // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
-  // and we want to allow hrefs like 'abc' since those are relative urls.
-  if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+  // Security issues JET-79830, JET-79570, and JET-79644 flagged the legacy
+  // empty-protocol allowance. IE11 returned '' for some relative URLs, but IE11
+  // is no longer supported. Modern browsers resolve relative URLs against the
+  // document URL before exposing the protocol, so an empty protocol is not
+  // treated as valid.
+  if (allowed.indexOf(protocol) < 0) {
     throw new Error(protocol + ' is not a valid URL protocol');
   }
 };

package/dist/js/libs/oj/debug_esm/ojdvt-base.js

@@ -1554,9 +1554,7 @@ TemplateHandler.prototype.processTemplates = function (
                 }
               });
             } else {
-              processedDatum = Object.create(nodeData);
-              processedDatum._noTemplate = true;
-              processedDatum._dvtNoClone = true;
+              processedDatum = { ...nodeData, _noTemplate: true, _dvtNoClone: true };
             }
             nodeDataMap.set(nodeKey, { data: processedDatum, context: context });
           }