@oracle/oraclejet 20.0.5 → 20.0.7

package/dist/js/libs/oj/debug/ojnavigationlist.js

@@ -340,6 +340,7 @@ var __oj_tab_bar_metadata =
   const _ARIA_LABEL = 'aria-label';
   const _ARIA_DESCRBIEDBY = 'aria-describedby';
   const _ARIA_HASPOPUP = 'aria-haspopup';
+  const _NOOPENER_WINDOW_FEATURES = 'noopener,noreferrer';
   const _OJ_DEFAULT = 'oj-default';
   const _OJ_DISABLED = 'oj-disabled';
 
@@ -2074,7 +2075,7 @@ var __oj_tab_bar_metadata =
           if (!target || target === '_self') {
             window.location.href = url;
           } else {
-            window.open(url, target);
+            window.open(url, target, _NOOPENER_WINDOW_FEATURES);
           }
 
           return true;
@@ -2940,6 +2941,18 @@ var __oj_tab_bar_metadata =
      *
      * <p>It is not recommended to use <code class="prettyprint">oj-navigation-list</code> only for the purpose of rendering links that navigate to a different page. Instead, each item that has a link should be interactive and activating it should display or switch a content panel within the same page or context.</p>
      *
+     * <h3 id="security-section">
+     *   Security
+     *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#security-section"></a>
+     * </h3>
+     *
+     * <p><b>Note:</b> When item content includes an <code class="prettyprint">&lt;a></code> element with an
+     * <code class="prettyprint">href</code> attribute, JET validates the URL protocol before
+     * automatic navigation and currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. JET does not validate whether the URL
+     * is trusted for the application. Applications are responsible for providing sanitized URLs
+     * and enforcing any required origin or host allowlist.</p>
+     *
      * <h3 id="rtl-section">
      *   Reading direction
      *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#rtl-section"></a>
@@ -4722,6 +4735,17 @@ var __oj_tab_bar_metadata =
    * </h3>
    * <p>It is not recommended to use <code class="prettyprint">oj-tab-bar</code> only for the purpose of rendering links that navigate to a different page. Instead, each item that has a link should be interactive and activating it should display or switch a content panel within the same page or context.</p>
    *
+   * <h3 id="security-section">
+   * Security
+   * <a class="bookmarkable-link" title="Bookmarkable Link" href="#security-section"></a>
+   * </h3>
+   * <p><b>Note:</b> When item content includes an <code class="prettyprint">&lt;a></code> element with an
+   * <code class="prettyprint">href</code> attribute, JET validates the URL protocol before
+   * automatic navigation and currently supports <code class="prettyprint">http:</code> and
+   * <code class="prettyprint">https:</code> protocols. JET does not validate whether the URL
+   * is trusted for the application. Applications are responsible for providing sanitized URLs
+   * and enforcing any required origin or host allowlist.</p>
+   *
    * <h3 id="migration-section">
    *   Migration
    *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#migration-section"></a>

package/dist/js/libs/oj/debug/ojrouter.js

@@ -1530,6 +1530,13 @@ define(['ojs/ojcore', 'knockout', 'signals', 'ojs/ojlogger'], function(oj, ko, s
      * to specify a different module animation when going 'back'. The value of direction is either
      * undefined or 'back'. It is 'back' when the state transition is caused by a back button on the
      * browser and the new state is equal to the previous state.
+     * <p>
+     * The <code class="prettyprint">name</code> value can be derived from the browser URL when
+     * synchronizing router state. When using <code class="prettyprint">moduleConfig</code> with
+     * <code class="prettyprint">ojModule</code>, configure route states from a fixed allowlist or
+     * ensure that {@link oj.RouterState#value|RouterState.value} is a trusted module name. Do not
+     * reflect URL-derived state ids into module names without application validation.
+     * </p>
 
      * To customize the behavior of the moduleduleConfig object, it is possible to create your own
      * moduleConfig and merge other properties or modifies the value of existing properties.
@@ -2358,6 +2365,12 @@ define(['ojs/ojcore', 'knockout', 'signals', 'ojs/ojlogger'], function(oj, ko, s
   /**
    * Store additional data for this router that will be added in a compressed form to the URL
    * so it can be bookmarked. When calling this method, the URL is immediately modified.
+   * <p>
+   * The data is encoded into the browser URL and can be modified by a user before the
+   * application later retrieves it. Do not store sensitive values, and validate the
+   * retrieved value against the application's expected schema before using it in security
+   * decisions, module selection, URL construction, or DOM/CSS sinks.
+   * </p>
    * @param {!Object} data the data to store with this state.
    * @throws An error if the bookmarkable state is too big.
    * @return {undefined}
@@ -2367,7 +2380,9 @@ define(['ojs/ojcore', 'knockout', 'signals', 'ojs/ojlogger'], function(oj, ko, s
    * try {
    *    var color = '#99CCFF';
    *    router.store(color);
-   *    $('#chapter').css('background', color);
+   *    if (/^#[0-9A-Fa-f]{6}$/.test(color)) {
+   *      $('#chapter').css('background', color);
+   *    }
    * }
    * catch (error) {
    *    Logger.error('Error while storing data: ' + error.message);
@@ -2411,6 +2426,11 @@ define(['ojs/ojcore', 'knockout', 'signals', 'ojs/ojlogger'], function(oj, ko, s
 
   /**
    * Retrieve the additional data stored in the URL.
+   * <p>
+   * The returned value comes from bookmarkable state encoded in the browser URL. Treat it as
+   * user-modifiable input and validate it against the application's expected schema before
+   * using it in security decisions, module selection, URL construction, or DOM/CSS sinks.
+   * </p>
    * @return {any} the content stored in the URL
    * @ojsignature [{ target: "Type", for: "returns", value: "{[key:string]:any}" }]
    * @export
@@ -2418,7 +2438,7 @@ define(['ojs/ojcore', 'knockout', 'signals', 'ojs/ojlogger'], function(oj, ko, s
    *  oj.Router.sync().then(
    *     function() {
    *        var color = viewModel.router.retrieve();
-   *        if (color) {
+   *        if (typeof color === 'string' && /^#[0-9A-Fa-f]{6}$/.test(color)) {
    *           $('#chapter').css('background', color);
    *        }
    *     },
@@ -2680,7 +2700,7 @@ define(['ojs/ojcore', 'knockout', 'signals', 'ojs/ojlogger'], function(oj, ko, s
    *  oj.Router.sync().then(
    *     function() {
    *        var color = viewModel.router.retrieve();
-   *        if (color) {
+   *        if (typeof color === 'string' && /^#[0-9A-Fa-f]{6}$/.test(color)) {
    *           $('#chapter').css('background', color);
    *        }
    *     },

package/dist/js/libs/oj/debug/ojselectbase.js

@@ -1238,7 +1238,11 @@ define(['exports', 'ojs/ojeditablevalue', 'ojs/ojpopupcore', 'ojs/ojinputtext',
       var nodes = templateEngine.execute(
         renderContext.componentElement,
         this._itemTemplate,
-        renderContext
+        renderContext,
+        undefined,
+        undefined,
+        undefined,
+        { processTemplate: true }
       );
       for (var i = 0; i < nodes.length; i++) {
         // label.appendChild(nodes[i]);

package/dist/js/libs/oj/debug/ojsoundutils.js

@@ -5,8 +5,9 @@
  * as shown at https://oss.oracle.com/licenses/upl/
  * @ignore
  */
-define(['exports'], function (exports) { 'use strict';
+define(['exports', 'ojs/ojdomutils'], function (exports, ojdomutils) { 'use strict';
 
+    const ALLOWED_AUDIO_URL_PROTOCOLS = ['http:', 'https:', 'data:', 'blob:'];
     /**
      * @classdesc
      * A utility class with helpers to play audio
@@ -39,12 +40,20 @@ define(['exports'], function (exports) { 'use strict';
          * @returns {Promise<void, Error>} A promise that resolves when the audio is play or rejects if there are any issues
          */
         static playAudioFromURL(url) {
-            let resolve;
-            let reject;
+            let resolve = () => { };
+            let reject = () => { };
             const returnPromise = new Promise((_resolve, _reject) => {
                 resolve = _resolve;
                 reject = _reject;
             });
+            try {
+                ojdomutils.validateURL(url, ALLOWED_AUDIO_URL_PROTOCOLS);
+            }
+            catch (error) {
+                // Defer so callers can attach a rejection handler to the returned promise first.
+                void Promise.resolve().then(() => reject(error));
+                return returnPromise;
+            }
             // Using an <audio> element is simple for our use case.
             const audioElement = document.createElement('audio');
             audioElement.src = url;

package/dist/js/libs/oj/debug/ojtable.js

@@ -3229,7 +3229,8 @@ var __oj_table_metadata =
               slotContext,
               this.options.as,
               tableBody,
-              new Map([[UNSAFE_useFormVariantContext.FormVariantContext, 'legacyEmbedded']])
+              new Map([[UNSAFE_useFormVariantContext.FormVariantContext, 'legacyEmbedded']]),
+              { processTemplate: true }
             );
             for (let i = 0; i < nodes.length; i++) {
               var node = nodes[i];
@@ -5315,12 +5316,9 @@ var __oj_table_metadata =
       idleTimeout = null;
     }, 250);
 
-    // Chromium has an issue with requestIdleCallback when mouse wheel is used, see Chrome :
-    // https://bugs.chromium.org/p/chromium/issues/detail?id=822269
-    var options;
-    if (isMouseWheel && DataCollectionUtils.isBlink()) {
-      options = { timeout: 100 };
-    }
+    // Use a timeout so fetch rendering is not blocked indefinitely when the browser
+    // does not get an idle period, including scrollbar and mouse wheel scrolling.
+    var options = { timeout: 100 };
     this._idleCallback = window.requestIdleCallback(function (idleDeadline) {
       if (idleTimeout == null) {
         return;
@@ -23620,7 +23618,8 @@ var __oj_table_metadata =
             slotContext,
             this.options.as,
             tableBody,
-            new Map([[UNSAFE_useFormVariantContext.FormVariantContext, 'legacyEmbedded']])
+            new Map([[UNSAFE_useFormVariantContext.FormVariantContext, 'legacyEmbedded']]),
+            { processTemplate: true }
           );
           if (!(cellContent instanceof Array)) {
             cellContent = [cellContent];

package/dist/js/libs/oj/debug/ojtagcloud.js

@@ -175,6 +175,11 @@ define(['ojs/ojcore-base', 'ojs/ojcomponentcore', 'jquery', 'ojs/ojdvt-base', 'o
    * @property {Object=} svgStyle The CSS style object defining the style of the item text. Only SVG CSS style properties are supported. The default value comes from the CSS and varies based on theme.
    * @property {string=} svgClassName The CSS style class defining the style of the item text.
    * @property {string=} url The url this item references.
+   * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+   * currently supports <code class="prettyprint">http:</code>
+   * and <code class="prettyprint">https:</code> protocols. JET does not validate whether the
+   * URL is trusted for the application. Applications are responsible for providing sanitized
+   * URLs and enforcing any required origin or host allowlist.</p>
    * @property {number} value The value of this item which will be used to scale its font-size within the tag cloud.
    * @ojdeprecated {since: '15.0.0', description: 'This is not recommended in the Redwood design system.', target: 'property', for: 'svgStyle'}
    *
@@ -517,6 +522,11 @@ define(['ojs/ojcore-base', 'ojs/ojcomponentcore', 'jquery', 'ojs/ojdvt-base', 'o
    */
   /**
    * The url this item references.
+   * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+   * currently supports <code class="prettyprint">http:</code> and
+   * <code class="prettyprint">https:</code> protocols. JET does not validate whether the
+   * URL is trusted for the application. Applications are responsible for providing
+   * sanitized URLs and enforcing any required origin or host allowlist.</p>
    * @expose
    * @name url
    * @memberof! oj.ojTagCloudItem

package/dist/js/libs/oj/debug/ojtemplateengine-ko.js

@@ -5,13 +5,16 @@
  * as shown at https://oss.oracle.com/licenses/upl/
  * @ignore
  */
-define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore', 'ojs/ojhtmlutils', 'ojs/ojcustomelement-utils', 'ojs/ojcontext', 'ojs/ojlogger'], function (ko, BindingProviderImpl, ojtemplateengineUtils, oj, HtmlUtils, ojcustomelementUtils, Context, Logger) { 'use strict';
+define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore', 'ojs/ojhtmlutils', 'ojs/ojcustomelement-utils', 'ojs/ojlogger', 'ojs/ojcontext'], function (ko, BindingProviderImpl, ojtemplateengineUtils, oj, HtmlUtils, ojcustomelementUtils, Logger, Context) { 'use strict';
 
     BindingProviderImpl = BindingProviderImpl && Object.prototype.hasOwnProperty.call(BindingProviderImpl, 'default') ? BindingProviderImpl['default'] : BindingProviderImpl;
     oj = oj && Object.prototype.hasOwnProperty.call(oj, 'default') ? oj['default'] : oj;
     Context = Context && Object.prototype.hasOwnProperty.call(Context, 'default') ? Context['default'] : Context;
 
     const _propertyContribsCache = new WeakMap();
+    function _getBlockedPropertyToken(tokens) {
+        return tokens.find((token) => oj.CollectionUtils._isBlockedKey(token));
+    }
     class TemplateEngineKoInternal {
         constructor() {
             this._bindingProvider = {
@@ -32,8 +35,7 @@ define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore'
          * @ignore
          */
         executeTemplate(componentElement, templateElement, reportBusy, context, provided) {
-            const processedTemplate = templateElement._replacedNodes.templateCopy;
-            const tmpContainer = this._createAndPopulateContainer(processedTemplate, reportBusy);
+            const tmpContainer = this._createAndPopulateContainer(templateElement, reportBusy);
             let stampedNodes = tmpContainer.childNodes;
             for (let i = 0; i < stampedNodes.length; i++) {
                 const stampedNode = stampedNodes[i];
@@ -85,6 +87,9 @@ define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore'
                 // Handle the 'dot' notation for bound subprops
                 var propTokens = prop.split('.');
                 if (propertySet.has(propTokens[0])) {
+                    if (this._shouldSkipPropertyPath(propTokens)) {
+                        continue;
+                    }
                     var info = ojcustomelementUtils.AttributeUtils.getExpressionInfo(attr.value);
                     var expr = info.expr;
                     if (expr) {
@@ -121,6 +126,9 @@ define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore'
             const computed = ko.pureComputed(() => {
                 const boundValues = {};
                 contribs.evalMap.forEach((evaluator, tokens) => {
+                    if (this._shouldSkipPropertyPath(tokens)) {
+                        return;
+                    }
                     var leafValue = ko.utils.unwrapObservable(evaluator(context));
                     if (propertyValidator) {
                         propertyValidator(tokens, leafValue);
@@ -150,6 +158,14 @@ define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore'
             current[tokens[lastIndex]] = value;
             return complexVal;
         }
+        _shouldSkipPropertyPath(tokens) {
+            const blockedToken = _getBlockedPropertyToken(tokens);
+            if (blockedToken) {
+                Logger.warn(`Skipping template property path "${tokens.join('.')}" because it contains unsupported key "${blockedToken}".`);
+                return true;
+            }
+            return false;
+        }
         /**
          *
          * @param delegate
@@ -291,6 +307,7 @@ define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore'
         }
     }
 
+    const _ORIGINAL_PROPERTIES = Symbol.for('_ojOriginalProps');
     /**
      * JET Template Engine implementation used by legacy components
      * with 'knockout' or 'none' binding providers.
@@ -317,14 +334,20 @@ define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore'
          * @param {string} alias an alias for referencing the data within a template
          * @param {Element} reportBusy - optional element for bubblng busy states outside of the template
          * @param {Map} provided - optional provided context to be applied to template
+         * @param {TemplateExecutionOptions=} options - optional template execution options
          * @return {Array.<Node>} HTML nodes representing the result of the execution
          * @ignore
          */
-        execute(componentElement, templateElement, properties, alias, reportBusy, provided) {
+        execute(componentElement, templateElement, properties, alias, reportBusy, provided, options) {
             // Check to see if data-oj-as was defined on the template element as an additional
             // alias to provide to the template children
             const templateAlias = templateElement.getAttribute('data-oj-as');
-            const processedNodes = ojtemplateengineUtils.TemplateEngineUtils.processTemplate(templateElement);
+            // Preprocessing avoids repeated work only for templates that are stamped repeatedly. The
+            // default path intentionally retains original behavior, where KO preprocesses the
+            // cloned template at execution time.
+            const processedNodes = options?.processTemplate
+                ? ojtemplateengineUtils.TemplateEngineUtils.processTemplate(templateElement)
+                : undefined;
             let contextProperties = properties;
             if (processedNodes && processedNodes.replacementMap?.size > 0) {
                 // proxy to support multiple templates being executed with the same properties instance
@@ -334,10 +357,15 @@ define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore'
                         if (p === '_ojNodesMap') {
                             return nodesMap;
                         }
-                        if (p === Symbol.for('_ojOriginalProps')) {
+                        if (p === _ORIGINAL_PROPERTIES) {
                             return properties;
                         }
                         return Reflect.get(target, p, receiver);
+                    },
+                    has(target, p) {
+                        // Allow consumers to identify this internal proxy without treating a user-supplied
+                        // _ojNodesMap property as a processed-template marker.
+                        return p === _ORIGINAL_PROPERTIES || Reflect.has(target, p);
                     }
                 });
             }
@@ -345,7 +373,7 @@ define(['knockout', 'ojs/ojkoshared', 'ojs/ojtemplateengine-utils', 'ojs/ojcore'
             if (templateElement.render) {
                 return this._templateEngineVDOM.executeTemplate(componentElement, templateElement, reportBusy, context, provided);
             }
-            return this._templateEngineKO.executeTemplate(componentElement, templateElement, reportBusy, context, provided);
+            return this._templateEngineKO.executeTemplate(componentElement, processedNodes?.templateCopy ?? templateElement, reportBusy, context, provided);
         }
         /**
          * Cleans specified node

package/dist/js/libs/oj/debug/ojthematicmap.js

@@ -2350,10 +2350,10 @@ var __oj_thematic_map_marker_metadata =
       return [
         { path: 'tooltip/renderer', slot: 'tooltipTemplate' },
         { path: '_tooltip/renderer' },
-        { path: 'renderer', slot: 'markerContentTemplate' },
-        { path: 'focusRenderer', slot: 'markerContentTemplate' },
-        { path: 'hoverRenderer', slot: 'markerContentTemplate' },
-        { path: 'selectionRenderer', slot: 'markerContentTemplate' }
+        { path: 'renderer', slot: 'markerContentTemplate', processTemplate: true },
+        { path: 'focusRenderer', slot: 'markerContentTemplate', processTemplate: true },
+        { path: 'hoverRenderer', slot: 'markerContentTemplate', processTemplate: true },
+        { path: 'selectionRenderer', slot: 'markerContentTemplate', processTemplate: true }
       ];
     },
 

package/dist/js/libs/oj/debug/ojtimeline.js

@@ -3685,7 +3685,11 @@ var __oj_timeline_series_metadata =
 
     _GetComponentRendererOptions: function () {
       return [
-        { path: 'itemBubbleContentRenderer', slot: 'itemBubbleContentTemplate' },
+        {
+          path: 'itemBubbleContentRenderer',
+          slot: 'itemBubbleContentTemplate',
+          processTemplate: true
+        },
         { path: 'tooltip/renderer', slot: 'tooltipTemplate' }
       ];
     },

package/dist/js/libs/oj/debug/ojtreemap.js

@@ -1617,7 +1617,7 @@ var __oj_treemap_node_metadata =
     _GetComponentRendererOptions: function () {
       return [
         { path: 'tooltip/renderer', slot: 'tooltipTemplate' },
-        { path: 'nodeContent/renderer', slot: 'nodeContentTemplate' }
+        { path: 'nodeContent/renderer', slot: 'nodeContentTemplate', processTemplate: true }
       ];
     },
 

package/dist/js/libs/oj/debug/ojtreeview.js

@@ -2087,7 +2087,15 @@ define(['require', 'ojs/ojcore-base', 'jquery', 'ojs/ojcontext', 'ojs/ojthemeuti
           DataCollectionUtils.applyRendererContent(liElem, renderer.call(self, context), true);
         } else if (templateElement != null && templateEngine != null) {
           var componentElement = self.element[0];
-          var nodes = templateEngine.execute(componentElement, templateElement, context, null);
+          var nodes = templateEngine.execute(
+            componentElement,
+            templateElement,
+            context,
+            null,
+            undefined,
+            undefined,
+            { processTemplate: true }
+          );
           for (i = 0; i < nodes.length; i++) {
             if (nodes[i].tagName === 'LI') {
               liElem.parentNode.replaceChild(nodes[i], liElem);

package/dist/js/libs/oj/debug/ojurlpathadapter.js

@@ -33,7 +33,7 @@ define(function () { 'use strict';
       .forEach(function (key) {
         var value = params[key];
         if (value !== undefined && value !== null) {
-          paramArray.push(';' + key + '=' + encode(value));
+          paramArray.push(';' + encode(key) + '=' + encode(value));
         }
       });
     return paramArray.join('');
@@ -56,7 +56,7 @@ define(function () { 'use strict';
     parts.forEach(function (part) {
       if (part) {
         var pair = part.split('=');
-        parsed.params[pair[0]] = decode(pair[1]);
+        parsed.params[decode(pair[0])] = decode(pair[1]);
       }
     });
     return parsed;

package/dist/js/libs/oj/debug_esm/ojavatar.js

@@ -16,6 +16,28 @@ var __decorate = (null && null.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+const encodeCssUrlControlCharacter = (char) => {
+    const hex = char.charCodeAt(0).toString(16).toUpperCase();
+    return `%${hex.length < 2 ? '0' + hex : hex}`;
+};
+const escapeCssUrlString = (url) => {
+    let escapedUrl = '';
+    for (let i = 0; i < url.length; i++) {
+        const char = url.charAt(i);
+        const charCode = char.charCodeAt(0);
+        if (char === '"' || char === '\\') {
+            escapedUrl += `\\${char}`;
+        }
+        else if (charCode <= 0x1f || charCode === 0x7f) {
+            escapedUrl += encodeCssUrlControlCharacter(char);
+        }
+        else {
+            escapedUrl += char;
+        }
+    }
+    return escapedUrl;
+};
+const getCssUrl = (url) => `url("${escapeCssUrlString(url)}")`;
 /**
  * @classdesc
  * <h3 id="avatarOverview-section">
@@ -301,7 +323,7 @@ let Avatar = class Avatar extends Component {
     }
     _getInnerContent(props) {
         if (props.src && !props.iconClass) {
-            return (jsx("div", { class: "oj-avatar-background-image", style: { backgroundImage: `url("${props.src}")` } }));
+            return (jsx("div", { class: "oj-avatar-background-image", style: { backgroundImage: getCssUrl(props.src) } }));
         }
         else {
             return jsx("div", { class: "oj-avatar-background oj-avatar-background-image" });

package/dist/js/libs/oj/debug_esm/ojcolorpalette.js

@@ -625,9 +625,13 @@ var __oj_color_palette_metadata =
    * it shows all the time.
    * </p>
    * <p>
-   * For security reasons we only support urls with protocol 'http:' or 'https:'.
-   * If the url doesn't comply we ignore it and throw an error.
-   * Pass in an encoded URL since we do not encode the URL.</p>
+   * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+   * currently supports <code class="prettyprint">http:</code> and
+   * <code class="prettyprint">https:</code> protocols. If the url doesn't
+   * comply we ignore it and throw an error. JET does not validate whether
+   * the URL is trusted for the application. Applications are responsible
+   * for providing sanitized URLs and enforcing any required origin or host
+   * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
    *
    * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
    *
@@ -673,6 +677,8 @@ var __oj_color_palette_metadata =
    * <p>
    * To include formatted text in the help.instruction, format the string using html tags.
    * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+   * Inline style attributes are sanitized; the retained styling is limited to color, font
+   * style, font weight, and text decoration. Use CSS classes for other styling.
    * For example the
    * help.instruction might look like:
    * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -803,6 +809,8 @@ var __oj_color_palette_metadata =
    * hints and message summary text cannot. If you use formatted text, it should be accessible
    * and make sense to the user if formatting wasn't there.
    * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+   * Inline style attributes are sanitized; the retained styling is limited to color, font
+   * style, font weight, and text decoration. Use CSS classes for other styling.
    * To format the message detail, you could do this:
    * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
    * </p>
@@ -2005,7 +2013,7 @@ var __oj_color_palette_metadata =
         );
 
       if (label) {
-        entry.append($("<span class='oj-colorpalette-swatch-text'>" + label + '</span>')[0]); // @HTMLUpdateOK
+        entry.append($("<span class='oj-colorpalette-swatch-text'></span>").text(label)[0]); // @HTMLUpdateOK
       }
       return entry[0];
     },
@@ -2023,30 +2031,23 @@ var __oj_color_palette_metadata =
      * @private
      */
     _renderNone: function (showLabels, label, tooltip, swatchClass, selectedClass) {
-      var raw;
-
-      raw =
-        "<div class='oj-colorpalette-swatch-entry " +
-        swatchClass +
-        (showLabels ? ' oj-colorpalette-swatch-showlabel' : '') +
-        "'>" +
-        "<div class='oj-colorpalette-swatch-container'>" +
-        "<div class='oj-colorpalette-swatch " +
-        selectedClass +
-        "'" +
-        (!label ? " title='" + tooltip + "'" : '') +
-        (!label ? " aria-label='" + tooltip + "'" : '') +
-        '>' +
-        "<div class='oj-colorpalette-swatch-none-icon'>" +
-        '</div>' +
-        '</div>' +
-        '</div>';
+      // prettier-ignore
+      var entry = $("<div class='oj-colorpalette-swatch-entry'></div>")
+        .addClass(swatchClass + (showLabels ? ' oj-colorpalette-swatch-showlabel' : ''))
+        .append( // @HTMLUpdateOK
+          $("<div class='oj-colorpalette-swatch-container'></div>").append( // @HTMLUpdateOK
+            $("<div class='oj-colorpalette-swatch'></div>")
+              .attr('title', !label ? tooltip : null)
+              .attr('aria-label', !label ? tooltip : null)
+              .addClass(selectedClass)
+              .append($("<div class='oj-colorpalette-swatch-none-icon'></div>")) // @HTMLUpdateOK
+          )
+        );
 
       if (label) {
-        raw += "<span class='oj-colorpalette-swatch-text'>" + label + '</span>';
+        entry.append($("<span class='oj-colorpalette-swatch-text'></span>").text(label)[0]); // @HTMLUpdateOK
       }
-      raw += '</div>';
-      return $(raw)[0];
+      return entry[0];
     },
 
     /**

package/dist/js/libs/oj/debug_esm/ojcomponentcore.js

@@ -2503,6 +2503,10 @@ oj.CollectionUtils.copyInto(CustomElementBridge.proto, {
     };
     // eslint-disable-next-line no-param-reassign
     proto.getProperty = function (prop) {
+      if (oj.BaseCustomElementBridge.__IsBlockedPropertyPath(prop)) {
+        return undefined;
+      }
+
       var bridge = CustomElementUtils.getElementBridge(this);
       var meta = getPropertyMetadata(prop, getElementProperties(this));
 
@@ -6465,38 +6469,40 @@ function _mergeObjectsWithExclusions(target, input, ignoreSubkeys, basePath, avo
     var keys = Object.keys(source);
     for (var i = 0; i < keys.length; i++) {
       var key = keys[i];
-      var path;
-      if (ignoreSubkeys == null) {
-        path = null;
-      } else if (basePath == null) {
-        path = key;
-      } else {
-        path = basePath + '.' + key;
-      }
-      // Ignore all sources when the current path is registered in ignoreSubkeys
-      if (ignoreSubkeys == null || !ignoreSubkeys[path]) {
-        var value = source[key];
-        if (value !== undefined) {
-          if ($.isPlainObject(value)) {
-            const plainObjectTarget = $.isPlainObject(target[key]);
-            // If merging an object onto a non-object and avoidClones is set, just replace target with value
-            if (!plainObjectTarget && avoidClones) {
-              // eslint-disable-next-line no-param-reassign
-              target[key] = value;
+      if (!oj.CollectionUtils._isBlockedKey(key)) {
+        var path;
+        if (ignoreSubkeys == null) {
+          path = null;
+        } else if (basePath == null) {
+          path = key;
+        } else {
+          path = basePath + '.' + key;
+        }
+        // Ignore all sources when the current path is registered in ignoreSubkeys
+        if (ignoreSubkeys == null || !ignoreSubkeys[path]) {
+          var value = source[key];
+          if (value !== undefined) {
+            if ($.isPlainObject(value)) {
+              const plainObjectTarget = $.isPlainObject(target[key]);
+              // If merging an object onto a non-object and avoidClones is set, just replace target with value
+              if (!plainObjectTarget && avoidClones) {
+                // eslint-disable-next-line no-param-reassign
+                target[key] = value;
+              } else {
+                var params = plainObjectTarget ? [target[key], value] : [value];
+                // eslint-disable-next-line no-param-reassign
+                target[key] = _mergeObjectsWithExclusions(
+                  {},
+                  params,
+                  ignoreSubkeys,
+                  path,
+                  avoidClones
+                );
+              }
             } else {
-              var params = plainObjectTarget ? [target[key], value] : [value];
               // eslint-disable-next-line no-param-reassign
-              target[key] = _mergeObjectsWithExclusions(
-                {},
-                params,
-                ignoreSubkeys,
-                path,
-                avoidClones
-              );
+              target[key] = value;
             }
-          } else {
-            // eslint-disable-next-line no-param-reassign
-            target[key] = value;
           }
         }
       }