@oracle/oraclejet 20.0.5 → 20.0.7

package/dist/js/libs/oj/debug_esm/ojknockout-base.js

@@ -433,6 +433,8 @@ oj$1._registerLegacyNamespaceProp('__ExpressionUtils', __ExpressionUtils);
   };
 })();
 
+const _ORIGINAL_PROPERTIES = Symbol.for('_ojOriginalProps');
+
 /**
  * @ignore
  * @constructor
@@ -615,9 +617,9 @@ const ExpressionPropertyUpdater = function (element, bindingContext, skipThrottl
 
   function _getCurrent(_bindingContext) {
     let current = _bindingContext.$current;
-    if (current?._ojNodesMap) {
+    if (current && _ORIGINAL_PROPERTIES in Object(current)) {
       // original props should be used for proxied _nodesMap cases
-      current = current[Symbol.for('_ojOriginalProps')];
+      current = current[_ORIGINAL_PROPERTIES];
     }
     return current || _bindingContext.$data;
   }
@@ -1499,8 +1501,7 @@ oj._registerLegacyNamespaceProp('_KnockoutBindingProvider', _KnockoutBindingProv
       return undefined;
     }
 
-    const handler = bindableAttr === 'if' ? '_ojBindIf_V2_' : bindableAttr;
-    const binding = 'ko ' + handler + ':' + expr;
+    const binding = 'ko ' + bindableAttr + ':' + expr;
     return _getReplacementNodes(node, bindableAttr, binding);
   }
 
@@ -2455,7 +2456,10 @@ oj._registerLegacyNamespaceProp('_KnockoutBindingProvider', _KnockoutBindingProv
           this.element,
           this.element._templateNode,
           currentChildContext,
-          this.as
+          this.as,
+          undefined,
+          undefined,
+          { processTemplate: true }
         );
       }
 
@@ -2705,14 +2709,21 @@ oj$1._registerLegacyNamespaceProp('KnockoutTemplateUtils', KnockoutTemplateUtils
       let wrappedReturn = _wrappedReturn;
       if (node.nodeType === 1 && node.localName === 'oj-if') {
         const testEvaluator = _getEvaluator(node, 'test', bindingContext);
-        const nodesEvaluator = _getEvaluator(node, 'oj-private-do-not-use', bindingContext);
         wrappedReturn = wrappedReturn || {};
-        wrappedReturn._ojBindIf_V2_ = () => {
-          const nodes = nodesEvaluator ? unwrap(nodesEvaluator(bindingContext)) : null;
-          return nodes
-            ? { test: unwrap(testEvaluator(bindingContext)), nodes, ojDoNotUseProcessed: true }
-            : unwrap(testEvaluator(bindingContext));
-        };
+        if (node.hasAttribute('oj-private-do-not-use')) {
+          // The private nodes attribute is written only by TemplateEngineUtils.processTemplate().
+          // Use V2 in that opt-in path so the nodes can be shared between repeated executions.
+          const nodesEvaluator = _getEvaluator(node, 'oj-private-do-not-use', bindingContext);
+          wrappedReturn._ojBindIf_V2_ = () => {
+            const nodes = nodesEvaluator ? unwrap(nodesEvaluator(bindingContext)) : null;
+            return nodes
+              ? { test: unwrap(testEvaluator(bindingContext)), nodes, ojDoNotUseProcessed: true }
+              : unwrap(testEvaluator(bindingContext));
+          };
+        } else {
+          // Preserve the original ko behavior for ordinary oj-if elements.
+          wrappedReturn.if = () => unwrap(testEvaluator(bindingContext));
+        }
         wrappedReturn.style = () => {
           return { display: 'contents' };
         };

package/dist/js/libs/oj/debug_esm/ojkoshared.js

@@ -7,9 +7,10 @@
  */
 import oj from 'ojs/ojcore-base';
 import { bindingProvider, components, ignoreDependencies, virtualElements, nativeTemplateEngine, templateSources, utils, expressionRewriting } from 'knockout';
-import { getExpressionEvaluator } from 'ojs/ojconfig';
+import { getExpressionEvaluator, getFallbackExpressionEvaluator } from 'ojs/ojconfig';
 import { error } from 'ojs/ojlogger';
 import { getTemplateContent } from 'ojs/ojhtmlutils';
+import { CspExpressionEvaluatorInternal } from 'ojs/ojcspexpressionevaluator-internal';
 
 /**
  * @private
@@ -198,19 +199,16 @@ function _KoCustomBindingProvider() {
         return evaluate([$context.$data || {}, $context]);
       };
     }
-
-    var evaluator;
-    try {
-      /* jslint evil:true */
-      // eslint-disable-next-line no-new-func
-      evaluator = new Function( // @HTMLUpdateOK
-        '$context',
-        'with($context){with($data||{}){return ' + expressionText + ';}}'
-      ); // binding expression evaluation
-    } catch (e) {
-      throw new Error(e.message + ' in expression "' + expressionText + '"');
+    var fallbackEvaluator = getFallbackExpressionEvaluator();
+    if (fallbackEvaluator) {
+      return fallbackEvaluator.createBindingExpressionEvaluator(expressionText);
     }
-    return evaluator;
+    var defaultEvaluate = new CspExpressionEvaluatorInternal().createEvaluator(
+      expressionText
+    ).evaluate;
+    return function ($context) {
+      return defaultEvaluate([$context.$data || {}, $context]);
+    };
   };
 
   this.createEvaluator = function (expression, bindingContext) {
@@ -433,20 +431,16 @@ function _KoCustomBindingProvider() {
         return evaluate([$context, $context.$data || {}, { $element: $element }]);
       };
     }
-
-    var evaluator;
-    try {
-      /* jslint evil:true */
-      // eslint-disable-next-line no-new-func
-      evaluator = new Function( // @HTMLUpdateOK
-        '$context',
-        '$element',
-        'with($context.$data||{}){with($context){return ' + expressionText + '}}'
-      ); // binding expression evaluation
-    } catch (e) {
-      throw new Error(e.message + ' in expression "' + expressionText + '"');
+    var fallbackEvaluator = getFallbackExpressionEvaluator();
+    if (fallbackEvaluator) {
+      return fallbackEvaluator.createReplacementEvaluatorForExtend(expressionText);
     }
-    return evaluator;
+    var defaultEvaluate = new CspExpressionEvaluatorInternal().createEvaluator(
+      expressionText
+    ).evaluate;
+    return function ($context, $element) {
+      return defaultEvaluate([$context, $context.$data || {}, { $element: $element }]);
+    };
   }
 
   function _createEvaluatorViaCache(factory, expr, bindingContext) {
@@ -518,7 +512,10 @@ function _getParseBindingsReplacement(original, cache) {
   return function (bindingsString, bindingContext, node, options) {
     var factory = getExpressionEvaluator();
     if (!factory) {
-      return original(bindingsString, bindingContext, node, options);
+      if (getFallbackExpressionEvaluator()) {
+        return original(bindingsString, bindingContext, node, options);
+      }
+      factory = new CspExpressionEvaluatorInternal();
     }
     var evaluate = _createKoEvaluatorViaCache(bindingsString, options, factory, cache);
     return evaluate([bindingContext.$data || {}, bindingContext, { $element: node }]);

package/dist/js/libs/oj/debug_esm/ojlabel.js

@@ -408,11 +408,14 @@ import { isTouchSupported, validateURL, PRESS_HOLD_THRESHOLD, recentTouchStart,
        * and holds the help icon on a mobile device. No formatted text is available for
        * help definition attribute.</li>
        * <li><code class="prettyprint">source</code> - this is the help source url.
-       * If present, a help icon will
-       * render next to the label. For security reasons
-       *  we only support urls with protocol http: or https:.
-       * If the url doesn't comply we ignore it and throw an error.
-       * Pass in an encoded URL since we do not encode the URL.
+       * If present, a help icon will render next to the label.
+       * <p><b>Note:</b> For security, JET validates the URL protocol before navigation
+       * and currently supports <code class="prettyprint">http:</code> and
+       * <code class="prettyprint">https:</code> protocols. If the url doesn't
+       * comply we ignore it and throw an error. JET does not validate whether
+       * the URL is trusted for the application. Applications are responsible
+       * for providing sanitized URLs and enforcing any required origin or host
+       * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
        * </ul>
        *
        * @expose
@@ -1404,6 +1407,7 @@ import { isTouchSupported, validateURL, PRESS_HOLD_THRESHOLD, recentTouchStart,
       helpIconAnchor = document.createElement('a');
       helpIconAnchor.setAttribute('tabindex', '0');
       helpIconAnchor.setAttribute('target', '_blank');
+      helpIconAnchor.setAttribute('rel', 'noopener noreferrer');
       helpIconAnchor.className =
         'oj-label-help-icon-anchor oj-label-help-icon oj-component-icon oj-clickable-icon-nocontext';
       if (source) {

package/dist/js/libs/oj/debug_esm/ojlistview.js

@@ -2010,7 +2010,7 @@ const _ojListView = _ListViewUtils.clazz(
                 // if event target is within listview, but not around items, e.g. the padding
                 var active = self.m_active && self.m_active.elem;
                 if (active == null && self.element.attr('tabIndex') === '0') {
-                  self.element.focus();
+                  self._initFocus(event, true);
                 } else if (active != null) {
                   self._makeFocusable(active);
                   self.HighlightActive();
@@ -7625,7 +7625,9 @@ const _ojListView = _ListViewUtils.clazz(
      */
     ActiveAndFocus: function (item, event, skipFocus, preventScroll) {
       // make sure that it is visible
-      this._scrollToVisible(item[0]);
+      if (!preventScroll) {
+        this._scrollToVisible(item[0]);
+      }
 
       // unhighlight any previous active item
       this.UnhighlightActive();

package/dist/js/libs/oj/debug_esm/ojlogger.js

@@ -26,11 +26,12 @@ import { error as error$1, info as info$1, warn as warn$1, log as log$1, getLogL
  *
  * <p>If the logging options are changed at a later point, the Logger will use the modified options for the subsequent log operations.
  *
- * <p>The logging level can be overridden via sessionStorage.setItem() call for the current browser session.
+ * <p>In debug builds, the logging level can be overridden via sessionStorage.setItem() call for the current browser session.
  * Use 'ojet.logLevel' as the key with one of the following values: 'none' (least verbose), 'error', 'warning', 'info', 'log' (most verbose).
  * Set the value in the browser console and refresh the browser in order for the value to take effect.
+ * Production builds ignore this key.
  * </p>
- * <h3> Session storage usage : </h3>
+ * <h3> Session storage usage in debug builds : </h3>
  * <pre class="prettyprint">
  * <code>
  * // override logging level for the current session

package/dist/js/libs/oj/debug_esm/ojmessage.js

@@ -13,7 +13,7 @@ import oj from 'ojs/ojcore-base';
 import $ from 'jquery';
 import { observable } from 'knockout';
 import { startAnimation } from 'ojs/ojanimation';
-import { isTouchSupported, getReadingDirection } from 'ojs/ojdomutils';
+import { isTouchSupported, getReadingDirection, validateURL } from 'ojs/ojdomutils';
 import { subtreeHidden } from 'ojs/ojcomponentcore';
 import { register } from 'ojs/ojcomposite';
 import Context from 'ojs/ojcontext';
@@ -24,6 +24,34 @@ import { getComponentTranslations, getTranslatedString } from 'ojs/ojtranslation
 
 const ojMessage = {};
 
+const ALLOWED_AUDIO_URL_PROTOCOLS = ['http:', 'https:', 'data:', 'blob:'];
+
+function encodeCssUrlControlCharacter(char) {
+  var hex = char.charCodeAt(0).toString(16).toUpperCase();
+  return '%' + (hex.length < 2 ? '0' + hex : hex);
+}
+
+function escapeCssUrlString(url) {
+  var escapedUrl = '';
+  var urlString = String(url);
+  for (var i = 0; i < urlString.length; i++) {
+    var char = urlString.charAt(i);
+    var charCode = char.charCodeAt(0);
+    if (char === '"' || char === '\\') {
+      escapedUrl += '\\' + char;
+    } else if (charCode <= 0x1f || charCode === 0x7f) {
+      escapedUrl += encodeCssUrlControlCharacter(char);
+    } else {
+      escapedUrl += char;
+    }
+  }
+  return escapedUrl;
+}
+
+function getCssUrl(url) {
+  return 'url("' + escapeCssUrlString(url) + '")';
+}
+
 /**
  * @ojcomponent oj.ojMessage
  * @since 5.0.0
@@ -61,10 +89,13 @@ const ojMessage = {};
  *
  * <p>The {@link oj.ojMessage#message.sound} property is an accessibility feature for playing a
  * sound when a message is opened. This property defaults to "none", and can be enabled by setting
- * it to "defaults" or by providing URL to an audio file of a format that the browser supports. An
- * accessible application must provide a way for users to enable sound on a settings or preferences
- * page. Some browsers will have auto-play disabled by default, enabling it may require adjusting
- * the browser settings.</p>
+ * it to "defaults" or by providing a URL to an audio file of a format that the browser supports.
+ * Custom sound URLs are validated before playback. Relative URLs and URLs that resolve to
+ * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="touch-section">
  *   Touch End User Information
@@ -416,9 +447,12 @@ const ojMessage = {};
  * required for low vision users who view a zoomed section of the UI. Because messages may be shown
  * outside of the zoomed section, such users require sound to be played to notify of new messages.</p>
  *
- * <p>This attribute can take a URL of the audio file for the custom sound to be played. The
- * supported formats are mp3, wav and ogg. Browser support should also be considered while choosing
- * the format of the audio file. Literal string values
+ * <p>This attribute can take a URL of the audio file for the custom sound to be played. Custom
+ * sound URLs are validated before playback. Relative URLs and URLs that resolve to
+ * <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. The supported formats are mp3, wav and ogg. Browser support should also be considered
+ * while choosing the format of the audio file. Literal string values
  * <code class="prettyprint">"defaults"</code> and <code class="prettyprint">"none"</code> can also
  * be used for this attribute. If the value is set to "none", then the sound will be disabled. If
  * the value is set to "defaults", then a default sound is played.<p>
@@ -1252,7 +1286,7 @@ MessageViewModel.prototype._computeIconStyle = function () {
     return undefined;
   }
 
-  return ["url('", message.icon, "') no-repeat"].join('');
+  return getCssUrl(message.icon) + ' no-repeat';
 };
 
 MessageViewModel.prototype._computeIconClass = function () {
@@ -1485,6 +1519,13 @@ MessageViewModel.prototype._handleKeydown = function (event) {
 MessageViewModel.prototype._playSound = function (sound) {
   // Custom URL was specified for the sound, using <audio> element is simple and best for this case.
   if (sound !== 'defaults') {
+    try {
+      validateURL(sound, ALLOWED_AUDIO_URL_PROTOCOLS);
+    } catch (error) {
+      info(`JET oj-message: Invalid URL in message.sound='${sound}'. Error: ${error}`);
+      return;
+    }
+
     var audio = document.createElement('AUDIO');
     audio.src = sound;
 

package/dist/js/libs/oj/debug_esm/ojmessagebanner.js

@@ -1366,9 +1366,12 @@ var __decorate = (null && null.__decorate) || function (decorators, target, key,
  * <p>The <code class="prettyprint">MessageBannerItem["sound"]</code> property is an accessibility
  * feature for playing a sound when a message is opened. This property defaults to "none", and can
  * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
- * browser supports. An accessible application must provide a way for users to enable sound on a
- * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
- * it may require adjusting the browser settings.</p>
+ * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+ * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="keyboard-section">
  *   Keyboard End User Information

package/dist/js/libs/oj/debug_esm/ojmetadatautils.js

@@ -158,7 +158,15 @@ MetadataUtils.getComplexPropertyMetadata = function (propPath, metadata) {
   if (subProp) {
     const namePath = propPath.split('.');
     for (let i = 0; i < namePath.length; i++) {
-      subProp = subProp[namePath[i]];
+      const propName = namePath[i];
+      if (
+        oj.CollectionUtils._isBlockedKey(propName) ||
+        !Object.prototype.hasOwnProperty.call(subProp, propName)
+      ) {
+        subProp = undefined;
+      } else {
+        subProp = subProp[propName];
+      }
       if (i === 0) {
         prop = subProp;
       }