@oracle/oraclejet 20.1.0 → 20.1.2

package/dist/js/libs/oj/debug/ojdvt-toolkit.js

@@ -962,6 +962,32 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
   /** @private **/
   ToolkitUtils._ICON_CACHE = {};
 
+  /**
+   * Validates link URL protocol before browser navigation.
+   * Copied from DomUtils.validateURL to avoid adding an ojdomutils dependency to DVT toolkit.
+   * @param {string} href URL to validate.
+   * @param {Array=} whitelist optional list of the allowed protocols.
+   * @throws {Error} if the URL uses an invalid protocol.
+   * @private
+   */
+  const _validateURL = function (href, whitelist) {
+    var allowed = whitelist || ['http:', 'https:'];
+
+    var link = document.createElement('a');
+    link.href = href;
+
+    var protocol = link.protocol;
+    if (protocol != null) {
+      protocol = protocol.toLowerCase();
+    }
+    // if it isn't on the allowed list and it isn't '', throw an error.
+    // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
+    // and we want to allow hrefs like 'abc' since those are relative urls.
+    if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+      throw new Error(protocol + ' is not a valid URL protocol');
+    }
+  };
+
   /**
    * Creates and returns a new SVG document with the specified id.
    * @param {string} id The id for the new SVG document.
@@ -1208,6 +1234,10 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
       // DVT ES6 TODO: Added missing 'self' ref - Trung
       var self = this;
       var callback = function () {
+        if (dest) {
+          _validateURL(dest);
+        }
+
         if (target == null) {
           self.location = dest;
         } else {
@@ -10689,7 +10719,7 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
   /**
    * Restores a supported HTML tag.
    * All HTML brackets are converted into &gt; and &lt; for security reasons, to prevent people from adding unsupported
-   * elements. This method restores the brackets for the supported element only.
+   * elements. JET-79039: This method restores the brackets for the supported element only, discarding all attributes.
    * @param {string} text The HTML string.
    * @param {string} tag The tag name to be restored.
    * @return {string} The updated HTML string.
@@ -10698,7 +10728,7 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
   HtmlTooltipManager._restoreTag = function (text, tag) {
     // Match the following: <tag...>, </tag...>, and <tag.../>
     var regExp = new RegExp('&lt;(/?)(' + tag + ')(?=[\\s&/])([^&]*)(/?)&gt;', 'g');
-    return text.replace(regExp, '<$1' + tag + '$3$4>');
+    return text.replace(regExp, '<$1' + tag + '>');
   };
 
   /**
@@ -15528,6 +15558,17 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
 
   Obj.createSubclass(JsonUtils, Obj);
 
+  /**
+   * Returns true if the key provided should be blocked from merge utilities.
+   * Specifically keys that could cause prototype pollution issues are included.
+   * @param {string} key
+   * @return {boolean}
+   * @private
+   */
+  JsonUtils._isBlockedKey = function (key) {
+    return key === '__proto__' || key === 'constructor' || key === 'prototype';
+  };
+
   /**
    * Returns a deep clone of the object.
    * @param {object} obj The object to clone.
@@ -15559,8 +15600,10 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
       ret = {};
 
       // Loop through all properties of the object
-      for (var key in obj) {
-        if (!keyFunc || keyFunc(key)) {
+      var keys = Object.keys(obj);
+      for (var i = 0; i < keys.length; i++) {
+        var key = keys[i];
+        if (!JsonUtils._isBlockedKey(key) && (!keyFunc || keyFunc(key))) {
           var value = obj[key];
           if (
             !(noClone && noClone[key] == true) &&
@@ -15611,25 +15654,32 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
    * @private
    */
   JsonUtils._copy = function (a, b) {
-    for (var key in a) {
-      var value = a[key];
-      // Treat an 'undefined' value as if the key were not set and ignore
-      if (value === undefined) continue;
-
-      if ((value && value instanceof Array) || key == '_widgetConstructor') {
-        // Copy the array over, since we don't want arrays to be merged
-        // We also don't want the widget constructor to be copied/cloned
-        b[key] = value;
-      } else if (b[key] && b[key] instanceof CSSStyle) {
-        // If an object is defined as CSS in the base object, merge the CSS
-        if (value instanceof CSSStyle) b[key].merge(value);
-        // value is String
-        else b[key].merge(new CSSStyle(value));
-      } else if (JsonUtils._isDeepClonable(value)) {
-        // Deep clone if object exists in b, copy otherwise
-        if (b[key]) JsonUtils._copy(value, b[key]);
-        else b[key] = value;
-      } else b[key] = value;
+    var keys = Object.keys(a);
+    for (var i = 0; i < keys.length; i++) {
+      var key = keys[i];
+      if (!JsonUtils._isBlockedKey(key)) {
+        var value = a[key];
+        var hasOwnKey = Object.hasOwn(b, key);
+        var targetValue = hasOwnKey ? b[key] : undefined;
+        // Treat an 'undefined' value as if the key were not set and ignore
+        if (value === undefined) continue;
+
+        if ((value && value instanceof Array) || key == '_widgetConstructor') {
+          // Copy the array over, since we don't want arrays to be merged
+          // We also don't want the widget constructor to be copied/cloned
+          b[key] = value;
+        } else if (hasOwnKey && targetValue && targetValue instanceof CSSStyle) {
+          // If an object is defined as CSS in the base object, merge the CSS
+          if (value instanceof CSSStyle) targetValue.merge(value);
+          // value is String
+          else targetValue.merge(new CSSStyle(value));
+        } else if (JsonUtils._isDeepClonable(value)) {
+          // Deep clone if object exists in b, copy otherwise
+          if (hasOwnKey && JsonUtils._isDeepClonable(targetValue))
+            JsonUtils._copy(value, targetValue);
+          else b[key] = value;
+        } else b[key] = value;
+      }
     }
   };
 

package/dist/js/libs/oj/debug/ojeditablevalue.js

@@ -8983,6 +8983,31 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
 
   const OJ_HAS_HELPHINTS_STYLECLASS = 'oj-has-helphints';
 
+  /**
+   * Builds HTML for unformatted hints by escaping each hint and inserting <br> nodes
+   * between hint lines.
+   *
+   * @param {Array<string>} hints
+   * @return {string} escaped hint HTML
+   * @private
+   */
+  function _getUnformattedHintsHtml(hints) {
+    if (!hints || hints.length < 1) {
+      return '';
+    }
+    let hintsDom = document.createElement('div');
+    hints.forEach(function (hint, index) {
+      let hintDom = PopupMessagingStrategyUtils.GetTextDom(document, hint, false);
+      if (hintDom) {
+        if (index > 0) {
+          hintsDom.appendChild(document.createElement('br'));
+        }
+        hintsDom.appendChild(hintDom);
+      }
+    });
+    return hintsDom.innerHTML;
+  }
+
   /**
    * Registers the InlineHelpHintsStrategy constructor function with ComponentMessaging.
    * No need to register since we are not creating this strategy on from ComponentMessaging.
@@ -9254,7 +9279,7 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
       // we do the same thing that we do in PopupComponentMessages
       let hints = this.GetValidatorHints();
       if (hints.length > 0) {
-        hintsHtml = hints.join('<br/>');
+        hintsHtml = _getUnformattedHintsHtml(hints);
       }
     }
     if (!hintsHtml) {
@@ -9263,14 +9288,16 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
       // InlineHelpHintsStrategy.prototype._createHelpHintsAttributeEventHandlers
       let definition = helpHints ? helpHints.definition : null;
       if (definition) {
-        hintsHtml = definition;
+        // helpHints.definition does not allow formatted text, unlike help.instruction above which does.
+        let definitionDom = PopupMessagingStrategyUtils.GetTextDom(document, definition, false);
+        hintsHtml = definitionDom ? definitionDom.outerHTML : '';
       }
     }
     // try to get the converterHint
     if (!hintsHtml && this.ShowConverterHint()) {
       let hints = this.GetConverterHint();
       if (hints.length > 0) {
-        hintsHtml = hints.join('<br/>');
+        hintsHtml = _getUnformattedHintsHtml(hints);
       }
     }
 

package/dist/js/libs/oj/debug/ojexpressionutils.js

@@ -5,7 +5,7 @@
  * as shown at https://oss.oracle.com/licenses/upl/
  * @ignore
  */
-define(['exports', 'ojs/ojconfig', 'ojs/ojcustomelement-utils'], function (exports, Config, ojcustomelementUtils) { 'use strict';
+define(['exports', 'ojs/ojconfig', 'ojs/ojcustomelement-utils', 'ojs/ojcspexpressionevaluator-internal'], function (exports, Config, ojcustomelementUtils, ojcspexpressionevaluatorInternal) { 'use strict';
 
   /**
    * @namespace
@@ -49,15 +49,17 @@ define(['exports', 'ojs/ojconfig', 'ojs/ojcustomelement-utils'], function (expor
       };
     }
 
-    var evaluator;
-    try {
-      /* jslint evil:true */
-      // eslint-disable-next-line no-new-func
-      evaluator = new Function('context', 'with(context){return ' + expressionText + ';}'); // @HTMLUpdateOK binding expression evaluation
-    } catch (e) {
-      throw new Error(e.message + ' in expression "' + expressionText + '"');
+    var fallbackEvaluator = Config.getFallbackExpressionEvaluator();
+    if (fallbackEvaluator) {
+      return fallbackEvaluator.createGenericExpressionEvaluator(expressionText);
     }
-    return evaluator;
+
+    var defaultEvaluate = new ojcspexpressionevaluatorInternal.CspExpressionEvaluatorInternal().createEvaluator(
+      expressionText
+    ).evaluate;
+    return function (context) {
+      return defaultEvaluate([context]);
+    };
   };
 
   const getExpressionInfo = ExpressionUtils.getExpressionInfo;

package/dist/js/libs/oj/debug/ojgantt-toolkit.js

@@ -3638,7 +3638,7 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
         var defaultNavigationLabel =
           gantt.getEventManager().getKeyboardDnDMode() === 'move' ? 'MoveBy' : 'ResizeBy';
         var navigationScaleDesc = DvtGanttTooltipUtils._addDatatipRow(
-          '',
+          isTabular ? [] : '',
           gantt,
           '',
           defaultNavigationLabel,
@@ -3759,7 +3759,7 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
       }
 
       // Default Tooltip Support
-      var datatip = '';
+      var datatip = isTabular ? [] : '';
       datatip = DvtGanttTooltipUtils._addRowDatatip(datatip, taskNode, isTabular);
       datatip = DvtGanttTooltipUtils._addTaskDatatip(datatip, taskNode, isTabular);
 
@@ -3768,39 +3768,32 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
 
     /**
      * Final processing for the datatip.
-     * @param {string} datatip The current datatip.
+     * @param {string|Array<Node>} datatip The current datatip.
      * @param {Gantt} gantt The owning gantt instance.
      * @param {boolean} isTabular Whether the datatip is in a table format.
-     * @return {string} The updated datatip.
+     * @return {string|Node} The updated datatip.
      * @private
      */
     _processDatatip: (datatip, gantt, isTabular) => {
       // Don't render tooltip if empty
-      if (datatip === '') return null;
-
-      // Add outer table tags
-      // Note: Unlike Charts, we're not going to create a table start tag with
-      // dvt.HtmlTooltipManager.createElement(). That method applies parsed styles
-      // to the element, but for gantt we want to directly apply the class to the element:
-      //
-      // Security note: gantt.GetStyleClass('tooltipTable') returns an internally generated class string
-      // defined in ojgantt.js (in this case, returns the string 'oj-gantt-tooltip-table')
-      //
-      // datatip contains externally provided strings, but this entire value is eventually passed to
-      // dvt.HtmlTooltipManager._showTextAtPosition(),
-      // and that method makes sure all parsable HTML tags are disabled/handled
+      if (isTabular && datatip.length === 0) return null;
+      if (!isTabular && datatip === '') return null;
+
+      // Add outer table element
       if (isTabular)
-        return '<table class="' + gantt.GetStyleClass('tooltipTable') + '">' + datatip + '</table>';
+        return dvt.HtmlTooltipManager.createElement('table', null, datatip, [
+          gantt.GetStyleClass('tooltipTable')
+        ]);
 
       return datatip;
     },
 
     /**
-     * Adds the row string to the datatip.
-     * @param {string} datatip The current datatip.
+     * Adds the row to the datatip.
+     * @param {string|Array<Node>} datatip The current datatip.
      * @param {DvtGanttTaskNode} taskNode The task node.
      * @param {boolean} isTabular Whether the datatip is in a table format.
-     * @return {string} The updated datatip.
+     * @return {string|Array<Node>} The updated datatip.
      * @private
      */
     _addRowDatatip: (datatip, taskNode, isTabular) => {
@@ -3818,11 +3811,11 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
     },
 
     /**
-     * Adds the task strings to the datatip.
-     * @param {string} datatip The current datatip.
+     * Adds the task rows to the datatip.
+     * @param {string|Array<Node>} datatip The current datatip.
      * @param {DvtGanttTaskNode} taskNode The task node.
      * @param {boolean} isTabular Whether the datatip is in a table format.
-     * @return {string} The updated datatip.
+     * @return {string|Array<Node>} The updated datatip.
      * @private
      */
     _addTaskDatatip: (datatip, taskNode, isTabular) => {
@@ -4059,15 +4052,15 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
     },
 
     /**
-     * Adds a row of item to the datatip string.
-     * @param {string} datatip The current datatip.
+     * Adds a row of item to the datatip.
+     * @param {string|Array<Node>} datatip The current datatip.
      * @param {Gantt} gantt The gantt instance.
      * @param {string} type The item type, e.g. row, start, end, label
      * @param {string} defaultLabel The bundle resource string for the default label.
      * @param {string|number} value The item value.
      * @param {boolean} isTabular Whether the datatip is in a table format.
      * @param {number} index (optional) The index of the tooltipLabel string to be used
-     * @return {string} The updated datatip.
+     * @return {string|Array<Node>} The updated datatip.
      * @private
      */
     _addDatatipRow: (datatip, gantt, type, defaultLabel, value, isTabular, index) => {
@@ -4091,35 +4084,16 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-timecomponent', 'ojs/ojtimeax
       value = DvtGanttTooltipUtils.formatValue(gantt, type, valueFormat, value);
 
       if (isTabular) {
-        // Note: Unlike Charts, we're not going to create a td start tag with
-        // dvt.HtmlTooltipManager.createElement(). That method applies parsed styles
-        // to the element, but for gantt we want to directly apply the class to the element:
-        //
-        // Security note: gantt.GetStyleClass returns an internally generated class string
-        // defined in ojgantt.js (in this case, returns the strings 'oj-gantt-tooltip-label'
-        // and 'oj-gantt-tooltip-value' respectively in the two calls below).
-        //
-        // tooltipLabel and value contains externally provided strings, but these values are eventually passed to
-        // DvtGanttTooltipUtils._processDatatip(), which concatenates more strings to it, and the entire value is passed to
-        // dvt.HtmlTooltipManager._showTextAtPosition(),
-        // and that last method makes sure all parsable HTML tags are disabled/handled
-        var tooltipLabelClass = gantt.GetStyleClass('tooltipLabel');
-        var tooltipValueClass = gantt.GetStyleClass('tooltipValue');
-        return (
-          datatip +
-          '<tr>' +
-          '<td class="' +
-          tooltipLabelClass +
-          '">' +
-          tooltipLabel +
-          '</td>' +
-          '<td class="' +
-          tooltipValueClass +
-          '">' +
-          value +
-          '</td>' +
-          '</tr>'
-        );
+        var tds = [
+          dvt.HtmlTooltipManager.createElement('td', null, tooltipLabel, [
+            gantt.GetStyleClass('tooltipLabel')
+          ]),
+          dvt.HtmlTooltipManager.createElement('td', null, value, [
+            gantt.GetStyleClass('tooltipValue')
+          ])
+        ];
+        datatip.push(dvt.HtmlTooltipManager.createElement('tr', null, tds));
+        return datatip;
       } else {
         if (datatip.length > 0) datatip += '<br>';
 

package/dist/js/libs/oj/debug/ojkoshared.js

@@ -5,7 +5,7 @@
  * as shown at https://oss.oracle.com/licenses/upl/
  * @ignore
  */
-define(['ojs/ojcore-base', 'knockout', 'ojs/ojconfig', 'ojs/ojlogger', 'ojs/ojhtmlutils'], function (oj, ko, Config, Logger, HtmlUtils) { 'use strict';
+define(['ojs/ojcore-base', 'knockout', 'ojs/ojconfig', 'ojs/ojlogger', 'ojs/ojhtmlutils', 'ojs/ojcspexpressionevaluator-internal'], function (oj, ko, Config, Logger, HtmlUtils, ojcspexpressionevaluatorInternal) { 'use strict';
 
   oj = oj && Object.prototype.hasOwnProperty.call(oj, 'default') ? oj['default'] : oj;
 
@@ -196,19 +196,16 @@ define(['ojs/ojcore-base', 'knockout', 'ojs/ojconfig', 'ojs/ojlogger', 'ojs/ojht
           return evaluate([$context.$data || {}, $context]);
         };
       }
-
-      var evaluator;
-      try {
-        /* jslint evil:true */
-        // eslint-disable-next-line no-new-func
-        evaluator = new Function( // @HTMLUpdateOK
-          '$context',
-          'with($context){with($data||{}){return ' + expressionText + ';}}'
-        ); // binding expression evaluation
-      } catch (e) {
-        throw new Error(e.message + ' in expression "' + expressionText + '"');
+      var fallbackEvaluator = Config.getFallbackExpressionEvaluator();
+      if (fallbackEvaluator) {
+        return fallbackEvaluator.createBindingExpressionEvaluator(expressionText);
       }
-      return evaluator;
+      var defaultEvaluate = new ojcspexpressionevaluatorInternal.CspExpressionEvaluatorInternal().createEvaluator(
+        expressionText
+      ).evaluate;
+      return function ($context) {
+        return defaultEvaluate([$context.$data || {}, $context]);
+      };
     };
 
     this.createEvaluator = function (expression, bindingContext) {
@@ -431,20 +428,16 @@ define(['ojs/ojcore-base', 'knockout', 'ojs/ojconfig', 'ojs/ojlogger', 'ojs/ojht
           return evaluate([$context, $context.$data || {}, { $element: $element }]);
         };
       }
-
-      var evaluator;
-      try {
-        /* jslint evil:true */
-        // eslint-disable-next-line no-new-func
-        evaluator = new Function( // @HTMLUpdateOK
-          '$context',
-          '$element',
-          'with($context.$data||{}){with($context){return ' + expressionText + '}}'
-        ); // binding expression evaluation
-      } catch (e) {
-        throw new Error(e.message + ' in expression "' + expressionText + '"');
+      var fallbackEvaluator = Config.getFallbackExpressionEvaluator();
+      if (fallbackEvaluator) {
+        return fallbackEvaluator.createReplacementEvaluatorForExtend(expressionText);
       }
-      return evaluator;
+      var defaultEvaluate = new ojcspexpressionevaluatorInternal.CspExpressionEvaluatorInternal().createEvaluator(
+        expressionText
+      ).evaluate;
+      return function ($context, $element) {
+        return defaultEvaluate([$context, $context.$data || {}, { $element: $element }]);
+      };
     }
 
     function _createEvaluatorViaCache(factory, expr, bindingContext) {
@@ -516,7 +509,10 @@ define(['ojs/ojcore-base', 'knockout', 'ojs/ojconfig', 'ojs/ojlogger', 'ojs/ojht
     return function (bindingsString, bindingContext, node, options) {
       var factory = Config.getExpressionEvaluator();
       if (!factory) {
-        return original(bindingsString, bindingContext, node, options);
+        if (Config.getFallbackExpressionEvaluator()) {
+          return original(bindingsString, bindingContext, node, options);
+        }
+        factory = new ojcspexpressionevaluatorInternal.CspExpressionEvaluatorInternal();
       }
       var evaluate = _createKoEvaluatorViaCache(bindingsString, options, factory, cache);
       return evaluate([bindingContext.$data || {}, bindingContext, { $element: node }]);

package/dist/js/libs/oj/debug/ojnavigationlist.js

@@ -2069,8 +2069,8 @@ var __oj_tab_bar_metadata =
         var url = itemContent.attr('href');
         var target = itemContent.attr('target');
         if (url && url !== '#') {
-          // In case of javascript uri, javascript will get executed on assigning it to href.
-          // Ideally user can use beforeSelect/optionChange events to do this,Will there be any issue in supporting this?
+          DomUtils.validateURL(url);
+
           if (!target || target === '_self') {
             window.location.href = url;
           } else {

package/dist/js/libs/oj/debug_esm/ojconfig.js

@@ -337,6 +337,20 @@ Config.getExpressionEvaluator = function () {
   return Config._expressionEvaluator;
 };
 
+/**
+ * Returns fallback expression evaluator used by legacy expression evaluation paths
+ * when no expression evaluator has been configured.
+ * @return {undefined | Object}
+ * @ignore
+ * @export
+ * @memberof oj.Config
+ * @since 20.1.2
+ * @ojdeprecated {since: '20.1.2', description: 'This API is deprecated. Applications should use CSP-compliant expressions and evaluators.'}
+ */
+Config.getFallbackExpressionEvaluator = function () {
+  return Config._fallbackExpressionEvaluator;
+};
+
 /**
  * Sets an optional CSP-compliant expression evaluator for the JET binding provider and JET ExpressionUtils.
  * This method can only be called once and must be called before applying
@@ -359,6 +373,42 @@ Config.setExpressionEvaluator = function (expressionEvaluator) {
   Config._expressionEvaluator = expressionEvaluator;
 };
 
+/**
+ * Sets an optional fallback expression evaluator used only by legacy expression
+ * evaluation paths when no expression evaluator has been configured.
+ * The fallback evaluator must implement the following methods:
+ * <code>createGenericExpressionEvaluator(expressionText)</code>,
+ * <code>createBindingExpressionEvaluator(expressionText)</code>,
+ * and <code>createReplacementEvaluatorForExtend(expressionText)</code>.
+ * @method setFallbackExpressionEvaluator
+ * @param {Object} fallbackExpressionEvaluator A legacy expression evaluator instance
+ * @return {undefined}
+ * @memberof oj.Config
+ * @ojshortdesc Sets a fallback expression evaluator.
+ * @export
+ * @ojsignature {target:"Type", value: "{createGenericExpressionEvaluator: Function, createBindingExpressionEvaluator: Function, createReplacementEvaluatorForExtend: Function}", for: "fallbackExpressionEvaluator"}
+ * @since 20.1.2
+ * @ojdeprecated {since: '20.1.2', description: 'This API is deprecated. Applications should use CSP-compliant expressions and evaluators.'}
+ */
+Config.setFallbackExpressionEvaluator = function (fallbackExpressionEvaluator) {
+  if (Config._fallbackExpressionEvaluator) {
+    throw new Error("JET fallback expression evaluator can't be set more than once.");
+  }
+  var isValidLegacyEvaluator =
+    fallbackExpressionEvaluator &&
+    typeof fallbackExpressionEvaluator.createGenericExpressionEvaluator === 'function' &&
+    typeof fallbackExpressionEvaluator.createBindingExpressionEvaluator === 'function' &&
+    typeof fallbackExpressionEvaluator.createReplacementEvaluatorForExtend === 'function';
+  if (!isValidLegacyEvaluator) {
+    throw new Error(
+      'JET fallback expression evaluator must implement createGenericExpressionEvaluator(), ' +
+        'createBindingExpressionEvaluator(), and createReplacementEvaluatorForExtend().'
+    );
+  }
+
+  Config._fallbackExpressionEvaluator = fallbackExpressionEvaluator;
+};
+
 /**
  * Sets mode value for the application deployment.
  * @method setDeploymentMode
@@ -404,9 +454,11 @@ const getVersionInfo = Config.getVersionInfo;
 const logVersionInfo = Config.logVersionInfo;
 const setExpressionEvaluator = Config.setExpressionEvaluator;
 const getExpressionEvaluator = Config.getExpressionEvaluator;
+const setFallbackExpressionEvaluator = Config.setFallbackExpressionEvaluator;
+const getFallbackExpressionEvaluator = Config.getFallbackExpressionEvaluator;
 const getConfigBundle = Config.getConfigBundle;
 const __getTemplateEngine = Config.__getTemplateEngine;
 const setDeploymentMode = Config.setDeploymentMode;
 const getDeploymentMode = Config.getDeploymentMode;
 
-export { __getTemplateEngine, getAutomationMode, getConfigBundle, getDeploymentMode, getDeviceRenderMode, getDeviceType, getExpressionEvaluator, getLocale, getResourceUrl, getVersionInfo, logVersionInfo, setAutomationMode, setDeploymentMode, setExpressionEvaluator, setLocale, setResourceBaseUrl };
+export { __getTemplateEngine, getAutomationMode, getConfigBundle, getDeploymentMode, getDeviceRenderMode, getDeviceType, getExpressionEvaluator, getFallbackExpressionEvaluator, getLocale, getResourceUrl, getVersionInfo, logVersionInfo, setAutomationMode, setDeploymentMode, setExpressionEvaluator, setFallbackExpressionEvaluator, setLocale, setResourceBaseUrl };