@oracle/oraclejet 20.1.1 → 20.1.3

package/dist/css/stable/oj-stable.css

@@ -342,7 +342,7 @@
 }
 
 .oj-theme-json {
-  font-family: '{"name":"stable","targetPlatform":"all","behavior":"redwood","jetReleaseVersion":"v20.1.1"}' !important;
+  font-family: '{"name":"stable","targetPlatform":"all","behavior":"redwood","jetReleaseVersion":"v20.1.3"}' !important;
 }
 
 .oj-helper-hidden-accessible {

package/dist/js/libs/oj/debug/ojL10n.js

@@ -77,7 +77,19 @@
   }
 
   function _isObject(val) {
-    return typeof val === 'object';
+    return val !== null && typeof val === 'object';
+  }
+
+  function _isPlainObject(val) {
+    return Object.prototype.toString.call(val) === '[object Object]';
+  }
+
+  /**
+   * Returns true if the key provided should be blocked from recursive bundle merges.
+   * Specifically keys that could cause prototype pollution issues are included.
+   */
+  function _isBlockedKey(key) {
+    return key === '__proto__' || key === 'constructor' || key === 'prototype';
   }
 
   /**
@@ -159,11 +171,16 @@
     var props = Object.keys(source);
     for (var i = 0; i < props.length; i++) {
       var prop = props[i];
-      if (target[prop] == null) {
-        // eslint-disable-next-line no-param-reassign
-        target[prop] = source[prop];
-      } else if (_isObject(source[prop]) && _isObject(target[prop])) {
-        _mixin(target[prop], source[prop]);
+      if (!_isBlockedKey(prop)) {
+        if (target[prop] == null) {
+          // eslint-disable-next-line no-param-reassign
+          target[prop] = _isPlainObject(source[prop]) ? {} : source[prop];
+          if (target[prop] !== source[prop]) {
+            _mixin(target[prop], source[prop]);
+          }
+        } else if (_isObject(source[prop]) && _isObject(target[prop])) {
+          _mixin(target[prop], source[prop]);
+        }
       }
     }
   }

package/dist/js/libs/oj/debug/ojavatar.js

@@ -13,6 +13,28 @@ define(['exports', 'preact/jsx-runtime', 'ojs/ojvcomponent', 'ojs/ojthemeutils',
         else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
         return c > 3 && r && Object.defineProperty(target, key, r), r;
     };
+    const encodeCssUrlControlCharacter = (char) => {
+        const hex = char.charCodeAt(0).toString(16).toUpperCase();
+        return `%${hex.length < 2 ? '0' + hex : hex}`;
+    };
+    const escapeCssUrlString = (url) => {
+        let escapedUrl = '';
+        for (let i = 0; i < url.length; i++) {
+            const char = url.charAt(i);
+            const charCode = char.charCodeAt(0);
+            if (char === '"' || char === '\\') {
+                escapedUrl += `\\${char}`;
+            }
+            else if (charCode <= 0x1f || charCode === 0x7f) {
+                escapedUrl += encodeCssUrlControlCharacter(char);
+            }
+            else {
+                escapedUrl += char;
+            }
+        }
+        return escapedUrl;
+    };
+    const getCssUrl = (url) => `url("${escapeCssUrlString(url)}")`;
     /**
      * @classdesc
      * <h3 id="avatarOverview-section">
@@ -298,7 +320,7 @@ define(['exports', 'preact/jsx-runtime', 'ojs/ojvcomponent', 'ojs/ojthemeutils',
         }
         _getInnerContent(props) {
             if (props.src && !props.iconClass) {
-                return (jsxRuntime.jsx("div", { class: "oj-avatar-background-image", style: { backgroundImage: `url("${props.src}")` } }));
+                return (jsxRuntime.jsx("div", { class: "oj-avatar-background-image", style: { backgroundImage: getCssUrl(props.src) } }));
             }
             else {
                 return jsxRuntime.jsx("div", { class: "oj-avatar-background oj-avatar-background-image" });

package/dist/js/libs/oj/debug/ojcolorpalette.js

@@ -622,9 +622,13 @@ var __oj_color_palette_metadata =
      * it shows all the time.
      * </p>
      * <p>
-     * For security reasons we only support urls with protocol 'http:' or 'https:'.
-     * If the url doesn't comply we ignore it and throw an error.
-     * Pass in an encoded URL since we do not encode the URL.</p>
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. If the url doesn't
+     * comply we ignore it and throw an error. JET does not validate whether
+     * the URL is trusted for the application. Applications are responsible
+     * for providing sanitized URLs and enforcing any required origin or host
+     * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
      *
      * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
      *
@@ -670,6 +674,8 @@ var __oj_color_palette_metadata =
      * <p>
      * To include formatted text in the help.instruction, format the string using html tags.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * For example the
      * help.instruction might look like:
      * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -800,6 +806,8 @@ var __oj_color_palette_metadata =
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the message detail, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -2002,7 +2010,7 @@ var __oj_color_palette_metadata =
           );
 
         if (label) {
-          entry.append($("<span class='oj-colorpalette-swatch-text'>" + label + '</span>')[0]); // @HTMLUpdateOK
+          entry.append($("<span class='oj-colorpalette-swatch-text'></span>").text(label)[0]); // @HTMLUpdateOK
         }
         return entry[0];
       },
@@ -2020,30 +2028,23 @@ var __oj_color_palette_metadata =
        * @private
        */
       _renderNone: function (showLabels, label, tooltip, swatchClass, selectedClass) {
-        var raw;
-
-        raw =
-          "<div class='oj-colorpalette-swatch-entry " +
-          swatchClass +
-          (showLabels ? ' oj-colorpalette-swatch-showlabel' : '') +
-          "'>" +
-          "<div class='oj-colorpalette-swatch-container'>" +
-          "<div class='oj-colorpalette-swatch " +
-          selectedClass +
-          "'" +
-          (!label ? " title='" + tooltip + "'" : '') +
-          (!label ? " aria-label='" + tooltip + "'" : '') +
-          '>' +
-          "<div class='oj-colorpalette-swatch-none-icon'>" +
-          '</div>' +
-          '</div>' +
-          '</div>';
+        // prettier-ignore
+        var entry = $("<div class='oj-colorpalette-swatch-entry'></div>")
+          .addClass(swatchClass + (showLabels ? ' oj-colorpalette-swatch-showlabel' : ''))
+          .append( // @HTMLUpdateOK
+            $("<div class='oj-colorpalette-swatch-container'></div>").append( // @HTMLUpdateOK
+              $("<div class='oj-colorpalette-swatch'></div>")
+                .attr('title', !label ? tooltip : null)
+                .attr('aria-label', !label ? tooltip : null)
+                .addClass(selectedClass)
+                .append($("<div class='oj-colorpalette-swatch-none-icon'></div>")) // @HTMLUpdateOK
+            )
+          );
 
         if (label) {
-          raw += "<span class='oj-colorpalette-swatch-text'>" + label + '</span>';
+          entry.append($("<span class='oj-colorpalette-swatch-text'></span>").text(label)[0]); // @HTMLUpdateOK
         }
-        raw += '</div>';
-        return $(raw)[0];
+        return entry[0];
       },
 
       /**

package/dist/js/libs/oj/debug/ojcomponentcore.js

@@ -2490,6 +2490,10 @@ define(['exports', 'jqueryui-amd/widget', 'jqueryui-amd/unique-id', 'jqueryui-am
       };
       // eslint-disable-next-line no-param-reassign
       proto.getProperty = function (prop) {
+        if (oj.BaseCustomElementBridge.__IsBlockedPropertyPath(prop)) {
+          return undefined;
+        }
+
         var bridge = ojcustomelementUtils.CustomElementUtils.getElementBridge(this);
         var meta = MetadataUtils.getPropertyMetadata(prop, ojcustomelementRegistry.getElementProperties(this));
 
@@ -6452,38 +6456,40 @@ define(['exports', 'jqueryui-amd/widget', 'jqueryui-amd/unique-id', 'jqueryui-am
       var keys = Object.keys(source);
       for (var i = 0; i < keys.length; i++) {
         var key = keys[i];
-        var path;
-        if (ignoreSubkeys == null) {
-          path = null;
-        } else if (basePath == null) {
-          path = key;
-        } else {
-          path = basePath + '.' + key;
-        }
-        // Ignore all sources when the current path is registered in ignoreSubkeys
-        if (ignoreSubkeys == null || !ignoreSubkeys[path]) {
-          var value = source[key];
-          if (value !== undefined) {
-            if ($.isPlainObject(value)) {
-              const plainObjectTarget = $.isPlainObject(target[key]);
-              // If merging an object onto a non-object and avoidClones is set, just replace target with value
-              if (!plainObjectTarget && avoidClones) {
-                // eslint-disable-next-line no-param-reassign
-                target[key] = value;
+        if (!oj.CollectionUtils._isBlockedKey(key)) {
+          var path;
+          if (ignoreSubkeys == null) {
+            path = null;
+          } else if (basePath == null) {
+            path = key;
+          } else {
+            path = basePath + '.' + key;
+          }
+          // Ignore all sources when the current path is registered in ignoreSubkeys
+          if (ignoreSubkeys == null || !ignoreSubkeys[path]) {
+            var value = source[key];
+            if (value !== undefined) {
+              if ($.isPlainObject(value)) {
+                const plainObjectTarget = $.isPlainObject(target[key]);
+                // If merging an object onto a non-object and avoidClones is set, just replace target with value
+                if (!plainObjectTarget && avoidClones) {
+                  // eslint-disable-next-line no-param-reassign
+                  target[key] = value;
+                } else {
+                  var params = plainObjectTarget ? [target[key], value] : [value];
+                  // eslint-disable-next-line no-param-reassign
+                  target[key] = _mergeObjectsWithExclusions(
+                    {},
+                    params,
+                    ignoreSubkeys,
+                    path,
+                    avoidClones
+                  );
+                }
               } else {
-                var params = plainObjectTarget ? [target[key], value] : [value];
                 // eslint-disable-next-line no-param-reassign
-                target[key] = _mergeObjectsWithExclusions(
-                  {},
-                  params,
-                  ignoreSubkeys,
-                  path,
-                  avoidClones
-                );
+                target[key] = value;
               }
-            } else {
-              // eslint-disable-next-line no-param-reassign
-              target[key] = value;
             }
           }
         }

package/dist/js/libs/oj/debug/ojconfig.js

@@ -367,6 +367,20 @@ define(['require', 'exports', 'ojs/ojcore-base', 'ojL10n!ojtranslations/nls/ojtr
     return Config._expressionEvaluator;
   };
 
+  /**
+   * Returns fallback expression evaluator used by legacy expression evaluation paths
+   * when no expression evaluator has been configured.
+   * @return {undefined | Object}
+   * @ignore
+   * @export
+   * @memberof oj.Config
+   * @since 20.0.6
+   * @ojdeprecated {since: '20.0.6', description: 'This API is deprecated. Applications should use CSP-compliant expressions and evaluators.'}
+   */
+  Config.getFallbackExpressionEvaluator = function () {
+    return Config._fallbackExpressionEvaluator;
+  };
+
   /**
    * Sets an optional CSP-compliant expression evaluator for the JET binding provider and JET ExpressionUtils.
    * This method can only be called once and must be called before applying
@@ -389,6 +403,42 @@ define(['require', 'exports', 'ojs/ojcore-base', 'ojL10n!ojtranslations/nls/ojtr
     Config._expressionEvaluator = expressionEvaluator;
   };
 
+  /**
+   * Sets an optional fallback expression evaluator used only by legacy expression
+   * evaluation paths when no expression evaluator has been configured.
+   * The fallback evaluator must implement the following methods:
+   * <code>createGenericExpressionEvaluator(expressionText)</code>,
+   * <code>createBindingExpressionEvaluator(expressionText)</code>,
+   * and <code>createReplacementEvaluatorForExtend(expressionText)</code>.
+   * @method setFallbackExpressionEvaluator
+   * @param {Object} fallbackExpressionEvaluator A legacy expression evaluator instance
+   * @return {undefined}
+   * @memberof oj.Config
+   * @ojshortdesc Sets a fallback expression evaluator.
+   * @export
+   * @ojsignature {target:"Type", value: "{createGenericExpressionEvaluator: Function, createBindingExpressionEvaluator: Function, createReplacementEvaluatorForExtend: Function}", for: "fallbackExpressionEvaluator"}
+   * @since 20.0.6
+   * @ojdeprecated {since: '20.0.6', description: 'This API is deprecated. Applications should use CSP-compliant expressions and evaluators.'}
+   */
+  Config.setFallbackExpressionEvaluator = function (fallbackExpressionEvaluator) {
+    if (Config._fallbackExpressionEvaluator) {
+      throw new Error("JET fallback expression evaluator can't be set more than once.");
+    }
+    var isValidLegacyEvaluator =
+      fallbackExpressionEvaluator &&
+      typeof fallbackExpressionEvaluator.createGenericExpressionEvaluator === 'function' &&
+      typeof fallbackExpressionEvaluator.createBindingExpressionEvaluator === 'function' &&
+      typeof fallbackExpressionEvaluator.createReplacementEvaluatorForExtend === 'function';
+    if (!isValidLegacyEvaluator) {
+      throw new Error(
+        'JET fallback expression evaluator must implement createGenericExpressionEvaluator(), ' +
+          'createBindingExpressionEvaluator(), and createReplacementEvaluatorForExtend().'
+      );
+    }
+
+    Config._fallbackExpressionEvaluator = fallbackExpressionEvaluator;
+  };
+
   /**
    * Sets mode value for the application deployment.
    * @method setDeploymentMode
@@ -434,6 +484,8 @@ define(['require', 'exports', 'ojs/ojcore-base', 'ojL10n!ojtranslations/nls/ojtr
   const logVersionInfo = Config.logVersionInfo;
   const setExpressionEvaluator = Config.setExpressionEvaluator;
   const getExpressionEvaluator = Config.getExpressionEvaluator;
+  const setFallbackExpressionEvaluator = Config.setFallbackExpressionEvaluator;
+  const getFallbackExpressionEvaluator = Config.getFallbackExpressionEvaluator;
   const getConfigBundle = Config.getConfigBundle;
   const __getTemplateEngine = Config.__getTemplateEngine;
   const setDeploymentMode = Config.setDeploymentMode;
@@ -446,6 +498,7 @@ define(['require', 'exports', 'ojs/ojcore-base', 'ojL10n!ojtranslations/nls/ojtr
   exports.getDeviceRenderMode = getDeviceRenderMode;
   exports.getDeviceType = getDeviceType;
   exports.getExpressionEvaluator = getExpressionEvaluator;
+  exports.getFallbackExpressionEvaluator = getFallbackExpressionEvaluator;
   exports.getLocale = getLocale;
   exports.getResourceUrl = getResourceUrl;
   exports.getVersionInfo = getVersionInfo;
@@ -453,6 +506,7 @@ define(['require', 'exports', 'ojs/ojcore-base', 'ojL10n!ojtranslations/nls/ojtr
   exports.setAutomationMode = setAutomationMode;
   exports.setDeploymentMode = setDeploymentMode;
   exports.setExpressionEvaluator = setExpressionEvaluator;
+  exports.setFallbackExpressionEvaluator = setFallbackExpressionEvaluator;
   exports.setLocale = setLocale;
   exports.setResourceBaseUrl = setResourceBaseUrl;
 

package/dist/js/libs/oj/debug/ojcontext.js

@@ -223,15 +223,16 @@ define(['ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojcustomelement-registry'], func
    * @ojtsexportastype Context
    * @since 2.1.0
    * @classdesc Framework service for querying the busy state of components on the page.
-   * <h3> Session storage usage : </h3>
+   * <h3> Session storage usage in debug builds : </h3>
    * <pre class="prettyprint">
    * <code>
    * // enable BusyContext tracing of BusyState creation
    * sessionStorage.setItem('ojet.busyContextTracing', 'on');
    * </code></pre>
    *
-   * <p>Setting this key in sessionStorage will cause BusyStates to be created with an
-   * additional `stack` property containing the call stack at the time of creation.
+   * <p>In debug builds, setting this key in sessionStorage will cause BusyStates to be
+   * created with an additional `stack` property containing the call stack at the time of creation.
+   * Production builds ignore this key.
    * </p>
    */
   const BusyContext = function (hostNode, context) {
@@ -584,7 +585,7 @@ define(['ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojcustomelement-registry'], func
 
     const storageKey = 'ojet.busyContextTracing';
     let stack;
-    if (window?.sessionStorage?.getItem(storageKey) === 'on') {
+    if (true && window?.sessionStorage?.getItem(storageKey) === 'on') {
       try {
         throw new BusyStateTrace('');
       } catch (ex) {

package/dist/js/libs/oj/debug/ojcore-base.js

@@ -37,12 +37,12 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
      * @global
      * @member {string} version JET version numberr
      */
-    version: '20.1.1',
+    version: '20.1.3',
     /**
      * @global
      * @member {string} revision JET source code revision number
      */
-    revision: '2026-05-26_10-56-29',
+    revision: '2026-07-14_15-58-33',
 
     // This function is only meant to be used outside the library, so quoting the name
     // to avoid renaming is appropriate
@@ -404,6 +404,17 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
    * @private
    */
   var _DEBUG = 'DEBUG';
+  var _debug = false;
+
+  Object.defineProperty(Assert, _DEBUG, {
+    get: function () {
+      return _debug;
+    },
+    set: function (value) {
+      _debug = true && value === true;
+    },
+    enumerable: true
+  });
 
   /**
    * @private
@@ -411,12 +422,14 @@ define(['ojs/ojlogger', 'ojs/ojwebdrivertest-proxy'], function (Logger, ojwebdri
   const _NO_PROTO = "' doesn't match prototype ";
 
   /**
-   * Forces DEBUG to be set to true
+   * Forces DEBUG to be set to true in debug builds
    * @export
    * @memberof oj.Assert
    */
   Assert.forceDebug = function () {
-    Assert[_DEBUG] = true;
+    if (true) {
+      Assert[_DEBUG] = true;
+    }
   };
 
   /**

package/dist/js/libs/oj/debug/ojcorerouter.js

@@ -178,10 +178,19 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * activity that must be completed before the transition is finalized.
    * <pre class="prettyprint">
    * <code>
+   * var routeModuleMap = {
+   *   dashboard: 'dashboard',
+   *   incidents: 'incidents'
+   * };
+   *
    * router.currentState.subscribe(function (args) {
    *   var state = args.state;
-   *   var name = state.path;
    *   var complete = args.complete;
+   *   var name = routeModuleMap[state.path];
+   *   if (!name) {
+   *     complete(Promise.reject(new Error('Unknown module route')));
+   *     return;
+   *   }
    *   // Load the module and return Promise to CoreRouter
    *   complete(
    *     Promise.all([
@@ -250,6 +259,10 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * <p>
    * <h5>With RegExp as path.</h5>
    * Note that all paths matching the regular expression will be using this configuration entry.
+   * String routes with known safe names can be used to load matching modules. If RegExp,
+   * catch-all, URL-derived, or user-controlled path values are used to load modules or
+   * other resources, map the matched value to an explicit allowed resource identifier
+   * instead of using the raw matched value directly.
    * <pre class="prettyprint">
    * <code>
    * var root = new CoreRouter([
@@ -1046,7 +1059,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
 
     this.beforeStateChange = null;
     this.currentState = null;
-    this._parentRouter.childRouter = null;
+    if (this._parentRouter) {
+      this._parentRouter.childRouter = null;
+    }
 
     if (this === rootRouter) {
       window.removeEventListener('popstate', this._popstateHandler, false);
@@ -1081,7 +1096,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * can be referenced in the state.
    * @typedef {object} CoreRouter.DetailedRouteConfig
    * @property {string|RegExp} path The path of the route. This may be an exact-
-   * match string, or a regular expression.
+   * match string, or a regular expression. If application code uses a RegExp-matched
+   * path to load a module or other resource, use the route detail to provide an
+   * explicit allowed resource identifier instead of loading the raw matched path value.
    * @property {object=} detail An optional detail object which is passed to
    * the route when it is navigated to.
    * @ojsignature [{target: "Type", value: "D", for: "detail"},
@@ -1095,7 +1112,9 @@ define(['ojs/ojlogger', 'ojs/ojobservable', 'ojs/ojurlpathadapter'], function (L
    * route.
    * @typedef {object} CoreRouter.RedirectedRouteConfig
    * @property {string|RegExp} path The path of the route. This may be an exact-
-   * match string, or a regular expression.
+   * match string, or a regular expression. If application code uses a RegExp-matched
+   * path to load a module or other resource, map it to an explicit allowed resource
+   * identifier instead of loading the raw matched path value.
    * @property {string=} redirect An optional name of a route to which paths matching
    * this route will redirect. The redirected route's path must be of type string.
    */