@oracle/oraclejet 20.1.1 → 20.1.3

package/dist/js/libs/oj/debug/ojcspexpressionevaluator-internal.js

@@ -293,20 +293,33 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     }
 
     function _evaluateMember(node, contexts) {
+      var memberAccess = _getMemberAccess(node, contexts);
+      if (memberAccess.length === 0) {
+        return memberAccess;
+      }
+      var value = _getMemberValue(memberAccess);
+      return [memberAccess[0], value];
+    }
+
+    function _getMemberAccess(node, contexts) {
       var object = _evaluate(node.object, contexts);
       if (!object && node.optional) {
         // handle optional chaining operator: test?.prop
         return [];
-      } else if (node.computed) {
-        return [object, object[_evaluate(node.property, contexts)]];
       }
-      return [object, object[node.property.name]];
+      var key = node.computed ? _evaluate(node.property, contexts) : node.property.name;
+      return _getMemberAccessForKey(object, key);
     }
 
     function _evaluateObjectExpression(node, contexts) {
       return node.properties.reduce(function (acc, curr) {
         const key = ojexpparser.getKeyValue(curr.key);
-        acc[key] = _evaluateAndUnwrap(curr.value, contexts);
+        Object.defineProperty(acc, key, {
+          configurable: true,
+          enumerable: true,
+          value: _evaluateAndUnwrap(curr.value, contexts),
+          writable: true
+        });
         return acc;
       }, {});
     }
@@ -315,7 +328,7 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     function _getValue(contexts, name) {
       var target = _getContextForIdentifier(contexts, name);
       if (target) {
-        return target[name];
+        return _getMemberValue(_getMemberAccessForKey(target, name));
       }
       throw new Error('Variable ' + name + ' is undefined');
     }
@@ -324,7 +337,7 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
     function _getValueWithContext(contexts, name) {
       var target = _getContextForIdentifier(contexts, name);
       if (target) {
-        return [target, target[name]];
+        return [target, _getMemberValue(_getMemberAccessForKey(target, name))];
       }
       throw new Error('Variable ' + name + ' is undefined');
     }
@@ -337,11 +350,18 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
           if (!target) {
             _throwError('Cannot assign value to undefined variable ' + name);
           }
-          target[name] = val;
+          var identifierAccess = _getMemberAccessForKey(target, name);
+          if (_isRestrictedMemberKey(identifierAccess[1])) {
+            _throwError('Assignment to member "' + identifierAccess[1] + '" is not allowed');
+          }
+          identifierAccess[0][identifierAccess[1]] = val;
           break;
         case ojexpparser.MEMBER_EXP:
-          var key = node.computed ? _evaluateAndUnwrap(node.property, contexts) : node.property.name;
-          _evaluateMember(node, contexts)[0][key] = val;
+          var memberAccess = _getMemberAccess(node, contexts);
+          if (_isRestrictedMemberKey(memberAccess[1])) {
+            _throwError('Assignment to member "' + memberAccess[1] + '" is not allowed');
+          }
+          memberAccess[0][memberAccess[1]] = val;
           break;
         default:
           _throwError('Expression of type: ' + node.type + ' not supported for assignment');
@@ -400,6 +420,94 @@ define(['exports', 'ojs/ojexpparser'], function (exports, ojexpparser) { 'use st
       return result.join('');
     }
 
+    // Block prototype-chain escape hatches. Safe data objects can still expose these
+    // names as own, non-accessor properties, but never as inherited capabilities.
+    function _getMemberAccessForKey(object, key) {
+      var propertyKey = typeof key === 'symbol' ? key : String(key);
+      return [object, propertyKey, _validateMemberKey(object, propertyKey)];
+    }
+
+    function _validateMemberKey(object, key) {
+      if (object === Object && _isUnsafeObjectStaticMember(key)) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (_isInheritedIntrinsicPrototypeHelper(object, key)) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      }
+      if (!_isRestrictedMemberKey(key)) {
+        return null;
+      }
+      var descriptor = Object.getOwnPropertyDescriptor(Object(object), key);
+      if (!descriptor || !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (typeof descriptor.value === 'function') {
+        _throwError('Access to member "' + key + '" is not allowed');
+      } else if (key === 'prototype' && typeof object === 'function') {
+        _throwError('Access to member "' + key + '" is not allowed');
+      }
+      return descriptor;
+    }
+
+    function _getMemberValue(memberAccess) {
+      // For restricted keys, use the validated data-descriptor value rather than
+      // invoking a Proxy get trap that could return a different capability.
+      return memberAccess[2] ? memberAccess[2].value : memberAccess[0][memberAccess[1]];
+    }
+
+    function _isRestrictedMemberKey(propertyKey) {
+      return (
+        propertyKey === 'constructor' || propertyKey === '__proto__' || propertyKey === 'prototype'
+      );
+    }
+
+    // These legacy accessors can recover or modify an intrinsic prototype without
+    // evaluating a restricted member name. Allow applications to use an own data
+    // property with one of these names, but reject the inherited intrinsic helpers.
+    function _isInheritedIntrinsicPrototypeHelper(object, propertyKey) {
+      if (
+        propertyKey !== '__lookupGetter__' &&
+        propertyKey !== '__lookupSetter__' &&
+        propertyKey !== '__defineGetter__' &&
+        propertyKey !== '__defineSetter__'
+      ) {
+        return false;
+      }
+
+      var target = Object(object);
+      var visitedTargets = new Set();
+      while (target) {
+        // An extensible Proxy can report itself, or an earlier object, as its
+        // prototype. Treat cycles as unsafe rather than looping indefinitely.
+        if (visitedTargets.has(target)) {
+          return true;
+        }
+        visitedTargets.add(target);
+        var descriptor = Object.getOwnPropertyDescriptor(target, propertyKey);
+        if (descriptor) {
+          return (
+            (target === Object.prototype || target === Function.prototype) &&
+            typeof descriptor.value === 'function'
+          );
+        }
+        target = Object.getPrototypeOf(target);
+      }
+      return false;
+    }
+
+    // The evaluator exposes Object by default. These reflection methods can otherwise
+    // retrieve or mutate intrinsic prototypes and recover Function through descriptors.
+    function _isUnsafeObjectStaticMember(propertyKey) {
+      return (
+        propertyKey === 'assign' ||
+        propertyKey === 'create' ||
+        propertyKey === 'defineProperty' ||
+        propertyKey === 'defineProperties' ||
+        propertyKey === 'getOwnPropertyDescriptor' ||
+        propertyKey === 'getOwnPropertyDescriptors' ||
+        propertyKey === 'getPrototypeOf' ||
+        propertyKey === 'setPrototypeOf'
+      );
+    }
+
     function _getContextForIdentifier(contexts, name) {
       for (var i = 0; i < contexts.length; i++) {
         var context = contexts[i];

package/dist/js/libs/oj/debug/ojcspexpressionevaluator.js

@@ -23,22 +23,29 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
   /**
    * @class oj.CspExpressionEvaluator
    * @since 7.1.0
-   * @ojshortdesc Object representing CSP-compliant evaluator.
+   * @ojshortdesc Object representing a Content Security Policy (CSP)-compliant evaluator.
    * @ojtsmodule
    *
-   * @classdesc A class for creating CSP-compliant evaluators of JavaScript expressions
-   * <p> The default JET expression evaluator cannot be used when Content Security Policy
-   * prohibits unsafe evaluations. In order to replace the default evaluator with the JET CSP-compliant evaluator,
-   * create and pass an instance of CspExpressionEvaluator class to the
-   * <a href="oj.Config.html#.setExpressionEvaluator">Config.setExpressionEvaluator()</a> method.
-   * This method must be called before applying knockout bindings in the application for the first time.
+   * @classdesc A class for creating Content Security Policy (CSP)-compliant evaluators of JavaScript expressions.
+   * Content Security Policy is a browser security mechanism that can disallow dynamically compiled code, including
+   * code generated with JavaScript Function constructors.
+   * <p> Starting with JET 20.0.6, the default JET expression evaluator is CSP-compliant and uses
+   * CspExpressionEvaluator. To provide an additional global scope for evaluating expressions, create and pass a
+   * CspExpressionEvaluator instance to the <a href="oj.Config.html#.setExpressionEvaluator">Config.setExpressionEvaluator()</a>
+   * method before applying knockout bindings in the application for the first time.
    * </p>
    *
-   * <p>Any extra context required for evaluating expressions can be passed to the object constructor using <code>globalScope</code> property.</p>
+   * <p>Any extra context required for evaluating expressions can be passed to the object constructor using the <code>globalScope</code> property.
+   * Expression text must be trusted application code. This evaluator is CSP-compliant because it does not use dynamic code compilation; it is
+   * not a security sandbox. Restricting <code>globalScope</code> does not make untrusted expression text safe because expressions can access
+   * capabilities from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs. This
+   * evaluator restricts known prototype-chain access routes in its default capabilities, but applications remain responsible for the
+   * capabilities they expose.</p>
    *
    * <pre class="prettyprint">
    * <code>
-   * Config.setExpressionEvaluator(new CspExpressionEvaluator());
+   * const extraScope = { Date: Date };
+   * Config.setExpressionEvaluator(new CspExpressionEvaluator({ globalScope: extraScope }));
    * </code>
    * </pre>
    *
@@ -77,9 +84,16 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
    * <h2 id="invalidExpressions">Expression limitations:
    *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#invalidExpressions"></a>
    * </h2>
-   * <p> The following code is not supported in expressions:
+   * <p> The following syntax and behaviors are unsupported or restricted in expressions:
    * <ul>
-   *  <li>Assignment operators of any types such as <code>'='</code> or <code>'+='</code> or <code>'|='</code></li>
+   *  <li>Expression text must be trusted application code. This evaluator avoids dynamic code compilation for CSP compliance, but it is not a security sandbox. Expressions can invoke functions and access non-restricted values from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs, as well as <code>globalScope</code>.</li>
+   *  <li>To prevent prototype-chain access, access to properties named <code>'constructor'</code>, <code>'__proto__'</code>, and <code>'prototype'</code> is read-only and supported only as own, non-accessor, non-function data properties, including when accessed with bracket notation or as an identifier. A <code>'prototype'</code> property cannot be accessed on a function. For these names, a Proxy's data descriptor value is used instead of its <code>get</code> trap result.</li>
+   *  <li>Inherited <code>'__lookupGetter__'</code>, <code>'__lookupSetter__'</code>, <code>'__defineGetter__'</code>, and <code>'__defineSetter__'</code> prototype helpers are not supported. Own data properties with these names are supported.</li>
+   *  <li>An object-literal <code>'__proto__'</code> property is created as an own data property and does not change the object's prototype.</li>
+   *  <li>The default <code>Object</code> global does not support <code>assign</code> or the reflection methods <code>create</code>, <code>defineProperty</code>, <code>defineProperties</code>, <code>getOwnPropertyDescriptor</code>, <code>getOwnPropertyDescriptors</code>, <code>getPrototypeOf</code>, or <code>setPrototypeOf</code>.</li>
+   *  <li>Assignment operators of any type, such as <code>'='</code>, <code>'+='</code>, or <code>'|='</code>, are generally unsupported.
+   *    JET and Knockout may use internal assignment expressions to implement two-way binding writeback; applications should not rely on
+   *    assignment being accepted in expression text.</li>
    *  <li>Blocks of code such as <code>'if (...){}'</code></li>
    *  <li>Comma operator (,) such as <code>'(expr1, expr2)'</code></li>
    *  <li>in operator such as <code>'prop in testObject'</code></li>
@@ -94,6 +108,7 @@ define(['ojs/ojcspexpressionevaluator-internal', 'ojs/ojkoshared'], function (oj
    * @param {Object} options
    * @param {any=} options.globalScope optional additional scope required for evaluating expressions.
    * The additional scope will be used to resolve the variables if they are not defined in the $data or $context.
+   * It is not a security boundary for untrusted expression text.
    * <pre class="prettyprint"><code>Config.setExpressionEvaluator(new CspExpressionEvaluator({globalScope:extraScope}));</code></pre>
    * @constructor
    * @final

package/dist/js/libs/oj/debug/ojcustomelement-utils.js

@@ -552,7 +552,9 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcustomelement-registry', 'ojs/ojcon
             if (attrValue != null) {
                 let exp = AttributeUtils.getExpressionInfo(attrValue).expr;
                 if (exp == null) {
-                    exp = stringify ? `'${attrValue}'` : attrValue;
+                    // Binding strings are evaluated as expressions. Serialize literal attribute
+                    // values so quotes and other JavaScript syntax characters remain data.
+                    exp = stringify ? JSON.stringify(attrValue) : attrValue;
                 }
                 return exp;
             }

package/dist/js/libs/oj/debug/ojcustomelement.js

@@ -180,6 +180,7 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
       // as well since we don't reflect property values back to the DOM attribute.
       const prop = ojcustomelementUtils.AttributeUtils.attributeToPropertyName(attr);
       const bridge = ojcustomelementUtils.CustomElementUtils.getElementBridge(this);
+      BaseCustomElementBridge.__ValidatePropertyPath(this, prop);
       if (oldValue !== newValue || bridge.State.dirtyProps.has(prop)) {
         bridge.State.dirtyProps.delete(prop.split('.')[0]);
         // Due to  where IE11 disables child inputs for a parent with the disabled attribute,
@@ -323,6 +324,10 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     },
 
     GetProperty: function (element, prop, props) {
+      if (BaseCustomElementBridge.__IsBlockedPropertyPath(prop)) {
+        return undefined;
+      }
+
       var meta = MetadataUtils.getPropertyMetadata(prop, ojcustomelementRegistry.getElementProperties(element));
 
       // For event listener and non component properties, retrieve the value directly stored on the element.
@@ -377,6 +382,8 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
      * @return {boolean}
      */
     SaveEarlyPropertySet: function (element, prop, value) {
+      BaseCustomElementBridge.__ValidatePropertyPath(element, prop);
+
       // Do not save sets that occur during BaseCustomElementBridge.__InitProperties
       // or expression evaluation. We can process these as normal. Playback occurs before the
       // binding provider promise is resolved leading to component creation.
@@ -410,6 +417,8 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     },
 
     SetProperty: function (element, prop, value, props, bOuter) {
+      BaseCustomElementBridge.__ValidatePropertyPath(element, prop);
+
       // Check value against any defined enums
       var meta = MetadataUtils.getPropertyMetadata(prop, ojcustomelementRegistry.getElementProperties(element));
       if (ojcustomelementUtils.AttributeUtils.isEventListenerProperty(prop) || !meta) {
@@ -496,6 +505,8 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     },
 
     ValidatePropertySet: function (element, property, value) {
+      BaseCustomElementBridge.__ValidatePropertyPath(element, property);
+
       var propsMeta = ojcustomelementRegistry.getElementProperties(element);
       var propMeta = MetadataUtils.getPropertyMetadata(property, propsMeta);
       var propAr = property.split('.');
@@ -628,6 +639,7 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
       var keys = Object.keys(props);
       for (var i = 0; i < keys.length; i++) {
         var key = keys[i];
+        BaseCustomElementBridge.__ValidatePropertyPath(elem, key);
         if (key.indexOf('.') >= 0) {
           mutationKeys.push(key);
         } else {
@@ -734,6 +746,38 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     );
   };
 
+  /**
+   * Checks whether a property path segment could mutate Object.prototype or other prototypes.
+   * @param {string} property The property path
+   * @return {boolean} true if the path contains a blocked segment
+   * @ignore
+   */
+  BaseCustomElementBridge.__IsBlockedPropertyPath = function (property) {
+    var propPath = property.split('.');
+    for (var i = 0; i < propPath.length; i++) {
+      if (oj.CollectionUtils._isBlockedKey(propPath[i])) {
+        return true;
+      }
+    }
+    return false;
+  };
+
+  /**
+   * Validates a property path before walking objects with dot notation.
+   * @param {Element=} element The custom element
+   * @param {string} property The property path
+   * @ignore
+   */
+  BaseCustomElementBridge.__ValidatePropertyPath = function (element, property) {
+    if (BaseCustomElementBridge.__IsBlockedPropertyPath(property)) {
+      var message = `Invalid property path '${property}'.`;
+      if (element) {
+        throw new ojcustomelementUtils.JetElementError(element, message);
+      }
+      throw new Error(message);
+    }
+  };
+
   /**
    * Checks to see if there are any overlapping attribute for the given element and attribute
    * @ignore
@@ -766,6 +810,7 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
       for (var i = 0; i < attrs.length; i++) {
         var attr = attrs[i];
         var property = ojcustomelementUtils.AttributeUtils.attributeToPropertyName(attr.nodeName);
+        BaseCustomElementBridge.__ValidatePropertyPath(element, property);
 
         // See if attribute is a component property
         var meta = MetadataUtils.getPropertyMetadata(property, metaProps);
@@ -807,11 +852,14 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     var propsObj = componentProps;
     var propPath = property.split('.');
     var branchedProps;
+    BaseCustomElementBridge.__ValidatePropertyPath(null, property);
+
     // Set subproperty, initializing parent objects along the way unless the top level
     // property is not defined since setting it to an empty object will trigger a property changed
     // event. Instead, branch and set at the end. We only have listeners on top level properties
     // so setting a subproperty will not trigger a property changed event along the way.
     var topProp = propNameFun(propPath[0]);
+    BaseCustomElementBridge.__ValidatePropertyPath(null, topProp);
     if (propPath.length > 1 && !componentProps[topProp]) {
       branchedProps = {};
       propsObj = branchedProps;
@@ -820,6 +868,7 @@ define(['ojs/ojcore', 'ojs/ojlogger', 'ojs/ojcustomelement-utils', 'ojs/ojcustom
     // Walk to the correct location
     for (var i = 0; i < propPath.length; i++) {
       var subprop = propNameFun(propPath[i]);
+      BaseCustomElementBridge.__ValidatePropertyPath(null, subprop);
       if (i === propPath.length - 1) {
         propsObj[subprop] = value;
       } else if (!propsObj[subprop]) {

package/dist/js/libs/oj/debug/ojdataprovider.js

@@ -2198,8 +2198,7 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
                             // 2. Remove single and double quotes
                             // 3. Add word boundary and wild cards for phrase matching
                             filterValue = new RegExp(`${'\\b' +
-                            textFilterValue
-                                .replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')
+                            FilterImpl._escapeRegExp(textFilterValue)
                                 .replace(/('|")/g, '')
                                 // Avoid nested quantifiers that can trigger ReDoS.
                                 // Equivalent to original "(.*)((\\s|\\t|\\r|\\n)*)" with JS-dot behavior:
@@ -2207,12 +2206,12 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
                                 .replace(/(\s|\t)/g, '[^\\r\\n]*[\\s\\t\\r\\n]*')}`, 'i');
                         }
                         else if (filter['matchBy'] === 'startsWith') {
-                            filterValue = new RegExp(`^${textFilterValue.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')}`, 'i');
+                            filterValue = new RegExp(`^${FilterImpl._escapeRegExp(textFilterValue)}`, 'i');
                         }
                         else {
                             // 'contains' | 'fuzzy' | 'unknown'
                             // Escape special characters without change filter['text'] which is the original filter string by default
-                            filterValue = new RegExp(textFilterValue.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&'), 'i');
+                            filterValue = new RegExp(FilterImpl._escapeRegExp(textFilterValue), 'i');
                         }
                     }
                     else {
@@ -2283,12 +2282,27 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
                     const fieldAttributePath = path ? path + '.' + fieldAttribute : fieldAttribute;
                     if (!(fieldValue instanceof Object)) {
                         const operatorExpr = {};
-                        // need express co, sw and ew as regex
-                        if (op === '$sw' || op === '$ew' || op === '$co') {
-                            fieldValue = FilterImpl._fixStringExpr(op, fieldValue);
-                            op = '$regex';
+                        // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+                        // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+                        //
+                        // AttributeFilterDef object values are expanded into one criterion per field. For example,
+                        // { op: '$ew', value: { name: 'admin', value: 'foo' } } becomes an $and expression with
+                        // separate criteria for "name" and "value". The $co/$sw/$ew operators are implemented by
+                        // converting each field criterion to $regex, because FilterUtils only has a regex evaluator
+                        // for contains/starts-with/ends-with matching in this transformed expression.
+                        //
+                        // Keep the converted operator in a local variable. Mutating the shared op parameter while
+                        // processing the first field would cause later sibling fields to see "$regex" instead of the
+                        // original "$co", "$sw", or "$ew". That would skip _fixStringExpr for later fields, losing
+                        // either the $sw/$ew anchoring semantics or the regex escaping added for the ReDoS fix.
+                        // This behavior is intentionally changed/fixed as part of the security fix so every field
+                        // in an object filter preserves the original string operator semantics before regex conversion.
+                        let fieldOp = op;
+                        if (fieldOp === '$sw' || fieldOp === '$ew' || fieldOp === '$co') {
+                            fieldValue = FilterImpl._fixStringExpr(fieldOp, fieldValue);
+                            fieldOp = '$regex';
                         }
-                        operatorExpr[op] = fieldValue;
+                        operatorExpr[fieldOp] = fieldValue;
                         const fieldExpr = {};
                         fieldExpr[fieldAttributePath] = operatorExpr;
                         criteriaArray.push(fieldExpr);
@@ -2308,6 +2322,14 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
         }
         static _fixStringExpr(op, value) {
             if (typeof value === 'string' || value instanceof String) {
+                // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+                // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+                //
+                // $co, $sw, and $ew are public literal string matching operators, but internally they are
+                // converted to $regex and later evaluated with new RegExp(...) in FilterUtils. Without escaping,
+                // input such as ".*", "admin|", or "(a+)+$" is interpreted as regex syntax. That can change
+                // filter meaning and can also trigger excessive backtracking in the browser.
+                value = FilterImpl._escapeRegExp(value);
                 if (op === '$sw') {
                     value = '^' + value;
                 }
@@ -2317,6 +2339,22 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojlogger', 'ojs/ojeventtarget'], func
             }
             return value;
         }
+        /**
+         * Escapes JavaScript regular expression metacharacters in a string so the
+         * value can be embedded in a RegExp and matched literally.
+         *
+         * This is used before building RegExp instances from literal filter text. It
+         * prefixes every JavaScript RegExp metacharacter with a backslash:
+         *   . * + - ? ^ $ { } ( ) | [ ] \
+         * The replacement string "\\$&" means "insert a backslash, then the entire
+         * matched character".
+         *
+         * @param value The string value to escape.
+         * @returns A string with every RegExp metacharacter prefixed by a backslash.
+         */
+        static _escapeRegExp(value) {
+            return value.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&');
+        }
     }
     // Bound text-filter input size to reduce regex amplification risks
     FilterImpl._MAX_TEXT_FILTER_LENGTH = 512;

package/dist/js/libs/oj/debug/ojdataproviderscroller.js

@@ -2811,12 +2811,9 @@ define(['exports', 'ojs/ojcore-base', 'jquery', 'ojs/ojcontext', 'ojs/ojdatacoll
         addFragmentOnRequestAnimationFrame(fragment);
       });
     } else {
-      // Chromium has an issue with requestIdleCallback when mouse wheel is used, see Chrome :
-      // https://bugs.chromium.org/p/chromium/issues/detail?id=822269
-      var options;
-      if (isMouseWheel && oj.AgentUtils.getAgentInfo().engine === oj.AgentUtils.ENGINE.BLINK) {
-        options = { timeout: 100 };
-      }
+      // Use a timeout so fetch rendering is not blocked indefinitely when the browser
+      // does not get an idle period, including scrollbar and mouse wheel scrolling.
+      var options = { timeout: 100 };
       this.m_idleCallback = window.requestIdleCallback(function (idleDeadline) {
         // no need to check for whether listview has been destroyed yet since we cancel the callback on destroy
         var timeRemaining = idleDeadline.timeRemaining();

package/dist/js/libs/oj/debug/ojdatetimepicker.js

@@ -1426,6 +1426,33 @@ var __oj_input_date_time_metadata =
     );
   }
 
+  /**
+   * JET-79822 - JET - ARM5_UNCONSTRAINED- F37 - OJ-INPUT-DATE DAYFORMATTER CLASSNAME UNESCAPED IN HTML CLASS ATTRIBUTE
+   * Encodes application-supplied text before it is inserted into a generated HTML attribute string.
+   *
+   * @param {string} value value to encode
+   * @returns {string} value encoded for an HTML attribute
+   * @ignore
+   */
+  function _escapeHtmlAttribute(value) {
+    return String(value).replace(/[&'"<>]/g, function (match) {
+      switch (match) {
+        case '&':
+          return '&amp;';
+        case "'":
+          return '&#39;';
+        case '"':
+          return '&quot;';
+        case '<':
+          return '&lt;';
+        case '>':
+          return '&gt;';
+        default:
+          return match;
+      }
+    });
+  }
+
   /**
    * For default converter
    * @static
@@ -2814,9 +2841,13 @@ var __oj_input_date_time_metadata =
        * it shows all the time.
        * </p>
        * <p>
-       * For security reasons we only support urls with protocol 'http:' or 'https:'.
-       * If the url doesn't comply we ignore it and throw an error.
-       * Pass in an encoded URL since we do not encode the URL.</p>
+       * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+       * currently supports <code class="prettyprint">http:</code> and
+       * <code class="prettyprint">https:</code> protocols. If the url doesn't
+       * comply we ignore it and throw an error. JET does not validate whether
+       * the URL is trusted for the application. Applications are responsible
+       * for providing sanitized URLs and enforcing any required origin or host
+       * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
        *
        * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
        *
@@ -2862,6 +2893,8 @@ var __oj_input_date_time_metadata =
        * <p>
        * To include formatted text in the help.instruction, format the string using html tags.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * For example the
        * help.instruction might look like:
        * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -2992,6 +3025,8 @@ var __oj_input_date_time_metadata =
        * hints and message summary text cannot. If you use formatted text, it should be accessible
        * and make sense to the user if formatting wasn't there.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * To format the message detail, you could do this:
        * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
        * </p>
@@ -3482,6 +3517,8 @@ var __oj_input_date_time_metadata =
        * hints and message summary text cannot. If you use formatted text, it should be accessible
        * and make sense to the user if formatting wasn't there.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * To format the help.instruction, you could do this:
        * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
        * </p>
@@ -6836,7 +6873,7 @@ var __oj_input_date_time_metadata =
                 (otherMonth && daysOutsideMonth === 'hidden'
                   ? ''
                   : ' ' +
-                    daySettings[1] + // highlight custom dates
+                    _escapeHtmlAttribute(daySettings[1]) + // highlight custom dates
                     (selected ? ' ' + this._CURRENT_CLASS : '') + // highlight selected day
                     (printDate.getTime() === today.getTime() ? ' oj-datepicker-today' : '')) +
                 "'" + // highlight today (if different)
@@ -11057,6 +11094,8 @@ var __oj_input_date_time_metadata =
        * hints and message summary text cannot. If you use formatted text, it should be accessible
        * and make sense to the user if formatting wasn't there.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * To format the help.instruction, you could do this:
        * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
        * </p>
@@ -14387,9 +14426,13 @@ var __oj_input_date_time_metadata =
        * it shows all the time.
        * </p>
        * <p>
-       * For security reasons we only support urls with protocol 'http:' or 'https:'.
-       * If the url doesn't comply we ignore it and throw an error.
-       * Pass in an encoded URL since we do not encode the URL.</p>
+       * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+       * currently supports <code class="prettyprint">http:</code> and
+       * <code class="prettyprint">https:</code> protocols. If the url doesn't
+       * comply we ignore it and throw an error. JET does not validate whether
+       * the URL is trusted for the application. Applications are responsible
+       * for providing sanitized URLs and enforcing any required origin or host
+       * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
        *
        * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
        *
@@ -14435,6 +14478,8 @@ var __oj_input_date_time_metadata =
        * <p>
        * To include formatted text in the help.instruction, format the string using html tags.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * For example the
        * help.instruction might look like:
        * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -14565,6 +14610,8 @@ var __oj_input_date_time_metadata =
        * hints and message summary text cannot. If you use formatted text, it should be accessible
        * and make sense to the user if formatting wasn't there.
        * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+       * Inline style attributes are sanitized; the retained styling is limited to color, font
+       * style, font weight, and text decoration. Use CSS classes for other styling.
        * To format the message detail, you could do this:
        * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
        * </p>