@oracle/oraclejet 20.1.1 → 20.1.3

package/dist/js/libs/oj/debug_esm/ojcorerouter.js

@@ -178,10 +178,19 @@ function getPathParam(segment) {
  * activity that must be completed before the transition is finalized.
  * <pre class="prettyprint">
  * <code>
+ * var routeModuleMap = {
+ *   dashboard: 'dashboard',
+ *   incidents: 'incidents'
+ * };
+ *
  * router.currentState.subscribe(function (args) {
  *   var state = args.state;
- *   var name = state.path;
  *   var complete = args.complete;
+ *   var name = routeModuleMap[state.path];
+ *   if (!name) {
+ *     complete(Promise.reject(new Error('Unknown module route')));
+ *     return;
+ *   }
  *   // Load the module and return Promise to CoreRouter
  *   complete(
  *     Promise.all([
@@ -250,6 +259,10 @@ function getPathParam(segment) {
  * <p>
  * <h5>With RegExp as path.</h5>
  * Note that all paths matching the regular expression will be using this configuration entry.
+ * String routes with known safe names can be used to load matching modules. If RegExp,
+ * catch-all, URL-derived, or user-controlled path values are used to load modules or
+ * other resources, map the matched value to an explicit allowed resource identifier
+ * instead of using the raw matched value directly.
  * <pre class="prettyprint">
  * <code>
  * var root = new CoreRouter([
@@ -1046,7 +1059,9 @@ CoreRouter.prototype.destroy = function () {
 
   this.beforeStateChange = null;
   this.currentState = null;
-  this._parentRouter.childRouter = null;
+  if (this._parentRouter) {
+    this._parentRouter.childRouter = null;
+  }
 
   if (this === rootRouter) {
     window.removeEventListener('popstate', this._popstateHandler, false);
@@ -1081,7 +1096,9 @@ CoreRouter.prototype.destroy = function () {
  * can be referenced in the state.
  * @typedef {object} CoreRouter.DetailedRouteConfig
  * @property {string|RegExp} path The path of the route. This may be an exact-
- * match string, or a regular expression.
+ * match string, or a regular expression. If application code uses a RegExp-matched
+ * path to load a module or other resource, use the route detail to provide an
+ * explicit allowed resource identifier instead of loading the raw matched path value.
  * @property {object=} detail An optional detail object which is passed to
  * the route when it is navigated to.
  * @ojsignature [{target: "Type", value: "D", for: "detail"},
@@ -1095,7 +1112,9 @@ CoreRouter.prototype.destroy = function () {
  * route.
  * @typedef {object} CoreRouter.RedirectedRouteConfig
  * @property {string|RegExp} path The path of the route. This may be an exact-
- * match string, or a regular expression.
+ * match string, or a regular expression. If application code uses a RegExp-matched
+ * path to load a module or other resource, map it to an explicit allowed resource
+ * identifier instead of loading the raw matched path value.
  * @property {string=} redirect An optional name of a route to which paths matching
  * this route will redirect. The redirected route's path must be of type string.
  */

package/dist/js/libs/oj/debug_esm/ojcspexpressionevaluator-internal.js

@@ -293,20 +293,33 @@ const CspExpressionEvaluatorInternal = function (options) {
   }
 
   function _evaluateMember(node, contexts) {
+    var memberAccess = _getMemberAccess(node, contexts);
+    if (memberAccess.length === 0) {
+      return memberAccess;
+    }
+    var value = _getMemberValue(memberAccess);
+    return [memberAccess[0], value];
+  }
+
+  function _getMemberAccess(node, contexts) {
     var object = _evaluate(node.object, contexts);
     if (!object && node.optional) {
       // handle optional chaining operator: test?.prop
       return [];
-    } else if (node.computed) {
-      return [object, object[_evaluate(node.property, contexts)]];
     }
-    return [object, object[node.property.name]];
+    var key = node.computed ? _evaluate(node.property, contexts) : node.property.name;
+    return _getMemberAccessForKey(object, key);
   }
 
   function _evaluateObjectExpression(node, contexts) {
     return node.properties.reduce(function (acc, curr) {
       const key = getKeyValue(curr.key);
-      acc[key] = _evaluateAndUnwrap(curr.value, contexts);
+      Object.defineProperty(acc, key, {
+        configurable: true,
+        enumerable: true,
+        value: _evaluateAndUnwrap(curr.value, contexts),
+        writable: true
+      });
       return acc;
     }, {});
   }
@@ -315,7 +328,7 @@ const CspExpressionEvaluatorInternal = function (options) {
   function _getValue(contexts, name) {
     var target = _getContextForIdentifier(contexts, name);
     if (target) {
-      return target[name];
+      return _getMemberValue(_getMemberAccessForKey(target, name));
     }
     throw new Error('Variable ' + name + ' is undefined');
   }
@@ -324,7 +337,7 @@ const CspExpressionEvaluatorInternal = function (options) {
   function _getValueWithContext(contexts, name) {
     var target = _getContextForIdentifier(contexts, name);
     if (target) {
-      return [target, target[name]];
+      return [target, _getMemberValue(_getMemberAccessForKey(target, name))];
     }
     throw new Error('Variable ' + name + ' is undefined');
   }
@@ -337,11 +350,18 @@ const CspExpressionEvaluatorInternal = function (options) {
         if (!target) {
           _throwError('Cannot assign value to undefined variable ' + name);
         }
-        target[name] = val;
+        var identifierAccess = _getMemberAccessForKey(target, name);
+        if (_isRestrictedMemberKey(identifierAccess[1])) {
+          _throwError('Assignment to member "' + identifierAccess[1] + '" is not allowed');
+        }
+        identifierAccess[0][identifierAccess[1]] = val;
         break;
       case MEMBER_EXP:
-        var key = node.computed ? _evaluateAndUnwrap(node.property, contexts) : node.property.name;
-        _evaluateMember(node, contexts)[0][key] = val;
+        var memberAccess = _getMemberAccess(node, contexts);
+        if (_isRestrictedMemberKey(memberAccess[1])) {
+          _throwError('Assignment to member "' + memberAccess[1] + '" is not allowed');
+        }
+        memberAccess[0][memberAccess[1]] = val;
         break;
       default:
         _throwError('Expression of type: ' + node.type + ' not supported for assignment');
@@ -400,6 +420,94 @@ const CspExpressionEvaluatorInternal = function (options) {
     return result.join('');
   }
 
+  // Block prototype-chain escape hatches. Safe data objects can still expose these
+  // names as own, non-accessor properties, but never as inherited capabilities.
+  function _getMemberAccessForKey(object, key) {
+    var propertyKey = typeof key === 'symbol' ? key : String(key);
+    return [object, propertyKey, _validateMemberKey(object, propertyKey)];
+  }
+
+  function _validateMemberKey(object, key) {
+    if (object === Object && _isUnsafeObjectStaticMember(key)) {
+      _throwError('Access to member "' + key + '" is not allowed');
+    } else if (_isInheritedIntrinsicPrototypeHelper(object, key)) {
+      _throwError('Access to member "' + key + '" is not allowed');
+    }
+    if (!_isRestrictedMemberKey(key)) {
+      return null;
+    }
+    var descriptor = Object.getOwnPropertyDescriptor(Object(object), key);
+    if (!descriptor || !Object.prototype.hasOwnProperty.call(descriptor, 'value')) {
+      _throwError('Access to member "' + key + '" is not allowed');
+    } else if (typeof descriptor.value === 'function') {
+      _throwError('Access to member "' + key + '" is not allowed');
+    } else if (key === 'prototype' && typeof object === 'function') {
+      _throwError('Access to member "' + key + '" is not allowed');
+    }
+    return descriptor;
+  }
+
+  function _getMemberValue(memberAccess) {
+    // For restricted keys, use the validated data-descriptor value rather than
+    // invoking a Proxy get trap that could return a different capability.
+    return memberAccess[2] ? memberAccess[2].value : memberAccess[0][memberAccess[1]];
+  }
+
+  function _isRestrictedMemberKey(propertyKey) {
+    return (
+      propertyKey === 'constructor' || propertyKey === '__proto__' || propertyKey === 'prototype'
+    );
+  }
+
+  // These legacy accessors can recover or modify an intrinsic prototype without
+  // evaluating a restricted member name. Allow applications to use an own data
+  // property with one of these names, but reject the inherited intrinsic helpers.
+  function _isInheritedIntrinsicPrototypeHelper(object, propertyKey) {
+    if (
+      propertyKey !== '__lookupGetter__' &&
+      propertyKey !== '__lookupSetter__' &&
+      propertyKey !== '__defineGetter__' &&
+      propertyKey !== '__defineSetter__'
+    ) {
+      return false;
+    }
+
+    var target = Object(object);
+    var visitedTargets = new Set();
+    while (target) {
+      // An extensible Proxy can report itself, or an earlier object, as its
+      // prototype. Treat cycles as unsafe rather than looping indefinitely.
+      if (visitedTargets.has(target)) {
+        return true;
+      }
+      visitedTargets.add(target);
+      var descriptor = Object.getOwnPropertyDescriptor(target, propertyKey);
+      if (descriptor) {
+        return (
+          (target === Object.prototype || target === Function.prototype) &&
+          typeof descriptor.value === 'function'
+        );
+      }
+      target = Object.getPrototypeOf(target);
+    }
+    return false;
+  }
+
+  // The evaluator exposes Object by default. These reflection methods can otherwise
+  // retrieve or mutate intrinsic prototypes and recover Function through descriptors.
+  function _isUnsafeObjectStaticMember(propertyKey) {
+    return (
+      propertyKey === 'assign' ||
+      propertyKey === 'create' ||
+      propertyKey === 'defineProperty' ||
+      propertyKey === 'defineProperties' ||
+      propertyKey === 'getOwnPropertyDescriptor' ||
+      propertyKey === 'getOwnPropertyDescriptors' ||
+      propertyKey === 'getPrototypeOf' ||
+      propertyKey === 'setPrototypeOf'
+    );
+  }
+
   function _getContextForIdentifier(contexts, name) {
     for (var i = 0; i < contexts.length; i++) {
       var context = contexts[i];

package/dist/js/libs/oj/debug_esm/ojcspexpressionevaluator.js

@@ -24,22 +24,29 @@ import 'ojs/ojkoshared';
 /**
  * @class oj.CspExpressionEvaluator
  * @since 7.1.0
- * @ojshortdesc Object representing CSP-compliant evaluator.
+ * @ojshortdesc Object representing a Content Security Policy (CSP)-compliant evaluator.
  * @ojtsmodule
  *
- * @classdesc A class for creating CSP-compliant evaluators of JavaScript expressions
- * <p> The default JET expression evaluator cannot be used when Content Security Policy
- * prohibits unsafe evaluations. In order to replace the default evaluator with the JET CSP-compliant evaluator,
- * create and pass an instance of CspExpressionEvaluator class to the
- * <a href="oj.Config.html#.setExpressionEvaluator">Config.setExpressionEvaluator()</a> method.
- * This method must be called before applying knockout bindings in the application for the first time.
+ * @classdesc A class for creating Content Security Policy (CSP)-compliant evaluators of JavaScript expressions.
+ * Content Security Policy is a browser security mechanism that can disallow dynamically compiled code, including
+ * code generated with JavaScript Function constructors.
+ * <p> Starting with JET 20.0.6, the default JET expression evaluator is CSP-compliant and uses
+ * CspExpressionEvaluator. To provide an additional global scope for evaluating expressions, create and pass a
+ * CspExpressionEvaluator instance to the <a href="oj.Config.html#.setExpressionEvaluator">Config.setExpressionEvaluator()</a>
+ * method before applying knockout bindings in the application for the first time.
  * </p>
  *
- * <p>Any extra context required for evaluating expressions can be passed to the object constructor using <code>globalScope</code> property.</p>
+ * <p>Any extra context required for evaluating expressions can be passed to the object constructor using the <code>globalScope</code> property.
+ * Expression text must be trusted application code. This evaluator is CSP-compliant because it does not use dynamic code compilation; it is
+ * not a security sandbox. Restricting <code>globalScope</code> does not make untrusted expression text safe because expressions can access
+ * capabilities from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs. This
+ * evaluator restricts known prototype-chain access routes in its default capabilities, but applications remain responsible for the
+ * capabilities they expose.</p>
  *
  * <pre class="prettyprint">
  * <code>
- * Config.setExpressionEvaluator(new CspExpressionEvaluator());
+ * const extraScope = { Date: Date };
+ * Config.setExpressionEvaluator(new CspExpressionEvaluator({ globalScope: extraScope }));
  * </code>
  * </pre>
  *
@@ -78,9 +85,16 @@ import 'ojs/ojkoshared';
  * <h2 id="invalidExpressions">Expression limitations:
  *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#invalidExpressions"></a>
  * </h2>
- * <p> The following code is not supported in expressions:
+ * <p> The following syntax and behaviors are unsupported or restricted in expressions:
  * <ul>
- *  <li>Assignment operators of any types such as <code>'='</code> or <code>'+='</code> or <code>'|='</code></li>
+ *  <li>Expression text must be trusted application code. This evaluator avoids dynamic code compilation for CSP compliance, but it is not a security sandbox. Expressions can invoke functions and access non-restricted values from binding contexts, including inherited members and, where supplied, <code>$element</code> and related DOM APIs, as well as <code>globalScope</code>.</li>
+ *  <li>To prevent prototype-chain access, access to properties named <code>'constructor'</code>, <code>'__proto__'</code>, and <code>'prototype'</code> is read-only and supported only as own, non-accessor, non-function data properties, including when accessed with bracket notation or as an identifier. A <code>'prototype'</code> property cannot be accessed on a function. For these names, a Proxy's data descriptor value is used instead of its <code>get</code> trap result.</li>
+ *  <li>Inherited <code>'__lookupGetter__'</code>, <code>'__lookupSetter__'</code>, <code>'__defineGetter__'</code>, and <code>'__defineSetter__'</code> prototype helpers are not supported. Own data properties with these names are supported.</li>
+ *  <li>An object-literal <code>'__proto__'</code> property is created as an own data property and does not change the object's prototype.</li>
+ *  <li>The default <code>Object</code> global does not support <code>assign</code> or the reflection methods <code>create</code>, <code>defineProperty</code>, <code>defineProperties</code>, <code>getOwnPropertyDescriptor</code>, <code>getOwnPropertyDescriptors</code>, <code>getPrototypeOf</code>, or <code>setPrototypeOf</code>.</li>
+ *  <li>Assignment operators of any type, such as <code>'='</code>, <code>'+='</code>, or <code>'|='</code>, are generally unsupported.
+ *    JET and Knockout may use internal assignment expressions to implement two-way binding writeback; applications should not rely on
+ *    assignment being accepted in expression text.</li>
  *  <li>Blocks of code such as <code>'if (...){}'</code></li>
  *  <li>Comma operator (,) such as <code>'(expr1, expr2)'</code></li>
  *  <li>in operator such as <code>'prop in testObject'</code></li>
@@ -95,6 +109,7 @@ import 'ojs/ojkoshared';
  * @param {Object} options
  * @param {any=} options.globalScope optional additional scope required for evaluating expressions.
  * The additional scope will be used to resolve the variables if they are not defined in the $data or $context.
+ * It is not a security boundary for untrusted expression text.
  * <pre class="prettyprint"><code>Config.setExpressionEvaluator(new CspExpressionEvaluator({globalScope:extraScope}));</code></pre>
  * @constructor
  * @final

package/dist/js/libs/oj/debug_esm/ojcustomelement-utils.js

@@ -553,7 +553,9 @@ class KoBindingUtils {
         if (attrValue != null) {
             let exp = AttributeUtils.getExpressionInfo(attrValue).expr;
             if (exp == null) {
-                exp = stringify ? `'${attrValue}'` : attrValue;
+                // Binding strings are evaluated as expressions. Serialize literal attribute
+                // values so quotes and other JavaScript syntax characters remain data.
+                exp = stringify ? JSON.stringify(attrValue) : attrValue;
             }
             return exp;
         }

package/dist/js/libs/oj/debug_esm/ojcustomelement.js

@@ -183,6 +183,7 @@ BaseCustomElementBridge.proto = {
     // as well since we don't reflect property values back to the DOM attribute.
     const prop = AttributeUtils.attributeToPropertyName(attr);
     const bridge = CustomElementUtils.getElementBridge(this);
+    BaseCustomElementBridge.__ValidatePropertyPath(this, prop);
     if (oldValue !== newValue || bridge.State.dirtyProps.has(prop)) {
       bridge.State.dirtyProps.delete(prop.split('.')[0]);
       // Due to  where IE11 disables child inputs for a parent with the disabled attribute,
@@ -326,6 +327,10 @@ BaseCustomElementBridge.proto = {
   },
 
   GetProperty: function (element, prop, props) {
+    if (BaseCustomElementBridge.__IsBlockedPropertyPath(prop)) {
+      return undefined;
+    }
+
     var meta = getPropertyMetadata(prop, getElementProperties(element));
 
     // For event listener and non component properties, retrieve the value directly stored on the element.
@@ -380,6 +385,8 @@ BaseCustomElementBridge.proto = {
    * @return {boolean}
    */
   SaveEarlyPropertySet: function (element, prop, value) {
+    BaseCustomElementBridge.__ValidatePropertyPath(element, prop);
+
     // Do not save sets that occur during BaseCustomElementBridge.__InitProperties
     // or expression evaluation. We can process these as normal. Playback occurs before the
     // binding provider promise is resolved leading to component creation.
@@ -413,6 +420,8 @@ BaseCustomElementBridge.proto = {
   },
 
   SetProperty: function (element, prop, value, props, bOuter) {
+    BaseCustomElementBridge.__ValidatePropertyPath(element, prop);
+
     // Check value against any defined enums
     var meta = getPropertyMetadata(prop, getElementProperties(element));
     if (AttributeUtils.isEventListenerProperty(prop) || !meta) {
@@ -499,6 +508,8 @@ BaseCustomElementBridge.proto = {
   },
 
   ValidatePropertySet: function (element, property, value) {
+    BaseCustomElementBridge.__ValidatePropertyPath(element, property);
+
     var propsMeta = getElementProperties(element);
     var propMeta = getPropertyMetadata(property, propsMeta);
     var propAr = property.split('.');
@@ -631,6 +642,7 @@ BaseCustomElementBridge.proto = {
     var keys = Object.keys(props);
     for (var i = 0; i < keys.length; i++) {
       var key = keys[i];
+      BaseCustomElementBridge.__ValidatePropertyPath(elem, key);
       if (key.indexOf('.') >= 0) {
         mutationKeys.push(key);
       } else {
@@ -737,6 +749,38 @@ BaseCustomElementBridge.__ThrowTypeError = function (element, property, value, t
   );
 };
 
+/**
+ * Checks whether a property path segment could mutate Object.prototype or other prototypes.
+ * @param {string} property The property path
+ * @return {boolean} true if the path contains a blocked segment
+ * @ignore
+ */
+BaseCustomElementBridge.__IsBlockedPropertyPath = function (property) {
+  var propPath = property.split('.');
+  for (var i = 0; i < propPath.length; i++) {
+    if (oj.CollectionUtils._isBlockedKey(propPath[i])) {
+      return true;
+    }
+  }
+  return false;
+};
+
+/**
+ * Validates a property path before walking objects with dot notation.
+ * @param {Element=} element The custom element
+ * @param {string} property The property path
+ * @ignore
+ */
+BaseCustomElementBridge.__ValidatePropertyPath = function (element, property) {
+  if (BaseCustomElementBridge.__IsBlockedPropertyPath(property)) {
+    var message = `Invalid property path '${property}'.`;
+    if (element) {
+      throw new JetElementError(element, message);
+    }
+    throw new Error(message);
+  }
+};
+
 /**
  * Checks to see if there are any overlapping attribute for the given element and attribute
  * @ignore
@@ -769,6 +813,7 @@ BaseCustomElementBridge.__InitProperties = function (element, componentProps) {
     for (var i = 0; i < attrs.length; i++) {
       var attr = attrs[i];
       var property = AttributeUtils.attributeToPropertyName(attr.nodeName);
+      BaseCustomElementBridge.__ValidatePropertyPath(element, property);
 
       // See if attribute is a component property
       var meta = getPropertyMetadata(property, metaProps);
@@ -810,11 +855,14 @@ BaseCustomElementBridge.__SetProperty = function (propNameFun, componentProps, p
   var propsObj = componentProps;
   var propPath = property.split('.');
   var branchedProps;
+  BaseCustomElementBridge.__ValidatePropertyPath(null, property);
+
   // Set subproperty, initializing parent objects along the way unless the top level
   // property is not defined since setting it to an empty object will trigger a property changed
   // event. Instead, branch and set at the end. We only have listeners on top level properties
   // so setting a subproperty will not trigger a property changed event along the way.
   var topProp = propNameFun(propPath[0]);
+  BaseCustomElementBridge.__ValidatePropertyPath(null, topProp);
   if (propPath.length > 1 && !componentProps[topProp]) {
     branchedProps = {};
     propsObj = branchedProps;
@@ -823,6 +871,7 @@ BaseCustomElementBridge.__SetProperty = function (propNameFun, componentProps, p
   // Walk to the correct location
   for (var i = 0; i < propPath.length; i++) {
     var subprop = propNameFun(propPath[i]);
+    BaseCustomElementBridge.__ValidatePropertyPath(null, subprop);
     if (i === propPath.length - 1) {
       propsObj[subprop] = value;
     } else if (!propsObj[subprop]) {

package/dist/js/libs/oj/debug_esm/ojdataprovider.js

@@ -2208,8 +2208,7 @@ class FilterImpl {
                         // 2. Remove single and double quotes
                         // 3. Add word boundary and wild cards for phrase matching
                         filterValue = new RegExp(`${'\\b' +
-                            textFilterValue
-                                .replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')
+                            FilterImpl._escapeRegExp(textFilterValue)
                                 .replace(/('|")/g, '')
                                 // Avoid nested quantifiers that can trigger ReDoS.
                                 // Equivalent to original "(.*)((\\s|\\t|\\r|\\n)*)" with JS-dot behavior:
@@ -2217,12 +2216,12 @@ class FilterImpl {
                                 .replace(/(\s|\t)/g, '[^\\r\\n]*[\\s\\t\\r\\n]*')}`, 'i');
                     }
                     else if (filter['matchBy'] === 'startsWith') {
-                        filterValue = new RegExp(`^${textFilterValue.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&')}`, 'i');
+                        filterValue = new RegExp(`^${FilterImpl._escapeRegExp(textFilterValue)}`, 'i');
                     }
                     else {
                         // 'contains' | 'fuzzy' | 'unknown'
                         // Escape special characters without change filter['text'] which is the original filter string by default
-                        filterValue = new RegExp(textFilterValue.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&'), 'i');
+                        filterValue = new RegExp(FilterImpl._escapeRegExp(textFilterValue), 'i');
                     }
                 }
                 else {
@@ -2293,12 +2292,27 @@ class FilterImpl {
                 const fieldAttributePath = path ? path + '.' + fieldAttribute : fieldAttribute;
                 if (!(fieldValue instanceof Object)) {
                     const operatorExpr = {};
-                    // need express co, sw and ew as regex
-                    if (op === '$sw' || op === '$ew' || op === '$co') {
-                        fieldValue = FilterImpl._fixStringExpr(op, fieldValue);
-                        op = '$regex';
+                    // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+                    // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+                    //
+                    // AttributeFilterDef object values are expanded into one criterion per field. For example,
+                    // { op: '$ew', value: { name: 'admin', value: 'foo' } } becomes an $and expression with
+                    // separate criteria for "name" and "value". The $co/$sw/$ew operators are implemented by
+                    // converting each field criterion to $regex, because FilterUtils only has a regex evaluator
+                    // for contains/starts-with/ends-with matching in this transformed expression.
+                    //
+                    // Keep the converted operator in a local variable. Mutating the shared op parameter while
+                    // processing the first field would cause later sibling fields to see "$regex" instead of the
+                    // original "$co", "$sw", or "$ew". That would skip _fixStringExpr for later fields, losing
+                    // either the $sw/$ew anchoring semantics or the regex escaping added for the ReDoS fix.
+                    // This behavior is intentionally changed/fixed as part of the security fix so every field
+                    // in an object filter preserves the original string operator semantics before regex conversion.
+                    let fieldOp = op;
+                    if (fieldOp === '$sw' || fieldOp === '$ew' || fieldOp === '$co') {
+                        fieldValue = FilterImpl._fixStringExpr(fieldOp, fieldValue);
+                        fieldOp = '$regex';
                     }
-                    operatorExpr[op] = fieldValue;
+                    operatorExpr[fieldOp] = fieldValue;
                     const fieldExpr = {};
                     fieldExpr[fieldAttributePath] = operatorExpr;
                     criteriaArray.push(fieldExpr);
@@ -2318,6 +2332,14 @@ class FilterImpl {
     }
     static _fixStringExpr(op, value) {
         if (typeof value === 'string' || value instanceof String) {
+            // JET-79758: Regex Injection in $sw/$ew/$co Attribute Filter Operators.
+            // JET-79598: Regex Injection in FilterFactory Attribute Filter.
+            //
+            // $co, $sw, and $ew are public literal string matching operators, but internally they are
+            // converted to $regex and later evaluated with new RegExp(...) in FilterUtils. Without escaping,
+            // input such as ".*", "admin|", or "(a+)+$" is interpreted as regex syntax. That can change
+            // filter meaning and can also trigger excessive backtracking in the browser.
+            value = FilterImpl._escapeRegExp(value);
             if (op === '$sw') {
                 value = '^' + value;
             }
@@ -2327,6 +2349,22 @@ class FilterImpl {
         }
         return value;
     }
+    /**
+     * Escapes JavaScript regular expression metacharacters in a string so the
+     * value can be embedded in a RegExp and matched literally.
+     *
+     * This is used before building RegExp instances from literal filter text. It
+     * prefixes every JavaScript RegExp metacharacter with a backslash:
+     *   . * + - ? ^ $ { } ( ) | [ ] \
+     * The replacement string "\\$&" means "insert a backslash, then the entire
+     * matched character".
+     *
+     * @param value The string value to escape.
+     * @returns A string with every RegExp metacharacter prefixed by a backslash.
+     */
+    static _escapeRegExp(value) {
+        return value.replace(/[.*+\-?^${}()|[\]\\]/g, '\\$&');
+    }
 }
 // Bound text-filter input size to reduce regex amplification risks
 FilterImpl._MAX_TEXT_FILTER_LENGTH = 512;

package/dist/js/libs/oj/debug_esm/ojdataproviderscroller.js

@@ -2814,12 +2814,9 @@ IteratingDataProviderContentHandler.prototype._renderItemsWhenIdle = function (
       addFragmentOnRequestAnimationFrame(fragment);
     });
   } else {
-    // Chromium has an issue with requestIdleCallback when mouse wheel is used, see Chrome :
-    // https://bugs.chromium.org/p/chromium/issues/detail?id=822269
-    var options;
-    if (isMouseWheel && oj.AgentUtils.getAgentInfo().engine === oj.AgentUtils.ENGINE.BLINK) {
-      options = { timeout: 100 };
-    }
+    // Use a timeout so fetch rendering is not blocked indefinitely when the browser
+    // does not get an idle period, including scrollbar and mouse wheel scrolling.
+    var options = { timeout: 100 };
     this.m_idleCallback = window.requestIdleCallback(function (idleDeadline) {
       // no need to check for whether listview has been destroyed yet since we cancel the callback on destroy
       var timeRemaining = idleDeadline.timeRemaining();