@oracle/oraclejet 20.1.2 → 20.1.3

package/dist/js/libs/oj/debug/ojdvt-toolkit.js

@@ -952,6 +952,7 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
   const ToolkitUtils = {};
 
   Obj.createSubclass(ToolkitUtils, Obj);
+  const _NOOPENER_WINDOW_FEATURES = 'noopener,noreferrer';
   /** @const **/
   ToolkitUtils.SVG_NS = 'http://www.w3.org/2000/svg';
   /** @const **/
@@ -980,14 +981,42 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
     if (protocol != null) {
       protocol = protocol.toLowerCase();
     }
-    // if it isn't on the allowed list and it isn't '', throw an error.
-    // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
-    // and we want to allow hrefs like 'abc' since those are relative urls.
-    if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+    // Security issues JET-79830, JET-79570, and JET-79644 flagged the legacy
+    // empty-protocol allowance. IE11 returned '' for some relative URLs, but IE11
+    // is no longer supported. Modern browsers resolve relative URLs against the
+    // document URL before exposing the protocol, so an empty protocol is not
+    // treated as valid.
+    if (allowed.indexOf(protocol) < 0) {
       throw new Error(protocol + ' is not a valid URL protocol');
     }
   };
 
+  /**
+   * Encodes an SVG definition ID for use as the fragment portion of a URL.
+   * @param {string} id The SVG definition ID.
+   * @return {string} The encoded fragment ID.
+   */
+  const _encodeSvgUrlFragmentId = function (id) {
+    return encodeURIComponent(id).replace(/[!'()*]/g, function (ch) {
+      return '%' + ch.charCodeAt(0).toString(16).toUpperCase();
+    });
+  };
+
+  /**
+   * Escapes a value for interpolation inside a quoted CSS string.
+   * @param {string} value The CSS string value.
+   * @return {string} The escaped CSS string value.
+   */
+  const _escapeCssString = function (value) {
+    return value.replace(/["\\\n\r\f]/g, function (ch) {
+      if (ch === '"') return '\\"';
+      if (ch === '\\') return '\\\\';
+      if (ch === '\n') return '\\A ';
+      if (ch === '\r') return '\\D ';
+      return '\\C ';
+    });
+  };
+
   /**
    * Creates and returns a new SVG document with the specified id.
    * @param {string} id The id for the new SVG document.
@@ -1241,7 +1270,7 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
         if (target == null) {
           self.location = dest;
         } else {
-          var newWindow = window.open(dest, target);
+          var newWindow = window.open(dest, target, _NOOPENER_WINDOW_FEATURES);
           if (newWindow) newWindow.focus();
         }
       };
@@ -1257,13 +1286,13 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
    */
   ToolkitUtils.getUrlPathById = function (id) {
     // If <base> is defined on the document, we have to use the full URL.
-    // document.baseURI is not supported in IE, so we have to check if the <base> tag exists in the document.
+    // document.baseURI is not supported in IE, so fall back to checking for the <base> tag.
     var hasBase =
-      Agent.browser === 'ie' || Agent.browser === 'edge'
+      document.baseURI == null
         ? document.querySelector('base') != null
         : document.URL != document.baseURI;
     var root = hasBase ? document.URL.split('#')[0] + '#' : '#';
-    return root + id;
+    return root + _encodeSvgUrlFragmentId(id);
   };
 
   /**
@@ -1272,7 +1301,7 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
    * @return {string} URL attribute value.
    */
   ToolkitUtils.getUrlById = function (id) {
-    return 'url(' + ToolkitUtils.getUrlPathById(id) + ')';
+    return 'url("' + _escapeCssString(ToolkitUtils.getUrlPathById(id)) + '")';
   };
 
   /**
@@ -10319,33 +10348,8 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
       while (outerElem.hasChildNodes()) outerElem.removeChild(outerElem.firstChild);
     }
 
-    // Make replacements on the text string as needed
     if (typeof text == 'string') {
-      // For security, turn HTML brackets into strings to disable tags.
-      text = text.replace(/(<|&#60;)/g, '&lt;');
-      text = text.replace(/(>|&#62;)/g, '&gt;');
-
-      // Support a subset of HTML tags, including bold, italic, and table tags.
-      text = HtmlTooltipManager._restoreTag(text, 'b');
-      text = HtmlTooltipManager._restoreTag(text, 'i');
-      text = HtmlTooltipManager._restoreTag(text, 'table');
-      text = HtmlTooltipManager._restoreTag(text, 'tr');
-      text = HtmlTooltipManager._restoreTag(text, 'td');
-
-      // Replace logical newlines sequences
-      text = text.replace(/\n/g, '<br>');
-      text = text.replace(/\\n/g, '<br>');
-      text = text.replace(/&#92;n/g, '<br>');
-      text = HtmlTooltipManager._restoreTag(text, 'br');
-
-      // Create the tooltip element
-      tooltipDOM = document.createElement('span');
-      tooltipDOM.style.visibility = 'inherit';
-      tooltipDOM.style.width = null;
-      tooltipDOM.style.height = null;
-
-      // Set the text
-      tooltipDOM.innerHTML = text; //@HTMLUpdateOK
+      tooltipDOM = HtmlTooltipManager._createTooltipTextElement(text);
     } else if (canModify) tooltipDOM = text; // the text is an element or array of elements to be appended directly
 
     // Apply default class and border color on the outer element only if the user hasn't specified them ( + 21150376)
@@ -10716,19 +10720,233 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
     return tooltip;
   };
 
+  /** @private @const */
+  HtmlTooltipManager._SUPPORTED_TOOLTIP_TAGS = {
+    b: true,
+    i: true,
+    br: true,
+    table: true,
+    tr: true,
+    td: true
+  };
+
+  /** @private @const */
+  HtmlTooltipManager._TOOLTIP_ENTITY_MAP = {
+    amp: '&',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+    nbsp: String.fromCharCode(160)
+  };
+
   /**
-   * Restores a supported HTML tag.
-   * All HTML brackets are converted into &gt; and &lt; for security reasons, to prevent people from adding unsupported
-   * elements. JET-79039: This method restores the brackets for the supported element only, discarding all attributes.
-   * @param {string} text The HTML string.
-   * @param {string} tag The tag name to be restored.
-   * @return {string} The updated HTML string.
+   * Creates a tooltip span from a string without parsing the string as HTML.
+   * Supported tooltip tags are converted to DOM nodes and all other markup is rendered as text.
+   * @param {string} text The tooltip string.
+   * @return {HTMLSpanElement}
    * @private
    */
-  HtmlTooltipManager._restoreTag = function (text, tag) {
-    // Match the following: <tag...>, </tag...>, and <tag.../>
-    var regExp = new RegExp('&lt;(/?)(' + tag + ')(?=[\\s&/])([^&]*)(/?)&gt;', 'g');
-    return text.replace(regExp, '<$1' + tag + '>');
+  HtmlTooltipManager._createTooltipTextElement = function (text) {
+    var tooltipDOM = document.createElement('span');
+    tooltipDOM.style.visibility = 'inherit';
+    tooltipDOM.style.width = null;
+    tooltipDOM.style.height = null;
+
+    HtmlTooltipManager._appendTooltipTextContent(
+      tooltipDOM,
+      HtmlTooltipManager._decodeTooltipEntities(text)
+    );
+    return tooltipDOM;
+  };
+
+  /**
+   * Appends tooltip string content to an element using only DOM APIs.
+   * @param {Element} root The element receiving tooltip content.
+   * @param {string} text The tooltip string.
+   * @private
+   */
+  HtmlTooltipManager._appendTooltipTextContent = function (root, text) {
+    var stack = [root];
+    var index = 0;
+
+    while (index < text.length) {
+      if (text.charAt(index) === '\n') {
+        HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+        index += 1;
+        continue;
+      }
+
+      if (text.charAt(index) === '\\' && text.charAt(index + 1) === 'n') {
+        HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+        index += 2;
+        continue;
+      }
+
+      if (text.indexOf('&#92;n', index) === index) {
+        HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+        index += 6;
+        continue;
+      }
+
+      var tag = HtmlTooltipManager._parseTooltipTag(text, index);
+      if (tag) {
+        if (tag.name === 'br') {
+          HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+        } else if (tag.closing) {
+          HtmlTooltipManager._closeTooltipTag(stack, tag.name);
+        } else {
+          var element = document.createElement(tag.name); // @HTMLUpdateOK
+          stack[stack.length - 1].appendChild(element);
+          stack.push(element);
+        }
+        index = tag.end;
+        continue;
+      }
+
+      if (text.charAt(index) === '<') {
+        var tagEnd = text.indexOf('>', index + 1);
+        var literalEnd = tagEnd >= 0 ? tagEnd + 1 : index + 1;
+        HtmlTooltipManager._appendTooltipText(
+          stack[stack.length - 1],
+          text.substring(index, literalEnd)
+        );
+        index = literalEnd;
+      } else {
+        var textEnd = HtmlTooltipManager._getNextTooltipSpecialTokenIndex(text, index + 1);
+        HtmlTooltipManager._appendTooltipText(
+          stack[stack.length - 1],
+          text.substring(index, textEnd)
+        );
+        index = textEnd;
+      }
+    }
+  };
+
+  /**
+   * Parses a supported tooltip tag at the specified index.
+   * @param {string} text The tooltip string.
+   * @param {number} index The index to parse.
+   * @return {{name:string, closing:boolean, end:number}|null}
+   * @private
+   */
+  HtmlTooltipManager._parseTooltipTag = function (text, index) {
+    if (text.charAt(index) !== '<') return null;
+
+    var tagEnd = text.indexOf('>', index + 1);
+    if (tagEnd < 0) return null;
+
+    var position = index + 1;
+    var closing = text.charAt(position) === '/';
+    if (closing) position += 1;
+
+    var tagStart = position;
+    while (position < tagEnd && /[a-z]/.test(text.charAt(position))) {
+      position += 1;
+    }
+
+    var tagName = text.substring(tagStart, position);
+    if (!HtmlTooltipManager._SUPPORTED_TOOLTIP_TAGS[tagName]) return null;
+    if (!HtmlTooltipManager._isTooltipTagBoundary(text, position, tagEnd)) return null;
+
+    return {
+      name: tagName,
+      closing: closing,
+      end: tagEnd + 1
+    };
+  };
+
+  /**
+   * Returns the next index that needs token-level tooltip handling.
+   * @param {string} text The tooltip string.
+   * @param {number} index The index to start scanning from.
+   * @return {number}
+   * @private
+   */
+  HtmlTooltipManager._getNextTooltipSpecialTokenIndex = function (text, index) {
+    while (index < text.length) {
+      if (
+        text.charAt(index) === '<' ||
+        text.charAt(index) === '\n' ||
+        (text.charAt(index) === '\\' && text.charAt(index + 1) === 'n')
+      ) {
+        return index;
+      }
+      index += 1;
+    }
+    return index;
+  };
+
+  /**
+   * Returns whether a parsed tag name is followed by a valid tag boundary.
+   * @param {string} text The tooltip string.
+   * @param {number} index The index after the parsed tag name.
+   * @param {number} tagEnd The index of the closing angle bracket.
+   * @return {boolean}
+   * @private
+   */
+  HtmlTooltipManager._isTooltipTagBoundary = function (text, index, tagEnd) {
+    return index === tagEnd || /\s/.test(text.charAt(index)) || text.charAt(index) === '/';
+  };
+
+  /**
+   * Closes the most recent matching supported tooltip tag.
+   * @param {Array<Element>} stack The open tooltip element stack.
+   * @param {string} tagName The tag name to close.
+   * @private
+   */
+  HtmlTooltipManager._closeTooltipTag = function (stack, tagName) {
+    for (var i = stack.length - 1; i > 0; i--) {
+      if (stack[i].tagName.toLowerCase() === tagName) {
+        stack.length = i;
+        return;
+      }
+    }
+  };
+
+  /**
+   * Appends a line break to tooltip content.
+   * @param {Element} parent The parent element.
+   * @private
+   */
+  HtmlTooltipManager._appendTooltipLineBreak = function (parent) {
+    parent.appendChild(document.createElement('br')); // @HTMLUpdateOK
+  };
+
+  /**
+   * Appends decoded text to tooltip content.
+   * @param {Element} parent The parent element.
+   * @param {string} text The text to append.
+   * @private
+   */
+  HtmlTooltipManager._appendTooltipText = function (parent, text) {
+    if (text) {
+      parent.appendChild(document.createTextNode(text));
+    }
+  };
+
+  /**
+   * Decodes only the common entities supported in DVT tooltip string content.
+   * @param {string} text The text to decode.
+   * @return {string}
+   * @private
+   */
+  HtmlTooltipManager._decodeTooltipEntities = function (text) {
+    return text.replace(
+      /&(#x[0-9a-fA-F]+|#[0-9]+|amp|lt|gt|quot|apos|nbsp);/g,
+      function (match, entity) {
+        if (entity.charAt(0) === '#') {
+          var radix = entity.charAt(1).toLowerCase() === 'x' ? 16 : 10;
+          var value = parseInt(entity.substring(radix === 16 ? 2 : 1), radix);
+          if (!isNaN(value) && value >= 0 && value <= 0x10ffff) {
+            return String.fromCodePoint ? String.fromCodePoint(value) : String.fromCharCode(value);
+          }
+          return match;
+        }
+
+        return HtmlTooltipManager._TOOLTIP_ENTITY_MAP[entity];
+      }
+    );
   };
 
   /**

package/dist/js/libs/oj/debug/ojeditablevalue.js

@@ -2139,7 +2139,14 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
          * myInputComp.help.definition = "Enter your name";
          */
         /**
-         * <p>help source url.  See the top-level <code class="prettyprint">help</code> option for details.
+         * <p>help source url. See the top-level
+         * <code class="prettyprint">help</code> option for details.</p>
+         * <p><b>Note:</b> For security, JET validates the URL protocol before
+         * navigation and currently supports <code class="prettyprint">http:</code>
+         * and <code class="prettyprint">https:</code> protocols. JET does not
+         * validate whether the URL is trusted for the application. Applications
+         * are responsible for providing sanitized URLs and enforcing any required
+         * origin or host allowlist.</p>
          *
          * @expose
          * @name help.source
@@ -2243,9 +2250,13 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
            * it shows all the time.
            * </p>
            * <p>
-           * For security reasons we only support urls with protocol 'http:' or 'https:'.
-           * If the url doesn't comply we ignore it and throw an error.
-           * Pass in an encoded URL since we do not encode the URL.</p>
+           * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+           * currently supports <code class="prettyprint">http:</code> and
+           * <code class="prettyprint">https:</code> protocols. If the url doesn't
+           * comply we ignore it and throw an error. JET does not validate whether
+           * the URL is trusted for the application. Applications are responsible
+           * for providing sanitized URLs and enforcing any required origin or host
+           * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
            *
            * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
            *
@@ -2348,6 +2359,8 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
          * hints and message summary text cannot. If you use formatted text, it should be accessible
          * and make sense to the user if formatting wasn't there.
          * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+         * Inline style attributes are sanitized; the retained styling is limited to color, font
+         * style, font weight, and text decoration. Use CSS classes for other styling.
          * To format the message detail, you could do this:
          * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
          * </p>
@@ -2504,6 +2517,8 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
          * <p>
          * To include formatted text in the help.instruction, format the string using html tags.
          * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+         * Inline style attributes are sanitized; the retained styling is limited to color, font
+         * style, font weight, and text decoration. Use CSS classes for other styling.
          * For example the
          * help.instruction might look like:
          * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -9369,6 +9384,7 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
 
     helpSourceAnchor.setAttribute('tabindex', '0');
     helpSourceAnchor.setAttribute('target', '_blank');
+    helpSourceAnchor.setAttribute('rel', 'noopener noreferrer');
     try {
       DomUtils.validateURL(source);
       helpSourceAnchor.setAttribute('href', source);

package/dist/js/libs/oj/debug/ojgauge-toolkit.js

@@ -1411,6 +1411,12 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-axis'], function (exports, dv
         alta: dvt.JsonUtils.merge(defaultsMap['alta'], SKIN_ALTA)
       });
     }
+
+    getNoCloneObject() {
+      const noClone = super.getNoCloneObject();
+      noClone.metricLabel = { converter: true };
+      return noClone;
+    }
   }
 
   /**
@@ -1809,7 +1815,7 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-axis'], function (exports, dv
      */
     SetOptions(options) {
       // NOTE: This extra clone should be removed once we stop supporting the deprecated attrs
-      options = dvt.JsonUtils.clone(options);
+      options = dvt.JsonUtils.clone(options, null, this.Defaults.getNoCloneObject());
 
       if (options['title']) {
         options['label'] = options['title'];
@@ -4402,7 +4408,7 @@ define(['exports', 'ojs/ojdvt-toolkit', 'ojs/ojdvt-axis'], function (exports, dv
      */
     SetOptions(options) {
       // NOTE: This extra clone should be removed once we stop supporting the deprecated attrs
-      options = dvt.JsonUtils.clone(options);
+      options = dvt.JsonUtils.clone(options, null, this.Defaults.getNoCloneObject());
 
       if (options['title']) options['label'] = options['title'];
 

package/dist/js/libs/oj/debug/ojgauge.js

@@ -1020,6 +1020,13 @@ var __oj_status_meter_gauge_metadata =
         return this.element;
       },
 
+      _GetComponentNoClonePaths: function () {
+        var noClonePaths = this._super();
+        // Don't clone converter instances because their class methods must be preserved.
+        noClonePaths.metricLabel = { converter: true };
+        return noClonePaths;
+      },
+
       _GetChildStyleClasses: function () {
         var styleClasses = this._super();
         styleClasses['oj-gauge-metric-label'] = { path: 'metricLabel/style', property: 'TEXT' };

package/dist/js/libs/oj/debug/ojhtmlutils.js

@@ -20,6 +20,20 @@ define(['exports'], function (exports) { 'use strict';
    * the input to prevent unsafe content from being added to the page.</p>
    */
   const HtmlUtils = {};
+  const _ESCAPED_TAGS = [
+    'table',
+    'caption',
+    'colgroup',
+    'col',
+    'thead',
+    'tfoot',
+    'th',
+    'tbody',
+    'tr',
+    'td',
+    'template',
+    'p'
+  ];
 
   /**
    * Utility that will parse an HTML string into an array of DOM Nodes.
@@ -30,20 +44,7 @@ define(['exports'], function (exports) { 'use strict';
    */
   HtmlUtils.stringToNodeArray = function (html) {
     // escape html for the predefined tags
-    var tags = [
-      'table',
-      'caption',
-      'colgroup',
-      'col',
-      'thead',
-      'tfoot',
-      'th',
-      'tbody',
-      'tr',
-      'td',
-      'template',
-      'p'
-    ];
+    var tags = _ESCAPED_TAGS;
     var i;
 
     for (i = 0; i < tags.length; i++) {
@@ -122,25 +123,21 @@ define(['exports'], function (exports) { 'use strict';
       const BIND_REPLACE = 'oj-bind-replace-';
       if (nodeName.substr(0, 16) === BIND_REPLACE) {
         var replName = nodeName.substr(16);
-        replNode = document.createElement(replName); // @HTMLUpdateOK
-        for (j = 0; j < child.attributes.length; j++) {
-          attr = child.attributes[j];
-          replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
+        if (_ESCAPED_TAGS.indexOf(replName) !== -1) {
+          replNode = document.createElement(replName); // @HTMLUpdateOK
+          for (j = 0; j < child.attributes.length; j++) {
+            attr = child.attributes[j];
+            replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
+          }
+          var childHolder = replNode.content ? replNode.content : replNode;
+          for (j = 0; child.childNodes.length > 0; ) {
+            childHolder.appendChild(child.childNodes[0]);
+          }
+          parent.replaceChild(replNode, child);
         }
-        var childHolder = replNode.content ? replNode.content : replNode;
-        for (j = 0; child.childNodes.length > 0; ) {
-          childHolder.appendChild(child.childNodes[0]);
-        }
-        parent.replaceChild(replNode, child);
       } else if (nodeName === 'script' || nodeName === 'style') {
-        replNode = document.createElement(nodeName); // @HTMLUpdateOK
-        for (j = 0; j < child.attributes.length; j++) {
-          attr = child.attributes[j];
-          replNode.setAttribute(attr.name, attr.value); // @HTMLUpdateOK
-        }
-        var origHTML = child.innerHTML; // @HTMLUpdateOK
-        replNode.innerHTML = origHTML.replace(new RegExp(BIND_REPLACE, 'g'), ''); // @HTMLUpdateOK
-        parent.replaceChild(replNode, child);
+        var origText = child.textContent || '';
+        child.textContent = origText.replace(new RegExp(BIND_REPLACE, 'g'), '');
       } else if (child.nodeType === 8) {
         // comment node
         var origValue = child.nodeValue;

package/dist/js/libs/oj/debug/ojlabel.js

@@ -403,11 +403,14 @@ define(['ojs/ojcore', 'ojs/ojjquery-hammer', 'ojs/ojcomponentcore', 'ojs/ojpopup
          * and holds the help icon on a mobile device. No formatted text is available for
          * help definition attribute.</li>
          * <li><code class="prettyprint">source</code> - this is the help source url.
-         * If present, a help icon will
-         * render next to the label. For security reasons
-         *  we only support urls with protocol http: or https:.
-         * If the url doesn't comply we ignore it and throw an error.
-         * Pass in an encoded URL since we do not encode the URL.
+         * If present, a help icon will render next to the label.
+         * <p><b>Note:</b> For security, JET validates the URL protocol before navigation
+         * and currently supports <code class="prettyprint">http:</code> and
+         * <code class="prettyprint">https:</code> protocols. If the url doesn't
+         * comply we ignore it and throw an error. JET does not validate whether
+         * the URL is trusted for the application. Applications are responsible
+         * for providing sanitized URLs and enforcing any required origin or host
+         * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
          * </ul>
          *
          * @expose
@@ -1399,6 +1402,7 @@ define(['ojs/ojcore', 'ojs/ojjquery-hammer', 'ojs/ojcomponentcore', 'ojs/ojpopup
         helpIconAnchor = document.createElement('a');
         helpIconAnchor.setAttribute('tabindex', '0');
         helpIconAnchor.setAttribute('target', '_blank');
+        helpIconAnchor.setAttribute('rel', 'noopener noreferrer');
         helpIconAnchor.className =
           'oj-label-help-icon-anchor oj-label-help-icon oj-component-icon oj-clickable-icon-nocontext';
         if (source) {

package/dist/js/libs/oj/debug/ojlistview.js

@@ -2016,7 +2016,7 @@ var __oj_list_view_metadata =
                   // if event target is within listview, but not around items, e.g. the padding
                   var active = self.m_active && self.m_active.elem;
                   if (active == null && self.element.attr('tabIndex') === '0') {
-                    self.element.focus();
+                    self._initFocus(event, true);
                   } else if (active != null) {
                     self._makeFocusable(active);
                     self.HighlightActive();
@@ -7636,7 +7636,9 @@ var __oj_list_view_metadata =
        */
       ActiveAndFocus: function (item, event, skipFocus, preventScroll) {
         // make sure that it is visible
-        this._scrollToVisible(item[0]);
+        if (!preventScroll) {
+          this._scrollToVisible(item[0]);
+        }
 
         // unhighlight any previous active item
         this.UnhighlightActive();

package/dist/js/libs/oj/debug/ojlogger.js

@@ -25,11 +25,12 @@ define(['exports', '@oracle/oraclejet-preact/utils/UNSAFE_logger'], function (ex
    *
    * <p>If the logging options are changed at a later point, the Logger will use the modified options for the subsequent log operations.
    *
-   * <p>The logging level can be overridden via sessionStorage.setItem() call for the current browser session.
+   * <p>In debug builds, the logging level can be overridden via sessionStorage.setItem() call for the current browser session.
    * Use 'ojet.logLevel' as the key with one of the following values: 'none' (least verbose), 'error', 'warning', 'info', 'log' (most verbose).
    * Set the value in the browser console and refresh the browser in order for the value to take effect.
+   * Production builds ignore this key.
    * </p>
-   * <h3> Session storage usage : </h3>
+   * <h3> Session storage usage in debug builds : </h3>
    * <pre class="prettyprint">
    * <code>
    * // override logging level for the current session