@oracle/oraclejet 20.1.2 → 20.1.3

package/dist/js/libs/oj/debug_esm/ojdatetimepicker.js

@@ -1441,6 +1441,33 @@ function _getMetaData(dayMetaData, position, params) {
   );
 }
 
+/**
+ * JET-79822 - JET - ARM5_UNCONSTRAINED- F37 - OJ-INPUT-DATE DAYFORMATTER CLASSNAME UNESCAPED IN HTML CLASS ATTRIBUTE
+ * Encodes application-supplied text before it is inserted into a generated HTML attribute string.
+ *
+ * @param {string} value value to encode
+ * @returns {string} value encoded for an HTML attribute
+ * @ignore
+ */
+function _escapeHtmlAttribute(value) {
+  return String(value).replace(/[&'"<>]/g, function (match) {
+    switch (match) {
+      case '&':
+        return '&amp;';
+      case "'":
+        return '&#39;';
+      case '"':
+        return '&quot;';
+      case '<':
+        return '&lt;';
+      case '>':
+        return '&gt;';
+      default:
+        return match;
+    }
+  });
+}
+
 /**
  * For default converter
  * @static
@@ -2829,9 +2856,13 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * it shows all the time.
      * </p>
      * <p>
-     * For security reasons we only support urls with protocol 'http:' or 'https:'.
-     * If the url doesn't comply we ignore it and throw an error.
-     * Pass in an encoded URL since we do not encode the URL.</p>
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. If the url doesn't
+     * comply we ignore it and throw an error. JET does not validate whether
+     * the URL is trusted for the application. Applications are responsible
+     * for providing sanitized URLs and enforcing any required origin or host
+     * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
      *
      * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
      *
@@ -2877,6 +2908,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * <p>
      * To include formatted text in the help.instruction, format the string using html tags.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * For example the
      * help.instruction might look like:
      * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -3007,6 +3040,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the message detail, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -3497,6 +3532,8 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the help.instruction, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -6851,7 +6888,7 @@ oj.__registerWidget('oj.ojInputDate', $.oj.inputBase, {
               (otherMonth && daysOutsideMonth === 'hidden'
                 ? ''
                 : ' ' +
-                  daySettings[1] + // highlight custom dates
+                  _escapeHtmlAttribute(daySettings[1]) + // highlight custom dates
                   (selected ? ' ' + this._CURRENT_CLASS : '') + // highlight selected day
                   (printDate.getTime() === today.getTime() ? ' oj-datepicker-today' : '')) +
               "'" + // highlight today (if different)
@@ -11072,6 +11109,8 @@ oj.__registerWidget('oj.ojInputTime', $.oj.inputBase, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the help.instruction, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>
@@ -14402,9 +14441,13 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * it shows all the time.
      * </p>
      * <p>
-     * For security reasons we only support urls with protocol 'http:' or 'https:'.
-     * If the url doesn't comply we ignore it and throw an error.
-     * Pass in an encoded URL since we do not encode the URL.</p>
+     * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+     * currently supports <code class="prettyprint">http:</code> and
+     * <code class="prettyprint">https:</code> protocols. If the url doesn't
+     * comply we ignore it and throw an error. JET does not validate whether
+     * the URL is trusted for the application. Applications are responsible
+     * for providing sanitized URLs and enforcing any required origin or host
+     * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
      *
      * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
      *
@@ -14450,6 +14493,8 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * <p>
      * To include formatted text in the help.instruction, format the string using html tags.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * For example the
      * help.instruction might look like:
      * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -14580,6 +14625,8 @@ oj.__registerWidget('oj.ojInputDateTime', $.oj.ojInputDate, {
      * hints and message summary text cannot. If you use formatted text, it should be accessible
      * and make sense to the user if formatting wasn't there.
      * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+     * Inline style attributes are sanitized; the retained styling is limited to color, font
+     * style, font weight, and text decoration. Use CSS classes for other styling.
      * To format the message detail, you could do this:
      * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
      * </p>

package/dist/js/libs/oj/debug_esm/ojdomutils.js

@@ -32,7 +32,16 @@ const DomUtils = {
     SMALL: 1,
     PRE: 1
   },
-  _LEGAL_ATTRIBUTES: { class: 1, style: 1 }
+  _LEGAL_ATTRIBUTES: { class: 1, style: 1 },
+  _LEGAL_CSS_PROPERTIES: {
+    color: 1,
+    'font-style': 1,
+    'font-weight': 1,
+    'text-decoration': 1,
+    'text-decoration-line': 1
+  },
+  _ILLEGAL_CSS_VALUE_PATTERN:
+    /(?:url\s*\(|expression\s*\(|behavior\s*:|-moz-binding|@import|!important|var\s*\()/i
 };
 
 /**
@@ -53,11 +62,13 @@ DomUtils.isHTMLContent = function (content) {
 };
 
 DomUtils.cleanHtml = function (value) {
-  var offSpan = $(document.createElement('span')).get(0);
-  offSpan.innerHTML = value; // @HTMLUpdateOK safe manipulation
+  var offSpan = document.createElement('span');
+  var template = document.createElement('template');
+  template.innerHTML = value; // @HTMLUpdateOK template content is sanitized before use
   if (value && value.indexOf('\x3c') >= 0) {
-    DomUtils._cleanElementHtml(offSpan);
+    DomUtils._cleanElementHtml(template.content);
   }
+  offSpan.appendChild(template.content); // @HTMLUpdateOK appending sanitized template content
   return offSpan;
 };
 
@@ -71,22 +82,73 @@ DomUtils._cleanElementHtml = function (node) {
         var attrs = child.attributes;
         for (var i = attrs.length - 1; i >= 0; i--) {
           var attr = attrs[i];
+          var attrName = attr.name.toLowerCase();
           // jquery - the .attr() method returns undefined for attributes that have not been set.
           var childHasAttr = $(child).attr(attr.name) !== undefined;
           if (childHasAttr) {
-            if (!Object.hasOwn(DomUtils._LEGAL_ATTRIBUTES, attr.name)) {
+            if (!Object.hasOwn(DomUtils._LEGAL_ATTRIBUTES, attrName)) {
               child.removeAttribute(attr.nodeName);
+            } else if (attrName === 'style') {
+              DomUtils._sanitizeStyleAttribute(child);
             }
           }
         }
         DomUtils._cleanElementHtml(child);
-      } else if (child) {
+      } else {
         node.removeChild(child);
       }
+    } else if (child && child.nodeType === 8) {
+      node.removeChild(child);
+    }
+  }
+};
+
+DomUtils._sanitizeStyleAttribute = function (node) {
+  var cleanDeclarations = [];
+  var style = node.style;
+  var properties = Array.from(style);
+
+  for (var i = 0; i < properties.length; i++) {
+    var property = properties[i];
+    var value = style.getPropertyValue(property);
+    var cleanValue = DomUtils._getCleanHtmlCssValue(
+      property,
+      value,
+      style.getPropertyPriority(property)
+    );
+
+    if (cleanValue) {
+      cleanDeclarations.push({ property: property, value: cleanValue });
+    }
+  }
+
+  node.removeAttribute('style');
+
+  if (cleanDeclarations.length > 0) {
+    for (var j = 0; j < cleanDeclarations.length; j++) {
+      var cleanDeclaration = cleanDeclarations[j];
+      node.style.setProperty(cleanDeclaration.property, cleanDeclaration.value);
     }
   }
 };
 
+DomUtils._getCleanHtmlCssValue = function (property, value, priority) {
+  if (
+    !Object.hasOwn(DomUtils._LEGAL_CSS_PROPERTIES, property) ||
+    !value ||
+    priority ||
+    DomUtils._ILLEGAL_CSS_VALUE_PATTERN.test(value)
+  ) {
+    return null;
+  }
+
+  if (window.CSS && CSS.supports && !CSS.supports(property, value)) {
+    return null;
+  }
+
+  return value;
+};
+
 /**
  * Checks to see if the "ancestorNode" is a ancestor of "node".
  *
@@ -1011,10 +1073,10 @@ DomUtils.isLogicalAncestorOrSelf = function (ancestorNode, node) {
 };
 
 /**
- * Checks whether the href represents a safe URL
+ * Checks whether the href uses an allowed URL protocol.
  * @param {!string} href - HREF to test
  * @param {Array=} whitelist - optional list of the allowed protocols. Protocol name has to use lowercase letters and
- * be followed by a ':'. If the parameter is ommitted, ['http:', 'https:'] will be used
+ * be followed by a ':'. If the parameter is omitted, ['http:', 'https:'] will be used
  * @throws {Exception} an error if the HREF represents an invalid URL
  * @ignore
  */
@@ -1028,10 +1090,12 @@ DomUtils.validateURL = function (href, whitelist) {
   if (protocol != null) {
     protocol = protocol.toLowerCase();
   }
-  // if it isn't on the allowed list and it isn't '', throw an error.
-  // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
-  // and we want to allow hrefs like 'abc' since those are relative urls.
-  if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+  // Security issues JET-79830, JET-79570, and JET-79644 flagged the legacy
+  // empty-protocol allowance. IE11 returned '' for some relative URLs, but IE11
+  // is no longer supported. Modern browsers resolve relative URLs against the
+  // document URL before exposing the protocol, so an empty protocol is not
+  // treated as valid.
+  if (allowed.indexOf(protocol) < 0) {
     throw new Error(protocol + ' is not a valid URL protocol');
   }
 };

package/dist/js/libs/oj/debug_esm/ojdvt-toolkit.js

@@ -952,6 +952,7 @@ Matrix.prototype.isIdentity = function () {
 const ToolkitUtils = {};
 
 Obj.createSubclass(ToolkitUtils, Obj);
+const _NOOPENER_WINDOW_FEATURES = 'noopener,noreferrer';
 /** @const **/
 ToolkitUtils.SVG_NS = 'http://www.w3.org/2000/svg';
 /** @const **/
@@ -980,14 +981,42 @@ const _validateURL = function (href, whitelist) {
   if (protocol != null) {
     protocol = protocol.toLowerCase();
   }
-  // if it isn't on the allowed list and it isn't '', throw an error.
-  // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
-  // and we want to allow hrefs like 'abc' since those are relative urls.
-  if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+  // Security issues JET-79830, JET-79570, and JET-79644 flagged the legacy
+  // empty-protocol allowance. IE11 returned '' for some relative URLs, but IE11
+  // is no longer supported. Modern browsers resolve relative URLs against the
+  // document URL before exposing the protocol, so an empty protocol is not
+  // treated as valid.
+  if (allowed.indexOf(protocol) < 0) {
     throw new Error(protocol + ' is not a valid URL protocol');
   }
 };
 
+/**
+ * Encodes an SVG definition ID for use as the fragment portion of a URL.
+ * @param {string} id The SVG definition ID.
+ * @return {string} The encoded fragment ID.
+ */
+const _encodeSvgUrlFragmentId = function (id) {
+  return encodeURIComponent(id).replace(/[!'()*]/g, function (ch) {
+    return '%' + ch.charCodeAt(0).toString(16).toUpperCase();
+  });
+};
+
+/**
+ * Escapes a value for interpolation inside a quoted CSS string.
+ * @param {string} value The CSS string value.
+ * @return {string} The escaped CSS string value.
+ */
+const _escapeCssString = function (value) {
+  return value.replace(/["\\\n\r\f]/g, function (ch) {
+    if (ch === '"') return '\\"';
+    if (ch === '\\') return '\\\\';
+    if (ch === '\n') return '\\A ';
+    if (ch === '\r') return '\\D ';
+    return '\\C ';
+  });
+};
+
 /**
  * Creates and returns a new SVG document with the specified id.
  * @param {string} id The id for the new SVG document.
@@ -1241,7 +1270,7 @@ ToolkitUtils.getLinkCallback = function (target, dest) {
       if (target == null) {
         self.location = dest;
       } else {
-        var newWindow = window.open(dest, target);
+        var newWindow = window.open(dest, target, _NOOPENER_WINDOW_FEATURES);
         if (newWindow) newWindow.focus();
       }
     };
@@ -1257,13 +1286,13 @@ ToolkitUtils.getLinkCallback = function (target, dest) {
  */
 ToolkitUtils.getUrlPathById = function (id) {
   // If <base> is defined on the document, we have to use the full URL.
-  // document.baseURI is not supported in IE, so we have to check if the <base> tag exists in the document.
+  // document.baseURI is not supported in IE, so fall back to checking for the <base> tag.
   var hasBase =
-    Agent.browser === 'ie' || Agent.browser === 'edge'
+    document.baseURI == null
       ? document.querySelector('base') != null
       : document.URL != document.baseURI;
   var root = hasBase ? document.URL.split('#')[0] + '#' : '#';
-  return root + id;
+  return root + _encodeSvgUrlFragmentId(id);
 };
 
 /**
@@ -1272,7 +1301,7 @@ ToolkitUtils.getUrlPathById = function (id) {
  * @return {string} URL attribute value.
  */
 ToolkitUtils.getUrlById = function (id) {
-  return 'url(' + ToolkitUtils.getUrlPathById(id) + ')';
+  return 'url("' + _escapeCssString(ToolkitUtils.getUrlPathById(id)) + '")';
 };
 
 /**
@@ -10319,33 +10348,8 @@ HtmlTooltipManager.prototype._showTextAtPosition = function (
     while (outerElem.hasChildNodes()) outerElem.removeChild(outerElem.firstChild);
   }
 
-  // Make replacements on the text string as needed
   if (typeof text == 'string') {
-    // For security, turn HTML brackets into strings to disable tags.
-    text = text.replace(/(<|&#60;)/g, '&lt;');
-    text = text.replace(/(>|&#62;)/g, '&gt;');
-
-    // Support a subset of HTML tags, including bold, italic, and table tags.
-    text = HtmlTooltipManager._restoreTag(text, 'b');
-    text = HtmlTooltipManager._restoreTag(text, 'i');
-    text = HtmlTooltipManager._restoreTag(text, 'table');
-    text = HtmlTooltipManager._restoreTag(text, 'tr');
-    text = HtmlTooltipManager._restoreTag(text, 'td');
-
-    // Replace logical newlines sequences
-    text = text.replace(/\n/g, '<br>');
-    text = text.replace(/\\n/g, '<br>');
-    text = text.replace(/&#92;n/g, '<br>');
-    text = HtmlTooltipManager._restoreTag(text, 'br');
-
-    // Create the tooltip element
-    tooltipDOM = document.createElement('span');
-    tooltipDOM.style.visibility = 'inherit';
-    tooltipDOM.style.width = null;
-    tooltipDOM.style.height = null;
-
-    // Set the text
-    tooltipDOM.innerHTML = text; //@HTMLUpdateOK
+    tooltipDOM = HtmlTooltipManager._createTooltipTextElement(text);
   } else if (canModify) tooltipDOM = text; // the text is an element or array of elements to be appended directly
 
   // Apply default class and border color on the outer element only if the user hasn't specified them ( + 21150376)
@@ -10716,19 +10720,233 @@ HtmlTooltipManager.prototype.getCustomTooltip = function (tooltipFunc, dataConte
   return tooltip;
 };
 
+/** @private @const */
+HtmlTooltipManager._SUPPORTED_TOOLTIP_TAGS = {
+  b: true,
+  i: true,
+  br: true,
+  table: true,
+  tr: true,
+  td: true
+};
+
+/** @private @const */
+HtmlTooltipManager._TOOLTIP_ENTITY_MAP = {
+  amp: '&',
+  lt: '<',
+  gt: '>',
+  quot: '"',
+  apos: "'",
+  nbsp: String.fromCharCode(160)
+};
+
 /**
- * Restores a supported HTML tag.
- * All HTML brackets are converted into &gt; and &lt; for security reasons, to prevent people from adding unsupported
- * elements. JET-79039: This method restores the brackets for the supported element only, discarding all attributes.
- * @param {string} text The HTML string.
- * @param {string} tag The tag name to be restored.
- * @return {string} The updated HTML string.
+ * Creates a tooltip span from a string without parsing the string as HTML.
+ * Supported tooltip tags are converted to DOM nodes and all other markup is rendered as text.
+ * @param {string} text The tooltip string.
+ * @return {HTMLSpanElement}
  * @private
  */
-HtmlTooltipManager._restoreTag = function (text, tag) {
-  // Match the following: <tag...>, </tag...>, and <tag.../>
-  var regExp = new RegExp('&lt;(/?)(' + tag + ')(?=[\\s&/])([^&]*)(/?)&gt;', 'g');
-  return text.replace(regExp, '<$1' + tag + '>');
+HtmlTooltipManager._createTooltipTextElement = function (text) {
+  var tooltipDOM = document.createElement('span');
+  tooltipDOM.style.visibility = 'inherit';
+  tooltipDOM.style.width = null;
+  tooltipDOM.style.height = null;
+
+  HtmlTooltipManager._appendTooltipTextContent(
+    tooltipDOM,
+    HtmlTooltipManager._decodeTooltipEntities(text)
+  );
+  return tooltipDOM;
+};
+
+/**
+ * Appends tooltip string content to an element using only DOM APIs.
+ * @param {Element} root The element receiving tooltip content.
+ * @param {string} text The tooltip string.
+ * @private
+ */
+HtmlTooltipManager._appendTooltipTextContent = function (root, text) {
+  var stack = [root];
+  var index = 0;
+
+  while (index < text.length) {
+    if (text.charAt(index) === '\n') {
+      HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+      index += 1;
+      continue;
+    }
+
+    if (text.charAt(index) === '\\' && text.charAt(index + 1) === 'n') {
+      HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+      index += 2;
+      continue;
+    }
+
+    if (text.indexOf('&#92;n', index) === index) {
+      HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+      index += 6;
+      continue;
+    }
+
+    var tag = HtmlTooltipManager._parseTooltipTag(text, index);
+    if (tag) {
+      if (tag.name === 'br') {
+        HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+      } else if (tag.closing) {
+        HtmlTooltipManager._closeTooltipTag(stack, tag.name);
+      } else {
+        var element = document.createElement(tag.name); // @HTMLUpdateOK
+        stack[stack.length - 1].appendChild(element);
+        stack.push(element);
+      }
+      index = tag.end;
+      continue;
+    }
+
+    if (text.charAt(index) === '<') {
+      var tagEnd = text.indexOf('>', index + 1);
+      var literalEnd = tagEnd >= 0 ? tagEnd + 1 : index + 1;
+      HtmlTooltipManager._appendTooltipText(
+        stack[stack.length - 1],
+        text.substring(index, literalEnd)
+      );
+      index = literalEnd;
+    } else {
+      var textEnd = HtmlTooltipManager._getNextTooltipSpecialTokenIndex(text, index + 1);
+      HtmlTooltipManager._appendTooltipText(
+        stack[stack.length - 1],
+        text.substring(index, textEnd)
+      );
+      index = textEnd;
+    }
+  }
+};
+
+/**
+ * Parses a supported tooltip tag at the specified index.
+ * @param {string} text The tooltip string.
+ * @param {number} index The index to parse.
+ * @return {{name:string, closing:boolean, end:number}|null}
+ * @private
+ */
+HtmlTooltipManager._parseTooltipTag = function (text, index) {
+  if (text.charAt(index) !== '<') return null;
+
+  var tagEnd = text.indexOf('>', index + 1);
+  if (tagEnd < 0) return null;
+
+  var position = index + 1;
+  var closing = text.charAt(position) === '/';
+  if (closing) position += 1;
+
+  var tagStart = position;
+  while (position < tagEnd && /[a-z]/.test(text.charAt(position))) {
+    position += 1;
+  }
+
+  var tagName = text.substring(tagStart, position);
+  if (!HtmlTooltipManager._SUPPORTED_TOOLTIP_TAGS[tagName]) return null;
+  if (!HtmlTooltipManager._isTooltipTagBoundary(text, position, tagEnd)) return null;
+
+  return {
+    name: tagName,
+    closing: closing,
+    end: tagEnd + 1
+  };
+};
+
+/**
+ * Returns the next index that needs token-level tooltip handling.
+ * @param {string} text The tooltip string.
+ * @param {number} index The index to start scanning from.
+ * @return {number}
+ * @private
+ */
+HtmlTooltipManager._getNextTooltipSpecialTokenIndex = function (text, index) {
+  while (index < text.length) {
+    if (
+      text.charAt(index) === '<' ||
+      text.charAt(index) === '\n' ||
+      (text.charAt(index) === '\\' && text.charAt(index + 1) === 'n')
+    ) {
+      return index;
+    }
+    index += 1;
+  }
+  return index;
+};
+
+/**
+ * Returns whether a parsed tag name is followed by a valid tag boundary.
+ * @param {string} text The tooltip string.
+ * @param {number} index The index after the parsed tag name.
+ * @param {number} tagEnd The index of the closing angle bracket.
+ * @return {boolean}
+ * @private
+ */
+HtmlTooltipManager._isTooltipTagBoundary = function (text, index, tagEnd) {
+  return index === tagEnd || /\s/.test(text.charAt(index)) || text.charAt(index) === '/';
+};
+
+/**
+ * Closes the most recent matching supported tooltip tag.
+ * @param {Array<Element>} stack The open tooltip element stack.
+ * @param {string} tagName The tag name to close.
+ * @private
+ */
+HtmlTooltipManager._closeTooltipTag = function (stack, tagName) {
+  for (var i = stack.length - 1; i > 0; i--) {
+    if (stack[i].tagName.toLowerCase() === tagName) {
+      stack.length = i;
+      return;
+    }
+  }
+};
+
+/**
+ * Appends a line break to tooltip content.
+ * @param {Element} parent The parent element.
+ * @private
+ */
+HtmlTooltipManager._appendTooltipLineBreak = function (parent) {
+  parent.appendChild(document.createElement('br')); // @HTMLUpdateOK
+};
+
+/**
+ * Appends decoded text to tooltip content.
+ * @param {Element} parent The parent element.
+ * @param {string} text The text to append.
+ * @private
+ */
+HtmlTooltipManager._appendTooltipText = function (parent, text) {
+  if (text) {
+    parent.appendChild(document.createTextNode(text));
+  }
+};
+
+/**
+ * Decodes only the common entities supported in DVT tooltip string content.
+ * @param {string} text The text to decode.
+ * @return {string}
+ * @private
+ */
+HtmlTooltipManager._decodeTooltipEntities = function (text) {
+  return text.replace(
+    /&(#x[0-9a-fA-F]+|#[0-9]+|amp|lt|gt|quot|apos|nbsp);/g,
+    function (match, entity) {
+      if (entity.charAt(0) === '#') {
+        var radix = entity.charAt(1).toLowerCase() === 'x' ? 16 : 10;
+        var value = parseInt(entity.substring(radix === 16 ? 2 : 1), radix);
+        if (!isNaN(value) && value >= 0 && value <= 0x10ffff) {
+          return String.fromCodePoint ? String.fromCodePoint(value) : String.fromCharCode(value);
+        }
+        return match;
+      }
+
+      return HtmlTooltipManager._TOOLTIP_ENTITY_MAP[entity];
+    }
+  );
 };
 
 /**