@oracle/oraclejet 20.1.2 → 20.1.3

package/dist/pcss/oj/{20.1.2 → 20.1.3}/oj/helpers/themes/base/_oj-helpers.scss

@@ -45,7 +45,7 @@
   $themeRootMap: map-merge(
     $themeRootMap,
     (
-      jetReleaseVersion: "v20.1.2"
+      jetReleaseVersion: "v20.1.3"
     )
   );
 

package/dist/scss/common/helpers/_oj.common.helpers.scss

@@ -29,7 +29,7 @@
       $themeRootMap: map-merge($themeRootMap, (targetPlatform: $themeTargetPlatform));
   }
   $themeRootMap: map-merge($themeRootMap, (behavior: "alta"));
-  $themeRootMap: map-merge($themeRootMap, (jetReleaseVersion: "v20.1.2"));
+  $themeRootMap: map-merge($themeRootMap, (jetReleaseVersion: "v20.1.3"));
 
   .oj-theme-json {
       font-family: oj-json-from-map($themeRootMap);

package/dist/types/ojmessagebanner/ojmessagebanner.d.ts

@@ -231,9 +231,12 @@ type State<K, D> = {
  * <p>The <code class="prettyprint">MessageBannerItem["sound"]</code> property is an accessibility
  * feature for playing a sound when a message is opened. This property defaults to "none", and can
  * be enabled by setting it to "default" or by providing a URL to an audio file of a format that the
- * browser supports. An accessible application must provide a way for users to enable sound on a
- * settings or preferences page. Some browsers will have auto-play disabled by default, enabling
- * it may require adjusting the browser settings.</p>
+ * browser supports. Custom sound URLs are validated before playback. Relative URLs and URLs that
+ * resolve to <code class="prettyprint">http:</code>, <code class="prettyprint">https:</code>,
+ * <code class="prettyprint">data:</code>, or <code class="prettyprint">blob:</code> are
+ * supported. An accessible application must provide a way for users to enable sound on a settings
+ * or preferences page. Some browsers will have auto-play disabled by default, enabling it may
+ * require adjusting the browser settings.</p>
  *
  * <h3 id="keyboard-section">
  *   Keyboard End User Information

package/dist/types/ojmodel/index.d.ts

@@ -288,18 +288,6 @@ export namespace Model {
         recordID?: string;
     };
 }
-export class OAuth {
-    constructor(attributes: object, header: string);
-    cleanAccessTokenRequest(): undefined;
-    cleanAccessTokenResponse(): undefined;
-    clientCredentialGrant(): undefined;
-    getAccessTokenRequest(): object;
-    getAccessTokenResponse(): object;
-    getHeader(): object;
-    isInitialized(): boolean;
-    setAccessTokenRequest(data: object): undefined;
-    setAccessTokenResponse(data: object): undefined;
-}
 // tslint:disable-next-line no-unnecessary-class
 export class URLError {
     constructor();

package/dist/webpack-tools/4.x/loaders/ojL10n-loader.js

@@ -40,6 +40,7 @@
 const path = require("path");
 const fs = require("fs");
 const vm = require('vm');
+const {mergeDeep} = require('../../shared/bundleUtils');
 
 
 module.exports = function ojL10nLoader(source) {
@@ -68,7 +69,7 @@ module.exports = function ojL10nLoader(source) {
     toLoad.push('root');
   }
   else {
-    root = rootVal;
+    root = mergeDeep({}, rootVal);
   }
 
   root = root||{};
@@ -156,32 +157,10 @@ function _mergeParts(target, toMerge) {
     return target;
 
 
-   return _mergeDeep.apply(null, [target].concat(toMerge));
+   return mergeDeep.apply(null, [target].concat(toMerge));
 
 }
 
-function _isObject(item) {
-  return (item && typeof item === 'object' && !Array.isArray(item));
-}
-
-function _mergeDeep(target, ...sources) {
-  if (!sources.length) return target;
-  const source = sources.shift();
-
-  if (_isObject(target) && _isObject(source)) {
-    for (const key in source) {
-      if (_isObject(source[key])) {
-        if (!target[key]) Object.assign(target, { [key]: {} });
-        _mergeDeep(target[key], source[key]);
-      } else {
-        Object.assign(target, { [key]: source[key] });
-      }
-    }
-  }
-
-  return _mergeDeep(target, ...sources);
-}
-
 /**
  * Fixes up locale to comply with BCP47 spec and returns parts that should be used for mathching the bundles
  */

package/dist/webpack-tools/4.x/plugins/WebpackRequireFixupPlugin.js

@@ -22,11 +22,44 @@ const ReplaceContentDependency = require('./ReplaceContentDependency');
 const OjModuleImportDependency = require('./OjModuleImportDependency');
 const BaseResourceUrlDependency = require('./BaseResourceUrlDependency');
 const ImportDependenciesBlock = require('webpack/lib/dependencies/ImportDependenciesBlock');
+const {mergeDeep} = require('../../shared/bundleUtils');
 
 const vm = require("vm");
 
 
 const _OJ_OPTION_COMMENT_REGEXP = new RegExp(/(^|\W)oj[A-Z]{1,}[A-Za-z]{1,}:/);
+const _MODULE_PATH_VALIDATION_HELPERS = `
+      function isSafeSegment(segment) {
+        return segment !== '' && segment !== '.' && segment !== '..' && /^[A-Za-z0-9_.-]+$/.test(segment);
+      }
+      function isSafeResourcePath(path) {
+        if (
+          typeof path !== 'string' ||
+          path === '' ||
+          path.indexOf('\\\\') !== -1 ||
+          path.indexOf('!') !== -1 ||
+          path.indexOf(':') !== -1 ||
+          path.charAt(0) === '/'
+        ) {
+          return false;
+        }
+        var normalizedPath = path;
+        if (normalizedPath.indexOf('./') === 0) {
+          normalizedPath = normalizedPath.substring(2);
+        }
+        return normalizedPath.split('/').every(isSafeSegment);
+      }`;
+const _MODULE_ID_VALIDATION_HELPERS = `${_MODULE_PATH_VALIDATION_HELPERS}
+      function isSafeModuleId(type, module) {
+        var modulePath = module;
+        if (type === 'view') {
+          if (modulePath.indexOf('text!') !== 0) {
+            return false;
+          }
+          modulePath = modulePath.substring(5);
+        }
+        return isSafeResourcePath(modulePath);
+      }`;
 
 class WebpackRequireFixupPlugin
 {
@@ -121,7 +154,7 @@ class WebpackRequireFixupPlugin
                     }
                     // require instance is being passed for loading a View and a ViewModel by ojModule
                     else if (ojModuleBindingOpts) {
-                      return _replaceOjModuleRequirePromise(range, _mergeDeep({}, rootOpts, root, ojModuleBindingOpts), parser, true);
+                      return _replaceOjModuleRequirePromise(range, mergeDeep({}, rootOpts, root, ojModuleBindingOpts), parser, true);
                     }
                     // require instance is being passed for use by ModuleRouterAdapter
                     else if (moduleRouterAdapterOpts) {
@@ -241,8 +274,16 @@ function _replaceOjModuleRequirePromise(range, options, parser, isDelegate) {
 
   const content1 = isDelegate ? `function (type, module)
   {
+    ${_MODULE_ID_VALIDATION_HELPERS}
+    if (!isSafeModuleId(type, module)) {
+      return Promise.reject(new Error('Invalid module path'));
+    }
   `: `function _getOjModuleRequirePromise(delegate, type, module)
   {
+    ${_MODULE_ID_VALIDATION_HELPERS}
+    if (!isSafeModuleId(type, module)) {
+      return Promise.reject(new Error('Invalid module path'));
+    }
     if (delegate)
       return delegate(type, module);
   `;
@@ -311,9 +352,13 @@ function _replaceOjModuleViewPromise(range, options, parser) {
     if (!(options && options.viewPath)) {
       return Promise.resolve([]);
     }
+    ${_MODULE_PATH_VALIDATION_HELPERS}
 
     var delegate = options.require;
     var module = options.viewPath;
+    if (!isSafeResourcePath(module)) {
+      return Promise.reject(new Error('Invalid module path'));
+    }
 
     var ret;
 
@@ -361,9 +406,13 @@ function _replaceOjModuleViewModelPromise(range, options, parser) {
       if (!(options && options.viewModelPath)) {
         return Promise.resolve(null);
       }
+      ${_MODULE_PATH_VALIDATION_HELPERS}
       var vmP;
       var delegate = options.require;
       var module = options.viewModelPath;
+      if (!isSafeResourcePath(module)) {
+        return Promise.reject(new Error('Invalid module path'));
+      }
       if (delegate) {
         var vmd = delegate.viewModel;
         delegate = vmd || delegate;
@@ -420,6 +469,10 @@ function _replaceOjModuleRequireDelegate(range, options, parser) {
 
   const content1 =
     `function(module) {
+      ${_MODULE_PATH_VALIDATION_HELPERS}
+      if (!isSafeResourcePath(module)) {
+        return Promise.reject(new Error('Invalid module path'));
+      }
       return `;
 
   const content3 = `
@@ -482,28 +535,6 @@ function _replaceRouterAdapterRequireDelegate(range, viewOpts, viewModelOpts, pa
   return true;
 }
 
-function _isObject(item) {
-  return (item && typeof item === 'object' && !Array.isArray(item));
-};
-
-function _mergeDeep(target, ...sources) {
-  if (!sources.length) return target;
-  const source = sources.shift();
-
-  if (_isObject(target) && _isObject(source)) {
-    Object.keys(source).forEach( key =>  {
-      if (_isObject(source[key])) {
-        if (!target[key]) Object.assign(target, { [key]: {} });
-        _mergeDeep(target[key], source[key]);
-      } else {
-        Object.assign(target, { [key]: source[key] });
-      }
-    });
-  }
-
-  return _mergeDeep(target, ...sources);
-};
-
 function _getCommentOptions(parser, range) {
   const ret = {};
   const comments = parser.getComments(range);

package/dist/webpack-tools/4.x/webpack.config.js

@@ -56,8 +56,8 @@ module.exports = {
       'jqueryui-amd': path.resolve(__dirname, './web/js/libs/jquery/jqueryui-amd-1.14.1'),
       'hammerjs': path.resolve(__dirname, './web/js/libs/hammer/hammer-2.0.8'),
       'ojdnd': path.resolve(__dirname, './web/js/libs/dnd-polyfill/dnd-polyfill-1.0.2'),
-      'ojs': path.resolve(__dirname, './web/js/libs/oj/20.1.2/debug'),
-      'ojtranslations': path.resolve(__dirname, './web/js/libs/oj/20.1.2/resources'),
+      'ojs': path.resolve(__dirname, './web/js/libs/oj/20.1.3/debug'),
+      'ojtranslations': path.resolve(__dirname, './web/js/libs/oj/20.1.3/resources'),
       'oj-c': '@oracle/oraclejet-core-pack/oj-c',
       // Webpack 4 doesn't read oraclejet-preact's package exports, so point it
       // to the AMD distribution. For projects also using oj-c, the imports start
@@ -103,7 +103,7 @@ module.exports = {
           }
         },
         // Point this setting to the root folder for the associated JET distribution (could be a CDN). Used by the oj.Config.getResourceUri() call
-        baseResourceUrl: "./web/js/libs/oj/20.1.2"
+        baseResourceUrl: "./web/js/libs/oj/20.1.3"
       }
     )
 

package/dist/webpack-tools/loaders/ojL10n-loader.js

@@ -42,7 +42,7 @@ const hash = require('crypto');
 const vm = require('vm');
 
 const {setBundlesForId} = require('../shared/mediator');
-const {stringifyWithFunctions, isObject} = require('../shared/bundleUtils');
+const {stringifyWithFunctions, mergeDeep} = require('../shared/bundleUtils');
 
 
 module.exports = function ojL10nLoader(source) {
@@ -89,7 +89,7 @@ module.exports = function ojL10nLoader(source) {
     toLoad.push('root');
   }
   else {
-    root = rootVal;
+    root = mergeDeep({}, rootVal);
   }
 
   let localeBlock = "";
@@ -114,7 +114,7 @@ module.exports = function ojL10nLoader(source) {
   toMergePromises = toLoad.map((loc) => _loadLocaleBundle(this, dir, baseName, loc));
 
   Promise.all(toMergePromises).then((toMerge) =>
-      callback(null, _getModuleContent(_mergeDeep(root, toMerge)))).catch((err) => callback(err));
+      callback(null, _getModuleContent(mergeDeep(root, ...toMerge)))).catch((err) => callback(err));
 
 }
 
@@ -210,24 +210,6 @@ function _executeBundle(src) {
 }
 
 
-function _mergeDeep(target, sources) {
-  if (!sources.length) return target;
-  const source = sources.shift();
-
-  if (isObject(target) && isObject(source)) {
-    for (const key in source) {
-      if (isObject(source[key])) {
-        if (!target[key]) Object.assign(target, { [key]: {} });
-        _mergeDeep(target[key], [source[key]]);
-      } else {
-        Object.assign(target, { [key]: source[key] });
-      }
-    }
-  }
-  return _mergeDeep(target, sources);
-}
-
-
 function _getCompleteLocaleSet(rootBundle) {
   const keys = Object.keys(rootBundle);
   const locales = keys.filter((key) => {
@@ -255,7 +237,7 @@ async function _mergeBundles(loader/* ojL10n-loader instance*/, dir, baseName, s
     rootTranslations = _loadLocaleBundle(loader, dir, baseName, 'root');
   }
 
-  const rootValue = await rootTranslations;
+  const rootValue = mergeDeep({}, await rootTranslations);
   localeBundles.set('root', rootValue);
 
   // BCP-47 locales may have up to 3 parts separated by '-'
@@ -284,7 +266,7 @@ async function _mergeBundles(loader/* ojL10n-loader instance*/, dir, baseName, s
       }
     }
     toMerge.push(bundle);
-    const merged = _mergeDeep({}, toMerge);
+    const merged = mergeDeep({}, ...toMerge);
     localeBundles.set(locale, merged);
   });
 

package/dist/webpack-tools/plugins/WebpackRequireFixupPlugin.js

@@ -26,7 +26,7 @@ const AsyncDependenciesBlock = require('webpack/lib/AsyncDependenciesBlock');
 const ImportDependency = require('webpack/lib/dependencies/ImportDependency');
 const NullDependency = require('webpack/lib/dependencies/NullDependency');
 const {getBundleMap} = require('../shared/mediator');
-const {stringifyWithFunctions} = require('../shared/bundleUtils');
+const {mergeDeep, stringifyWithFunctions} = require('../shared/bundleUtils');
 
 
 
@@ -53,6 +53,38 @@ ReplaceV1BundlesDependency.Template = class ReplaceV1BundlesDependencyTemplate
 
 
 const _OJ_OPTION_COMMENT_REGEXP = new RegExp(/(^|\W)oj[A-Z]{1,}[A-Za-z]{1,}:/);
+const _MODULE_PATH_VALIDATION_HELPERS = `
+      function isSafeSegment(segment) {
+        return segment !== '' && segment !== '.' && segment !== '..' && /^[A-Za-z0-9_.-]+$/.test(segment);
+      }
+      function isSafeResourcePath(path) {
+        if (
+          typeof path !== 'string' ||
+          path === '' ||
+          path.indexOf('\\\\') !== -1 ||
+          path.indexOf('!') !== -1 ||
+          path.indexOf(':') !== -1 ||
+          path.charAt(0) === '/'
+        ) {
+          return false;
+        }
+        var normalizedPath = path;
+        if (normalizedPath.indexOf('./') === 0) {
+          normalizedPath = normalizedPath.substring(2);
+        }
+        return normalizedPath.split('/').every(isSafeSegment);
+      }`;
+const _MODULE_ID_VALIDATION_HELPERS = `${_MODULE_PATH_VALIDATION_HELPERS}
+      function isSafeModuleId(type, module) {
+        var modulePath = module;
+        if (type === 'view') {
+          if (modulePath.indexOf('text!') !== 0) {
+            return false;
+          }
+          modulePath = modulePath.substring(5);
+        }
+        return isSafeResourcePath(modulePath);
+      }`;
 
 class WebpackRequireFixupPlugin
 {
@@ -175,7 +207,7 @@ class WebpackRequireFixupPlugin
                     }
                     // require instance is being passed for loading a View and a ViewModel by ojModule
                     else if (ojModuleBindingOpts) {
-                      return _replaceOjModuleRequirePromise(range, mergeDeep({}, [rootOpts, root, ojModuleBindingOpts]), parser, true);
+                      return _replaceOjModuleRequirePromise(range, mergeDeep({}, rootOpts, root, ojModuleBindingOpts), parser, true);
                     }
                     // require instance is being passed for use by ModuleRouterAdapter
                     else if (moduleRouterAdapterOpts) {
@@ -319,8 +351,16 @@ function _replaceOjModuleRequirePromise(range, options, parser, isDelegate) {
 
   const content1 = isDelegate ? `function (type, module)
   {
+    ${_MODULE_ID_VALIDATION_HELPERS}
+    if (!isSafeModuleId(type, module)) {
+      return Promise.reject(new Error('Invalid module path'));
+    }
   `: `function _getOjModuleRequirePromise(delegate, type, module)
   {
+    ${_MODULE_ID_VALIDATION_HELPERS}
+    if (!isSafeModuleId(type, module)) {
+      return Promise.reject(new Error('Invalid module path'));
+    }
     if (delegate)
       return delegate(type, module);
   `;
@@ -389,9 +429,13 @@ function _replaceOjModuleViewPromise(range, options, parser) {
     if (!(options && options.viewPath)) {
       return Promise.resolve([]);
     }
+    ${_MODULE_PATH_VALIDATION_HELPERS}
 
     var delegate = options.require;
     var module = options.viewPath;
+    if (!isSafeResourcePath(module)) {
+      return Promise.reject(new Error('Invalid module path'));
+    }
 
     var ret;
 
@@ -439,9 +483,13 @@ function _replaceOjModuleViewModelPromise(range, options, parser) {
       if (!(options && options.viewModelPath)) {
         return Promise.resolve(null);
       }
+      ${_MODULE_PATH_VALIDATION_HELPERS}
       var vmP;
       var delegate = options.require;
       var module = options.viewModelPath;
+      if (!isSafeResourcePath(module)) {
+        return Promise.reject(new Error('Invalid module path'));
+      }
       if (delegate) {
         var vmd = delegate.viewModel;
         delegate = vmd || delegate;
@@ -498,6 +546,10 @@ function _replaceOjModuleRequireDelegate(range, options, parser) {
 
   const content1 =
     `function(module) {
+      ${_MODULE_PATH_VALIDATION_HELPERS}
+      if (!isSafeResourcePath(module)) {
+        return Promise.reject(new Error('Invalid module path'));
+      }
       return `;
 
   const content3 = `

package/dist/webpack-tools/shared/bundleUtils.js

@@ -32,6 +32,35 @@ function isObject(item) {
   return item && typeof item === 'object' && !Array.isArray(item);
 }
 
+function isBlockedKey(key) {
+  return key === '__proto__' || key === 'constructor' || key === 'prototype';
+}
+
+function mergeDeep(target, ...sources) {
+  if (!sources.length) return target;
+  const source = sources.shift();
+
+  if (isObject(target) && isObject(source)) {
+    Object.keys(source).forEach((key) => {
+      if (!isBlockedKey(key)) {
+        const sourceValue = source[key];
+        if (isObject(sourceValue)) {
+          if (!Object.prototype.hasOwnProperty.call(target, key) || !target[key]) {
+            target[key] = {};
+          }
+          if (isObject(target[key])) {
+            mergeDeep(target[key], sourceValue);
+          }
+        } else {
+          target[key] = sourceValue;
+        }
+      }
+    });
+  }
+
+  return mergeDeep(target, ...sources);
+}
+
 
 
-module.exports = {stringifyWithFunctions, isObject};
+module.exports = {stringifyWithFunctions, isObject, mergeDeep};

package/dist/webpack-tools/webpack.config.js

@@ -56,8 +56,8 @@ module.exports = {
       'jqueryui-amd': path.resolve(__dirname, './web/js/libs/jquery/jqueryui-amd-1.14.1'),
       'hammerjs': path.resolve(__dirname, './web/js/libs/hammer/hammer-2.0.8'),
       'ojdnd': path.resolve(__dirname, './web/js/libs/dnd-polyfill/dnd-polyfill-1.0.2'),
-      'ojs': path.resolve(__dirname, './web/js/libs/oj/20.1.2/debug'),
-      'ojtranslations': path.resolve(__dirname, './web/js/libs/oj/20.1.2/resources'),
+      'ojs': path.resolve(__dirname, './web/js/libs/oj/20.1.3/debug'),
+      'ojtranslations': path.resolve(__dirname, './web/js/libs/oj/20.1.3/resources'),
       'oj-c': '@oracle/oraclejet-core-pack/oj-c',
       // Webpack 5 will discover oraclejet-preact's exports and map the name
       // "@oracle/oraclejet-preact" to "@oracle/oraclejet-preact/cjs". We redirect
@@ -105,7 +105,7 @@ module.exports = {
           }
         },
         // Point this setting to the root folder for the associated JET distribution (could be a CDN). Used by the oj.Config.getResourceUri() call
-        baseResourceUrl: "./web/js/libs/oj/20.1.2"
+        baseResourceUrl: "./web/js/libs/oj/20.1.3"
       }
     )
 

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@oracle/oraclejet",
-  "version": "20.1.2",
+  "version": "20.1.3",
   "license": "UPL-1.0",
   "description": "Oracle JavaScript Extension Toolkit (JET) empowers developers by providing a modular open source toolkit based on modern JavaScript, CSS3 and HTML5 design and development principles.",
   "keywords": [
     "oraclejet"
   ],
   "dependencies": {
-    "@oracle/oraclejet-preact": "20.1.2",
+    "@oracle/oraclejet-preact": "20.1.3",
     "hammerjs": "2.0.8",
     "jquery": "3.7.1",
     "jquery-ui": "1.14.1",