@oracle/oraclejet 20.1.2 → 20.1.4

package/dist/js/libs/oj/debug/ojdomutils.js

@@ -33,7 +33,16 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
       SMALL: 1,
       PRE: 1
     },
-    _LEGAL_ATTRIBUTES: { class: 1, style: 1 }
+    _LEGAL_ATTRIBUTES: { class: 1, style: 1 },
+    _LEGAL_CSS_PROPERTIES: {
+      color: 1,
+      'font-style': 1,
+      'font-weight': 1,
+      'text-decoration': 1,
+      'text-decoration-line': 1
+    },
+    _ILLEGAL_CSS_VALUE_PATTERN:
+      /(?:url\s*\(|expression\s*\(|behavior\s*:|-moz-binding|@import|!important|var\s*\()/i
   };
 
   /**
@@ -54,11 +63,13 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
   };
 
   DomUtils.cleanHtml = function (value) {
-    var offSpan = $(document.createElement('span')).get(0);
-    offSpan.innerHTML = value; // @HTMLUpdateOK safe manipulation
+    var offSpan = document.createElement('span');
+    var template = document.createElement('template');
+    template.innerHTML = value; // @HTMLUpdateOK template content is sanitized before use
     if (value && value.indexOf('\x3c') >= 0) {
-      DomUtils._cleanElementHtml(offSpan);
+      DomUtils._cleanElementHtml(template.content);
     }
+    offSpan.appendChild(template.content); // @HTMLUpdateOK appending sanitized template content
     return offSpan;
   };
 
@@ -72,22 +83,73 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
           var attrs = child.attributes;
           for (var i = attrs.length - 1; i >= 0; i--) {
             var attr = attrs[i];
+            var attrName = attr.name.toLowerCase();
             // jquery - the .attr() method returns undefined for attributes that have not been set.
             var childHasAttr = $(child).attr(attr.name) !== undefined;
             if (childHasAttr) {
-              if (!Object.hasOwn(DomUtils._LEGAL_ATTRIBUTES, attr.name)) {
+              if (!Object.hasOwn(DomUtils._LEGAL_ATTRIBUTES, attrName)) {
                 child.removeAttribute(attr.nodeName);
+              } else if (attrName === 'style') {
+                DomUtils._sanitizeStyleAttribute(child);
               }
             }
           }
           DomUtils._cleanElementHtml(child);
-        } else if (child) {
+        } else {
           node.removeChild(child);
         }
+      } else if (child && child.nodeType === 8) {
+        node.removeChild(child);
+      }
+    }
+  };
+
+  DomUtils._sanitizeStyleAttribute = function (node) {
+    var cleanDeclarations = [];
+    var style = node.style;
+    var properties = Array.from(style);
+
+    for (var i = 0; i < properties.length; i++) {
+      var property = properties[i];
+      var value = style.getPropertyValue(property);
+      var cleanValue = DomUtils._getCleanHtmlCssValue(
+        property,
+        value,
+        style.getPropertyPriority(property)
+      );
+
+      if (cleanValue) {
+        cleanDeclarations.push({ property: property, value: cleanValue });
+      }
+    }
+
+    node.removeAttribute('style');
+
+    if (cleanDeclarations.length > 0) {
+      for (var j = 0; j < cleanDeclarations.length; j++) {
+        var cleanDeclaration = cleanDeclarations[j];
+        node.style.setProperty(cleanDeclaration.property, cleanDeclaration.value);
       }
     }
   };
 
+  DomUtils._getCleanHtmlCssValue = function (property, value, priority) {
+    if (
+      !Object.hasOwn(DomUtils._LEGAL_CSS_PROPERTIES, property) ||
+      !value ||
+      priority ||
+      DomUtils._ILLEGAL_CSS_VALUE_PATTERN.test(value)
+    ) {
+      return null;
+    }
+
+    if (window.CSS && CSS.supports && !CSS.supports(property, value)) {
+      return null;
+    }
+
+    return value;
+  };
+
   /**
    * Checks to see if the "ancestorNode" is a ancestor of "node".
    *
@@ -1012,10 +1074,10 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
   };
 
   /**
-   * Checks whether the href represents a safe URL
+   * Checks whether the href uses an allowed URL protocol.
    * @param {!string} href - HREF to test
    * @param {Array=} whitelist - optional list of the allowed protocols. Protocol name has to use lowercase letters and
-   * be followed by a ':'. If the parameter is ommitted, ['http:', 'https:'] will be used
+   * be followed by a ':'. If the parameter is omitted, ['http:', 'https:'] will be used
    * @throws {Exception} an error if the HREF represents an invalid URL
    * @ignore
    */
@@ -1029,10 +1091,12 @@ define(['exports', 'ojs/ojthemeutils', 'ojs/ojcore-base', 'jquery'], function (e
     if (protocol != null) {
       protocol = protocol.toLowerCase();
     }
-    // if it isn't on the allowed list and it isn't '', throw an error.
-    // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
-    // and we want to allow hrefs like 'abc' since those are relative urls.
-    if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+    // Security issues JET-79830, JET-79570, and JET-79644 flagged the legacy
+    // empty-protocol allowance. IE11 returned '' for some relative URLs, but IE11
+    // is no longer supported. Modern browsers resolve relative URLs against the
+    // document URL before exposing the protocol, so an empty protocol is not
+    // treated as valid.
+    if (allowed.indexOf(protocol) < 0) {
       throw new Error(protocol + ' is not a valid URL protocol');
     }
   };

package/dist/js/libs/oj/debug/ojdvt-base.js

@@ -2417,7 +2417,11 @@ define(['ojs/ojdataprovider', 'ojs/ojcore-base', 'ojs/ojdvt-toolkit', 'ojs/ojcon
         if (options.selection !== undefined) {
           this._component.select(options.selection);
         }
-        if (options.dataCursorPosition !== undefined && this._component.positionDataCursor && !this._isSubtreeDetached) {
+        if (
+          options.dataCursorPosition !== undefined &&
+          this._component.positionDataCursor &&
+          !this._isSubtreeDetached
+        ) {
           this._component.positionDataCursor(options.dataCursorPosition);
         }
         if (options.scrollPosition !== undefined) {
@@ -3548,11 +3552,12 @@ define(['ojs/ojdataprovider', 'ojs/ojcore-base', 'ojs/ojdvt-toolkit', 'ojs/ojcon
         if (this._IsCustomElement()) {
           var renderers = this._GetComponentRendererOptions();
           for (var i = 0; i < renderers.length; i++) {
-            var optionPath = renderers[i].path;
-            var slot = renderers[i].slot;
+            var rendererOptions = renderers[i];
+            var optionPath = rendererOptions.path;
+            var slot = rendererOptions.slot;
             var templates = this._TemplateHandler.getTemplates();
             if (slot && templates[slot] && templates[slot][0]) {
-              this._ProcessInlineTemplateRenderer(options, optionPath, templates[slot][0], slot);
+              this._ProcessInlineTemplateRenderer(options, rendererOptions, templates[slot][0]);
             } else {
               var path = new DvtJsonPath(options, optionPath);
               var value = path.getValue();
@@ -3677,21 +3682,28 @@ define(['ojs/ojdataprovider', 'ojs/ojcore-base', 'ojs/ojdvt-toolkit', 'ojs/ojcon
       /**
        * Creates a callback function that will be used as a custom renderer for an inline template slot.
        * @param {Object} options Options for rendering the component
-       * @param {string} optionPath The path to set the generated renderer function
+       * @param {Object} rendererOptions The renderer path, slot, and optional template processing metadata
        * @param {Element} templateElement The <template> element
-       * @param {string} templateName The name of the template
        * @return {Function} A function that will be used as a custom renderer
        * @protected
        * @memberof oj.dvtBaseComponent
        */
-      _ProcessInlineTemplateRenderer: function (options, optionPath, templateElement, templateName) {
+      _ProcessInlineTemplateRenderer: function (options, rendererOptions, templateElement) {
+        var optionPath = rendererOptions.path;
+        var templateName = rendererOptions.slot;
         var renderCount = this._renderCount;
         this._numDeferredObjs += 1;
         var templateEnginePromise = this._TemplateHandler.getTemplateEngine();
         templateEnginePromise.then(
           function (templateEngine) {
             var templateRenderer = function (context) {
-              return this._TemplateRenderer(context, templateEngine, templateElement, templateName);
+              return this._TemplateRenderer(
+                context,
+                templateEngine,
+                templateElement,
+                templateName,
+                rendererOptions
+              );
             }.bind(this);
             templateRenderer = this._WrapInlineTemplateRenderer(
               templateRenderer,
@@ -3714,12 +3726,29 @@ define(['ojs/ojdataprovider', 'ojs/ojcore-base', 'ojs/ojdvt-toolkit', 'ojs/ojcon
        * @param {Object} templateEngine The template engine to be used to process templates
        * @param {Element} templateElement The <template> element
        * @param {string} templateName The name of the template
+       * @param {Object} rendererOptions The renderer path, slot, and optional template processing metadata
        * @return {Object}
        * @protected
        * @memberof oj.dvtBaseComponent
        */
-      _TemplateRenderer: function (context, templateEngine, templateElement, templateName) {
-        var nodes = templateEngine.execute(this.element[0], templateElement, context);
+      _TemplateRenderer: function (
+        context,
+        templateEngine,
+        templateElement,
+        templateName,
+        rendererOptions
+      ) {
+        var executionOptions =
+          rendererOptions && rendererOptions.processTemplate ? { processTemplate: true } : undefined;
+        var nodes = templateEngine.execute(
+          this.element[0],
+          templateElement,
+          context,
+          undefined,
+          undefined,
+          undefined,
+          executionOptions
+        );
         if (nodes && nodes.length > 0) {
           Object.defineProperty(context, '_templateCleanup', {
             value: () => {

package/dist/js/libs/oj/debug/ojdvt-toolkit.js

@@ -952,6 +952,7 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
   const ToolkitUtils = {};
 
   Obj.createSubclass(ToolkitUtils, Obj);
+  const _NOOPENER_WINDOW_FEATURES = 'noopener,noreferrer';
   /** @const **/
   ToolkitUtils.SVG_NS = 'http://www.w3.org/2000/svg';
   /** @const **/
@@ -980,14 +981,42 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
     if (protocol != null) {
       protocol = protocol.toLowerCase();
     }
-    // if it isn't on the allowed list and it isn't '', throw an error.
-    // IE11 returns '' for hrefs like 'abc', other browsers return 'https'
-    // and we want to allow hrefs like 'abc' since those are relative urls.
-    if (allowed.indexOf(protocol) < 0 && protocol !== '') {
+    // Security issues JET-79830, JET-79570, and JET-79644 flagged the legacy
+    // empty-protocol allowance. IE11 returned '' for some relative URLs, but IE11
+    // is no longer supported. Modern browsers resolve relative URLs against the
+    // document URL before exposing the protocol, so an empty protocol is not
+    // treated as valid.
+    if (allowed.indexOf(protocol) < 0) {
       throw new Error(protocol + ' is not a valid URL protocol');
     }
   };
 
+  /**
+   * Encodes an SVG definition ID for use as the fragment portion of a URL.
+   * @param {string} id The SVG definition ID.
+   * @return {string} The encoded fragment ID.
+   */
+  const _encodeSvgUrlFragmentId = function (id) {
+    return encodeURIComponent(id).replace(/[!'()*]/g, function (ch) {
+      return '%' + ch.charCodeAt(0).toString(16).toUpperCase();
+    });
+  };
+
+  /**
+   * Escapes a value for interpolation inside a quoted CSS string.
+   * @param {string} value The CSS string value.
+   * @return {string} The escaped CSS string value.
+   */
+  const _escapeCssString = function (value) {
+    return value.replace(/["\\\n\r\f]/g, function (ch) {
+      if (ch === '"') return '\\"';
+      if (ch === '\\') return '\\\\';
+      if (ch === '\n') return '\\A ';
+      if (ch === '\r') return '\\D ';
+      return '\\C ';
+    });
+  };
+
   /**
    * Creates and returns a new SVG document with the specified id.
    * @param {string} id The id for the new SVG document.
@@ -1241,7 +1270,7 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
         if (target == null) {
           self.location = dest;
         } else {
-          var newWindow = window.open(dest, target);
+          var newWindow = window.open(dest, target, _NOOPENER_WINDOW_FEATURES);
           if (newWindow) newWindow.focus();
         }
       };
@@ -1257,13 +1286,13 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
    */
   ToolkitUtils.getUrlPathById = function (id) {
     // If <base> is defined on the document, we have to use the full URL.
-    // document.baseURI is not supported in IE, so we have to check if the <base> tag exists in the document.
+    // document.baseURI is not supported in IE, so fall back to checking for the <base> tag.
     var hasBase =
-      Agent.browser === 'ie' || Agent.browser === 'edge'
+      document.baseURI == null
         ? document.querySelector('base') != null
         : document.URL != document.baseURI;
     var root = hasBase ? document.URL.split('#')[0] + '#' : '#';
-    return root + id;
+    return root + _encodeSvgUrlFragmentId(id);
   };
 
   /**
@@ -1272,7 +1301,7 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
    * @return {string} URL attribute value.
    */
   ToolkitUtils.getUrlById = function (id) {
-    return 'url(' + ToolkitUtils.getUrlPathById(id) + ')';
+    return 'url("' + _escapeCssString(ToolkitUtils.getUrlPathById(id)) + '")';
   };
 
   /**
@@ -10319,33 +10348,8 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
       while (outerElem.hasChildNodes()) outerElem.removeChild(outerElem.firstChild);
     }
 
-    // Make replacements on the text string as needed
     if (typeof text == 'string') {
-      // For security, turn HTML brackets into strings to disable tags.
-      text = text.replace(/(<|&#60;)/g, '&lt;');
-      text = text.replace(/(>|&#62;)/g, '&gt;');
-
-      // Support a subset of HTML tags, including bold, italic, and table tags.
-      text = HtmlTooltipManager._restoreTag(text, 'b');
-      text = HtmlTooltipManager._restoreTag(text, 'i');
-      text = HtmlTooltipManager._restoreTag(text, 'table');
-      text = HtmlTooltipManager._restoreTag(text, 'tr');
-      text = HtmlTooltipManager._restoreTag(text, 'td');
-
-      // Replace logical newlines sequences
-      text = text.replace(/\n/g, '<br>');
-      text = text.replace(/\\n/g, '<br>');
-      text = text.replace(/&#92;n/g, '<br>');
-      text = HtmlTooltipManager._restoreTag(text, 'br');
-
-      // Create the tooltip element
-      tooltipDOM = document.createElement('span');
-      tooltipDOM.style.visibility = 'inherit';
-      tooltipDOM.style.width = null;
-      tooltipDOM.style.height = null;
-
-      // Set the text
-      tooltipDOM.innerHTML = text; //@HTMLUpdateOK
+      tooltipDOM = HtmlTooltipManager._createTooltipTextElement(text);
     } else if (canModify) tooltipDOM = text; // the text is an element or array of elements to be appended directly
 
     // Apply default class and border color on the outer element only if the user hasn't specified them ( + 21150376)
@@ -10716,19 +10720,233 @@ define(['exports', 'ojs/ojthemeutils'], function (exports, ThemeUtils) { 'use st
     return tooltip;
   };
 
+  /** @private @const */
+  HtmlTooltipManager._SUPPORTED_TOOLTIP_TAGS = {
+    b: true,
+    i: true,
+    br: true,
+    table: true,
+    tr: true,
+    td: true
+  };
+
+  /** @private @const */
+  HtmlTooltipManager._TOOLTIP_ENTITY_MAP = {
+    amp: '&',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+    nbsp: String.fromCharCode(160)
+  };
+
   /**
-   * Restores a supported HTML tag.
-   * All HTML brackets are converted into &gt; and &lt; for security reasons, to prevent people from adding unsupported
-   * elements. JET-79039: This method restores the brackets for the supported element only, discarding all attributes.
-   * @param {string} text The HTML string.
-   * @param {string} tag The tag name to be restored.
-   * @return {string} The updated HTML string.
+   * Creates a tooltip span from a string without parsing the string as HTML.
+   * Supported tooltip tags are converted to DOM nodes and all other markup is rendered as text.
+   * @param {string} text The tooltip string.
+   * @return {HTMLSpanElement}
    * @private
    */
-  HtmlTooltipManager._restoreTag = function (text, tag) {
-    // Match the following: <tag...>, </tag...>, and <tag.../>
-    var regExp = new RegExp('&lt;(/?)(' + tag + ')(?=[\\s&/])([^&]*)(/?)&gt;', 'g');
-    return text.replace(regExp, '<$1' + tag + '>');
+  HtmlTooltipManager._createTooltipTextElement = function (text) {
+    var tooltipDOM = document.createElement('span');
+    tooltipDOM.style.visibility = 'inherit';
+    tooltipDOM.style.width = null;
+    tooltipDOM.style.height = null;
+
+    HtmlTooltipManager._appendTooltipTextContent(
+      tooltipDOM,
+      HtmlTooltipManager._decodeTooltipEntities(text)
+    );
+    return tooltipDOM;
+  };
+
+  /**
+   * Appends tooltip string content to an element using only DOM APIs.
+   * @param {Element} root The element receiving tooltip content.
+   * @param {string} text The tooltip string.
+   * @private
+   */
+  HtmlTooltipManager._appendTooltipTextContent = function (root, text) {
+    var stack = [root];
+    var index = 0;
+
+    while (index < text.length) {
+      if (text.charAt(index) === '\n') {
+        HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+        index += 1;
+        continue;
+      }
+
+      if (text.charAt(index) === '\\' && text.charAt(index + 1) === 'n') {
+        HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+        index += 2;
+        continue;
+      }
+
+      if (text.indexOf('&#92;n', index) === index) {
+        HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+        index += 6;
+        continue;
+      }
+
+      var tag = HtmlTooltipManager._parseTooltipTag(text, index);
+      if (tag) {
+        if (tag.name === 'br') {
+          HtmlTooltipManager._appendTooltipLineBreak(stack[stack.length - 1]);
+        } else if (tag.closing) {
+          HtmlTooltipManager._closeTooltipTag(stack, tag.name);
+        } else {
+          var element = document.createElement(tag.name); // @HTMLUpdateOK
+          stack[stack.length - 1].appendChild(element);
+          stack.push(element);
+        }
+        index = tag.end;
+        continue;
+      }
+
+      if (text.charAt(index) === '<') {
+        var tagEnd = text.indexOf('>', index + 1);
+        var literalEnd = tagEnd >= 0 ? tagEnd + 1 : index + 1;
+        HtmlTooltipManager._appendTooltipText(
+          stack[stack.length - 1],
+          text.substring(index, literalEnd)
+        );
+        index = literalEnd;
+      } else {
+        var textEnd = HtmlTooltipManager._getNextTooltipSpecialTokenIndex(text, index + 1);
+        HtmlTooltipManager._appendTooltipText(
+          stack[stack.length - 1],
+          text.substring(index, textEnd)
+        );
+        index = textEnd;
+      }
+    }
+  };
+
+  /**
+   * Parses a supported tooltip tag at the specified index.
+   * @param {string} text The tooltip string.
+   * @param {number} index The index to parse.
+   * @return {{name:string, closing:boolean, end:number}|null}
+   * @private
+   */
+  HtmlTooltipManager._parseTooltipTag = function (text, index) {
+    if (text.charAt(index) !== '<') return null;
+
+    var tagEnd = text.indexOf('>', index + 1);
+    if (tagEnd < 0) return null;
+
+    var position = index + 1;
+    var closing = text.charAt(position) === '/';
+    if (closing) position += 1;
+
+    var tagStart = position;
+    while (position < tagEnd && /[a-z]/.test(text.charAt(position))) {
+      position += 1;
+    }
+
+    var tagName = text.substring(tagStart, position);
+    if (!HtmlTooltipManager._SUPPORTED_TOOLTIP_TAGS[tagName]) return null;
+    if (!HtmlTooltipManager._isTooltipTagBoundary(text, position, tagEnd)) return null;
+
+    return {
+      name: tagName,
+      closing: closing,
+      end: tagEnd + 1
+    };
+  };
+
+  /**
+   * Returns the next index that needs token-level tooltip handling.
+   * @param {string} text The tooltip string.
+   * @param {number} index The index to start scanning from.
+   * @return {number}
+   * @private
+   */
+  HtmlTooltipManager._getNextTooltipSpecialTokenIndex = function (text, index) {
+    while (index < text.length) {
+      if (
+        text.charAt(index) === '<' ||
+        text.charAt(index) === '\n' ||
+        (text.charAt(index) === '\\' && text.charAt(index + 1) === 'n')
+      ) {
+        return index;
+      }
+      index += 1;
+    }
+    return index;
+  };
+
+  /**
+   * Returns whether a parsed tag name is followed by a valid tag boundary.
+   * @param {string} text The tooltip string.
+   * @param {number} index The index after the parsed tag name.
+   * @param {number} tagEnd The index of the closing angle bracket.
+   * @return {boolean}
+   * @private
+   */
+  HtmlTooltipManager._isTooltipTagBoundary = function (text, index, tagEnd) {
+    return index === tagEnd || /\s/.test(text.charAt(index)) || text.charAt(index) === '/';
+  };
+
+  /**
+   * Closes the most recent matching supported tooltip tag.
+   * @param {Array<Element>} stack The open tooltip element stack.
+   * @param {string} tagName The tag name to close.
+   * @private
+   */
+  HtmlTooltipManager._closeTooltipTag = function (stack, tagName) {
+    for (var i = stack.length - 1; i > 0; i--) {
+      if (stack[i].tagName.toLowerCase() === tagName) {
+        stack.length = i;
+        return;
+      }
+    }
+  };
+
+  /**
+   * Appends a line break to tooltip content.
+   * @param {Element} parent The parent element.
+   * @private
+   */
+  HtmlTooltipManager._appendTooltipLineBreak = function (parent) {
+    parent.appendChild(document.createElement('br')); // @HTMLUpdateOK
+  };
+
+  /**
+   * Appends decoded text to tooltip content.
+   * @param {Element} parent The parent element.
+   * @param {string} text The text to append.
+   * @private
+   */
+  HtmlTooltipManager._appendTooltipText = function (parent, text) {
+    if (text) {
+      parent.appendChild(document.createTextNode(text));
+    }
+  };
+
+  /**
+   * Decodes only the common entities supported in DVT tooltip string content.
+   * @param {string} text The text to decode.
+   * @return {string}
+   * @private
+   */
+  HtmlTooltipManager._decodeTooltipEntities = function (text) {
+    return text.replace(
+      /&(#x[0-9a-fA-F]+|#[0-9]+|amp|lt|gt|quot|apos|nbsp);/g,
+      function (match, entity) {
+        if (entity.charAt(0) === '#') {
+          var radix = entity.charAt(1).toLowerCase() === 'x' ? 16 : 10;
+          var value = parseInt(entity.substring(radix === 16 ? 2 : 1), radix);
+          if (!isNaN(value) && value >= 0 && value <= 0x10ffff) {
+            return String.fromCodePoint ? String.fromCodePoint(value) : String.fromCharCode(value);
+          }
+          return match;
+        }
+
+        return HtmlTooltipManager._TOOLTIP_ENTITY_MAP[entity];
+      }
+    );
   };
 
   /**

package/dist/js/libs/oj/debug/ojeditablevalue.js

@@ -2139,7 +2139,14 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
          * myInputComp.help.definition = "Enter your name";
          */
         /**
-         * <p>help source url.  See the top-level <code class="prettyprint">help</code> option for details.
+         * <p>help source url. See the top-level
+         * <code class="prettyprint">help</code> option for details.</p>
+         * <p><b>Note:</b> For security, JET validates the URL protocol before
+         * navigation and currently supports <code class="prettyprint">http:</code>
+         * and <code class="prettyprint">https:</code> protocols. JET does not
+         * validate whether the URL is trusted for the application. Applications
+         * are responsible for providing sanitized URLs and enforcing any required
+         * origin or host allowlist.</p>
          *
          * @expose
          * @name help.source
@@ -2243,9 +2250,13 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
            * it shows all the time.
            * </p>
            * <p>
-           * For security reasons we only support urls with protocol 'http:' or 'https:'.
-           * If the url doesn't comply we ignore it and throw an error.
-           * Pass in an encoded URL since we do not encode the URL.</p>
+           * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+           * currently supports <code class="prettyprint">http:</code> and
+           * <code class="prettyprint">https:</code> protocols. If the url doesn't
+           * comply we ignore it and throw an error. JET does not validate whether
+           * the URL is trusted for the application. Applications are responsible
+           * for providing sanitized URLs and enforcing any required origin or host
+           * allowlist. Pass in an encoded URL since we do not encode the URL.</p>
            *
            * <p>See the <a href="#helpHints">help-hints</a> attribute for usage examples.</p>
            *
@@ -2348,6 +2359,8 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
          * hints and message summary text cannot. If you use formatted text, it should be accessible
          * and make sense to the user if formatting wasn't there.
          * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+         * Inline style attributes are sanitized; the retained styling is limited to color, font
+         * style, font weight, and text decoration. Use CSS classes for other styling.
          * To format the message detail, you could do this:
          * <pre class="prettyprint"><code>&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html></code></pre>
          * </p>
@@ -2504,6 +2517,8 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
          * <p>
          * To include formatted text in the help.instruction, format the string using html tags.
          * The allowed html tags are: span, b, i, em, br, hr, li, ol, ul, p, small, pre.
+         * Inline style attributes are sanitized; the retained styling is limited to color, font
+         * style, font weight, and text decoration. Use CSS classes for other styling.
          * For example the
          * help.instruction might look like:
          * <pre class="prettyprint"><code>&lt;oj-some-element help.instruction="&lt;html>Enter &lt;b>at least&lt;/b> 6 characters&lt;/html>">&lt;/oj-some-element></code></pre>
@@ -9369,6 +9384,7 @@ define(['exports', 'ojs/ojcore-base', 'ojs/ojcomponentcore', 'ojs/ojpopup', 'ojs
 
     helpSourceAnchor.setAttribute('tabindex', '0');
     helpSourceAnchor.setAttribute('target', '_blank');
+    helpSourceAnchor.setAttribute('rel', 'noopener noreferrer');
     try {
       DomUtils.validateURL(source);
       helpSourceAnchor.setAttribute('href', source);