@oracle/oraclejet 20.1.2 → 20.1.4

package/dist/js/libs/oj/debug_esm/ojmodule.js

@@ -34,9 +34,11 @@ oj._registerLegacyNamespaceProp('ModuleBinding', ModuleBinding);
  * Note that the default names of the {@link ModuleBinding.ConventionMethods optional lifecycle methods}
  * on the ViewModel are different from their counterparts on the {@link ojModule.LifecycleListener LifecycleListener}
  * interface
- * @property {string} viewPath default View path. Defaults to 'text!views/'
+ * @property {string} viewPath default View path. Defaults to 'text!views/'. The final View
+ * module path must be a safe relative path using the <code>text!</code> plugin prefix.
  * @property {string} viewSuffix default View suffix. Defaults to '.html'
- * @property {string} modelPath default Model suffix. Defaults to 'viewModels/'
+ * @property {string} modelPath default Model suffix. Defaults to 'viewModels/'. The final
+ * ViewModel module path must be a safe relative path.
  * @property {string} initializeMethod name of the initialialization method
  * (see {@link ModuleBinding.ConventionMethods#initialize definition})
  * @property {string} disposeMethod name of the dispose method
@@ -75,6 +77,39 @@ ModuleBinding.defaults = {
  */
 ModuleBinding._EMPTY_MODULE = 'oj:blank';
 
+function isSafeSegment(segment) {
+  return segment !== '' && segment !== '.' && segment !== '..' && /^[A-Za-z0-9_.-]+$/.test(segment);
+}
+
+function isSafeResourcePath(path) {
+  if (
+    typeof path !== 'string' ||
+    path === '' ||
+    path.indexOf('\\') !== -1 ||
+    path.indexOf('!') !== -1 ||
+    path.indexOf(':') !== -1 ||
+    path.charAt(0) === '/'
+  ) {
+    return false;
+  }
+  var normalizedPath = path;
+  if (normalizedPath.indexOf('./') === 0) {
+    normalizedPath = normalizedPath.substring(2);
+  }
+  return normalizedPath.split('/').every(isSafeSegment);
+}
+
+function isSafeModuleId(type, module) {
+  var modulePath = module;
+  if (type === 'view') {
+    if (modulePath.indexOf('text!') !== 0) {
+      return false;
+    }
+    modulePath = modulePath.substring(5);
+  }
+  return isSafeResourcePath(modulePath);
+}
+
 (function () {
   bindingHandlers.ojModule = {
     init: function (element, valueAccessor, allBindingsAccessor, koViewModel, bindingContext) {
@@ -985,6 +1020,9 @@ ModuleBinding._EMPTY_MODULE = 'oj:blank';
   function _getOjModuleRequirePromise(_requireFunc, type, module) {
     // Note that the 'type' parameter is not used by the implementation below.
     // It is, however, used by the Webpack-specific implementation of this function.
+    if (!isSafeModuleId(type, module)) {
+      return Promise.reject(new Error('Invalid module path'));
+    }
     var requireFunc = _requireFunc || require;
     var p = new Promise(function (resolve, reject) {
       requireFunc([module], resolve, reject);

package/dist/js/libs/oj/debug_esm/ojmodulerouter-adapter.js

@@ -54,6 +54,15 @@ import { observable } from 'knockout';
  *      animationCallback: animationCallback
  *    }
  * );
+ *
+ * // For RegExp routes that should load a fixed module, use pathKey to load an
+ * // explicit module name from route detail.
+ * var regexRouter = new CoreRouter([
+ *   { path: /order-[0-9]+/, detail: { module: 'orders/detail' } }
+ * ]);
+ * var regexAdapter = new ModuleRouterAdapter(regexRouter, {
+ *   pathKey: 'module'
+ * });
  * </code>
  * </pre>
  * @param {CoreRouter} router The instance of the CoreRouter, that manages application navigation for a page or a section of the page.
@@ -63,10 +72,17 @@ import { observable } from 'knockout';
  *                  the default path will be used - 'views/'.
  * @param {string=} options.viewModelPath The path to the model, relative to the RequireJS baseURL.
  *                  If the option is not provided the default path wil be used - 'viewModels/'.
- * @param {string=} options.pathKey An optional key for retrieving module name from 'details' object on the router state.
+ * @param {string=} options.pathKey An optional key for retrieving module name from the 'detail' object on the router state.
  *                  By default the adapter will use the 'path' field of the router state as the name for the module.
- *                  However when 'path' does not represent the name of the module, the name can be retrieved from 'details' object
- *                  on the router state using specified pathKey.
+ *                  However when 'path' does not represent the name of the module, the name can be retrieved from the 'detail' object
+ *                  on the router state using specified pathKey. Blank module names produce an empty module configuration.
+ *                  Non-blank module names must be relative module identifiers made from nonempty slash-separated
+ *                  segments containing only ASCII letters, digits, <code>_</code>, <code>.</code>, and <code>-</code>,
+ *                  such as <code>dashboard</code> or <code>orders/detail</code>. A leading <code>./</code>,
+ *                  empty segments, <code>.</code> or <code>..</code> segments, backslashes, absolute paths, URL
+ *                  schemes, and traversal patterns are not supported. When a
+ *                  RegExp, catch-all, URL-derived, or user-controlled route path should not itself be the module
+ *                  name, use this option to map the matched route to an explicit allowed module name instead.
  * @param {Function=} options.require An optional instance of the require() function to be used
  *                  for loading the view and view model. By default the path is relative to the baseUrl
  *                  specified for the application require calls.
@@ -175,6 +191,17 @@ function ModuleRouterAdapter(router, options) {
     return _options.pathKey ? state.detail[_options.pathKey] : state.path;
   }
 
+  function isValidModulePath(modulePath) {
+    if (typeof modulePath !== 'string') {
+      return false;
+    }
+    return modulePath.split('/').every(function (segment) {
+      return (
+        segment !== '' && segment !== '.' && segment !== '..' && /^[A-Za-z0-9_.-]+$/.test(segment)
+      );
+    });
+  }
+
   // before state change handler
   function onBeforeStateChange(args) {
     // canExit must return a Promise resolution or rejection
@@ -188,32 +215,36 @@ function ModuleRouterAdapter(router, options) {
     var configPromise;
     var modulePath = getModulePathFromState(args ? args.state : null);
     if (modulePath) {
-      var currentModulePath = getModulePathFromState(_currentState);
-      // check if model path didn't change and we can just re-apply the parameters
-      // using parametersChanged() callback
-      if (
-        modulePath === currentModulePath &&
-        _moduleConfig().viewModel &&
-        _moduleConfig().viewModel.parametersChanged
-      ) {
-        _moduleConfig().viewModel.parametersChanged(args.state.params);
-        _currentState = args.state;
-        return;
-      }
-
-      var viewPath = _options.viewPath || 'views/';
-      var viewModelPath = _options.viewModelPath || 'viewModels/';
-      configPromise = createConfig({
-        require: _options.require,
-        viewPath: viewPath + modulePath + '.html',
-        viewModelPath: viewModelPath + modulePath,
-        params: {
-          parentRouter: _router,
-          params: args.state.params,
-          router: _router,
-          routerState: args.state
+      if (!isValidModulePath(modulePath)) {
+        configPromise = Promise.reject(new Error('Invalid module path'));
+      } else {
+        var currentModulePath = getModulePathFromState(_currentState);
+        // check if model path didn't change and we can just re-apply the parameters
+        // using parametersChanged() callback
+        if (
+          modulePath === currentModulePath &&
+          _moduleConfig().viewModel &&
+          _moduleConfig().viewModel.parametersChanged
+        ) {
+          _moduleConfig().viewModel.parametersChanged(args.state.params);
+          _currentState = args.state;
+          return;
         }
-      });
+
+        var viewPath = _options.viewPath || 'views/';
+        var viewModelPath = _options.viewModelPath || 'viewModels/';
+        configPromise = createConfig({
+          require: _options.require,
+          viewPath: viewPath + modulePath + '.html',
+          viewModelPath: viewModelPath + modulePath,
+          params: {
+            parentRouter: _router,
+            params: args.state.params,
+            router: _router,
+            routerState: args.state
+          }
+        });
+      }
     } else {
       configPromise = Promise.resolve({ view: [], viewModel: null });
     }

package/dist/js/libs/oj/debug_esm/ojnavigationlist.js

@@ -346,6 +346,7 @@ const _ARIA_HIDDEN = 'aria-hidden';
 const _ARIA_LABEL = 'aria-label';
 const _ARIA_DESCRBIEDBY = 'aria-describedby';
 const _ARIA_HASPOPUP = 'aria-haspopup';
+const _NOOPENER_WINDOW_FEATURES = 'noopener,noreferrer';
 const _OJ_DEFAULT = 'oj-default';
 const _OJ_DISABLED = 'oj-disabled';
 
@@ -2080,7 +2081,7 @@ const _ojNavigationListView = _NavigationListUtils.clazz(
         if (!target || target === '_self') {
           window.location.href = url;
         } else {
-          window.open(url, target);
+          window.open(url, target, _NOOPENER_WINDOW_FEATURES);
         }
 
         return true;
@@ -2946,6 +2947,18 @@ _ojNavigationListView._CSS_Vars = {
    *
    * <p>It is not recommended to use <code class="prettyprint">oj-navigation-list</code> only for the purpose of rendering links that navigate to a different page. Instead, each item that has a link should be interactive and activating it should display or switch a content panel within the same page or context.</p>
    *
+   * <h3 id="security-section">
+   *   Security
+   *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#security-section"></a>
+   * </h3>
+   *
+   * <p><b>Note:</b> When item content includes an <code class="prettyprint">&lt;a></code> element with an
+   * <code class="prettyprint">href</code> attribute, JET validates the URL protocol before
+   * automatic navigation and currently supports <code class="prettyprint">http:</code> and
+   * <code class="prettyprint">https:</code> protocols. JET does not validate whether the URL
+   * is trusted for the application. Applications are responsible for providing sanitized URLs
+   * and enforcing any required origin or host allowlist.</p>
+   *
    * <h3 id="rtl-section">
    *   Reading direction
    *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#rtl-section"></a>
@@ -4728,6 +4741,17 @@ _ojNavigationListView._CSS_Vars = {
  * </h3>
  * <p>It is not recommended to use <code class="prettyprint">oj-tab-bar</code> only for the purpose of rendering links that navigate to a different page. Instead, each item that has a link should be interactive and activating it should display or switch a content panel within the same page or context.</p>
  *
+ * <h3 id="security-section">
+ * Security
+ * <a class="bookmarkable-link" title="Bookmarkable Link" href="#security-section"></a>
+ * </h3>
+ * <p><b>Note:</b> When item content includes an <code class="prettyprint">&lt;a></code> element with an
+ * <code class="prettyprint">href</code> attribute, JET validates the URL protocol before
+ * automatic navigation and currently supports <code class="prettyprint">http:</code> and
+ * <code class="prettyprint">https:</code> protocols. JET does not validate whether the URL
+ * is trusted for the application. Applications are responsible for providing sanitized URLs
+ * and enforcing any required origin or host allowlist.</p>
+ *
  * <h3 id="migration-section">
  *   Migration
  *   <a class="bookmarkable-link" title="Bookmarkable Link" href="#migration-section"></a>

package/dist/js/libs/oj/debug_esm/ojselectbase.js

@@ -1251,7 +1251,11 @@ LovDropdown.prototype._templateItemRenderer = function (templateEngine, listView
     var nodes = templateEngine.execute(
       renderContext.componentElement,
       this._itemTemplate,
-      renderContext
+      renderContext,
+      undefined,
+      undefined,
+      undefined,
+      { processTemplate: true }
     );
     for (var i = 0; i < nodes.length; i++) {
       // label.appendChild(nodes[i]);

package/dist/js/libs/oj/debug_esm/ojsoundutils.js

@@ -5,6 +5,9 @@
  * as shown at https://oss.oracle.com/licenses/upl/
  * @ignore
  */
+import { validateURL } from 'ojs/ojdomutils';
+
+const ALLOWED_AUDIO_URL_PROTOCOLS = ['http:', 'https:', 'data:', 'blob:'];
 /**
  * @classdesc
  * A utility class with helpers to play audio
@@ -37,12 +40,20 @@ class SoundUtils {
      * @returns {Promise<void, Error>} A promise that resolves when the audio is play or rejects if there are any issues
      */
     static playAudioFromURL(url) {
-        let resolve;
-        let reject;
+        let resolve = () => { };
+        let reject = () => { };
         const returnPromise = new Promise((_resolve, _reject) => {
             resolve = _resolve;
             reject = _reject;
         });
+        try {
+            validateURL(url, ALLOWED_AUDIO_URL_PROTOCOLS);
+        }
+        catch (error) {
+            // Defer so callers can attach a rejection handler to the returned promise first.
+            void Promise.resolve().then(() => reject(error));
+            return returnPromise;
+        }
         // Using an <audio> element is simple for our use case.
         const audioElement = document.createElement('audio');
         audioElement.src = url;

package/dist/js/libs/oj/debug_esm/ojtable.js

@@ -26,7 +26,7 @@ import { __getTemplateEngine, getDeviceRenderMode } from 'ojs/ojconfig';
 import { applyParameters } from 'ojs/ojtranslation';
 import { _OJ_CONTAINER_ATTR, subtreeDetached, subtreeHidden, subtreeAttached, __GetWidgetConstructor, setDefaultOptions, createDynamicPropertyGetter } from 'ojs/ojcomponentcore';
 import { getCachedCSSVarValues, parseJSONFromFontFamily } from 'ojs/ojthemeutils';
-import { applyRendererContent, disableAllFocusableElements, isMobileTouchDevice, isIos, isFetchAborted, WARN_DUPLICATE_KEYS_DETAIL, isRequestIdleCallbackSupported, isBlink, isFirefox, getScrollEventElement, getDefaultScrollBarWidth, isSafari, getActionableElementsInNode, containsKey, isIterateAfterDoneNotAllowed, getAddEventKeysResult, applyMergedInlineStyles, isChrome, isEdgeChromium, isEscapeKeyEvent, isEnterKeyEvent, isF2KeyEvent, isTabKeyEvent, isArrowUpKeyEvent, isArrowDownKeyEvent, isArrowLeftKeyEvent, isArrowRightKeyEvent, isHomeKeyEvent, isEndKeyEvent, isSpaceBarKeyEvent, isMac, isMetaKeyEvent, isEventClickthroughDisabled, isFromDefaultSelector, isEdge, getFocusableElementsInNode, enableAllFocusableElements, KEYBOARD_KEYS, areKeySetsEqual, disableDefaultBrowserStyling } from 'ojs/ojdatacollection-common';
+import { applyRendererContent, disableAllFocusableElements, isMobileTouchDevice, isIos, isFetchAborted, WARN_DUPLICATE_KEYS_DETAIL, isRequestIdleCallbackSupported, isFirefox, getScrollEventElement, getDefaultScrollBarWidth, isSafari, getActionableElementsInNode, containsKey, isIterateAfterDoneNotAllowed, getAddEventKeysResult, applyMergedInlineStyles, isChrome, isEdgeChromium, isEscapeKeyEvent, isEnterKeyEvent, isF2KeyEvent, isTabKeyEvent, isArrowUpKeyEvent, isArrowDownKeyEvent, isArrowLeftKeyEvent, isArrowRightKeyEvent, isHomeKeyEvent, isEndKeyEvent, isSpaceBarKeyEvent, isMac, isMetaKeyEvent, isEventClickthroughDisabled, isFromDefaultSelector, isEdge, getFocusableElementsInNode, enableAllFocusableElements, KEYBOARD_KEYS, areKeySetsEqual, disableDefaultBrowserStyling } from 'ojs/ojdatacollection-common';
 import { startAnimation } from 'ojs/ojanimation';
 import DomScroller from 'ojs/ojdomscroller';
 import { CustomElementUtils, ElementUtils } from 'ojs/ojcustomelement-utils';
@@ -3251,7 +3251,8 @@ Table.prototype._refreshTableBodyRow = function (
             slotContext,
             this.options.as,
             tableBody,
-            new Map([[FormVariantContext, 'legacyEmbedded']])
+            new Map([[FormVariantContext, 'legacyEmbedded']]),
+            { processTemplate: true }
           );
           for (let i = 0; i < nodes.length; i++) {
             var node = nodes[i];
@@ -5337,12 +5338,9 @@ Table.prototype._requestIdleCallback = function (isMouseWheel, callback) {
     idleTimeout = null;
   }, 250);
 
-  // Chromium has an issue with requestIdleCallback when mouse wheel is used, see Chrome :
-  // https://bugs.chromium.org/p/chromium/issues/detail?id=822269
-  var options;
-  if (isMouseWheel && isBlink()) {
-    options = { timeout: 100 };
-  }
+  // Use a timeout so fetch rendering is not blocked indefinitely when the browser
+  // does not get an idle period, including scrollbar and mouse wheel scrolling.
+  var options = { timeout: 100 };
   this._idleCallback = window.requestIdleCallback(function (idleDeadline) {
     if (idleTimeout == null) {
       return;
@@ -23642,7 +23640,8 @@ Table.prototype._tableBodyCellDefaultRenderer = function (
           slotContext,
           this.options.as,
           tableBody,
-          new Map([[FormVariantContext, 'legacyEmbedded']])
+          new Map([[FormVariantContext, 'legacyEmbedded']]),
+          { processTemplate: true }
         );
         if (!(cellContent instanceof Array)) {
           cellContent = [cellContent];

package/dist/js/libs/oj/debug_esm/ojtagcloud.js

@@ -176,6 +176,11 @@ import { TagCloud } from 'ojs/ojtagcloud-toolkit';
  * @property {Object=} svgStyle The CSS style object defining the style of the item text. Only SVG CSS style properties are supported. The default value comes from the CSS and varies based on theme.
  * @property {string=} svgClassName The CSS style class defining the style of the item text.
  * @property {string=} url The url this item references.
+ * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+ * currently supports <code class="prettyprint">http:</code>
+ * and <code class="prettyprint">https:</code> protocols. JET does not validate whether the
+ * URL is trusted for the application. Applications are responsible for providing sanitized
+ * URLs and enforcing any required origin or host allowlist.</p>
  * @property {number} value The value of this item which will be used to scale its font-size within the tag cloud.
  * @ojdeprecated {since: '15.0.0', description: 'This is not recommended in the Redwood design system.', target: 'property', for: 'svgStyle'}
  *
@@ -518,6 +523,11 @@ import { TagCloud } from 'ojs/ojtagcloud-toolkit';
  */
 /**
  * The url this item references.
+ * <p><b>Note:</b> For security, JET validates the URL protocol before navigation and
+ * currently supports <code class="prettyprint">http:</code> and
+ * <code class="prettyprint">https:</code> protocols. JET does not validate whether the
+ * URL is trusted for the application. Applications are responsible for providing
+ * sanitized URLs and enforcing any required origin or host allowlist.</p>
  * @expose
  * @name url
  * @memberof! oj.ojTagCloudItem

package/dist/js/libs/oj/debug_esm/ojtemplateengine-ko.js

@@ -11,10 +11,13 @@ import { TemplateEngineUtils, PreactTemplate } from 'ojs/ojtemplateengine-utils'
 import oj from 'ojs/ojcore';
 import { getTemplateContent } from 'ojs/ojhtmlutils';
 import { CACHED_BINDING_PROVIDER, AttributeUtils } from 'ojs/ojcustomelement-utils';
-import Context from 'ojs/ojcontext';
 import { warn } from 'ojs/ojlogger';
+import Context from 'ojs/ojcontext';
 
 const _propertyContribsCache = new WeakMap();
+function _getBlockedPropertyToken(tokens) {
+    return tokens.find((token) => oj.CollectionUtils._isBlockedKey(token));
+}
 class TemplateEngineKoInternal {
     constructor() {
         this._bindingProvider = {
@@ -35,8 +38,7 @@ class TemplateEngineKoInternal {
      * @ignore
      */
     executeTemplate(componentElement, templateElement, reportBusy, context, provided) {
-        const processedTemplate = templateElement._replacedNodes.templateCopy;
-        const tmpContainer = this._createAndPopulateContainer(processedTemplate, reportBusy);
+        const tmpContainer = this._createAndPopulateContainer(templateElement, reportBusy);
         let stampedNodes = tmpContainer.childNodes;
         for (let i = 0; i < stampedNodes.length; i++) {
             const stampedNode = stampedNodes[i];
@@ -88,6 +90,9 @@ class TemplateEngineKoInternal {
             // Handle the 'dot' notation for bound subprops
             var propTokens = prop.split('.');
             if (propertySet.has(propTokens[0])) {
+                if (this._shouldSkipPropertyPath(propTokens)) {
+                    continue;
+                }
                 var info = AttributeUtils.getExpressionInfo(attr.value);
                 var expr = info.expr;
                 if (expr) {
@@ -124,6 +129,9 @@ class TemplateEngineKoInternal {
         const computed = pureComputed(() => {
             const boundValues = {};
             contribs.evalMap.forEach((evaluator, tokens) => {
+                if (this._shouldSkipPropertyPath(tokens)) {
+                    return;
+                }
                 var leafValue = utils.unwrapObservable(evaluator(context));
                 if (propertyValidator) {
                     propertyValidator(tokens, leafValue);
@@ -153,6 +161,14 @@ class TemplateEngineKoInternal {
         current[tokens[lastIndex]] = value;
         return complexVal;
     }
+    _shouldSkipPropertyPath(tokens) {
+        const blockedToken = _getBlockedPropertyToken(tokens);
+        if (blockedToken) {
+            warn(`Skipping template property path "${tokens.join('.')}" because it contains unsupported key "${blockedToken}".`);
+            return true;
+        }
+        return false;
+    }
     /**
      *
      * @param delegate
@@ -294,6 +310,7 @@ class TemplateEnginePreactInternal {
     }
 }
 
+const _ORIGINAL_PROPERTIES = Symbol.for('_ojOriginalProps');
 /**
  * JET Template Engine implementation used by legacy components
  * with 'knockout' or 'none' binding providers.
@@ -320,14 +337,20 @@ class JetTemplateEngine {
      * @param {string} alias an alias for referencing the data within a template
      * @param {Element} reportBusy - optional element for bubblng busy states outside of the template
      * @param {Map} provided - optional provided context to be applied to template
+     * @param {TemplateExecutionOptions=} options - optional template execution options
      * @return {Array.<Node>} HTML nodes representing the result of the execution
      * @ignore
      */
-    execute(componentElement, templateElement, properties, alias, reportBusy, provided) {
+    execute(componentElement, templateElement, properties, alias, reportBusy, provided, options) {
         // Check to see if data-oj-as was defined on the template element as an additional
         // alias to provide to the template children
         const templateAlias = templateElement.getAttribute('data-oj-as');
-        const processedNodes = TemplateEngineUtils.processTemplate(templateElement);
+        // Preprocessing avoids repeated work only for templates that are stamped repeatedly. The
+        // default path intentionally retains original behavior, where KO preprocesses the
+        // cloned template at execution time.
+        const processedNodes = options?.processTemplate
+            ? TemplateEngineUtils.processTemplate(templateElement)
+            : undefined;
         let contextProperties = properties;
         if (processedNodes && processedNodes.replacementMap?.size > 0) {
             // proxy to support multiple templates being executed with the same properties instance
@@ -337,10 +360,15 @@ class JetTemplateEngine {
                     if (p === '_ojNodesMap') {
                         return nodesMap;
                     }
-                    if (p === Symbol.for('_ojOriginalProps')) {
+                    if (p === _ORIGINAL_PROPERTIES) {
                         return properties;
                     }
                     return Reflect.get(target, p, receiver);
+                },
+                has(target, p) {
+                    // Allow consumers to identify this internal proxy without treating a user-supplied
+                    // _ojNodesMap property as a processed-template marker.
+                    return p === _ORIGINAL_PROPERTIES || Reflect.has(target, p);
                 }
             });
         }
@@ -348,7 +376,7 @@ class JetTemplateEngine {
         if (templateElement.render) {
             return this._templateEngineVDOM.executeTemplate(componentElement, templateElement, reportBusy, context, provided);
         }
-        return this._templateEngineKO.executeTemplate(componentElement, templateElement, reportBusy, context, provided);
+        return this._templateEngineKO.executeTemplate(componentElement, processedNodes?.templateCopy ?? templateElement, reportBusy, context, provided);
     }
     /**
      * Cleans specified node

package/dist/js/libs/oj/debug_esm/ojthematicmap.js

@@ -2333,10 +2333,10 @@ oj.__registerWidget('oj.ojThematicMap', $.oj.dvtBaseComponent, {
     return [
       { path: 'tooltip/renderer', slot: 'tooltipTemplate' },
       { path: '_tooltip/renderer' },
-      { path: 'renderer', slot: 'markerContentTemplate' },
-      { path: 'focusRenderer', slot: 'markerContentTemplate' },
-      { path: 'hoverRenderer', slot: 'markerContentTemplate' },
-      { path: 'selectionRenderer', slot: 'markerContentTemplate' }
+      { path: 'renderer', slot: 'markerContentTemplate', processTemplate: true },
+      { path: 'focusRenderer', slot: 'markerContentTemplate', processTemplate: true },
+      { path: 'hoverRenderer', slot: 'markerContentTemplate', processTemplate: true },
+      { path: 'selectionRenderer', slot: 'markerContentTemplate', processTemplate: true }
     ];
   },
 

package/dist/js/libs/oj/debug_esm/ojtimeline.js

@@ -3690,7 +3690,11 @@ oj.__registerWidget('oj.ojTimeline', $.oj.dvtTimeComponent, {
 
   _GetComponentRendererOptions: function () {
     return [
-      { path: 'itemBubbleContentRenderer', slot: 'itemBubbleContentTemplate' },
+      {
+        path: 'itemBubbleContentRenderer',
+        slot: 'itemBubbleContentTemplate',
+        processTemplate: true
+      },
       { path: 'tooltip/renderer', slot: 'tooltipTemplate' }
     ];
   },

package/dist/js/libs/oj/debug_esm/ojtreemap.js

@@ -1619,7 +1619,7 @@ oj.__registerWidget('oj.ojTreemap', $.oj.dvtBaseComponent, {
   _GetComponentRendererOptions: function () {
     return [
       { path: 'tooltip/renderer', slot: 'tooltipTemplate' },
-      { path: 'nodeContent/renderer', slot: 'nodeContentTemplate' }
+      { path: 'nodeContent/renderer', slot: 'nodeContentTemplate', processTemplate: true }
     ];
   },
 

package/dist/js/libs/oj/debug_esm/ojtreeview.js

@@ -2078,7 +2078,15 @@ class TreeviewSelectionManager {
         applyRendererContent(liElem, renderer.call(self, context), true);
       } else if (templateElement != null && templateEngine != null) {
         var componentElement = self.element[0];
-        var nodes = templateEngine.execute(componentElement, templateElement, context, null);
+        var nodes = templateEngine.execute(
+          componentElement,
+          templateElement,
+          context,
+          null,
+          undefined,
+          undefined,
+          { processTemplate: true }
+        );
         for (i = 0; i < nodes.length; i++) {
           if (nodes[i].tagName === 'LI') {
             liElem.parentNode.replaceChild(nodes[i], liElem);

package/dist/js/libs/oj/debug_esm/ojurlpathadapter.js

@@ -31,7 +31,7 @@ function buildParamsString(params) {
     .forEach(function (key) {
       var value = params[key];
       if (value !== undefined && value !== null) {
-        paramArray.push(';' + key + '=' + encode(value));
+        paramArray.push(';' + encode(key) + '=' + encode(value));
       }
     });
   return paramArray.join('');
@@ -54,7 +54,7 @@ function parseUrlSegment(segment) {
   parts.forEach(function (part) {
     if (part) {
       var pair = part.split('=');
-      parsed.params[pair[0]] = decode(pair[1]);
+      parsed.params[decode(pair[0])] = decode(pair[1]);
     }
   });
   return parsed;

package/dist/js/libs/oj/main-template.js

@@ -15,9 +15,9 @@
   requirejs.config({
     // Path mappings for the logical module names
     paths: {
-      'ojs': 'libs/oj/20.1.2/min@insertESLevelPath@',
-      'ojL10n': 'libs/oj/20.1.2/ojL10n',
-      'ojtranslations': 'libs/oj/20.1.2/resources',
+      'ojs': 'libs/oj/20.1.4/min@insertESLevelPath@',
+      'ojL10n': 'libs/oj/20.1.4/ojL10n',
+      'ojtranslations': 'libs/oj/20.1.4/resources',
       
   'knockout': 'libs/knockout/knockout-3.5.1',
   'jquery': 'libs/jquery/jquery-3.7.1.min',

package/dist/js/libs/oj/min/ojavatar.js

@@ -5,5 +5,5 @@
  * as shown at https://oss.oracle.com/licenses/upl/
  * @ignore
  */
-define(["exports","preact/jsx-runtime","ojs/ojvcomponent","ojs/ojthemeutils","preact"],function(a,e,t,r,s){"use strict";var n=function(a,e,t,r){var s,n=arguments.length,i=n<3?e:null===r?r=Object.getOwnPropertyDescriptor(e,t):r;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)i=Reflect.decorate(a,e,t,r);else for(var o=a.length-1;o>=0;o--)(s=a[o])&&(i=(n<3?s(i):n>3?s(e,t,i):s(e,t))||i);return n>3&&i&&Object.defineProperty(e,t,i),i};a.Avatar=class extends s.Component{render(a){return e.jsxs("div",{class:this._getClasses(a),"aria-hidden":"true",children:[this._getInnerContent(a),this._getSecondaryInnerContent(a)]})}_getClasses(a){const e=a.shape??r.getCachedCSSVarValues(["--oj-private-avatar-global-shape-default"])[0];let t=`oj-avatar oj-avatar-bg-${a.background} oj-avatar-${a.size} ${"circle"===e?"oj-avatar-circle":"oj-avatar-square"}`;return a.iconClass||!a.src?(t+=" oj-avatar-no-image",a.initials&&(t+=" oj-avatar-has-initials")):t+=" oj-avatar-image",t}_getInnerContent(a){return a.src&&!a.iconClass?e.jsx("div",{class:"oj-avatar-background-image",style:{backgroundImage:`url("${a.src}")`}}):e.jsx("div",{class:"oj-avatar-background oj-avatar-background-image"})}_getSecondaryInnerContent(a){return a.iconClass?e.jsx("div",{class:`oj-avatar-icon ${a.iconClass}`}):a.src?void 0:a.initials?e.jsx("div",{class:"oj-avatar-initials oj-avatar-background-image",children:a.initials}):e.jsx("div",{class:"oj-avatar-background-image oj-avatar-placeholder-icon"})}},a.Avatar.defaultProps={background:"neutral",initials:null,size:"md",src:null,iconClass:""},a.Avatar._metadata={properties:{background:{type:"string",enumValues:["blue","gray","green","orange","pink","purple","red","teal","neutral","slate","mauve","lilac","forest"]},initials:{type:"string"},size:{type:"string",enumValues:["sm","md","lg","2xs","xxs","xs","xl","2xl","xxl"]},src:{type:"string"},iconClass:{type:"string"},shape:{type:"string",enumValues:["square","circle"]}}},a.Avatar=n([t.customElement("oj-avatar")],a.Avatar),Object.defineProperty(a,"__esModule",{value:!0})});
+define(["exports","preact/jsx-runtime","ojs/ojvcomponent","ojs/ojthemeutils","preact"],function(a,e,t,r,s){"use strict";var n=function(a,e,t,r){var s,n=arguments.length,o=n<3?e:null===r?r=Object.getOwnPropertyDescriptor(e,t):r;if("object"==typeof Reflect&&"function"==typeof Reflect.decorate)o=Reflect.decorate(a,e,t,r);else for(var i=a.length-1;i>=0;i--)(s=a[i])&&(o=(n<3?s(o):n>3?s(e,t,o):s(e,t))||o);return n>3&&o&&Object.defineProperty(e,t,o),o};const o=a=>{const e=a.charCodeAt(0).toString(16).toUpperCase();return`%${e.length<2?"0"+e:e}`},i=a=>`url("${(a=>{let e="";for(let t=0;t<a.length;t++){const r=a.charAt(t),s=r.charCodeAt(0);e+='"'===r||"\\"===r?`\\${r}`:s<=31||127===s?o(r):r}return e})(a)}")`;a.Avatar=class extends s.Component{render(a){return e.jsxs("div",{class:this._getClasses(a),"aria-hidden":"true",children:[this._getInnerContent(a),this._getSecondaryInnerContent(a)]})}_getClasses(a){const e=a.shape??r.getCachedCSSVarValues(["--oj-private-avatar-global-shape-default"])[0];let t=`oj-avatar oj-avatar-bg-${a.background} oj-avatar-${a.size} ${"circle"===e?"oj-avatar-circle":"oj-avatar-square"}`;return a.iconClass||!a.src?(t+=" oj-avatar-no-image",a.initials&&(t+=" oj-avatar-has-initials")):t+=" oj-avatar-image",t}_getInnerContent(a){return a.src&&!a.iconClass?e.jsx("div",{class:"oj-avatar-background-image",style:{backgroundImage:i(a.src)}}):e.jsx("div",{class:"oj-avatar-background oj-avatar-background-image"})}_getSecondaryInnerContent(a){return a.iconClass?e.jsx("div",{class:`oj-avatar-icon ${a.iconClass}`}):a.src?void 0:a.initials?e.jsx("div",{class:"oj-avatar-initials oj-avatar-background-image",children:a.initials}):e.jsx("div",{class:"oj-avatar-background-image oj-avatar-placeholder-icon"})}},a.Avatar.defaultProps={background:"neutral",initials:null,size:"md",src:null,iconClass:""},a.Avatar._metadata={properties:{background:{type:"string",enumValues:["blue","gray","green","orange","pink","purple","red","teal","neutral","slate","mauve","lilac","forest"]},initials:{type:"string"},size:{type:"string",enumValues:["sm","md","lg","2xs","xxs","xs","xl","2xl","xxl"]},src:{type:"string"},iconClass:{type:"string"},shape:{type:"string",enumValues:["square","circle"]}}},a.Avatar=n([t.customElement("oj-avatar")],a.Avatar),Object.defineProperty(a,"__esModule",{value:!0})});
 //# sourceMappingURL=ojavatar.js.map

package/dist/js/libs/oj/min/ojavatar.js.map

@@ -1 +1 @@
-{"version":3,"names":["define","exports","jsxRuntime","ojvcomponent","ThemeUtils","preact","__decorate","decorators","target","key","desc","d","c","arguments","length","r","Object","getOwnPropertyDescriptor","Reflect","decorate","i","defineProperty","Avatar","Component","render","props","jsxs","class","this","_getClasses","children","_getInnerContent","_getSecondaryInnerContent","shape","getCachedCSSVarValues","classes","background","size","iconClass","src","initials","jsx","style","backgroundImage","defaultProps","_metadata","properties","type","enumValues","customElement","value"],"sources":["../debug/ojavatar.js"],"mappings":";;;;;;;AAOAA,OAAO,CAAC,UAAW,qBAAsB,mBAAoB,mBAAoB,UAAW,SAAUC,EAASC,EAAYC,EAAcC,EAAYC,GAAU,aAE3J,IAAIC,EAA0C,SAAUC,EAAYC,EAAQC,EAAKC,GAC7E,IAA2HC,EAAvHC,EAAIC,UAAUC,OAAQC,EAAIH,EAAI,EAAIJ,EAAkB,OAATE,EAAgBA,EAAOM,OAAOC,yBAAyBT,EAAQC,GAAOC,EACrH,GAAuB,iBAAZQ,SAAoD,mBAArBA,QAAQC,SAAyBJ,EAAIG,QAAQC,SAASZ,EAAYC,EAAQC,EAAKC,QACpH,IAAK,IAAIU,EAAIb,EAAWO,OAAS,EAAGM,GAAK,EAAGA,KAAST,EAAIJ,EAAWa,MAAIL,GAAKH,EAAI,EAAID,EAAEI,GAAKH,EAAI,EAAID,EAAEH,EAAQC,EAAKM,GAAKJ,EAAEH,EAAQC,KAASM,GAChJ,OAAOH,EAAI,GAAKG,GAAKC,OAAOK,eAAeb,EAAQC,EAAKM,GAAIA,CAChE,EAyQAd,EAAQqB,OAAS,cAAqBjB,EAAOkB,UACzCC,OAAOC,GACH,OAAQvB,EAAWwB,KAAK,MAAO,CAAEC,MAAOC,KAAKC,YAAYJ,GAAQ,cAAe,OAAQK,SAAU,CAACF,KAAKG,iBAAiBN,GAAQG,KAAKI,0BAA0BP,KACpK,CACAI,YAAYJ,GACR,MAAMQ,EAAQR,EAAMQ,OAChB7B,EAAW8B,sBAAsB,CAAC,6CAA6C,GACnF,IAAIC,EAAU,0BAA0BV,EAAMW,wBAAwBX,EAAMY,QAAkB,WAAVJ,EAAqB,mBAAqB,qBAU9H,OATIR,EAAMa,YAAcb,EAAMc,KAC1BJ,GAAW,sBACPV,EAAMe,WACNL,GAAW,4BAIfA,GAAW,mBAERA,CACX,CACAJ,iBAAiBN,GACb,OAAIA,EAAMc,MAAQd,EAAMa,UACZpC,EAAWuC,IAAI,MAAO,CAAEd,MAAO,6BAA8Be,MAAO,CAAEC,gBAAiB,QAAQlB,EAAMc,WAGtGrC,EAAWuC,IAAI,MAAO,CAAEd,MAAO,mDAE9C,CACAK,0BAA0BP,GACtB,OAAIA,EAAMa,UACCpC,EAAWuC,IAAI,MAAO,CAAEd,MAAO,kBAAkBF,EAAMa,cAEzDb,EAAMc,SACX,EAEKd,EAAMe,SACJtC,EAAWuC,IAAI,MAAO,CAAEd,MAAO,gDAAiDG,SAAUL,EAAMe,WAGhGtC,EAAWuC,IAAI,MAAO,CAAEd,MAAO,yDAE9C,GAEJ1B,EAAQqB,OAAOsB,aAAe,CAC1BR,WAAY,UACZI,SAAU,KACVH,KAAM,KACNE,IAAK,KACLD,UAAW,IAEfrC,EAAQqB,OAAOuB,UAAY,CAAEC,WAAc,CAAEV,WAAc,CAAEW,KAAQ,SAAUC,WAAc,CAAC,OAAQ,OAAQ,QAAS,SAAU,OAAQ,SAAU,MAAO,OAAQ,UAAW,QAAS,QAAS,QAAS,WAAaR,SAAY,CAAEO,KAAQ,UAAYV,KAAQ,CAAEU,KAAQ,SAAUC,WAAc,CAAC,KAAM,KAAM,KAAM,MAAO,MAAO,KAAM,KAAM,MAAO,QAAUT,IAAO,CAAEQ,KAAQ,UAAYT,UAAa,CAAES,KAAQ,UAAYd,MAAS,CAAEc,KAAQ,SAAUC,WAAc,CAAC,SAAU,aACrd/C,EAAQqB,OAAShB,EAAW,CACxBH,EAAa8C,cAAc,cAC5BhD,EAAQqB,QAEXN,OAAOK,eAAepB,EAAS,aAAc,CAAEiD,OAAO,GAE1D"}
+{"version":3,"names":["define","exports","jsxRuntime","ojvcomponent","ThemeUtils","preact","__decorate","decorators","target","key","desc","d","c","arguments","length","r","Object","getOwnPropertyDescriptor","Reflect","decorate","i","defineProperty","encodeCssUrlControlCharacter","char","hex","charCodeAt","toString","toUpperCase","getCssUrl","url","escapedUrl","charAt","charCode","escapeCssUrlString","Avatar","Component","render","props","jsxs","class","this","_getClasses","children","_getInnerContent","_getSecondaryInnerContent","shape","getCachedCSSVarValues","classes","background","size","iconClass","src","initials","jsx","style","backgroundImage","defaultProps","_metadata","properties","type","enumValues","customElement","value"],"sources":["../debug/ojavatar.js"],"mappings":";;;;;;;AAOAA,OAAO,CAAC,UAAW,qBAAsB,mBAAoB,mBAAoB,UAAW,SAAUC,EAASC,EAAYC,EAAcC,EAAYC,GAAU,aAE3J,IAAIC,EAA0C,SAAUC,EAAYC,EAAQC,EAAKC,GAC7E,IAA2HC,EAAvHC,EAAIC,UAAUC,OAAQC,EAAIH,EAAI,EAAIJ,EAAkB,OAATE,EAAgBA,EAAOM,OAAOC,yBAAyBT,EAAQC,GAAOC,EACrH,GAAuB,iBAAZQ,SAAoD,mBAArBA,QAAQC,SAAyBJ,EAAIG,QAAQC,SAASZ,EAAYC,EAAQC,EAAKC,QACpH,IAAK,IAAIU,EAAIb,EAAWO,OAAS,EAAGM,GAAK,EAAGA,KAAST,EAAIJ,EAAWa,MAAIL,GAAKH,EAAI,EAAID,EAAEI,GAAKH,EAAI,EAAID,EAAEH,EAAQC,EAAKM,GAAKJ,EAAEH,EAAQC,KAASM,GAChJ,OAAOH,EAAI,GAAKG,GAAKC,OAAOK,eAAeb,EAAQC,EAAKM,GAAIA,CAChE,EACA,MAAMO,EAAgCC,IAClC,MAAMC,EAAMD,EAAKE,WAAW,GAAGC,SAAS,IAAIC,cAC5C,MAAO,IAAIH,EAAIV,OAAS,EAAI,IAAMU,EAAMA,GAAK,EAmB3CI,EAAaC,GAAQ,QAjBA,CAACA,IACxB,IAAIC,EAAa,GACjB,IAAK,IAAIV,EAAI,EAAGA,EAAIS,EAAIf,OAAQM,IAAK,CACjC,MAAMG,EAAOM,EAAIE,OAAOX,GAClBY,EAAWT,EAAKE,WAAW,GAE7BK,GADS,MAATP,GAAyB,OAATA,EACF,KAAKA,IAEdS,GAAY,IAAqB,MAAbA,EACXV,EAA6BC,GAG7BA,CAEtB,CACA,OAAOO,CAAU,EAEcG,CAAmBJ,OAyQtD5B,EAAQiC,OAAS,cAAqB7B,EAAO8B,UACzCC,OAAOC,GACH,OAAQnC,EAAWoC,KAAK,MAAO,CAAEC,MAAOC,KAAKC,YAAYJ,GAAQ,cAAe,OAAQK,SAAU,CAACF,KAAKG,iBAAiBN,GAAQG,KAAKI,0BAA0BP,KACpK,CACAI,YAAYJ,GACR,MAAMQ,EAAQR,EAAMQ,OAChBzC,EAAW0C,sBAAsB,CAAC,6CAA6C,GACnF,IAAIC,EAAU,0BAA0BV,EAAMW,wBAAwBX,EAAMY,QAAkB,WAAVJ,EAAqB,mBAAqB,qBAU9H,OATIR,EAAMa,YAAcb,EAAMc,KAC1BJ,GAAW,sBACPV,EAAMe,WACNL,GAAW,4BAIfA,GAAW,mBAERA,CACX,CACAJ,iBAAiBN,GACb,OAAIA,EAAMc,MAAQd,EAAMa,UACZhD,EAAWmD,IAAI,MAAO,CAAEd,MAAO,6BAA8Be,MAAO,CAAEC,gBAAiB3B,EAAUS,EAAMc,QAGxGjD,EAAWmD,IAAI,MAAO,CAAEd,MAAO,mDAE9C,CACAK,0BAA0BP,GACtB,OAAIA,EAAMa,UACChD,EAAWmD,IAAI,MAAO,CAAEd,MAAO,kBAAkBF,EAAMa,cAEzDb,EAAMc,SACX,EAEKd,EAAMe,SACJlD,EAAWmD,IAAI,MAAO,CAAEd,MAAO,gDAAiDG,SAAUL,EAAMe,WAGhGlD,EAAWmD,IAAI,MAAO,CAAEd,MAAO,yDAE9C,GAEJtC,EAAQiC,OAAOsB,aAAe,CAC1BR,WAAY,UACZI,SAAU,KACVH,KAAM,KACNE,IAAK,KACLD,UAAW,IAEfjD,EAAQiC,OAAOuB,UAAY,CAAEC,WAAc,CAAEV,WAAc,CAAEW,KAAQ,SAAUC,WAAc,CAAC,OAAQ,OAAQ,QAAS,SAAU,OAAQ,SAAU,MAAO,OAAQ,UAAW,QAAS,QAAS,QAAS,WAAaR,SAAY,CAAEO,KAAQ,UAAYV,KAAQ,CAAEU,KAAQ,SAAUC,WAAc,CAAC,KAAM,KAAM,KAAM,MAAO,MAAO,KAAM,KAAM,MAAO,QAAUT,IAAO,CAAEQ,KAAQ,UAAYT,UAAa,CAAES,KAAQ,UAAYd,MAAS,CAAEc,KAAQ,SAAUC,WAAc,CAAC,SAAU,aACrd3D,EAAQiC,OAAS5B,EAAW,CACxBH,EAAa0D,cAAc,cAC5B5D,EAAQiC,QAEXlB,OAAOK,eAAepB,EAAS,aAAc,CAAE6D,OAAO,GAE1D"}