@ui5/webcomponents-base 0.0.0-4821618b2 → 0.0.0-49bade48d

package/dist/sap/base/assert.js

@@ -1,12 +1,34 @@
-import Log from './Log.js';
+// TODO-evo:assert on node throws an error if the assertion is violated
+
+/**
+ * A simple assertion mechanism that logs a message when a given condition is not met.
+ *
+ * <b>Note:</b> Calls to this method might be removed when the JavaScript code
+ *              is optimized during build. Therefore, callers should not rely on any side effects
+ *              of this method.
+ *
+ * @function
+ * @since 1.58
+ * @alias module:sap/base/assert
+ * @param {boolean} bResult Result of the checked assertion
+ * @param {string|function():any} vMessage Message that will be logged when the result is <code>false</code>.
+ * In case this is a function, the return value of the function will be displayed. This can be used to execute
+ * complex code only if the assertion fails.
+ * @public
+ * @SecSink {1|SECRET} Could expose secret data in logs
+ *
+ */ /*!
+     * OpenUI5
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
+     * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
+     */
+
 var fnAssert = function (bResult, vMessage) {
-    if (!bResult) {
-        var sMessage = typeof vMessage === 'function' ? vMessage() : vMessage;
-        if (console && console.assert) {
-            console.assert(bResult, sMessage);
-        } else {
-            Log.debug('[Assertions] ' + sMessage);
-        }
-    }
+  if (!bResult) {
+    var sMessage = typeof vMessage === "function" ? vMessage() : vMessage;
+    /*eslint-disable no-console */
+    console.assert(bResult, sMessage);
+    /*eslint-enable no-console */
+  }
 };
 export default fnAssert;

package/dist/sap/base/config/MemoryConfigurationProvider.js

@@ -0,0 +1,20 @@
+/*!
+ * OpenUI5
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
+ * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
+ */
+import uid from "../util/uid.js";
+var MemoryConfigurationProvider = function () {
+  this.oConfig = Object.create(null);
+  this.id = uid();
+};
+MemoryConfigurationProvider.prototype.getId = function () {
+  return this.id;
+};
+MemoryConfigurationProvider.prototype.get = function (sName) {
+  return this.oConfig[sName];
+};
+MemoryConfigurationProvider.prototype.set = function (sName, vValue) {
+  this.oConfig[sName] = vValue;
+};
+export default MemoryConfigurationProvider;

package/dist/sap/base/security/URLListValidator.js

@@ -1,4 +1,11 @@
-var rBasicUrl = /^(?:([^:\/?#]+):)?((?:\/\/((?:\[[^\]]+\]|[^\/?#:]+))(?::([0-9]+))?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
+// validation regexes
+/*!
+ * OpenUI5
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
+ * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
+ */
+
+var rBasicUrl = /^(?:([^:\/?#]+):)?((?:[\/\\]{2,}(?:(?:[^@\/?#]*@)?(\[[^\]]+\]|[^\/?#:]+)(?::([0-9]+))?)?)?([^?#]*))(?:\?([^#]*))?(?:#(.*))?$/;
 var rCheckPath = /^([a-z0-9-._~!$&'()*+,;=:@]|%[0-9a-f]{2})*$/i;
 var rCheckQuery = /^([a-z0-9-._~!$&'()*+,;=:@\/?]|%[0-9a-f]{2})*$/i;
 var rCheckFragment = rCheckQuery;
@@ -8,10 +15,45 @@ var rCheckValidIPv4 = /^(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3
 var rCheckIPv6 = /^\[[^\]]+\]$/;
 var rCheckValidIPv6 = /^\[(((([0-9a-f]{1,4}:){6}|(::([0-9a-f]{1,4}:){5})|(([0-9a-f]{1,4})?::([0-9a-f]{1,4}:){4})|((([0-9a-f]{1,4}:){0,1}[0-9a-f]{1,4})?::([0-9a-f]{1,4}:){3})|((([0-9a-f]{1,4}:){0,2}[0-9a-f]{1,4})?::([0-9a-f]{1,4}:){2})|((([0-9a-f]{1,4}:){0,3}[0-9a-f]{1,4})?::[0-9a-f]{1,4}:)|((([0-9a-f]{1,4}:){0,4}[0-9a-f]{1,4})?::))(([0-9a-f]{1,4}:[0-9a-f]{1,4})|(([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])))|((([0-9a-f]{1,4}:){0,5}[0-9a-f]{1,4})?::[0-9a-f]{1,4})|((([0-9a-f]{1,4}:){0,6}[0-9a-f]{1,4})?::))\]$/i;
 var rCheckHostName = /^([a-z0-9]([a-z0-9\-]*[a-z0-9])?\.)*[a-z0-9]([a-z0-9\-]*[a-z0-9])?$/i;
+var rSpecialSchemeURLs = /^((?:ftp|https?|wss?):)([\s\S]+)$/;
+
+/* eslint-disable no-control-regex */
+var rCheckWhitespaces = /[\u0009\u000A\u000D]/;
+
+/**
+ * Registry to manage allowed URLs and validate against them.
+ *
+ * @namespace
+ * @since 1.85
+ * @alias module:sap/base/security/URLListValidator
+ * @public
+ */
 var oURLListValidator = {};
+
+/**
+ * Creates a new URLListValidator.Entry object
+ *
+ * @param {string} [protocol] The protocol of the URL, can be falsy to allow all protocols for an entry e.g. "", "http", "mailto"
+ * @param {string} [host] The host of the URL, can be falsy to allow all hosts. A wildcard asterisk can be set at the beginning, e.g. "examples.com", "*.example.com"
+ * @param {string} [port] The port of the URL, can be falsy to allow all ports, e.g. "", "8080"
+ * @param {string} [path] the path of the URL, path of the url, can be falsy to allow all paths. A wildcard asterisk can be set at the end, e.g. "/my-example*", "/my-news"
+ * @returns {module:sap/base/security/URLListValidator.Entry|object}
+ * @private
+ */
 oURLListValidator._createEntry = function (protocol, host, port, path) {
   return new URLListValidatorEntry(protocol, host, port, path);
 };
+
+/**
+ * Entry object of the URLListValidator.
+ *
+ * @public
+ * @typedef {object} module:sap/base/security/URLListValidator.Entry
+ * @property {string} [protocol] The protocol of the URL, can be falsy to allow all protocols for an entry e.g. "", "http", "mailto"
+ * @property {string} [host] The host of the URL, can be falsy to allow all hosts. A wildcard asterisk can be set at the beginning, e.g. "examples.com", "*.example.com"
+ * @property {string} [port] The port of the URL, can be falsy to allow all ports, e.g. "", "8080"
+ * @property {string} [path] the path of the URL, path of the url, can be falsy to allow all paths. A wildcard asterisk can be set at the end, e.g. "/my-example*", "/my-news"
+ */
 function URLListValidatorEntry(protocol, host, port, path) {
   Object.defineProperties(this, {
     protocol: {
@@ -32,53 +74,258 @@ function URLListValidatorEntry(protocol, host, port, path) {
     }
   });
 }
+
+/**
+ * The internally managed allowed entries.
+ * @private
+ */
 var aAllowedEntries = [];
+
+/**
+ * Clears the allowed entries for URL validation.
+ * This makes all URLs allowed.
+ *
+ * @public
+ */
 oURLListValidator.clear = function () {
   aAllowedEntries = [];
 };
+
+/**
+ * Adds an allowed entry.
+ *
+ * Note:
+ * Adding the first entry to the list of allowed entries will disallow all URLs but the ones matching the newly added entry.
+ *
+ * <b>Note</b>:
+ * It is strongly recommended to set a path only in combination with an origin (never set a path alone).
+ * There's almost no case where checking only the path of a URL would allow to ensure its validity.
+ *
+ * @param {string} [protocol] The protocol of the URL, can be falsy to allow all protocols for an entry e.g. "", "http", "mailto"
+ * @param {string} [host] The host of the URL, can be falsy to allow all hosts. A wildcard asterisk can be set at the beginning, e.g. "examples.com", "*.example.com"
+ * @param {string} [port] The port of the URL, can be falsy to allow all ports, e.g. "", "8080"
+ * @param {string} [path] the path of the URL, e.g. "/my-news". Can be falsy to allow all paths. A wildcard asterisk can be set at the end to ensure a path starts with the given string, e.g. "/my-example*".
+ * 	When using wildcards, make sure to only provide normalized URLs to the validate function in order to mitigate the risk of path traversal attacks.
+ * @public
+ */
 oURLListValidator.add = function (protocol, host, port, path) {
   var oEntry = this._createEntry(protocol, host, port, path);
   aAllowedEntries.push(oEntry);
 };
+
+/**
+ * Deletes an entry from the allowed entries.
+ *
+ * Note:
+ * Deleting the last entry from the list of allowed entries will allow all URLs.
+ *
+ * @param {module:sap/base/security/URLListValidator.Entry} oEntry The entry to be deleted
+ * @private
+ */
 oURLListValidator._delete = function (oEntry) {
   aAllowedEntries.splice(aAllowedEntries.indexOf(oEntry), 1);
 };
+
+/**
+ * Gets the list of allowed entries.
+ *
+ * @returns {module:sap/base/security/URLListValidator.Entry[]} The allowed entries
+ * @public
+ */
 oURLListValidator.entries = function () {
   return aAllowedEntries.slice();
 };
+
+/**
+ * Validates a URL. Check if it's not a script or other security issue.
+ *
+ * <b>Note</b>:
+ * It is strongly recommended to validate only absolute, normalized URLs. There's almost no case
+ * where checking only the path of a URL would allow to ensure its validity.
+ * For compatibility reasons, this API does not normalize URLs and cannot automatically resolve URLs relative to
+ * <code>document.baseURI</code>, but callers should do so. In that case, and when the
+ * allow list is not empty, an entry for the origin of <code>document.baseURI</code>
+ * must be added to the allow list.
+ *
+ * Any measures to mitigate path traversal or similar attack vectors must be taken by the caller, e.g. by using the
+ * {@link https://developer.mozilla.org/docs/Web/API/URL URL} API to normalize the URL beforehand.
+ *
+ * <h3>Details</h3>
+ * Splits the given URL into components and checks for allowed characters according to RFC 3986:
+ *
+ * <pre>
+ * authority     = [ userinfo "@" ] host [ ":" port ]
+ * userinfo      = *( unreserved / pct-encoded / sub-delims / ":" )
+ * host          = IP-literal / IPv4address / reg-name
+ *
+ * IP-literal    = "[" ( IPv6address / IPvFuture  ) "]"
+ * IPvFuture     = "v" 1*HEXDIG "." 1*( unreserved / sub-delims / ":" )
+ * IPv6address   =                            6( h16 ":" ) ls32
+ *               /                       "::" 5( h16 ":" ) ls32
+ *               / [               h16 ] "::" 4( h16 ":" ) ls32
+ *               / [ *1( h16 ":" ) h16 ] "::" 3( h16 ":" ) ls32
+ *               / [ *2( h16 ":" ) h16 ] "::" 2( h16 ":" ) ls32
+ *               / [ *3( h16 ":" ) h16 ] "::"    h16 ":"   ls32
+ *               / [ *4( h16 ":" ) h16 ] "::"              ls32
+ *               / [ *5( h16 ":" ) h16 ] "::"              h16
+ *               / [ *6( h16 ":" ) h16 ] "::"
+ * ls32          = ( h16 ":" h16 ) / IPv4address
+ *               ; least-significant 32 bits of address
+ * h16           = 1*4HEXDIG
+	 *               ; 16 bits of address represented in hexadecimal
+	 *
+ * IPv4address   = dec-octet "." dec-octet "." dec-octet "." dec-octet
+ * dec-octet     = DIGIT                 ; 0-9
+ *               / %x31-39 DIGIT         ; 10-99
+ *               / "1" 2DIGIT            ; 100-199
+ *               / "2" %x30-34 DIGIT     ; 200-249
+ *               / "25" %x30-35          ; 250-255
+ *
+ * reg-name      = *( unreserved / pct-encoded / sub-delims )
+ *
+ * pct-encoded   = "%" HEXDIG HEXDIG
+ * reserved      = gen-delims / sub-delims
+ * gen-delims    = ":" / "/" / "?" / "#" / "[" / "]" / "@"
+ * sub-delims    = "!" / "$" / "&" / "'" / "(" / ")"
+ *               / "*" / "+" / "," / ";" / "="
+ * unreserved    = ALPHA / DIGIT / "-" / "." / "_" / "~"
+ * pchar         = unreserved / pct-encoded / sub-delims / ":" / "@"
+ *
+ * path          = path-abempty    ; begins with "/" or is empty
+ *               / path-absolute   ; begins with "/" but not "//"
+ *               / path-noscheme   ; begins with a non-colon segment
+ *               / path-rootless   ; begins with a segment
+ *               / path-empty      ; zero characters
+ *
+ * path-abempty  = *( "/" segment )
+ * path-absolute = "/" [ segment-nz *( "/" segment ) ]
+ * path-noscheme = segment-nz-nc *( "/" segment )
+ * path-rootless = segment-nz *( "/" segment )
+ * path-empty    = 0<pchar>
+ * segment       = *pchar
+ * segment-nz    = 1*pchar
+ * segment-nz-nc = 1*( unreserved / pct-encoded / sub-delims / "@" )
+ *               ; non-zero-length segment without any colon ":"
+ *
+ * query         = *( pchar / "/" / "?" )
+ *
+ * fragment      = *( pchar / "/" / "?" )
+ * </pre>
+ *
+ * For the hostname component, we are checking for valid DNS hostnames according to RFC 952 / RFC 1123:
+ *
+ * <pre>
+ * hname         = name *("." name)
+ * name          = let-or-digit ( *( let-or-digit-or-hyphen ) let-or-digit )
+ * </pre>
+ *
+ *
+ * When the URI uses the protocol 'mailto:', the address part is additionally checked
+ * against the most commonly used parts of RFC 6068:
+ *
+ * <pre>
+ * mailtoURI     = "mailto:" [ to ] [ hfields ]
+ * to            = addr-spec *("," addr-spec )
+ * hfields       = "?" hfield *( "&" hfield )
+ * hfield        = hfname "=" hfvalue
+ * hfname        = *qchar
+ * hfvalue       = *qchar
+ * addr-spec     = local-part "@" domain
+ * local-part    = dot-atom-text              // not accepted: quoted-string
+ * domain        = dot-atom-text              // not accepted: "[" *dtext-no-obs "]"
+ * dtext-no-obs  = %d33-90 / ; Printable US-ASCII
+ *                 %d94-126  ; characters not including
+ *                           ; "[", "]", or "\"
+ * qchar         = unreserved / pct-encoded / some-delims
+ * some-delims   = "!" / "$" / "'" / "(" / ")" / "*"
+ *               / "+" / "," / ";" / ":" / "@"
+ *
+ * Note:
+ * A number of characters that can appear in &lt;addr-spec> MUST be
+ * percent-encoded.  These are the characters that cannot appear in
+ * a URI according to [STD66] as well as "%" (because it is used for
+ * percent-encoding) and all the characters in gen-delims except "@"
+ * and ":" (i.e., "/", "?", "#", "[", and "]").  Of the characters
+ * in sub-delims, at least the following also have to be percent-
+ * encoded: "&", ";", and "=".  Care has to be taken both when
+ * encoding as well as when decoding to make sure these operations
+ * are applied only once.
+ *
+ * </pre>
+ *
+ * When a list of allowed entries has been configured using {@link #add},
+ * any URL that passes the syntactic checks above, additionally will be tested against
+ * the content of this list.
+ *
+ * @param {string} sUrl URL to be validated
+ * @return {boolean} true if valid, false if not valid
+ * @public
+ */
 oURLListValidator.validate = function (sUrl) {
-  var result = rBasicUrl.exec(sUrl);
+  // Test for not allowed whitespaces
+  if (typeof sUrl === "string") {
+    if (rCheckWhitespaces.test(sUrl)) {
+      return false;
+    }
+  }
+
+  // for 'special' URLs without a given base URL, the whatwg spec allows any number of slashes.
+  // As the rBasicUrl regular expression cannot handle 'special' URLs, the URL is modified upfront,
+  // if it wouldn't be recognized by the regex.
+  // See https://url.spec.whatwg.org/#scheme-state (case 2.6.)
+  var result = rSpecialSchemeURLs.exec(sUrl);
+  if (result && !/^[\/\\]{2}/.test(result[2])) {
+    sUrl = result[1] + "//" + result[2];
+  }
+  result = rBasicUrl.exec(sUrl);
   if (!result) {
     return false;
   }
-  var sProtocol = result[1], sBody = result[2], sHost = result[3], sPort = result[4], sPath = result[5], sQuery = result[6], sHash = result[7];
+  var sProtocol = result[1],
+    sBody = result[2],
+    sHost = result[3],
+    sPort = result[4],
+    sPath = result[5],
+    sQuery = result[6],
+    sHash = result[7];
+
+  // protocol
   if (sProtocol) {
     sProtocol = sProtocol.toUpperCase();
     if (aAllowedEntries.length <= 0) {
-      if (!(/^(https?|ftp)/i).test(sProtocol)) {
+      // no allowed entries -> check for default protocols
+      if (!/^(https?|ftp)/i.test(sProtocol)) {
         return false;
       }
     }
   }
+
+  // Host -> validity check for IP address or hostname
   if (sHost) {
     if (rCheckIPv4.test(sHost)) {
       if (!rCheckValidIPv4.test(sHost)) {
+        //invalid ipv4 address
         return false;
       }
     } else if (rCheckIPv6.test(sHost)) {
       if (!rCheckValidIPv6.test(sHost)) {
+        //invalid ipv6 address
         return false;
       }
     } else if (!rCheckHostName.test(sHost)) {
+      // invalid host name
       return false;
     }
     sHost = sHost.toUpperCase();
   }
+
+  // Path -> split for "/" and check if forbidden characters exist
   if (sPath) {
     if (sProtocol === "MAILTO") {
       var aAddresses = sBody.split(",");
       for (var i = 0; i < aAddresses.length; i++) {
         if (!rCheckMail.test(aAddresses[i])) {
+          // forbidden character found
           return false;
         }
       }
@@ -86,27 +333,38 @@ oURLListValidator.validate = function (sUrl) {
       var aComponents = sPath.split("/");
       for (var i = 0; i < aComponents.length; i++) {
         if (!rCheckPath.test(aComponents[i])) {
+          // forbidden character found
           return false;
         }
       }
     }
   }
+
+  // query
   if (sQuery) {
     if (!rCheckQuery.test(sQuery)) {
+      // forbidden character found
       return false;
     }
   }
+
+  // hash
   if (sHash) {
     if (!rCheckFragment.test(sHash)) {
+      // forbidden character found
       return false;
     }
   }
+
+  //filter allowed entries
   if (aAllowedEntries.length > 0) {
     var bFound = false;
     for (var i = 0; i < aAllowedEntries.length; i++) {
       if (!sProtocol || !aAllowedEntries[i].protocol || sProtocol == aAllowedEntries[i].protocol) {
+        // protocol OK
         var bOk = false;
-        if (sHost && aAllowedEntries[i].host && (/^\*/).test(aAllowedEntries[i].host)) {
+        if (sHost && aAllowedEntries[i].host && /^\*/.test(aAllowedEntries[i].host)) {
+          // check for wildcard search at begin
           if (!aAllowedEntries[i]._hostRegexp) {
             var sHostEscaped = aAllowedEntries[i].host.slice(1).replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
             aAllowedEntries[i]._hostRegexp = RegExp(sHostEscaped + "$");
@@ -119,8 +377,11 @@ oURLListValidator.validate = function (sUrl) {
           bOk = true;
         }
         if (bOk) {
+          // host OK
           if (!sHost && !sPort || !aAllowedEntries[i].port || sPort == aAllowedEntries[i].port) {
-            if (aAllowedEntries[i].path && (/\*$/).test(aAllowedEntries[i].path)) {
+            // port OK
+            if (aAllowedEntries[i].path && /\*$/.test(aAllowedEntries[i].path)) {
+              // check for wildcard search at end
               if (!aAllowedEntries[i]._pathRegexp) {
                 var sPathEscaped = aAllowedEntries[i].path.slice(0, -1).replace(/[-[\]{}()*+?.,\\^$|#\s]/g, "\\$&");
                 aAllowedEntries[i]._pathRegexp = RegExp("^" + sPathEscaped);
@@ -130,6 +391,7 @@ oURLListValidator.validate = function (sUrl) {
                 bFound = true;
               }
             } else if (!aAllowedEntries[i].path || sPath == aAllowedEntries[i].path) {
+              // path OK
               bFound = true;
             }
           }
@@ -145,4 +407,4 @@ oURLListValidator.validate = function (sUrl) {
   }
   return true;
 };
-export default oURLListValidator;
+export default oURLListValidator;

package/dist/sap/base/security/encodeCSS.js

@@ -0,0 +1,40 @@
+/*!
+ * OpenUI5
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
+ * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
+ */
+import toHex from "../strings/toHex.js";
+/**
+ * RegExp and escape function for CSS escaping
+ */
+// eslint-disable-next-line no-control-regex -- special characters are really needed here!
+var rCSS = /[\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\xff\u2028\u2029][0-9A-Fa-f]?/g;
+var fnCSS = function (sChar) {
+  var iChar = sChar.charCodeAt(0);
+  if (sChar.length === 1) {
+    return "\\" + toHex(iChar);
+  } else {
+    return "\\" + toHex(iChar) + " " + sChar.substr(1);
+  }
+};
+
+/*
+ * Encoding according to the Secure Programming Guide
+ * <SAPWIKI>/wiki/display/NWCUIAMSIM/XSS+Secure+Programming+Guide
+ */
+
+/**
+ * Encode the string for inclusion into CSS string literals or identifiers.
+ *
+ * @function
+ * @since 1.58
+ * @alias module:sap/base/security/encodeCSS
+ * @param {string} sString The string to be escaped
+ * @returns {string} The encoded string
+ * @SecValidate {0|return|XSS} validates the given string for a CSS context
+ * @public
+ */
+var fnEncodeCSS = function (sString) {
+  return sString.replace(rCSS, fnCSS);
+};
+export default fnEncodeCSS;

package/dist/sap/base/security/encodeXML.js

@@ -0,0 +1,53 @@
+/*!
+ * OpenUI5
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
+ * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
+ */
+import toHex from "../strings/toHex.js";
+/* eslint-disable no-control-regex -- special characters are really needed here! */
+/**
+ * RegExp and escape function for HTML escaping
+ */
+var rHtml = /[\x00-\x2b\x2f\x3a-\x40\x5b-\x5e\x60\x7b-\xff\u2028\u2029]/g,
+  rHtmlReplace = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f-\x9f]/,
+  mHtmlLookup = {
+    "<": "&lt;",
+    ">": "&gt;",
+    "&": "&amp;",
+    "\"": "&quot;"
+  };
+/* eslint-enable no-control-regex */
+
+var fnHtml = function (sChar) {
+  var sEncoded = mHtmlLookup[sChar];
+  if (!sEncoded) {
+    if (rHtmlReplace.test(sChar)) {
+      sEncoded = "&#xfffd;";
+    } else {
+      sEncoded = "&#x" + toHex(sChar.charCodeAt(0)) + ";";
+    }
+    mHtmlLookup[sChar] = sEncoded;
+  }
+  return sEncoded;
+};
+
+/*
+ * Encoding according to the Secure Programming Guide
+ * <SAPWIKI>/wiki/display/NWCUIAMSIM/XSS+Secure+Programming+Guide
+ */
+
+/**
+ * Encode the string for inclusion into XML content/attribute.
+ *
+ * @function
+ * @since 1.58
+ * @alias module:sap/base/security/encodeXML
+ * @param {string} sString The string to be escaped
+ * @returns {string} The encoded string
+ * @SecValidate {0|return|XSS} validates the given string for XML contexts
+ * @public
+ */
+var fnEncodeXML = function (sString) {
+  return sString.replace(rHtml, fnHtml);
+};
+export default fnEncodeXML;

package/dist/sap/base/security/sanitizeHTML.js

@@ -1,16 +1,38 @@
-import assert from '../assert.js';
-import URLListValidator from './URLListValidator.js';
-import '../../ui/thirdparty/caja-html-sanitizer.js';
+/*!
+ * OpenUI5
+ * (c) Copyright 2026 SAP SE or an SAP affiliate company.
+ * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
+ */
+/*
+ * IMPORTANT: This is a private module, its API must not be used and is subject to change.
+ * Code other than the OpenUI5 libraries must not introduce dependencies to this module.
+ */
+import assert from "../assert.js";
+import URLListValidator from "./URLListValidator.js";
+import "../../ui/thirdparty/caja-html-sanitizer.js";
+/**
+ * Strips unsafe tags and attributes from HTML.
+ *
+ * @function
+ * @since 1.58
+ * @alias module:sap/base/security/sanitizeHTML
+ * @param {string} sHTML the HTML to be sanitized.
+ * @param {object} [mOptions={}] options for the sanitizer
+ * @return {string} sanitized HTML
+ * @private
+ */
 var fnSanitizeHTML = function (sHTML, mOptions) {
-    assert(window.html && window.html.sanitize, 'Sanitizer should have been loaded');
-    mOptions = mOptions || {
-        uriRewriter: function (sUrl) {
-            if (URLListValidator.validate(sUrl)) {
-                return sUrl;
-            }
-        }
-    };
-    var oTagPolicy = mOptions.tagPolicy || window.html.makeTagPolicy(mOptions.uriRewriter, mOptions.tokenPolicy);
-    return window.html.sanitizeWithPolicy(sHTML, oTagPolicy);
+  assert(window.html && window.html.sanitize, "Sanitizer should have been loaded");
+  mOptions = mOptions || {
+    uriRewriter: function (sUrl) {
+      // by default, we use the URLListValidator to check the URLs
+
+      if (URLListValidator.validate(sUrl)) {
+        return sUrl;
+      }
+    }
+  };
+  var oTagPolicy = mOptions.tagPolicy || window.html.makeTagPolicy(mOptions.uriRewriter, mOptions.tokenPolicy);
+  return window.html.sanitizeWithPolicy(sHTML, oTagPolicy);
 };
 export default fnSanitizeHTML;

package/dist/sap/base/strings/toHex.js

@@ -0,0 +1,33 @@
+/**
+ * Create hex string and pad to length with zeros.
+ * @example
+ * sap.ui.require(["sap/base/strings/toHex"], function(toHex){
+ *      toHex(10, 2); // "0a"
+ *      toHex(16, 2); // "10"
+ * });
+ *
+ * @function
+ * @since 1.58
+ * @private
+ * @alias module:sap/base/strings/toHex
+ * @param {int} iChar UTF-16 character code
+ * @param {int} [iLength=0] number of padded zeros
+ * @returns {string} padded hex representation of the given character code
+ */ /*!
+     * OpenUI5
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
+     * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
+     */
+/*
+ * IMPORTANT: This is a private module, its API must not be used and is subject to change.
+ * Code other than the OpenUI5 libraries must not introduce dependencies to this module.
+ */
+
+var fnToHex = function (iChar, iLength) {
+  var sHex = iChar.toString(16);
+  if (iLength) {
+    sHex = sHex.padStart(iLength, '0');
+  }
+  return sHex;
+};
+export default fnToHex;

package/dist/sap/base/util/now.js

@@ -1,7 +1,22 @@
-var fnNow = !(typeof window != "undefined" && window.performance && performance.now && performance.timing) ? Date.now : (function () {
-  var iNavigationStart = performance.timing.navigationStart;
-  return function perfnow() {
-    return iNavigationStart + performance.now();
-  };
-})();
-export default fnNow;
+/**
+ * Returns a high resolution timestamp in microseconds.
+ * The timestamp is based on 01/01/1970 00:00:00 (UNIX epoch) as float with microsecond precision.
+ * The fractional part of the timestamp represents fractions of a millisecond.
+ * Converting to a <code>Date</code> is possible by using <code>require(["sap/base/util/now"], function(now){new Date(now());}</code>
+ *
+ * @function
+ * @since 1.58
+ * @public
+ * @alias module:sap/base/util/now
+ * @returns {float} timestamp in microseconds
+ */ /*!
+     * OpenUI5
+     * (c) Copyright 2026 SAP SE or an SAP affiliate company.
+     * Licensed under the Apache License, Version 2.0 - see LICENSE.txt.
+     */
+/*global performance */
+
+var fnNow = function now() {
+  return performance.timeOrigin + performance.now();
+};
+export default fnNow;