@ui5/webcomponents-base 2.14.0 → 2.14.1

package/dist/prod/config/ThemeRoot.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/config/ThemeRoot.ts"],
-  "sourcesContent": ["import createLinkInHead from \"../util/createLinkInHead.js\";\nimport validateThemeRoot from \"../validateThemeRoot.js\";\nimport { getThemeRoot as getConfiguredThemeRoot } from \"../InitialConfiguration.js\";\nimport { getTheme } from \"./Theme.js\";\nimport { attachConfigurationReset } from \"./ConfigurationReset.js\";\n\nlet currThemeRoot: string | undefined;\n\nattachConfigurationReset(() => {\n\tcurrThemeRoot = undefined;\n});\n\n/**\n * Returns the current theme root.\n *\n * @public\n * @since 1.14.0\n * @returns { string } the current theme root\n */\nconst getThemeRoot = (): string | undefined => {\n\tif (currThemeRoot === undefined) {\n\t\tcurrThemeRoot = getConfiguredThemeRoot();\n\t}\n\n\treturn currThemeRoot;\n};\n\n/**\n * Sets theme root for the current theme.\n * When set, the framework will validate the theme root and fetch the theme styles (CSS variables) from this location.\n *\n * **Note:** The feature is specific to custom themes, created with the `UI Theme Designer`.\n * The provided theme root is used only as a base to construct the actual location of the theme styles: `{themeRoot}/.../css_variables.css`.\n *\n * **Note:** Certain security restrictions will apply before fetching the theme assets.\n * Absolute URLs to a different origin than the current page will result in using the current page as an origin.\n *\n * **Important:** To use this feature you must explicitly allow specific origins by using &lt;meta name=\"sap-allowed-theme-origins\" content=\"https://my-example-host.com/\"&gt; tag inside the &lt;head&gt; of the page.\n * Failing to do so will result in a warning in the console and the theme root will not be set.\n *\n * @public\n * @since 1.14.0\n * @param { string } themeRoot the new theme root\n * @returns { Promise<void> }\n */\nconst setThemeRoot = (themeRoot: string): Promise<void> | undefined => {\n\tif (currThemeRoot === themeRoot) {\n\t\treturn;\n\t}\n\n\tcurrThemeRoot = themeRoot;\n\n\tif (!validateThemeRoot(themeRoot)) {\n\t\tconsole.warn(`The ${themeRoot} is not valid. Check the allowed origins as suggested in the \"setThemeRoot\" description.`); // eslint-disable-line\n\t\treturn;\n\t}\n\n\treturn attachCustomThemeStylesToHead(getTheme());\n};\n\nconst formatThemeLink = (theme: string) => {\n\treturn `${getThemeRoot()!}Base/baseLib/${theme}/css_variables.css`; // theme root is always set at this point.\n};\n\nconst attachCustomThemeStylesToHead = async (theme: string): Promise<void> => {\n\tconst link = document.querySelector(`[sap-ui-webcomponents-theme=\"${theme}\"]`);\n\n\tif (link) {\n\t\tdocument.head.removeChild(link);\n\t}\n\n\tawait createLinkInHead(formatThemeLink(theme), { \"sap-ui-webcomponents-theme\": theme });\n};\n\nexport {\n\tgetThemeRoot,\n\tsetThemeRoot,\n\tattachCustomThemeStylesToHead,\n};\n"],
-  "mappings": "aAAA,OAAOA,MAAsB,8BAC7B,OAAOC,MAAuB,0BAC9B,OAAS,gBAAgBC,MAA8B,6BACvD,OAAS,YAAAC,MAAgB,aACzB,OAAS,4BAAAC,MAAgC,0BAEzC,IAAIC,EAEJD,EAAyB,IAAM,CAC9BC,EAAgB,MACjB,CAAC,EASD,MAAMC,EAAe,KAChBD,IAAkB,SACrBA,EAAgBH,EAAuB,GAGjCG,GAqBFE,EAAgBC,GAAiD,CACtE,GAAIH,IAAkBG,EAMtB,IAFAH,EAAgBG,EAEZ,CAACP,EAAkBO,CAAS,EAAG,CAClC,QAAQ,KAAK,OAAOA,CAAS,0FAA0F,EACvH,MACD,CAEA,OAAOC,EAA8BN,EAAS,CAAC,EAChD,EAEMO,EAAmBC,GACjB,GAAGL,EAAa,CAAE,gBAAgBK,CAAK,qBAGzCF,EAAgC,MAAOE,GAAiC,CAC7E,MAAMC,EAAO,SAAS,cAAc,gCAAgCD,CAAK,IAAI,EAEzEC,GACH,SAAS,KAAK,YAAYA,CAAI,EAG/B,MAAMZ,EAAiBU,EAAgBC,CAAK,EAAG,CAAE,6BAA8BA,CAAM,CAAC,CACvF,EAEA,OACCL,KAAA,aACAC,KAAA,aACAE,KAAA",
-  "names": ["createLinkInHead", "validateThemeRoot", "getConfiguredThemeRoot", "getTheme", "attachConfigurationReset", "currThemeRoot", "getThemeRoot", "setThemeRoot", "themeRoot", "attachCustomThemeStylesToHead", "formatThemeLink", "theme", "link"]
+  "sourcesContent": ["import createLinkInHead from \"../util/createLinkInHead.js\";\nimport validateThemeRoot from \"../validateThemeRoot.js\";\nimport { getThemeRoot as getConfiguredThemeRoot } from \"../InitialConfiguration.js\";\nimport { getTheme } from \"./Theme.js\";\nimport { attachConfigurationReset } from \"./ConfigurationReset.js\";\n\nlet currThemeRoot: string | undefined;\n\nattachConfigurationReset(() => {\n\tcurrThemeRoot = undefined;\n});\n\n/**\n * Returns the current theme root.\n *\n * @public\n * @since 1.14.0\n * @returns { string } the current theme root\n */\nconst getThemeRoot = (): string | undefined => {\n\tif (currThemeRoot === undefined) {\n\t\tcurrThemeRoot = getConfiguredThemeRoot();\n\t}\n\n\treturn currThemeRoot;\n};\n\n/**\n * Sets theme root for the current theme.\n * When set, the framework will validate the theme root and fetch the theme styles (CSS variables) from this location.\n *\n * **Note:** The feature is specific to custom themes, created with the `UI Theme Designer`.\n * The provided theme root is used only as a base to construct the actual location of the theme styles: `{themeRoot}/.../css_variables.css`.\n *\n * **Note:** Certain security restrictions will apply before fetching the theme assets.\n * Absolute URLs to a different origin than the current page will result in using the current page as an origin.\n *\n * **Important:** To use this feature you must explicitly allow specific origins by using &lt;meta name=\"sap-allowed-theme-origins\" content=\"https://my-example-host.com/\"&gt; tag inside the &lt;head&gt; of the page.\n * Failing to do so will result in a warning in the console and the theme root will not be set.\n *\n * @public\n * @since 1.14.0\n * @param { string } themeRoot the new theme root\n * @returns { Promise<void> }\n */\nconst setThemeRoot = (themeRoot: string): Promise<void> | undefined => {\n\tif (currThemeRoot === themeRoot) {\n\t\treturn;\n\t}\n\n\tcurrThemeRoot = themeRoot;\n\n\treturn attachCustomThemeStylesToHead(getTheme());\n};\n\nconst formatThemeLink = (theme: string, validatedThemeRoot: string) => {\n\treturn `${validatedThemeRoot}Base/baseLib/${theme}/css_variables.css`;\n};\n\nconst attachCustomThemeStylesToHead = async (theme: string): Promise<void> => {\n\tconst link = document.querySelector(`[sap-ui-webcomponents-theme=\"${theme}\"]`);\n\n\tif (link) {\n\t\tdocument.head.removeChild(link);\n\t}\n\n\tconst themeRoot = getThemeRoot();\n\n\tif (!themeRoot) {\n\t\treturn;\n\t}\n\n\tconst validatedThemeRoot = validateThemeRoot(themeRoot);\n\n\tif (!validatedThemeRoot) {\n\t\tconsole.warn(`The ${themeRoot} is not valid. Check the allowed origins as suggested in the \"setThemeRoot\" description.`); // eslint-disable-line\n\t\treturn;\n\t}\n\n\tawait createLinkInHead(formatThemeLink(theme, validatedThemeRoot), { \"sap-ui-webcomponents-theme\": theme });\n};\n\nexport {\n\tgetThemeRoot,\n\tsetThemeRoot,\n\tattachCustomThemeStylesToHead,\n};\n"],
+  "mappings": "aAAA,OAAOA,MAAsB,8BAC7B,OAAOC,MAAuB,0BAC9B,OAAS,gBAAgBC,MAA8B,6BACvD,OAAS,YAAAC,MAAgB,aACzB,OAAS,4BAAAC,MAAgC,0BAEzC,IAAIC,EAEJD,EAAyB,IAAM,CAC9BC,EAAgB,MACjB,CAAC,EASD,MAAMC,EAAe,KAChBD,IAAkB,SACrBA,EAAgBH,EAAuB,GAGjCG,GAqBFE,EAAgBC,GAAiD,CACtE,GAAIH,IAAkBG,EAItB,OAAAH,EAAgBG,EAETC,EAA8BN,EAAS,CAAC,CAChD,EAEMO,EAAkB,CAACC,EAAeC,IAChC,GAAGA,CAAkB,gBAAgBD,CAAK,qBAG5CF,EAAgC,MAAOE,GAAiC,CAC7E,MAAME,EAAO,SAAS,cAAc,gCAAgCF,CAAK,IAAI,EAEzEE,GACH,SAAS,KAAK,YAAYA,CAAI,EAG/B,MAAML,EAAYF,EAAa,EAE/B,GAAI,CAACE,EACJ,OAGD,MAAMI,EAAqBX,EAAkBO,CAAS,EAEtD,GAAI,CAACI,EAAoB,CACxB,QAAQ,KAAK,OAAOJ,CAAS,0FAA0F,EACvH,MACD,CAEA,MAAMR,EAAiBU,EAAgBC,EAAOC,CAAkB,EAAG,CAAE,6BAA8BD,CAAM,CAAC,CAC3G,EAEA,OACCL,KAAA,aACAC,KAAA,aACAE,KAAA",
+  "names": ["createLinkInHead", "validateThemeRoot", "getConfiguredThemeRoot", "getTheme", "attachConfigurationReset", "currThemeRoot", "getThemeRoot", "setThemeRoot", "themeRoot", "attachCustomThemeStylesToHead", "formatThemeLink", "theme", "validatedThemeRoot", "link"]
 }

package/dist/prod/generated/VersionInfo.js

@@ -1,2 +1,2 @@
-"use strict";const e={version:"2.14.0",major:2,minor:14,patch:0,suffix:"",isNext:!1,buildTime:1756977409};export default e;
+"use strict";const e={version:"2.14.1",major:2,minor:14,patch:1,suffix:"",isNext:!1,buildTime:1778504096};export default e;
 //# sourceMappingURL=VersionInfo.js.map

package/dist/prod/generated/VersionInfo.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/generated/VersionInfo.ts"],
-  "sourcesContent": ["const VersionInfo = {\n\tversion: \"2.14.0\",\n\tmajor: 2,\n\tminor: 14,\n\tpatch: 0,\n\tsuffix: \"\",\n\tisNext: false,\n\tbuildTime: 1756977409,\n};\nexport default VersionInfo;"],
+  "sourcesContent": ["const VersionInfo = {\n\tversion: \"2.14.1\",\n\tmajor: 2,\n\tminor: 14,\n\tpatch: 1,\n\tsuffix: \"\",\n\tisNext: false,\n\tbuildTime: 1778504096,\n};\nexport default VersionInfo;"],
   "mappings": "aAAA,MAAMA,EAAc,CACnB,QAAS,SACT,MAAO,EACP,MAAO,GACP,MAAO,EACP,OAAQ,GACR,OAAQ,GACR,UAAW,UACZ,EACA,eAAeA",
   "names": ["VersionInfo"]
 }

package/dist/prod/validateThemeRoot.js

@@ -1,2 +1,2 @@
-"use strict";import{getLocationHref as i}from"./Location.js";const s=e=>{const t=document.querySelector(`META[name="${e}"]`);return t&&t.getAttribute("content")},o=e=>{const t=s("sap-allowed-theme-origins")??s("sap-allowedThemeOrigins");return t?t.split(",").some(n=>n==="*"||e===n.trim()):!1},a=(e,t)=>{const n=new URL(e).pathname;return new URL(n,t).toString()},g=e=>{let t;try{if(e.startsWith(".")||e.startsWith("/"))t=new URL(e,i()).toString();else{const n=new URL(e),r=n.origin;r&&o(r)?t=n.toString():t=a(n.toString(),i())}return t.endsWith("/")||(t=`${t}/`),`${t}UI5/`}catch{}};export default g;
+"use strict";import{getLocationHref as s}from"./Location.js";const a=t=>{const e=document.querySelector(`META[name="${t}"]`);return e&&e.getAttribute("content")},g=(t,e=!1)=>{const n=a("sap-allowed-theme-origins")??a("sap-allowedThemeOrigins");return n?e?!0:n.split(",").some(r=>r==="*"||t===r.trim()):!1},l=t=>{let e,n=!1;try{if(t.startsWith(".")||t.startsWith("/")&&!t.startsWith("//"))e=new URL(t,s()).toString(),n=!0;else{const r=t.startsWith("//")?new URL(t,s()):new URL(t),i=r.origin,o=new URL(s()).origin;if(n=i===o,i&&g(i,n))e=r.toString();else return}return e.endsWith("/")||(e=`${e}/`),`${e}UI5/`}catch{return}};export default l;
 //# sourceMappingURL=validateThemeRoot.js.map

package/dist/prod/validateThemeRoot.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/validateThemeRoot.ts"],
-  "sourcesContent": ["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst buildCorrectUrl = (oldUrl: string, newOrigin: string) => {\n\tconst oldUrlPath = new URL(oldUrl).pathname;\n\n\treturn new URL(oldUrlPath, newOrigin).toString();\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || themeRoot.startsWith(\"/\")) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t} else {\n\t\t\tconst themeRootURL = new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\n\t\t\tif (origin && validateThemeOrigin(origin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allow and the URL is not relative, we have to replace the origin\n\t\t\t\t// with current location\n\t\t\t\tresultUrl = buildCorrectUrl(themeRootURL.toString(), getLocationHref());\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t}\n};\n\nexport default validateThemeRoot;\n"],
-  "mappings": "aAAA,OAAS,mBAAAA,MAAuB,gBAEhC,MAAMC,EAAmBC,GAAwB,CAChD,MAAMC,EAAU,SAAS,cAAc,cAAcD,CAAW,IAAI,EAGpE,OAFkBC,GAAWA,EAAQ,aAAa,SAAS,CAG5D,EAEMC,EAAuBC,GAAmB,CAC/C,MAAMC,EAAiBL,EAAgB,2BAA2B,GAAKA,EAAgB,yBAAyB,EAGhH,OAAKK,EAIEA,EAAe,MAAM,GAAG,EAAE,KAAKC,GAC9BA,IAAkB,KAAOF,IAAWE,EAAc,KAAK,CAC9D,EALO,EAMT,EAEMC,EAAkB,CAACC,EAAgBC,IAAsB,CAC9D,MAAMC,EAAa,IAAI,IAAIF,CAAM,EAAE,SAEnC,OAAO,IAAI,IAAIE,EAAYD,CAAS,EAAE,SAAS,CAChD,EAEME,EAAqBC,GAAsB,CAChD,IAAIC,EAEJ,GAAI,CACH,GAAID,EAAU,WAAW,GAAG,GAAKA,EAAU,WAAW,GAAG,EAKxDC,EAAY,IAAI,IAAID,EAAWb,EAAgB,CAAC,EAAE,SAAS,MACrD,CACN,MAAMe,EAAe,IAAI,IAAIF,CAAS,EAChCR,EAASU,EAAa,OAExBV,GAAUD,EAAoBC,CAAM,EAEvCS,EAAYC,EAAa,SAAS,EAIlCD,EAAYN,EAAgBO,EAAa,SAAS,EAAGf,EAAgB,CAAC,CAExE,CAEA,OAAKc,EAAU,SAAS,GAAG,IAC1BA,EAAY,GAAGA,CAAS,KAGlB,GAAGA,CAAS,MACpB,MAAY,CAEZ,CACD,EAEA,eAAeF",
-  "names": ["getLocationHref", "getMetaTagValue", "metaTagName", "metaTag", "validateThemeOrigin", "origin", "allowedOrigins", "allowedOrigin", "buildCorrectUrl", "oldUrl", "newOrigin", "oldUrlPath", "validateThemeRoot", "themeRoot", "resultUrl", "themeRootURL"]
+  "sourcesContent": ["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string, isSameOrigin: boolean = false) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\t// If it's same-origin (relative URL resolved to current page), allow it when there's any meta tag present\n\t// The presence of the meta tag indicates the user wants to use theme roots\n\tif (isSameOrigin) {\n\t\treturn true;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\tlet isSameOrigin = false;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || (themeRoot.startsWith(\"/\") && !themeRoot.startsWith(\"//\"))) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t\tisSameOrigin = true;\n\t\t} else {\n\t\t\t// Protocol-relative URLs (//host/path) need a base to resolve the protocol\n\t\t\tconst themeRootURL = themeRoot.startsWith(\"//\") ? new URL(themeRoot, getLocationHref()) : new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\t\t\tconst currentOrigin = new URL(getLocationHref()).origin;\n\n\t\t\t// Check if the absolute URL is same-origin\n\t\t\tisSameOrigin = origin === currentOrigin;\n\n\t\t\tif (origin && validateThemeOrigin(origin, isSameOrigin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allowed, return undefined to indicate validation failed\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t\treturn undefined;\n\t}\n};\n\nexport default validateThemeRoot;\n"],
+  "mappings": "aAAA,OAAS,mBAAAA,MAAuB,gBAEhC,MAAMC,EAAmBC,GAAwB,CAChD,MAAMC,EAAU,SAAS,cAAc,cAAcD,CAAW,IAAI,EAGpE,OAFkBC,GAAWA,EAAQ,aAAa,SAAS,CAG5D,EAEMC,EAAsB,CAACC,EAAgBC,EAAwB,KAAU,CAC9E,MAAMC,EAAiBN,EAAgB,2BAA2B,GAAKA,EAAgB,yBAAyB,EAGhH,OAAKM,EAMDD,EACI,GAGDC,EAAe,MAAM,GAAG,EAAE,KAAKC,GAC9BA,IAAkB,KAAOH,IAAWG,EAAc,KAAK,CAC9D,EAXO,EAYT,EAEMC,EAAqBC,GAAsB,CAChD,IAAIC,EACAL,EAAe,GAEnB,GAAI,CACH,GAAII,EAAU,WAAW,GAAG,GAAMA,EAAU,WAAW,GAAG,GAAK,CAACA,EAAU,WAAW,IAAI,EAKxFC,EAAY,IAAI,IAAID,EAAWV,EAAgB,CAAC,EAAE,SAAS,EAC3DM,EAAe,OACT,CAEN,MAAMM,EAAeF,EAAU,WAAW,IAAI,EAAI,IAAI,IAAIA,EAAWV,EAAgB,CAAC,EAAI,IAAI,IAAIU,CAAS,EACrGL,EAASO,EAAa,OACtBC,EAAgB,IAAI,IAAIb,EAAgB,CAAC,EAAE,OAKjD,GAFAM,EAAeD,IAAWQ,EAEtBR,GAAUD,EAAoBC,EAAQC,CAAY,EAErDK,EAAYC,EAAa,SAAS,MAGlC,OAEF,CAEA,OAAKD,EAAU,SAAS,GAAG,IAC1BA,EAAY,GAAGA,CAAS,KAGlB,GAAGA,CAAS,MACpB,MAAY,CAEX,MACD,CACD,EAEA,eAAeF",
+  "names": ["getLocationHref", "getMetaTagValue", "metaTagName", "metaTag", "validateThemeOrigin", "origin", "isSameOrigin", "allowedOrigins", "allowedOrigin", "validateThemeRoot", "themeRoot", "resultUrl", "themeRootURL", "currentOrigin"]
 }

package/dist/validateThemeRoot.js

@@ -3,41 +3,47 @@ const getMetaTagValue = (metaTagName) => {
     const metaTag = document.querySelector(`META[name="${metaTagName}"]`), metaTagContent = metaTag && metaTag.getAttribute("content");
     return metaTagContent;
 };
-const validateThemeOrigin = (origin) => {
+const validateThemeOrigin = (origin, isSameOrigin = false) => {
     const allowedOrigins = getMetaTagValue("sap-allowed-theme-origins") ?? getMetaTagValue("sap-allowedThemeOrigins"); // Prioritize the new meta tag name
     // If no allowed origins are specified, block.
     if (!allowedOrigins) {
         return false;
     }
+    // If it's same-origin (relative URL resolved to current page), allow it when there's any meta tag present
+    // The presence of the meta tag indicates the user wants to use theme roots
+    if (isSameOrigin) {
+        return true;
+    }
     return allowedOrigins.split(",").some(allowedOrigin => {
         return allowedOrigin === "*" || origin === allowedOrigin.trim();
     });
 };
-const buildCorrectUrl = (oldUrl, newOrigin) => {
-    const oldUrlPath = new URL(oldUrl).pathname;
-    return new URL(oldUrlPath, newOrigin).toString();
-};
 const validateThemeRoot = (themeRoot) => {
     let resultUrl;
+    let isSameOrigin = false;
     try {
-        if (themeRoot.startsWith(".") || themeRoot.startsWith("/")) {
+        if (themeRoot.startsWith(".") || (themeRoot.startsWith("/") && !themeRoot.startsWith("//"))) {
             // Handle relative url
             // new URL("/newExmPath", "http://example.com/exmPath") => http://example.com/newExmPath
             // new URL("./newExmPath", "http://example.com/exmPath") => http://example.com/exmPath/newExmPath
             // new URL("../newExmPath", "http://example.com/exmPath") => http://example.com/newExmPath
             resultUrl = new URL(themeRoot, getLocationHref()).toString();
+            isSameOrigin = true;
         }
         else {
-            const themeRootURL = new URL(themeRoot);
+            // Protocol-relative URLs (//host/path) need a base to resolve the protocol
+            const themeRootURL = themeRoot.startsWith("//") ? new URL(themeRoot, getLocationHref()) : new URL(themeRoot);
             const origin = themeRootURL.origin;
-            if (origin && validateThemeOrigin(origin)) {
+            const currentOrigin = new URL(getLocationHref()).origin;
+            // Check if the absolute URL is same-origin
+            isSameOrigin = origin === currentOrigin;
+            if (origin && validateThemeOrigin(origin, isSameOrigin)) {
                 // If origin is allowed, use it
                 resultUrl = themeRootURL.toString();
             }
             else {
-                // If origin is not allow and the URL is not relative, we have to replace the origin
-                // with current location
-                resultUrl = buildCorrectUrl(themeRootURL.toString(), getLocationHref());
+                // If origin is not allowed, return undefined to indicate validation failed
+                return undefined;
             }
         }
         if (!resultUrl.endsWith("/")) {
@@ -47,6 +53,7 @@ const validateThemeRoot = (themeRoot) => {
     }
     catch (e) {
         // Catch if URL is not correct
+        return undefined;
     }
 };
 export default validateThemeRoot;

package/dist/validateThemeRoot.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateThemeRoot.js","sourceRoot":"","sources":["../src/validateThemeRoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,EAAE;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,cAAc,WAAW,IAAI,CAAC,EACpE,cAAc,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAE7D,OAAO,cAAc,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,EAAE;IAC9C,MAAM,cAAc,GAAG,eAAe,CAAC,2BAA2B,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC,mCAAmC;IAEtJ,8CAA8C;IAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;QACrD,OAAO,aAAa,KAAK,GAAG,IAAI,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,SAAiB,EAAE,EAAE;IAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IAE5C,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,EAAE;IAC/C,IAAI,SAAS,CAAC;IAEd,IAAI,CAAC;QACJ,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,sBAAsB;YACtB,wFAAwF;YACxF,iGAAiG;YACjG,0FAA0F;YAC1F,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9D,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YAEnC,IAAI,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,+BAA+B;gBAC/B,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACP,oFAAoF;gBACpF,wBAAwB;gBACxB,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,GAAG,SAAS,GAAG,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,SAAS,MAAM,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,8BAA8B;IAC/B,CAAC;AACF,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC","sourcesContent":["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst buildCorrectUrl = (oldUrl: string, newOrigin: string) => {\n\tconst oldUrlPath = new URL(oldUrl).pathname;\n\n\treturn new URL(oldUrlPath, newOrigin).toString();\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || themeRoot.startsWith(\"/\")) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t} else {\n\t\t\tconst themeRootURL = new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\n\t\t\tif (origin && validateThemeOrigin(origin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allow and the URL is not relative, we have to replace the origin\n\t\t\t\t// with current location\n\t\t\t\tresultUrl = buildCorrectUrl(themeRootURL.toString(), getLocationHref());\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t}\n};\n\nexport default validateThemeRoot;\n"]}
+{"version":3,"file":"validateThemeRoot.js","sourceRoot":"","sources":["../src/validateThemeRoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,EAAE;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,cAAc,WAAW,IAAI,CAAC,EACpE,cAAc,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAE7D,OAAO,cAAc,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,eAAwB,KAAK,EAAE,EAAE;IAC7E,MAAM,cAAc,GAAG,eAAe,CAAC,2BAA2B,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC,mCAAmC;IAEtJ,8CAA8C;IAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,0GAA0G;IAC1G,2EAA2E;IAC3E,IAAI,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;QACrD,OAAO,aAAa,KAAK,GAAG,IAAI,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,EAAE;IAC/C,IAAI,SAAS,CAAC;IACd,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,IAAI,CAAC;QACJ,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7F,sBAAsB;YACtB,wFAAwF;YACxF,iGAAiG;YACjG,0FAA0F;YAC1F,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7D,YAAY,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,2EAA2E;YAC3E,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7G,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YAExD,2CAA2C;YAC3C,YAAY,GAAG,MAAM,KAAK,aAAa,CAAC;YAExC,IAAI,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;gBACzD,+BAA+B;gBAC/B,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACP,2EAA2E;gBAC3E,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,GAAG,SAAS,GAAG,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,SAAS,MAAM,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,8BAA8B;QAC9B,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC","sourcesContent":["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string, isSameOrigin: boolean = false) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\t// If it's same-origin (relative URL resolved to current page), allow it when there's any meta tag present\n\t// The presence of the meta tag indicates the user wants to use theme roots\n\tif (isSameOrigin) {\n\t\treturn true;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\tlet isSameOrigin = false;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || (themeRoot.startsWith(\"/\") && !themeRoot.startsWith(\"//\"))) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t\tisSameOrigin = true;\n\t\t} else {\n\t\t\t// Protocol-relative URLs (//host/path) need a base to resolve the protocol\n\t\t\tconst themeRootURL = themeRoot.startsWith(\"//\") ? new URL(themeRoot, getLocationHref()) : new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\t\t\tconst currentOrigin = new URL(getLocationHref()).origin;\n\n\t\t\t// Check if the absolute URL is same-origin\n\t\t\tisSameOrigin = origin === currentOrigin;\n\n\t\t\tif (origin && validateThemeOrigin(origin, isSameOrigin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allowed, return undefined to indicate validation failed\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t\treturn undefined;\n\t}\n};\n\nexport default validateThemeRoot;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ui5/webcomponents-base",
-  "version": "2.14.0",
+  "version": "2.14.1",
   "description": "UI5 Web Components: webcomponents.base",
   "author": "SAP SE (https://www.sap.com)",
   "license": "Apache-2.0",
@@ -13,7 +13,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "https://github.com/SAP/ui5-webcomponents.git",
+    "url": "https://github.com/UI5/webcomponents.git",
     "directory": "packages/base"
   },
   "exports": {
@@ -63,8 +63,8 @@
     "@openui5/sap.ui.core": "1.120.17",
     "@sap-theming/theming-base-content": "11.29.3",
     "@ui5/cypress-internal": "0.0.0",
-    "@ui5/webcomponents-tools": "2.14.0",
-    "chromedriver": "^138.0.5",
+    "@ui5/webcomponents-tools": "2.14.1",
+    "chromedriver": "^147.0.0",
     "clean-css": "^5.2.2",
     "copy-and-watch": "^0.1.5",
     "cross-env": "^7.0.3",
@@ -74,5 +74,5 @@
     "resolve": "^1.20.0",
     "touch": "^3.1.0"
   },
-  "gitHead": "798113e3338ae2e3570cbee2ad0eb629d70445e4"
+  "gitHead": "bfb0635420ceaf9e098caa648b04810fc64adc49"
 }