@ui5/webcomponents-base 2.20.3 → 2.20.4

package/dist/validateThemeRoot.js

@@ -3,41 +3,47 @@ const getMetaTagValue = (metaTagName) => {
     const metaTag = document.querySelector(`META[name="${metaTagName}"]`), metaTagContent = metaTag && metaTag.getAttribute("content");
     return metaTagContent;
 };
-const validateThemeOrigin = (origin) => {
+const validateThemeOrigin = (origin, isSameOrigin = false) => {
     const allowedOrigins = getMetaTagValue("sap-allowed-theme-origins") ?? getMetaTagValue("sap-allowedThemeOrigins"); // Prioritize the new meta tag name
     // If no allowed origins are specified, block.
     if (!allowedOrigins) {
         return false;
     }
+    // If it's same-origin (relative URL resolved to current page), allow it when there's any meta tag present
+    // The presence of the meta tag indicates the user wants to use theme roots
+    if (isSameOrigin) {
+        return true;
+    }
     return allowedOrigins.split(",").some(allowedOrigin => {
         return allowedOrigin === "*" || origin === allowedOrigin.trim();
     });
 };
-const buildCorrectUrl = (oldUrl, newOrigin) => {
-    const oldUrlPath = new URL(oldUrl).pathname;
-    return new URL(oldUrlPath, newOrigin).toString();
-};
 const validateThemeRoot = (themeRoot) => {
     let resultUrl;
+    let isSameOrigin = false;
     try {
-        if (themeRoot.startsWith(".") || themeRoot.startsWith("/")) {
+        if (themeRoot.startsWith(".") || (themeRoot.startsWith("/") && !themeRoot.startsWith("//"))) {
             // Handle relative url
             // new URL("/newExmPath", "http://example.com/exmPath") => http://example.com/newExmPath
             // new URL("./newExmPath", "http://example.com/exmPath") => http://example.com/exmPath/newExmPath
             // new URL("../newExmPath", "http://example.com/exmPath") => http://example.com/newExmPath
             resultUrl = new URL(themeRoot, getLocationHref()).toString();
+            isSameOrigin = true;
         }
         else {
-            const themeRootURL = new URL(themeRoot);
+            // Protocol-relative URLs (//host/path) need a base to resolve the protocol
+            const themeRootURL = themeRoot.startsWith("//") ? new URL(themeRoot, getLocationHref()) : new URL(themeRoot);
             const origin = themeRootURL.origin;
-            if (origin && validateThemeOrigin(origin)) {
+            const currentOrigin = new URL(getLocationHref()).origin;
+            // Check if the absolute URL is same-origin
+            isSameOrigin = origin === currentOrigin;
+            if (origin && validateThemeOrigin(origin, isSameOrigin)) {
                 // If origin is allowed, use it
                 resultUrl = themeRootURL.toString();
             }
             else {
-                // If origin is not allow and the URL is not relative, we have to replace the origin
-                // with current location
-                resultUrl = buildCorrectUrl(themeRootURL.toString(), getLocationHref());
+                // If origin is not allowed, return undefined to indicate validation failed
+                return undefined;
             }
         }
         if (!resultUrl.endsWith("/")) {
@@ -47,6 +53,7 @@ const validateThemeRoot = (themeRoot) => {
     }
     catch (e) {
         // Catch if URL is not correct
+        return undefined;
     }
 };
 export default validateThemeRoot;

package/dist/validateThemeRoot.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateThemeRoot.js","sourceRoot":"","sources":["../src/validateThemeRoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,EAAE;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,cAAc,WAAW,IAAI,CAAC,EACpE,cAAc,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAE7D,OAAO,cAAc,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,EAAE;IAC9C,MAAM,cAAc,GAAG,eAAe,CAAC,2BAA2B,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC,mCAAmC;IAEtJ,8CAA8C;IAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;QACrD,OAAO,aAAa,KAAK,GAAG,IAAI,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,SAAiB,EAAE,EAAE;IAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IAE5C,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,EAAE;IAC/C,IAAI,SAAS,CAAC;IAEd,IAAI,CAAC;QACJ,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,sBAAsB;YACtB,wFAAwF;YACxF,iGAAiG;YACjG,0FAA0F;YAC1F,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9D,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YAEnC,IAAI,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,+BAA+B;gBAC/B,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACP,oFAAoF;gBACpF,wBAAwB;gBACxB,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,GAAG,SAAS,GAAG,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,SAAS,MAAM,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,8BAA8B;IAC/B,CAAC;AACF,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC","sourcesContent":["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst buildCorrectUrl = (oldUrl: string, newOrigin: string) => {\n\tconst oldUrlPath = new URL(oldUrl).pathname;\n\n\treturn new URL(oldUrlPath, newOrigin).toString();\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || themeRoot.startsWith(\"/\")) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t} else {\n\t\t\tconst themeRootURL = new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\n\t\t\tif (origin && validateThemeOrigin(origin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allow and the URL is not relative, we have to replace the origin\n\t\t\t\t// with current location\n\t\t\t\tresultUrl = buildCorrectUrl(themeRootURL.toString(), getLocationHref());\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t}\n};\n\nexport default validateThemeRoot;\n"]}
+{"version":3,"file":"validateThemeRoot.js","sourceRoot":"","sources":["../src/validateThemeRoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,EAAE;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,cAAc,WAAW,IAAI,CAAC,EACpE,cAAc,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAE7D,OAAO,cAAc,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,eAAwB,KAAK,EAAE,EAAE;IAC7E,MAAM,cAAc,GAAG,eAAe,CAAC,2BAA2B,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC,mCAAmC;IAEtJ,8CAA8C;IAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,0GAA0G;IAC1G,2EAA2E;IAC3E,IAAI,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;QACrD,OAAO,aAAa,KAAK,GAAG,IAAI,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,EAAE;IAC/C,IAAI,SAAS,CAAC;IACd,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,IAAI,CAAC;QACJ,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC7F,sBAAsB;YACtB,wFAAwF;YACxF,iGAAiG;YACjG,0FAA0F;YAC1F,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7D,YAAY,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,2EAA2E;YAC3E,MAAM,YAAY,GAAG,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7G,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YAExD,2CAA2C;YAC3C,YAAY,GAAG,MAAM,KAAK,aAAa,CAAC;YAExC,IAAI,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;gBACzD,+BAA+B;gBAC/B,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACP,2EAA2E;gBAC3E,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,GAAG,SAAS,GAAG,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,SAAS,MAAM,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,8BAA8B;QAC9B,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC","sourcesContent":["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string, isSameOrigin: boolean = false) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\t// If it's same-origin (relative URL resolved to current page), allow it when there's any meta tag present\n\t// The presence of the meta tag indicates the user wants to use theme roots\n\tif (isSameOrigin) {\n\t\treturn true;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\tlet isSameOrigin = false;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || (themeRoot.startsWith(\"/\") && !themeRoot.startsWith(\"//\"))) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t\tisSameOrigin = true;\n\t\t} else {\n\t\t\t// Protocol-relative URLs (//host/path) need a base to resolve the protocol\n\t\t\tconst themeRootURL = themeRoot.startsWith(\"//\") ? new URL(themeRoot, getLocationHref()) : new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\t\t\tconst currentOrigin = new URL(getLocationHref()).origin;\n\n\t\t\t// Check if the absolute URL is same-origin\n\t\t\tisSameOrigin = origin === currentOrigin;\n\n\t\t\tif (origin && validateThemeOrigin(origin, isSameOrigin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allowed, return undefined to indicate validation failed\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t\treturn undefined;\n\t}\n};\n\nexport default validateThemeRoot;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ui5/webcomponents-base",
-  "version": "2.20.3",
+  "version": "2.20.4",
   "description": "UI5 Web Components: webcomponents.base",
   "author": "SAP SE (https://www.sap.com)",
   "license": "Apache-2.0",
@@ -66,7 +66,7 @@
     "@openui5/sap.ui.core": "1.146.0",
     "@sap-theming/theming-base-content": "11.33.0",
     "@ui5/cypress-internal": "0.1.0",
-    "@ui5/webcomponents-tools": "2.20.3",
+    "@ui5/webcomponents-tools": "2.20.4",
     "clean-css": "^5.2.2",
     "cypress": "15.9.0",
     "mocha": "^11.7.2",
@@ -85,5 +85,5 @@
     }
   },
   "customElements": "dist/custom-elements.json",
-  "gitHead": "3e3a7936aae93d114542b1b2a7ca1a1d26c63194"
+  "gitHead": "7a352937f328989925ddd1aa8bb6bca03268520d"
 }