@ui5/webcomponents-base 2.21.0-rc.3 → 2.21.0

package/dist/prod/validateThemeRoot.js

@@ -1,2 +1,2 @@
-"use strict";import{getLocationHref as i}from"./Location.js";const s=e=>{const t=document.querySelector(`META[name="${e}"]`);return t&&t.getAttribute("content")},o=e=>{const t=s("sap-allowed-theme-origins")??s("sap-allowedThemeOrigins");return t?t.split(",").some(n=>n==="*"||e===n.trim()):!1},a=(e,t)=>{const n=new URL(e).pathname;return new URL(n,t).toString()},g=e=>{let t;try{if(e.startsWith(".")||e.startsWith("/"))t=new URL(e,i()).toString();else{const n=new URL(e),r=n.origin;r&&o(r)?t=n.toString():t=a(n.toString(),i())}return t.endsWith("/")||(t=`${t}/`),`${t}UI5/`}catch{}};export default g;
+"use strict";import{getLocationHref as s}from"./Location.js";const a=e=>{const t=document.querySelector(`META[name="${e}"]`);return t&&t.getAttribute("content")},g=(e,t=!1)=>{const n=a("sap-allowed-theme-origins")??a("sap-allowedThemeOrigins");return n?t?!0:n.split(",").some(r=>r==="*"||e===r.trim()):!1},l=e=>{let t,n=!1;try{if(e.startsWith(".")||e.startsWith("/"))t=new URL(e,s()).toString(),n=!0;else{const r=new URL(e),i=r.origin,o=new URL(s()).origin;if(n=i===o,i&&g(i,n))t=r.toString();else return}return t.endsWith("/")||(t=`${t}/`),`${t}UI5/`}catch{return}};export default l;
 //# sourceMappingURL=validateThemeRoot.js.map

package/dist/prod/validateThemeRoot.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/validateThemeRoot.ts"],
-  "sourcesContent": ["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst buildCorrectUrl = (oldUrl: string, newOrigin: string) => {\n\tconst oldUrlPath = new URL(oldUrl).pathname;\n\n\treturn new URL(oldUrlPath, newOrigin).toString();\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || themeRoot.startsWith(\"/\")) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t} else {\n\t\t\tconst themeRootURL = new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\n\t\t\tif (origin && validateThemeOrigin(origin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allow and the URL is not relative, we have to replace the origin\n\t\t\t\t// with current location\n\t\t\t\tresultUrl = buildCorrectUrl(themeRootURL.toString(), getLocationHref());\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t}\n};\n\nexport default validateThemeRoot;\n"],
-  "mappings": "aAAA,OAAS,mBAAAA,MAAuB,gBAEhC,MAAMC,EAAmBC,GAAwB,CAChD,MAAMC,EAAU,SAAS,cAAc,cAAcD,CAAW,IAAI,EAGpE,OAFkBC,GAAWA,EAAQ,aAAa,SAAS,CAG5D,EAEMC,EAAuBC,GAAmB,CAC/C,MAAMC,EAAiBL,EAAgB,2BAA2B,GAAKA,EAAgB,yBAAyB,EAGhH,OAAKK,EAIEA,EAAe,MAAM,GAAG,EAAE,KAAKC,GAC9BA,IAAkB,KAAOF,IAAWE,EAAc,KAAK,CAC9D,EALO,EAMT,EAEMC,EAAkB,CAACC,EAAgBC,IAAsB,CAC9D,MAAMC,EAAa,IAAI,IAAIF,CAAM,EAAE,SAEnC,OAAO,IAAI,IAAIE,EAAYD,CAAS,EAAE,SAAS,CAChD,EAEME,EAAqBC,GAAsB,CAChD,IAAIC,EAEJ,GAAI,CACH,GAAID,EAAU,WAAW,GAAG,GAAKA,EAAU,WAAW,GAAG,EAKxDC,EAAY,IAAI,IAAID,EAAWb,EAAgB,CAAC,EAAE,SAAS,MACrD,CACN,MAAMe,EAAe,IAAI,IAAIF,CAAS,EAChCR,EAASU,EAAa,OAExBV,GAAUD,EAAoBC,CAAM,EAEvCS,EAAYC,EAAa,SAAS,EAIlCD,EAAYN,EAAgBO,EAAa,SAAS,EAAGf,EAAgB,CAAC,CAExE,CAEA,OAAKc,EAAU,SAAS,GAAG,IAC1BA,EAAY,GAAGA,CAAS,KAGlB,GAAGA,CAAS,MACpB,MAAY,CAEZ,CACD,EAEA,eAAeF",
-  "names": ["getLocationHref", "getMetaTagValue", "metaTagName", "metaTag", "validateThemeOrigin", "origin", "allowedOrigins", "allowedOrigin", "buildCorrectUrl", "oldUrl", "newOrigin", "oldUrlPath", "validateThemeRoot", "themeRoot", "resultUrl", "themeRootURL"]
+  "sourcesContent": ["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string, isSameOrigin: boolean = false) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\t// If it's same-origin (relative URL resolved to current page), allow it when there's any meta tag present\n\t// The presence of the meta tag indicates the user wants to use theme roots\n\tif (isSameOrigin) {\n\t\treturn true;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\tlet isSameOrigin = false;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || themeRoot.startsWith(\"/\")) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t\tisSameOrigin = true;\n\t\t} else {\n\t\t\tconst themeRootURL = new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\t\t\tconst currentOrigin = new URL(getLocationHref()).origin;\n\n\t\t\t// Check if the absolute URL is same-origin\n\t\t\tisSameOrigin = origin === currentOrigin;\n\n\t\t\tif (origin && validateThemeOrigin(origin, isSameOrigin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allowed, return undefined to indicate validation failed\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t\treturn undefined;\n\t}\n};\n\nexport default validateThemeRoot;\n"],
+  "mappings": "aAAA,OAAS,mBAAAA,MAAuB,gBAEhC,MAAMC,EAAmBC,GAAwB,CAChD,MAAMC,EAAU,SAAS,cAAc,cAAcD,CAAW,IAAI,EAGpE,OAFkBC,GAAWA,EAAQ,aAAa,SAAS,CAG5D,EAEMC,EAAsB,CAACC,EAAgBC,EAAwB,KAAU,CAC9E,MAAMC,EAAiBN,EAAgB,2BAA2B,GAAKA,EAAgB,yBAAyB,EAGhH,OAAKM,EAMDD,EACI,GAGDC,EAAe,MAAM,GAAG,EAAE,KAAKC,GAC9BA,IAAkB,KAAOH,IAAWG,EAAc,KAAK,CAC9D,EAXO,EAYT,EAEMC,EAAqBC,GAAsB,CAChD,IAAIC,EACAL,EAAe,GAEnB,GAAI,CACH,GAAII,EAAU,WAAW,GAAG,GAAKA,EAAU,WAAW,GAAG,EAKxDC,EAAY,IAAI,IAAID,EAAWV,EAAgB,CAAC,EAAE,SAAS,EAC3DM,EAAe,OACT,CACN,MAAMM,EAAe,IAAI,IAAIF,CAAS,EAChCL,EAASO,EAAa,OACtBC,EAAgB,IAAI,IAAIb,EAAgB,CAAC,EAAE,OAKjD,GAFAM,EAAeD,IAAWQ,EAEtBR,GAAUD,EAAoBC,EAAQC,CAAY,EAErDK,EAAYC,EAAa,SAAS,MAGlC,OAEF,CAEA,OAAKD,EAAU,SAAS,GAAG,IAC1BA,EAAY,GAAGA,CAAS,KAGlB,GAAGA,CAAS,MACpB,MAAY,CAEX,MACD,CACD,EAEA,eAAeF",
+  "names": ["getLocationHref", "getMetaTagValue", "metaTagName", "metaTag", "validateThemeOrigin", "origin", "isSameOrigin", "allowedOrigins", "allowedOrigin", "validateThemeRoot", "themeRoot", "resultUrl", "themeRootURL", "currentOrigin"]
 }

package/dist/validateThemeRoot.js

@@ -3,22 +3,24 @@ const getMetaTagValue = (metaTagName) => {
     const metaTag = document.querySelector(`META[name="${metaTagName}"]`), metaTagContent = metaTag && metaTag.getAttribute("content");
     return metaTagContent;
 };
-const validateThemeOrigin = (origin) => {
+const validateThemeOrigin = (origin, isSameOrigin = false) => {
     const allowedOrigins = getMetaTagValue("sap-allowed-theme-origins") ?? getMetaTagValue("sap-allowedThemeOrigins"); // Prioritize the new meta tag name
     // If no allowed origins are specified, block.
     if (!allowedOrigins) {
         return false;
     }
+    // If it's same-origin (relative URL resolved to current page), allow it when there's any meta tag present
+    // The presence of the meta tag indicates the user wants to use theme roots
+    if (isSameOrigin) {
+        return true;
+    }
     return allowedOrigins.split(",").some(allowedOrigin => {
         return allowedOrigin === "*" || origin === allowedOrigin.trim();
     });
 };
-const buildCorrectUrl = (oldUrl, newOrigin) => {
-    const oldUrlPath = new URL(oldUrl).pathname;
-    return new URL(oldUrlPath, newOrigin).toString();
-};
 const validateThemeRoot = (themeRoot) => {
     let resultUrl;
+    let isSameOrigin = false;
     try {
         if (themeRoot.startsWith(".") || themeRoot.startsWith("/")) {
             // Handle relative url
@@ -26,18 +28,21 @@ const validateThemeRoot = (themeRoot) => {
             // new URL("./newExmPath", "http://example.com/exmPath") => http://example.com/exmPath/newExmPath
             // new URL("../newExmPath", "http://example.com/exmPath") => http://example.com/newExmPath
             resultUrl = new URL(themeRoot, getLocationHref()).toString();
+            isSameOrigin = true;
         }
         else {
             const themeRootURL = new URL(themeRoot);
             const origin = themeRootURL.origin;
-            if (origin && validateThemeOrigin(origin)) {
+            const currentOrigin = new URL(getLocationHref()).origin;
+            // Check if the absolute URL is same-origin
+            isSameOrigin = origin === currentOrigin;
+            if (origin && validateThemeOrigin(origin, isSameOrigin)) {
                 // If origin is allowed, use it
                 resultUrl = themeRootURL.toString();
             }
             else {
-                // If origin is not allow and the URL is not relative, we have to replace the origin
-                // with current location
-                resultUrl = buildCorrectUrl(themeRootURL.toString(), getLocationHref());
+                // If origin is not allowed, return undefined to indicate validation failed
+                return undefined;
             }
         }
         if (!resultUrl.endsWith("/")) {
@@ -47,6 +52,7 @@ const validateThemeRoot = (themeRoot) => {
     }
     catch (e) {
         // Catch if URL is not correct
+        return undefined;
     }
 };
 export default validateThemeRoot;

package/dist/validateThemeRoot.js.map

@@ -1 +1 @@
-{"version":3,"file":"validateThemeRoot.js","sourceRoot":"","sources":["../src/validateThemeRoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,EAAE;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,cAAc,WAAW,IAAI,CAAC,EACpE,cAAc,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAE7D,OAAO,cAAc,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,EAAE;IAC9C,MAAM,cAAc,GAAG,eAAe,CAAC,2BAA2B,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC,mCAAmC;IAEtJ,8CAA8C;IAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;QACrD,OAAO,aAAa,KAAK,GAAG,IAAI,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,eAAe,GAAG,CAAC,MAAc,EAAE,SAAiB,EAAE,EAAE;IAC7D,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC;IAE5C,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,EAAE;IAC/C,IAAI,SAAS,CAAC;IAEd,IAAI,CAAC;QACJ,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,sBAAsB;YACtB,wFAAwF;YACxF,iGAAiG;YACjG,0FAA0F;YAC1F,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC9D,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YAEnC,IAAI,MAAM,IAAI,mBAAmB,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3C,+BAA+B;gBAC/B,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACP,oFAAoF;gBACpF,wBAAwB;gBACxB,SAAS,GAAG,eAAe,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;YACzE,CAAC;QACF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,GAAG,SAAS,GAAG,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,SAAS,MAAM,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,8BAA8B;IAC/B,CAAC;AACF,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC","sourcesContent":["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst buildCorrectUrl = (oldUrl: string, newOrigin: string) => {\n\tconst oldUrlPath = new URL(oldUrl).pathname;\n\n\treturn new URL(oldUrlPath, newOrigin).toString();\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || themeRoot.startsWith(\"/\")) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t} else {\n\t\t\tconst themeRootURL = new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\n\t\t\tif (origin && validateThemeOrigin(origin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allow and the URL is not relative, we have to replace the origin\n\t\t\t\t// with current location\n\t\t\t\tresultUrl = buildCorrectUrl(themeRootURL.toString(), getLocationHref());\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t}\n};\n\nexport default validateThemeRoot;\n"]}
+{"version":3,"file":"validateThemeRoot.js","sourceRoot":"","sources":["../src/validateThemeRoot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAEhD,MAAM,eAAe,GAAG,CAAC,WAAmB,EAAE,EAAE;IAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,cAAc,WAAW,IAAI,CAAC,EACpE,cAAc,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;IAE7D,OAAO,cAAc,CAAC;AACvB,CAAC,CAAC;AAEF,MAAM,mBAAmB,GAAG,CAAC,MAAc,EAAE,eAAwB,KAAK,EAAE,EAAE;IAC7E,MAAM,cAAc,GAAG,eAAe,CAAC,2BAA2B,CAAC,IAAI,eAAe,CAAC,yBAAyB,CAAC,CAAC,CAAC,mCAAmC;IAEtJ,8CAA8C;IAC9C,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACd,CAAC;IAED,0GAA0G;IAC1G,2EAA2E;IAC3E,IAAI,YAAY,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE;QACrD,OAAO,aAAa,KAAK,GAAG,IAAI,MAAM,KAAK,aAAa,CAAC,IAAI,EAAE,CAAC;IACjE,CAAC,CAAC,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,iBAAiB,GAAG,CAAC,SAAiB,EAAE,EAAE;IAC/C,IAAI,SAAS,CAAC;IACd,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,IAAI,CAAC;QACJ,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5D,sBAAsB;YACtB,wFAAwF;YACxF,iGAAiG;YACjG,0FAA0F;YAC1F,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,eAAe,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC7D,YAAY,GAAG,IAAI,CAAC;QACrB,CAAC;aAAM,CAAC;YACP,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC;YAExD,2CAA2C;YAC3C,YAAY,GAAG,MAAM,KAAK,aAAa,CAAC;YAExC,IAAI,MAAM,IAAI,mBAAmB,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,CAAC;gBACzD,+BAA+B;gBAC/B,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,CAAC;YACrC,CAAC;iBAAM,CAAC;gBACP,2EAA2E;gBAC3E,OAAO,SAAS,CAAC;YAClB,CAAC;QACF,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,SAAS,GAAG,GAAG,SAAS,GAAG,CAAC;QAC7B,CAAC;QAED,OAAO,GAAG,SAAS,MAAM,CAAC;IAC3B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,8BAA8B;QAC9B,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC,CAAC;AAEF,eAAe,iBAAiB,CAAC","sourcesContent":["import { getLocationHref } from \"./Location.js\";\n\nconst getMetaTagValue = (metaTagName: string) => {\n\tconst metaTag = document.querySelector(`META[name=\"${metaTagName}\"]`),\n\t\tmetaTagContent = metaTag && metaTag.getAttribute(\"content\");\n\n\treturn metaTagContent;\n};\n\nconst validateThemeOrigin = (origin: string, isSameOrigin: boolean = false) => {\n\tconst allowedOrigins = getMetaTagValue(\"sap-allowed-theme-origins\") ?? getMetaTagValue(\"sap-allowedThemeOrigins\"); // Prioritize the new meta tag name\n\n\t// If no allowed origins are specified, block.\n\tif (!allowedOrigins) {\n\t\treturn false;\n\t}\n\n\t// If it's same-origin (relative URL resolved to current page), allow it when there's any meta tag present\n\t// The presence of the meta tag indicates the user wants to use theme roots\n\tif (isSameOrigin) {\n\t\treturn true;\n\t}\n\n\treturn allowedOrigins.split(\",\").some(allowedOrigin => {\n\t\treturn allowedOrigin === \"*\" || origin === allowedOrigin.trim();\n\t});\n};\n\nconst validateThemeRoot = (themeRoot: string) => {\n\tlet resultUrl;\n\tlet isSameOrigin = false;\n\n\ttry {\n\t\tif (themeRoot.startsWith(\".\") || themeRoot.startsWith(\"/\")) {\n\t\t\t// Handle relative url\n\t\t\t// new URL(\"/newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\t// new URL(\"./newExmPath\", \"http://example.com/exmPath\") => http://example.com/exmPath/newExmPath\n\t\t\t// new URL(\"../newExmPath\", \"http://example.com/exmPath\") => http://example.com/newExmPath\n\t\t\tresultUrl = new URL(themeRoot, getLocationHref()).toString();\n\t\t\tisSameOrigin = true;\n\t\t} else {\n\t\t\tconst themeRootURL = new URL(themeRoot);\n\t\t\tconst origin = themeRootURL.origin;\n\t\t\tconst currentOrigin = new URL(getLocationHref()).origin;\n\n\t\t\t// Check if the absolute URL is same-origin\n\t\t\tisSameOrigin = origin === currentOrigin;\n\n\t\t\tif (origin && validateThemeOrigin(origin, isSameOrigin)) {\n\t\t\t\t// If origin is allowed, use it\n\t\t\t\tresultUrl = themeRootURL.toString();\n\t\t\t} else {\n\t\t\t\t// If origin is not allowed, return undefined to indicate validation failed\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t}\n\n\t\tif (!resultUrl.endsWith(\"/\")) {\n\t\t\tresultUrl = `${resultUrl}/`;\n\t\t}\n\n\t\treturn `${resultUrl}UI5/`;\n\t} catch (e) {\n\t\t// Catch if URL is not correct\n\t\treturn undefined;\n\t}\n};\n\nexport default validateThemeRoot;\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ui5/webcomponents-base",
-  "version": "2.21.0-rc.3",
+  "version": "2.21.0",
   "description": "UI5 Web Components: webcomponents.base",
   "author": "SAP SE (https://www.sap.com)",
   "license": "Apache-2.0",
@@ -66,7 +66,7 @@
     "@openui5/sap.ui.core": "1.146.0",
     "@sap-theming/theming-base-content": "11.34.1",
     "@ui5/cypress-internal": "0.1.0",
-    "@ui5/webcomponents-tools": "2.21.0-rc.3",
+    "@ui5/webcomponents-tools": "2.21.0",
     "clean-css": "^5.2.2",
     "cypress": "15.9.0",
     "mocha": "^11.7.2",
@@ -85,5 +85,5 @@
     }
   },
   "customElements": "dist/custom-elements.json",
-  "gitHead": "a30970028a6aa6511315fc6b9f24e44ace0e66b1"
+  "gitHead": "a0d9146d9d08f171cabe6d826f104897261a139b"
 }