Vaadin Flow Components V14.14.4

Vaadin Flow Components 14.14.4

This is a release of the Java integration for Vaadin Components to be used from the Java server side with Vaadin Flow.

Changes in Flow Components from 14.14.3

Changes in vaadin-charts-flow

• New Features:

  • ⧉ Validate navigation-related URL schemes (CP: 14.14). PR:9710

    This PR cherry-picks changes from the original PR #9447 to branch 14.14. Because URL scheme validation is disabled by default in 14.14 (DeploymentConfiguration#getUrlSafeSchemes() allows all schemes unless configured), and because some components differ from main, the backport was adapted: - Scope: SideNavItem and BreadcrumbsItem do not exist in 14.14, and LoginOverlayTest is not present either, so they are excluded. Only Charts (Credits, Exporting) and Login (AbstractLogin#setAction) are validated. - Javadoc: the @throws clauses reference {@link DeploymentConfiguration#getUrlSafeSchemes()}, since validation only rejects schemes that are not in the configured safe set (allow-all by default). This also adds the previously missing @throws on Credits#setHref. - AbstractLogin#setAction: keeps the existing simple behavior of this branch plus the new validation and setUnsafeAction. - Tests: use JUnit 4 (as used by these modules in 14.14) and mock VaadinService/DeploymentConfiguration to enable validation, since it is off by default. mockito-inline was added to the Charts and Login test dependencies for static mocking. The Login module is on JUnit 4.12, so its throwing test uses @Test(expected = ...). --- > ## Motivation > > Mirror the Flow URL-scheme validation (vaadin/flow#24539) for the navigation, action and link sinks in flow-components. A javascript: (or other non-allow-listed) scheme on a value that the browser later treats as a link, form action or script source is a familiar XSS shape; rejecting it at the setter closes that path while leaving an explicit escape hatch for trusted, hard-coded URLs. > > ## Changes > > Validating setters added across the affected components, each with a matching setUnsafe* variant that bypasses validation: > > - SideNavItem.setPath / BreadcrumbsItem.setPath — navigation link. > - Credits.setHref — clickable Highcharts credits link. > - AbstractLogin.setAction — the form action attribute the browser POSTs to on submit. > - Exporting.setUrl — Highcharts posts SVG to this URL as a form action for export fallback. > - Exporting.setLibURL — concatenated into <script src="…"> to load offline-export dependencies at runtime. > > SideNavItem and BreadcrumbsItem constructors that take a String path validate transitively via setPath; their Javadoc now documents @throws IllegalArgumentException and explicit constructor tests cover the behaviour. > > Safe schemes are configured through the com.vaadin.safeUrlSchemes property and default to http, https, mailto, tel, ftp. > > Image, icon, SVG, Avatar, map tile and chart-resource URLs are intentionally not validated: javascript: cannot execute in <img src> / SVG <image> elements, and data: URLs are a legitimate, common use there. > > LoginFormTest and LoginOverlayTest already mock LoggerFactory to capture the existing "action attribute together with login listeners" warning. After merging Flow main, those tests started NPE-ing: Flow's UrlUtil.isSafeUrl debug-logs a fallback notice, going through LoggerFactory.getLogger(UrlUtil.class) which returned null inside the broad mock. The mock now uses Mockito.CALLS_REAL_METHODS so unrelated lookups fall through to the real factory; the explicit LoginForm/Overlay.class stubs still take precedence. > > Part of vaadin/flow#24539 --- 🤖 Generated with Claude Code

Changes in vaadin-login-flow

• New Features:

  • ⧉ Validate navigation-related URL schemes (CP: 14.14). PR:9710

    This PR cherry-picks changes from the original PR #9447 to branch 14.14. Because URL scheme validation is disabled by default in 14.14 (DeploymentConfiguration#getUrlSafeSchemes() allows all schemes unless configured), and because some components differ from main, the backport was adapted: - Scope: SideNavItem and BreadcrumbsItem do not exist in 14.14, and LoginOverlayTest is not present either, so they are excluded. Only Charts (Credits, Exporting) and Login (AbstractLogin#setAction) are validated. - Javadoc: the @throws clauses reference {@link DeploymentConfiguration#getUrlSafeSchemes()}, since validation only rejects schemes that are not in the configured safe set (allow-all by default). This also adds the previously missing @throws on Credits#setHref. - AbstractLogin#setAction: keeps the existing simple behavior of this branch plus the new validation and setUnsafeAction. - Tests: use JUnit 4 (as used by these modules in 14.14) and mock VaadinService/DeploymentConfiguration to enable validation, since it is off by default. mockito-inline was added to the Charts and Login test dependencies for static mocking. The Login module is on JUnit 4.12, so its throwing test uses @Test(expected = ...). --- > ## Motivation > > Mirror the Flow URL-scheme validation (vaadin/flow#24539) for the navigation, action and link sinks in flow-components. A javascript: (or other non-allow-listed) scheme on a value that the browser later treats as a link, form action or script source is a familiar XSS shape; rejecting it at the setter closes that path while leaving an explicit escape hatch for trusted, hard-coded URLs. > > ## Changes > > Validating setters added across the affected components, each with a matching setUnsafe* variant that bypasses validation: > > - SideNavItem.setPath / BreadcrumbsItem.setPath — navigation link. > - Credits.setHref — clickable Highcharts credits link. > - AbstractLogin.setAction — the form action attribute the browser POSTs to on submit. > - Exporting.setUrl — Highcharts posts SVG to this URL as a form action for export fallback. > - Exporting.setLibURL — concatenated into <script src="…"> to load offline-export dependencies at runtime. > > SideNavItem and BreadcrumbsItem constructors that take a String path validate transitively via setPath; their Javadoc now documents @throws IllegalArgumentException and explicit constructor tests cover the behaviour. > > Safe schemes are configured through the com.vaadin.safeUrlSchemes property and default to http, https, mailto, tel, ftp. > > Image, icon, SVG, Avatar, map tile and chart-resource URLs are intentionally not validated: javascript: cannot execute in <img src> / SVG <image> elements, and data: URLs are a legitimate, common use there. > > LoginFormTest and LoginOverlayTest already mock LoggerFactory to capture the existing "action attribute together with login listeners" warning. After merging Flow main, those tests started NPE-ing: Flow's UrlUtil.isSafeUrl debug-logs a fallback notice, going through LoggerFactory.getLogger(UrlUtil.class) which returned null inside the broad mock. The mock now uses Mockito.CALLS_REAL_METHODS so unrelated lookups fall through to the real factory; the explicit LoginForm/Overlay.class stubs still take precedence. > > Part of vaadin/flow#24539 --- 🤖 Generated with Claude Code

Compatibility

• This release use Web Components listed in Vaadin Platform 14.14.4
• Tested with Vaadin Flow version 2.13.6