Vaadin Flow Components V24.10.8

Vaadin Flow Components 24.10.8

This is a release of the Java integration for Vaadin Components to be used from the Java server side with Vaadin Flow.

Changes in Flow Components from 24.10.7

Changes in vaadin-charts-flow

• New Features:

  • ⧉ Validate navigation-related URL schemes (CP: 24.10). PR:9709

    This PR cherry-picks changes from the original PR #9447 to branch 24.10. Because URL scheme validation is disabled by default in 24.10 (DeploymentConfiguration#getUrlSafeSchemes() allows all schemes unless configured), and because some components differ from main, the backport was adapted: - Scope: BreadcrumbsItem does not exist in 24.10, so it is excluded. Charts (Credits, Exporting), Login (AbstractLogin#setAction) and SideNav (SideNavItem) are all validated. - Javadoc: the @throws clauses reference {@link DeploymentConfiguration#getUrlSafeSchemes()}, since validation only rejects schemes that are not in the configured safe set (allow-all by default). This also adds the previously missing @throws on Credits#setHref and SideNavItem#setPath. - Tests: converted to JUnit 4 (as used by these modules in 24.10) and mock VaadinService/DeploymentConfiguration to enable validation, since it is off by default. --- > ## Motivation > > Mirror the Flow URL-scheme validation (vaadin/flow#24539) for the navigation, action and link sinks in flow-components. A javascript: (or other non-allow-listed) scheme on a value that the browser later treats as a link, form action or script source is a familiar XSS shape; rejecting it at the setter closes that path while leaving an explicit escape hatch for trusted, hard-coded URLs. > > ## Changes > > Validating setters added across the affected components, each with a matching setUnsafe* variant that bypasses validation: > > - SideNavItem.setPath / BreadcrumbsItem.setPath — navigation link. > - Credits.setHref — clickable Highcharts credits link. > - AbstractLogin.setAction — the form action attribute the browser POSTs to on submit. > - Exporting.setUrl — Highcharts posts SVG to this URL as a form action for export fallback. > - Exporting.setLibURL — concatenated into <script src="…"> to load offline-export dependencies at runtime. > > SideNavItem and BreadcrumbsItem constructors that take a String path validate transitively via setPath; their Javadoc now documents @throws IllegalArgumentException and explicit constructor tests cover the behaviour. > > Safe schemes are configured through the com.vaadin.safeUrlSchemes property and default to http, https, mailto, tel, ftp. > > Image, icon, SVG, Avatar, map tile and chart-resource URLs are intentionally not validated: javascript: cannot execute in <img src> / SVG <image> elements, and data: URLs are a legitimate, common use there. > > LoginFormTest and LoginOverlayTest already mock LoggerFactory to capture the existing "action attribute together with login listeners" warning. After merging Flow main, those tests started NPE-ing: Flow's UrlUtil.isSafeUrl debug-logs a fallback notice, going through LoggerFactory.getLogger(UrlUtil.class) which returned null inside the broad mock. The mock now uses Mockito.CALLS_REAL_METHODS so unrelated lookups fall through to the real factory; the explicit LoginForm/Overlay.class stubs still take precedence. > > Part of vaadin/flow#24539 --- 🤖 Generated with Claude Code

Changes in vaadin-login-flow

• New Features:

  • ⧉ Validate navigation-related URL schemes (CP: 24.10). PR:9709

    This PR cherry-picks changes from the original PR #9447 to branch 24.10. Because URL scheme validation is disabled by default in 24.10 (DeploymentConfiguration#getUrlSafeSchemes() allows all schemes unless configured), and because some components differ from main, the backport was adapted: - Scope: BreadcrumbsItem does not exist in 24.10, so it is excluded. Charts (Credits, Exporting), Login (AbstractLogin#setAction) and SideNav (SideNavItem) are all validated. - Javadoc: the @throws clauses reference {@link DeploymentConfiguration#getUrlSafeSchemes()}, since validation only rejects schemes that are not in the configured safe set (allow-all by default). This also adds the previously missing @throws on Credits#setHref and SideNavItem#setPath. - Tests: converted to JUnit 4 (as used by these modules in 24.10) and mock VaadinService/DeploymentConfiguration to enable validation, since it is off by default. --- > ## Motivation > > Mirror the Flow URL-scheme validation (vaadin/flow#24539) for the navigation, action and link sinks in flow-components. A javascript: (or other non-allow-listed) scheme on a value that the browser later treats as a link, form action or script source is a familiar XSS shape; rejecting it at the setter closes that path while leaving an explicit escape hatch for trusted, hard-coded URLs. > > ## Changes > > Validating setters added across the affected components, each with a matching setUnsafe* variant that bypasses validation: > > - SideNavItem.setPath / BreadcrumbsItem.setPath — navigation link. > - Credits.setHref — clickable Highcharts credits link. > - AbstractLogin.setAction — the form action attribute the browser POSTs to on submit. > - Exporting.setUrl — Highcharts posts SVG to this URL as a form action for export fallback. > - Exporting.setLibURL — concatenated into <script src="…"> to load offline-export dependencies at runtime. > > SideNavItem and BreadcrumbsItem constructors that take a String path validate transitively via setPath; their Javadoc now documents @throws IllegalArgumentException and explicit constructor tests cover the behaviour. > > Safe schemes are configured through the com.vaadin.safeUrlSchemes property and default to http, https, mailto, tel, ftp. > > Image, icon, SVG, Avatar, map tile and chart-resource URLs are intentionally not validated: javascript: cannot execute in <img src> / SVG <image> elements, and data: URLs are a legitimate, common use there. > > LoginFormTest and LoginOverlayTest already mock LoggerFactory to capture the existing "action attribute together with login listeners" warning. After merging Flow main, those tests started NPE-ing: Flow's UrlUtil.isSafeUrl debug-logs a fallback notice, going through LoggerFactory.getLogger(UrlUtil.class) which returned null inside the broad mock. The mock now uses Mockito.CALLS_REAL_METHODS so unrelated lookups fall through to the real factory; the explicit LoginForm/Overlay.class stubs still take precedence. > > Part of vaadin/flow#24539 --- 🤖 Generated with Claude Code

Changes in vaadin-side-nav-flow

• New Features:

  • ⧉ Validate navigation-related URL schemes (CP: 24.10). PR:9709

    This PR cherry-picks changes from the original PR #9447 to branch 24.10. Because URL scheme validation is disabled by default in 24.10 (DeploymentConfiguration#getUrlSafeSchemes() allows all schemes unless configured), and because some components differ from main, the backport was adapted: - Scope: BreadcrumbsItem does not exist in 24.10, so it is excluded. Charts (Credits, Exporting), Login (AbstractLogin#setAction) and SideNav (SideNavItem) are all validated. - Javadoc: the @throws clauses reference {@link DeploymentConfiguration#getUrlSafeSchemes()}, since validation only rejects schemes that are not in the configured safe set (allow-all by default). This also adds the previously missing @throws on Credits#setHref and SideNavItem#setPath. - Tests: converted to JUnit 4 (as used by these modules in 24.10) and mock VaadinService/DeploymentConfiguration to enable validation, since it is off by default. --- > ## Motivation > > Mirror the Flow URL-scheme validation (vaadin/flow#24539) for the navigation, action and link sinks in flow-components. A javascript: (or other non-allow-listed) scheme on a value that the browser later treats as a link, form action or script source is a familiar XSS shape; rejecting it at the setter closes that path while leaving an explicit escape hatch for trusted, hard-coded URLs. > > ## Changes > > Validating setters added across the affected components, each with a matching setUnsafe* variant that bypasses validation: > > - SideNavItem.setPath / BreadcrumbsItem.setPath — navigation link. > - Credits.setHref — clickable Highcharts credits link. > - AbstractLogin.setAction — the form action attribute the browser POSTs to on submit. > - Exporting.setUrl — Highcharts posts SVG to this URL as a form action for export fallback. > - Exporting.setLibURL — concatenated into <script src="…"> to load offline-export dependencies at runtime. > > SideNavItem and BreadcrumbsItem constructors that take a String path validate transitively via setPath; their Javadoc now documents @throws IllegalArgumentException and explicit constructor tests cover the behaviour. > > Safe schemes are configured through the com.vaadin.safeUrlSchemes property and default to http, https, mailto, tel, ftp. > > Image, icon, SVG, Avatar, map tile and chart-resource URLs are intentionally not validated: javascript: cannot execute in <img src> / SVG <image> elements, and data: URLs are a legitimate, common use there. > > LoginFormTest and LoginOverlayTest already mock LoggerFactory to capture the existing "action attribute together with login listeners" warning. After merging Flow main, those tests started NPE-ing: Flow's UrlUtil.isSafeUrl debug-logs a fallback notice, going through LoggerFactory.getLogger(UrlUtil.class) which returned null inside the broad mock. The mock now uses Mockito.CALLS_REAL_METHODS so unrelated lookups fall through to the real factory; the explicit LoginForm/Overlay.class stubs still take precedence. > > Part of vaadin/flow#24539 --- 🤖 Generated with Claude Code

Changes in vaadin-spreadsheet-flow

• Fixes:

  • ⧉ Defer Spreadsheet.selectCellRange until sheet widget layout is ready (#9381) (CP: 24.10). PR:9487

    This PR cherry-picks changes from the original PR #9381 to branch 24.10. --- > > Follow-up to #9333. When a Spreadsheet inside a closed Dialog is opened, Flow > flushes the property writes and the setSelectedCellAndRange RPC in the same > task. The api receives the call before the deferred init scheduled in > SheetWidget.resetFromModel has run — so SheetWidget.getRowHeight reads an > uninitialized definedRowHeights and throws > > > Uncaught TypeError: Cannot read properties of undefined (reading 'length') > > > That throw drops the selection and trips the *_noErrors/*_noConsoleErrors > console-log assertions. > > #9333's connector-side guard masked this by probing definedRowHeights > through the api's private GWT fields — names that only survive > -Dgwt.style=pretty (local/dev). CI compiles the GWT client with > -Dgwt.style=OBF, where those private names are renamed and api.spreadsheetWidget > is undefined. The guard itself then threw, producing the same SEVERE log and > the same ~20 spreadsheet IT failures on the cherry-pick PRs. > > > Move the layout-readiness handling into the widget that owns the operation: > > - SheetWidget.isLoaded() (package-private) — exposes the already-existing > loaded flag that flips at the end of resetFromModel's deferred command. > - SpreadsheetWidget.selectCellRange — if !sheetWidget.isLoaded(), store the > latest args and Scheduler.scheduleDeferred(this::applyPendingSelectCellRange). > The deferred re-checks, applies, or re-schedules. Latest-wins (rapid successive > calls collapse to the final selection). Bounded at 100 hops as a safety net; > in the typical case the layout init has already been scheduled before us, so > GWT's FIFO scheduler resolves us in 0–1 hops. > - vaadin-spreadsheet.js — setSelectedCellAndRange goes back to a one-liner > (this._flush(); this.api.setSelectedCellAndRange(...args)). No try/catch, > no pending state, no constants. > > Only selectCellRange is deferred — it's the only RPC that touches row/column > metrics. Other RPCs (cellsUpdated, popup ops, etc.) don't need this and > didn't fail in the original CI runs. > > > Reproduce locally by compiling the client with -Dgwt.style=OBF (matching CI) > and running the merged ITs in production mode: > > > mvn clean install -DskipTests -Dgwt.style=OBF \ > -pl vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow-client,vaadin-spreadsheet-flow-parent/vaadin-spreadsheet-flow > node scripts/mergeITs.js spreadsheet > mvn verify -Drun-it -pl integration-tests -Dvaadin.productionMode=true \ > -Dit.test='NavigationIT,SpreadsheetDialogIT' -DskipUnitTests > > > - With this PR → NavigationIT 26/0, SpreadsheetDialogIT 1/0. > - Reverting only the GWT-side change → SpreadsheetDialogIT fails with the > underlying Cannot read properties of undefined (reading 'length') in > FlowClient-…js — the actual definedRowHeights NPE. > > Follow-up to #9333. > > --- > > 🤖 Generated with Claude Code

Compatibility

• This release use Web Components listed in Vaadin Platform 24.10.8
• Tested with Vaadin Flow version 24.10.9