Salesforce Docs Portal

API Distortion Changes in Lightning Web Security

Lightning Web Security (LWS) includes new security protections with more distortions for web APIs. ESLint rules matching the distortions are also available.

Where: This change applies to Lightning Experience, LWR-based Experience Cloud sites, and Lightning web components in Aura sites when LWS is enabled.

How: These APIs have new distortions documented in the LWS Distortion Viewer. Corresponding ESLint rules are in the ESLint package.

New Distortions

The following distortions are new in this release.

  • Document.createNodeIterator
  • Document.createTreeWalker
  • Element.prototype.getAttribute
  • Element.prototype.getAttributeNS
  • Element.prototype.getAttributeNode
  • Element.prototype.getAttributeNodeNS
  • Element.prototype.innerHTML getter
  • Element.prototype.outerHTML getter
  • HTMLAnchorElement.prototype.href setter — see additional details in HTMLAnchorElement Distortion Blocks data: URI Scheme
  • HTMLBaseElement.prototype.href setter
  • HTMLButtonElement.prototype.formAction setter
  • HTMLElement.prototype.innerText getter
  • HTMLFormElement.prototype.action setter
  • HTMLInputElement.prototype.formAction setter
  • HTMLMetaElement.prototype.content getter
  • HTMLScriptElement.prototype.text getter
  • HTMLScriptElement.prototype.textContent getter
  • HTMLScriptElement.innerText getter
  • IDBFactory.prototype.databases
  • IDBFactory.prototype.deleteDatabase
  • IDBFactory.prototype.open
  • MutationObserver.prototype.observe
  • Node.prototype.textContent getter
  • Observable.prototype.forEach
  • Observable.prototype.subscribe
  • Promise.prototype.catch
  • Promise.prototype.finally
  • Promise.prototype.then
  • Promise.all
  • Promise.allSettled
  • Promise.any
  • Promise.race
  • Promise.reject
  • Promise.resolve
  • Promise.withResolvers
  • Range.prototype.cloneContents
  • Range.prototype.cloneRange
  • Range.prototype.getBoundingClientRect
  • Range.prototype.toString
  • SVGAnimatedString.prototype.baseVal setter
  • Selection.prototype.anchorNode
  • Selection.prototype.focusNode
  • Selection.prototype.toString
  • Window.name getter
  • Window.name setter

Modified Distortions

The following distortions have changed behavior in this release.

  • Element.prototype.setHTMLUnsafe
  • URL.createObjectURL