---
schema_version: "1"
id: 45b3e13a087c3e70fa58796916b31b009d8ef264a3127921b07eaa6b5afcdd49
title: API Distortion Changes in Lightning Web Security
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_lc_lws_distortion_changes.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_lc_lws_distortion_changes.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 73883bfa546449dd8c892b4cbff494ac94da0b7a01280a2c2b7dd07444735b78
description: Lightning Web Security (LWS) includes new security protections with more distortions for web APIs. ESLint rules matching the distortions are also available.
products:
  - Cross Cloud
release: "262"
---
# API Distortion Changes in Lightning Web Security

Lightning Web Security (LWS) includes new security protections with more distortions for web APIs. ESLint rules matching the distortions are also available.

**Where:** This change applies to Lightning Experience, LWR-based Experience Cloud sites, and Lightning web components in Aura sites when LWS is enabled.

**How:** These APIs have new distortions documented in the [LWS Distortion Viewer](https://developer.salesforce.com/tools/lws-distortion-viewer). Corresponding ESLint rules are in the ESLint package.

## New Distortions

The following distortions are new in this release.

- `Document.createNodeIterator`
- `Document.createTreeWalker`
- `Element.prototype.getAttribute`
- `Element.prototype.getAttributeNS`
- `Element.prototype.getAttributeNode`
- `Element.prototype.getAttributeNodeNS`
- `Element.prototype.innerHTML` getter
- `Element.prototype.outerHTML` getter
- `HTMLAnchorElement.prototype.href` setter — see additional details in [HTMLAnchorElement Distortion Blocks data: URI Scheme](https://help.salesforce.com/s/articleView?id=release-notes.rn_lc_lws_htmlanchorelement_distortion.htm&release=262.0.0&type=5 "The new distortion on HTMLAnchorElement.prototype.href blocks URLs that use the data: URI scheme. The data: URI scheme can be used to create plain text download links, but that approach raises various security issues. Use the blob: URI scheme instead.")
- `HTMLBaseElement.prototype.href` setter
- `HTMLButtonElement.prototype.formAction` setter
- `HTMLElement.prototype.innerText` getter
- `HTMLFormElement.prototype.action` setter
- `HTMLInputElement.prototype.formAction` setter
- `HTMLMetaElement.prototype.content` getter
- `HTMLScriptElement.prototype.text` getter
- `HTMLScriptElement.prototype.textContent` getter
- `HTMLScriptElement.innerText` getter
- `IDBFactory.prototype.databases`
- `IDBFactory.prototype.deleteDatabase`
- `IDBFactory.prototype.open`
- `MutationObserver.prototype.observe`
- `Node.prototype.textContent` getter
- `Observable.prototype.forEach`
- `Observable.prototype.subscribe`
- `Promise.prototype.catch`
- `Promise.prototype.finally`
- `Promise.prototype.then`
- `Promise.all`
- `Promise.allSettled`
- `Promise.any`
- `Promise.race`
- `Promise.reject`
- `Promise.resolve`
- `Promise.withResolvers`
- `Range.prototype.cloneContents`
- `Range.prototype.cloneRange`
- `Range.prototype.getBoundingClientRect`
- `Range.prototype.toString`
- `SVGAnimatedString.prototype.baseVal` setter
- `Selection.prototype.anchorNode`
- `Selection.prototype.focusNode`
- `Selection.prototype.toString`
- `Window.name` getter
- `Window.name` setter

## Modified Distortions

The following distortions have changed behavior in this release.

- `Element.prototype.setHTMLUnsafe`
- `URL.createObjectURL`