@locker/shared-dom - npm Package Compare versions

Comparing version 0.22.5 to 0.23.1

dist/index.cjs.d.ts

@@ -1,2 +0,2 @@
-/// <reference types="cacheable-request" />
+/// <reference types="node" />
 import { Getter, Setter } from "@locker/shared";
@@ -25,2 +25,3 @@ import { SandboxRecord as SandboxRecordBase } from "@locker/shared";
         setHTML(value: string, options?: any): void;
+        setHTMLUnsafe(value: string): void;
     }
@@ -30,2 +31,5 @@ interface Event {
     }
+    interface ShadowRoot {
+        setHTMLUnsafe(value: string): void;
+    }
     interface Window {
@@ -92,3 +96,3 @@ CookieStore?: CookieStore;
 };
-declare const DocumentProtoCreateComment: (data: string) => Comment, DocumentProtoCreateElement: {
+declare const DocumentProtoCreateComment: (data: string) => Comment, DocumentProtoCreateDocumentFragment: () => DocumentFragment, DocumentProtoCreateElement: {
     <K extends keyof HTMLElementTagNameMap>(tagName: K, options?: ElementCreationOptions | undefined): HTMLElementTagNameMap[K];
@@ -112,3 +116,3 @@ <K_1 extends keyof HTMLElementDeprecatedTagNameMap>(tagName: K_1, options?: ElementCreationOptions | undefined): HTMLElementDeprecatedTagNameMap[K_1];
 declare const DocumentProtoImplementationGetter: import("@locker/shared").Getter;
-declare const DocumentFragmentProtoGetElementById: (elementId: string) => HTMLElement | null;
+declare const DocumentFragmentProtoAppend: (...nodes: (string | Node)[]) => void, DocumentFragmentProtoGetElementById: (elementId: string) => HTMLElement | null;
 // Used by '@locker/near-membrane-shared-dom'.
@@ -196,2 +200,3 @@ // The DOMException constructor was exposed in Edge 12 but wasn't invocable
 declare const HTMLElementProto: HTMLElement;
+declare const HTMLElementProtoInnerTextGetter: import("@locker/shared").Getter;
 // Used by '@locker/near-membrane-dom'.
@@ -223,2 +228,3 @@ declare const HTMLElementProtoStyleGetter: import("@locker/shared").Getter;
 declare const NodeProtoOwnerDocumentGetter: import("@locker/shared").Getter;
+declare const NodeProtoParentNodeGetter: import("@locker/shared").Getter;
 declare const NodeProtoTextContentGetter: import("@locker/shared").Getter, NodeProtoTextContentSetter: import("@locker/shared").Setter;
@@ -361,3 +367,3 @@ declare const RangeProtoCreateContextualFragment: (fragment: string) => DocumentFragment;
 declare const XhrProtoWithCredentialsSetter: import("@locker/shared").Setter;
-export { AbortControllerCtor, AbortControllerProto, AbortControllerProtoAbort, AbortControllerProtoSignalGetter, AttrProtoNameGetter, AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter, AttrProtoValueGetter, AttrProtoValueSetter, normalizeNamespacedAttributeName, rootValidator, getValidator, BlobCtor, BlobProtoSlice, BlobProtoSizeGetter, BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER, rootDocument, DocumentProtoClose, DocumentProtoOpen, DocumentProtoCreateComment, DocumentProtoCreateElement, DocumentProtoCreateElementNS, DocumentProtoGetElementById, DocumentProtoBodyGetter, DocumentProtoCookieGetter, DocumentProtoCookieSetter, DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter, DocumentProtoHeadGetter, DocumentProtoImplementationGetter, DocumentFragmentProtoGetElementById, DOMExceptionCtor, DATA_CLONE_ERROR_CODE, DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter, ElementAriaAttributesToPropertyName, ElementProtoRemove, ElementProtoClosest, ElementProtoGetAttribute, ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute, ElementProtoQuerySelector, ElementProtoQuerySelectorAll, ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNode, ElementProtoRemoveAttributeNS, ElementProtoSetAttribute, ElementProtoSetAttributeNS, ElementProtoToggleAttribute, ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter, ElementProtoTagNameGetter, EventCtor, ErrorEventCtor, EventProtoStopPropagation, EventProtoCurrentTargetGetter, EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter, HTMLElementProto, HTMLElementProtoStyleGetter, HTMLElementGlobalAttributesToPropertyName, HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor, HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter, NAMESPACE_DEFAULT, NAMESPACE_SVG, NAMESPACE_XHTML, NAMESPACE_XLINK, NodeProtoAppendChild, NodeProtoCloneNode, NodeProtoIsEqualNode, NodeProtoChildNodesGetter, NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter, NodeProtoLastChildGetter, NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter, NodeProtoTextContentSetter, RangeProtoCreateContextualFragment, RequestProtoURLGetter, ResponseCtor, ResponseProtoOkGetter, ResponseProtoStatus, ResponseProtoStatusText, ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT, defineScriptAccessorProperty, defineScriptEvaluatorProperty, deleteOriginalScriptProperty, deleteResolvedScriptURL, deleteScriptEvaluatorProperty, getOriginalScriptProperty, getResolvedScriptURL, getScriptSrcEvaluatorHookURL, isScriptEvaluated, isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined, setOriginalScriptScriptProperty, setResolvedScriptURL, trackScriptAsEvaluated, Transpiler, UNIVERSAL_CONTEXT_NAMES, compileSourceText, generateContextAssignmentCodeFromContextNames, transformSourceText, StorageProtoKey, StorageProtoGetItem, StorageProtoRemoveItem, StorageProtoSetItem, SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter, AttributeNameToResolvedURLRegistry, CookieStore, GlobalObject, SandboxEvaluator, SandboxRecord, ScriptElement, ScriptEvaluatorPropertyCallback, URLCreateObjectURL, URLRevokeObjectURL, rootWindow, WindowClearInterval, WindowDecodeURIComponent, WindowEncodeURIComponent, WindowFetch, rootWindowLocation, WindowSetInterval, rootWindowTop, WindowQueueMicrotask, WindowDocumentGetter, WindowFrameElementGetter, WindowLengthGetter, WindowLocationGetter, initWindowOpenChildWindow, ChildWindow, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, markForUnsafePropertyBlocking, throwIfMarkedAsUnsafeInChildWindow, isWindow, normalizeWindowOpenArguments, XhrCtor, XhrProtoAbort, XhrProtoOpen, XhrProtoSend, XhrProtoResponseTextGetter, XhrProtoStatusGetter, XhrProtoWithCredentialsSetter };
+export { AbortControllerCtor, AbortControllerProto, AbortControllerProtoAbort, AbortControllerProtoSignalGetter, AttrProtoNameGetter, AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter, AttrProtoValueGetter, AttrProtoValueSetter, normalizeNamespacedAttributeName, rootValidator, getValidator, BlobCtor, BlobProtoSlice, BlobProtoSizeGetter, BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER, rootDocument, DocumentProtoClose, DocumentProtoOpen, DocumentProtoCreateComment, DocumentProtoCreateDocumentFragment, DocumentProtoCreateElement, DocumentProtoCreateElementNS, DocumentProtoGetElementById, DocumentProtoBodyGetter, DocumentProtoCookieGetter, DocumentProtoCookieSetter, DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter, DocumentProtoHeadGetter, DocumentProtoImplementationGetter, DocumentFragmentProtoAppend, DocumentFragmentProtoGetElementById, DOMExceptionCtor, DATA_CLONE_ERROR_CODE, DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter, ElementAriaAttributesToPropertyName, ElementProtoRemove, ElementProtoClosest, ElementProtoGetAttribute, ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute, ElementProtoQuerySelector, ElementProtoQuerySelectorAll, ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNode, ElementProtoRemoveAttributeNS, ElementProtoSetAttribute, ElementProtoSetAttributeNS, ElementProtoToggleAttribute, ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter, ElementProtoTagNameGetter, EventCtor, ErrorEventCtor, EventProtoStopPropagation, EventProtoCurrentTargetGetter, EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter, HTMLElementProto, HTMLElementProtoInnerTextGetter, HTMLElementProtoStyleGetter, HTMLElementGlobalAttributesToPropertyName, HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor, HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter, NAMESPACE_DEFAULT, NAMESPACE_SVG, NAMESPACE_XHTML, NAMESPACE_XLINK, NodeProtoAppendChild, NodeProtoCloneNode, NodeProtoIsEqualNode, NodeProtoChildNodesGetter, NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter, NodeProtoLastChildGetter, NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter, NodeProtoParentNodeGetter, NodeProtoTextContentGetter, NodeProtoTextContentSetter, RangeProtoCreateContextualFragment, RequestProtoURLGetter, ResponseCtor, ResponseProtoOkGetter, ResponseProtoStatus, ResponseProtoStatusText, ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT, defineScriptAccessorProperty, defineScriptEvaluatorProperty, deleteOriginalScriptProperty, deleteResolvedScriptURL, deleteScriptEvaluatorProperty, getOriginalScriptProperty, getResolvedScriptURL, getScriptSrcEvaluatorHookURL, isScriptEvaluated, isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined, setOriginalScriptScriptProperty, setResolvedScriptURL, trackScriptAsEvaluated, Transpiler, UNIVERSAL_CONTEXT_NAMES, compileSourceText, generateContextAssignmentCodeFromContextNames, transformSourceText, StorageProtoKey, StorageProtoGetItem, StorageProtoRemoveItem, StorageProtoSetItem, SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter, AttributeNameToResolvedURLRegistry, CookieStore, GlobalObject, SandboxEvaluator, SandboxRecord, ScriptElement, ScriptEvaluatorPropertyCallback, URLCreateObjectURL, URLRevokeObjectURL, rootWindow, WindowClearInterval, WindowDecodeURIComponent, WindowEncodeURIComponent, WindowFetch, rootWindowLocation, WindowSetInterval, rootWindowTop, WindowQueueMicrotask, WindowDocumentGetter, WindowFrameElementGetter, WindowLengthGetter, WindowLocationGetter, initWindowOpenChildWindow, ChildWindow, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, markForUnsafePropertyBlocking, throwIfMarkedAsUnsafeInChildWindow, isWindow, normalizeWindowOpenArguments, XhrCtor, XhrProtoAbort, XhrProtoOpen, XhrProtoSend, XhrProtoResponseTextGetter, XhrProtoStatusGetter, XhrProtoWithCredentialsSetter };
 //# sourceMappingURL=index.cjs.d.ts.map

dist/index.cjs.js

@@ -49,2 +49,3 @@ /*!
   createComment: DocumentProtoCreateComment$LWS,
+  createDocumentFragment: DocumentProtoCreateDocumentFragment$LWS,
   createElement: DocumentProtoCreateElement$LWS,
@@ -64,2 +65,6 @@ createElementNS: DocumentProtoCreateElementNS$LWS,
 const {
+  append: DocumentFragmentProtoAppend$LWS,
+  getElementById: DocumentFragmentProtoGetElementById$LWS
+} = DocumentFragment.prototype;
+const {
   prototype: ElementProto$LWS
@@ -144,22 +149,2 @@ } = Element;
 const ElementProtoTagNameGetter$LWS = shared$LWS.ObjectLookupOwnGetter(ElementProto$LWS, 'tagName');
-const HTMLTemplateElementProtoContentGetter$LWS = shared$LWS.ObjectLookupOwnGetter(HTMLTemplateElement.prototype, 'content');
-const {
-  prototype: NodeProto$LWS
-} = Node;
-const {
-  appendChild: NodeProtoAppendChild$LWS,
-  cloneNode: NodeProtoCloneNode$LWS,
-  isEqualNode: NodeProtoIsEqualNode$LWS
-} = NodeProto$LWS;
-const NodeProtoChildNodesGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'childNodes');
-const NodeProtoFirstChildGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'firstChild');
-const NodeProtoIsConnectedGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'isConnected');
-// Used by '@locker/near-membrane-dom'.
-const NodeProtoLastChildGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'lastChild');
-const NodeProtoNodeNameGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'nodeName');
-const NodeProtoOwnerDocumentGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'ownerDocument');
-const {
-  get: NodeProtoTextContentGetter$LWS,
-  set: NodeProtoTextContentSetter$LWS
-} = shared$LWS.ReflectGetOwnPropertyDescriptor(NodeProto$LWS, 'textContent');
 
@@ -359,3 +344,40 @@ // Check for the noopener feature being enabled:
 }
-
+const HTMLElement$LWS = shared$LWS.getUnmaskedFunction(rootWindow$LWS.HTMLElement);
+const {
+  prototype: HTMLElementProto$LWS
+} = HTMLElement$LWS;
+const HTMLElementProtoInnerTextGetter$LWS = shared$LWS.ObjectLookupOwnGetter(HTMLElementProto$LWS, 'innerText');
+// Used by '@locker/near-membrane-dom'.
+const HTMLElementProtoStyleGetter$LWS = shared$LWS.ObjectLookupOwnGetter(HTMLElementProto$LWS, 'style');
+const HTMLElementGlobalAttributesToPropertyName$LWS = {
+  __proto__: null,
+  accesskey: 'accessKey',
+  contenteditable: 'contentEditable',
+  enterkeyhint: 'enterKeyHint',
+  inputmode: 'inputMode',
+  tabindex: 'tabIndex'
+};
+const HTMLTemplateElementProtoContentGetter$LWS = shared$LWS.ObjectLookupOwnGetter(HTMLTemplateElement.prototype, 'content');
+const {
+  prototype: NodeProto$LWS
+} = Node;
+const {
+  appendChild: NodeProtoAppendChild$LWS,
+  cloneNode: NodeProtoCloneNode$LWS,
+  isEqualNode: NodeProtoIsEqualNode$LWS
+} = NodeProto$LWS;
+const NodeProtoChildNodesGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'childNodes');
+const NodeProtoFirstChildGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'firstChild');
+const NodeProtoIsConnectedGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'isConnected');
+// Used by '@locker/near-membrane-dom'.
+const NodeProtoLastChildGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'lastChild');
+const NodeProtoNodeNameGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'nodeName');
+const NodeProtoOwnerDocumentGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'ownerDocument');
+const NodeProtoParentNodeGetter$LWS = shared$LWS.ObjectLookupOwnGetter(NodeProto$LWS, 'parentNode');
+const {
+  get: NodeProtoTextContentGetter$LWS,
+  set: NodeProtoTextContentSetter$LWS
+} = shared$LWS.ReflectGetOwnPropertyDescriptor(NodeProto$LWS, 'textContent');
+const rootDocumentDetachedFragment$LWS = shared$LWS.ReflectApply(DocumentProtoCreateDocumentFragment$LWS, rootDocument$LWS, []);
+const rootDocumentDetachedContainer$LWS = shared$LWS.ReflectApply(DocumentProtoCreateElement$LWS, rootDocument$LWS, ['div']);
 /* eslint-disable no-underscore-dangle */
@@ -376,3 +398,30 @@ class Validator$LWS {
     // eslint-disable-next-line class-methods-use-this
-    this.isInherentlyUnsecure = input$LWS => shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['iframe']) && shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['script']) && shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['srcdoc']);
+    this.isInherentlyUnsecure = input$LWS => {
+      const hasIframe$LWS = shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['iframe']) && shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['srcdoc']);
+      const hasScript$LWS = shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, input$LWS, ['script']);
+      // If neither an iframe or a script was detected, then this input is safe.
+      if (!hasIframe$LWS && !hasScript$LWS) {
+        return false;
+      }
+      // If the string contains both the words iframe and srcdoc, it is unsafe
+      if (hasIframe$LWS) {
+        return true;
+      }
+      // If the input contained the word "script", then we need to confirm that the string
+      // that was seen is actually markup.
+      //
+      // IMPORTANT: We CANNOT reuse this.template.left/right for this check. Template elements
+      // do not return innerText or textContent, which makes the following innerHTML/innerText
+      // check useless.
+      shared$LWS.ReflectApply(DocumentFragmentProtoAppend$LWS, rootDocumentDetachedFragment$LWS, [rootDocumentDetachedContainer$LWS]);
+      shared$LWS.ReflectApply(ElementProtoInnerHTMLSetter$LWS, rootDocumentDetachedContainer$LWS, [input$LWS]);
+      // This MUST BE CHECKED AFTER IT IS RENDERED. The nature of these attacks requires
+      // the actual source to be set to the innerHTML to allow the browser to render
+      const innerHTML$LWS = shared$LWS.ReflectApply(ElementProtoInnerHTMLGetter$LWS, rootDocumentDetachedContainer$LWS, []);
+      const innerText$LWS = shared$LWS.ReflectApply(HTMLElementProtoInnerTextGetter$LWS, rootDocumentDetachedContainer$LWS, []);
+      shared$LWS.ReflectApply(ElementProtoRemove$LWS, rootDocumentDetachedContainer$LWS, []);
+      // If innerHTML contains "script", but innerText does not, then the string
+      // was hiding a script element through some kind of obfuscation, and is unsecure.
+      return shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, innerHTML$LWS, ['script']) && !shared$LWS.ReflectApply(shared$LWS.StringProtoIncludes, innerText$LWS, ['script']);
+    };
     this.isSharedElement = element$LWS => element$LWS === shared$LWS.ReflectApply(DocumentProtoHeadGetter$LWS, this._document, []) || element$LWS === shared$LWS.ReflectApply(DocumentProtoBodyGetter$LWS, this._document, []) || element$LWS === shared$LWS.ReflectApply(DocumentProtoDocumentElementGetter$LWS, this._document, []);
@@ -488,5 +537,2 @@ this._constructors = {
 }]) !== undefined : shared$LWS.ReflectApply(shared$LWS.RegExpProtoTest, webKitUserAgentRegExp$LWS, [getUserAgent$LWS()]));
-const {
-  getElementById: DocumentFragmentProtoGetElementById$LWS
-} = DocumentFragment.prototype;
 
@@ -530,17 +576,3 @@ // Used by '@locker/near-membrane-shared-dom'.
 const HTMLAnchorElementProtoProtocolGetter$LWS = shared$LWS.ObjectLookupOwnGetter(HTMLAnchorElementProto$LWS, 'protocol');
-const HTMLElement$LWS = shared$LWS.getUnmaskedFunction(rootWindow$LWS.HTMLElement);
 const {
-  prototype: HTMLElementProto$LWS
-} = HTMLElement$LWS;
-// Used by '@locker/near-membrane-dom'.
-const HTMLElementProtoStyleGetter$LWS = shared$LWS.ObjectLookupOwnGetter(HTMLElementProto$LWS, 'style');
-const HTMLElementGlobalAttributesToPropertyName$LWS = {
-  __proto__: null,
-  accesskey: 'accessKey',
-  contenteditable: 'contentEditable',
-  enterkeyhint: 'enterKeyHint',
-  inputmode: 'inputMode',
-  tabindex: 'tabIndex'
-};
-const {
   prototype: HTMLIFrameElementProto$LWS
@@ -1083,2 +1115,3 @@ } = HTMLIFrameElement;
 exports.DOMTokenListProtoValueGetter = DOMTokenListProtoValueGetter$LWS;
+exports.DocumentFragmentProtoAppend = DocumentFragmentProtoAppend$LWS;
 exports.DocumentFragmentProtoGetElementById = DocumentFragmentProtoGetElementById$LWS;
@@ -1090,2 +1123,3 @@ exports.DocumentProtoBodyGetter = DocumentProtoBodyGetter$LWS;
 exports.DocumentProtoCreateComment = DocumentProtoCreateComment$LWS;
+exports.DocumentProtoCreateDocumentFragment = DocumentProtoCreateDocumentFragment$LWS;
 exports.DocumentProtoCreateElement = DocumentProtoCreateElement$LWS;
@@ -1133,2 +1167,3 @@ exports.DocumentProtoCreateElementNS = DocumentProtoCreateElementNS$LWS;
 exports.HTMLElementProto = HTMLElementProto$LWS;
+exports.HTMLElementProtoInnerTextGetter = HTMLElementProtoInnerTextGetter$LWS;
 exports.HTMLElementProtoStyleGetter = HTMLElementProtoStyleGetter$LWS;
@@ -1158,2 +1193,3 @@ exports.HTMLIFrameElementProtoContentWindowGetter = HTMLIFrameElementProtoContentWindowGetter$LWS;
 exports.NodeProtoOwnerDocumentGetter = NodeProtoOwnerDocumentGetter$LWS;
+exports.NodeProtoParentNodeGetter = NodeProtoParentNodeGetter$LWS;
 exports.NodeProtoTextContentGetter = NodeProtoTextContentGetter$LWS;
@@ -1225,2 +1261,2 @@ exports.NodeProtoTextContentSetter = NodeProtoTextContentSetter$LWS;
 exports.transformSourceText = transformSourceText$LWS;
-/*! version: 0.22.5 */
+/*! version: 0.23.1 */

dist/index.mjs.d.ts

@@ -0,1 +1,2 @@
+/// <reference types="node" />
 /// <reference types="cacheable-request" />
@@ -12,2 +13,3 @@ import { Getter, Setter } from "@locker/shared";
     (reason?: any): void;
+    (reason?: any): void;
 };
@@ -26,2 +28,3 @@ declare const AbortControllerProtoSignalGetter: import("@locker/shared").Getter;
         setHTML(value: string, options?: any): void;
+        setHTMLUnsafe(value: string): void;
     }
@@ -31,2 +34,5 @@ interface Event {
     }
+    interface ShadowRoot {
+        setHTMLUnsafe(value: string): void;
+    }
     interface Window {
@@ -93,3 +99,3 @@ CookieStore?: CookieStore;
 };
-declare const DocumentProtoCreateComment: (data: string) => Comment, DocumentProtoCreateElement: {
+declare const DocumentProtoCreateComment: (data: string) => Comment, DocumentProtoCreateDocumentFragment: () => DocumentFragment, DocumentProtoCreateElement: {
     <K extends keyof HTMLElementTagNameMap>(tagName: K, options?: ElementCreationOptions | undefined): HTMLElementTagNameMap[K];
@@ -113,3 +119,3 @@ <K_1 extends keyof HTMLElementDeprecatedTagNameMap>(tagName: K_1, options?: ElementCreationOptions | undefined): HTMLElementDeprecatedTagNameMap[K_1];
 declare const DocumentProtoImplementationGetter: import("@locker/shared").Getter;
-declare const DocumentFragmentProtoGetElementById: (elementId: string) => HTMLElement | null;
+declare const DocumentFragmentProtoAppend: (...nodes: (string | Node)[]) => void, DocumentFragmentProtoGetElementById: (elementId: string) => HTMLElement | null;
 // Used by '@locker/near-membrane-shared-dom'.
@@ -197,2 +203,3 @@ // The DOMException constructor was exposed in Edge 12 but wasn't invocable
 declare const HTMLElementProto: HTMLElement;
+declare const HTMLElementProtoInnerTextGetter: import("@locker/shared").Getter;
 // Used by '@locker/near-membrane-dom'.
@@ -224,2 +231,3 @@ declare const HTMLElementProtoStyleGetter: import("@locker/shared").Getter;
 declare const NodeProtoOwnerDocumentGetter: import("@locker/shared").Getter;
+declare const NodeProtoParentNodeGetter: import("@locker/shared").Getter;
 declare const NodeProtoTextContentGetter: import("@locker/shared").Getter, NodeProtoTextContentSetter: import("@locker/shared").Setter;
@@ -362,3 +370,3 @@ declare const RangeProtoCreateContextualFragment: (fragment: string) => DocumentFragment;
 declare const XhrProtoWithCredentialsSetter: import("@locker/shared").Setter;
-export { AbortControllerCtor, AbortControllerProto, AbortControllerProtoAbort, AbortControllerProtoSignalGetter, AttrProtoNameGetter, AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter, AttrProtoValueGetter, AttrProtoValueSetter, normalizeNamespacedAttributeName, rootValidator, getValidator, BlobCtor, BlobProtoSlice, BlobProtoSizeGetter, BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER, rootDocument, DocumentProtoClose, DocumentProtoOpen, DocumentProtoCreateComment, DocumentProtoCreateElement, DocumentProtoCreateElementNS, DocumentProtoGetElementById, DocumentProtoBodyGetter, DocumentProtoCookieGetter, DocumentProtoCookieSetter, DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter, DocumentProtoHeadGetter, DocumentProtoImplementationGetter, DocumentFragmentProtoGetElementById, DOMExceptionCtor, DATA_CLONE_ERROR_CODE, DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter, ElementAriaAttributesToPropertyName, ElementProtoRemove, ElementProtoClosest, ElementProtoGetAttribute, ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute, ElementProtoQuerySelector, ElementProtoQuerySelectorAll, ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNode, ElementProtoRemoveAttributeNS, ElementProtoSetAttribute, ElementProtoSetAttributeNS, ElementProtoToggleAttribute, ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter, ElementProtoTagNameGetter, EventCtor, ErrorEventCtor, EventProtoStopPropagation, EventProtoCurrentTargetGetter, EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter, HTMLElementProto, HTMLElementProtoStyleGetter, HTMLElementGlobalAttributesToPropertyName, HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor, HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter, NAMESPACE_DEFAULT, NAMESPACE_SVG, NAMESPACE_XHTML, NAMESPACE_XLINK, NodeProtoAppendChild, NodeProtoCloneNode, NodeProtoIsEqualNode, NodeProtoChildNodesGetter, NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter, NodeProtoLastChildGetter, NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter, NodeProtoTextContentSetter, RangeProtoCreateContextualFragment, RequestProtoURLGetter, ResponseCtor, ResponseProtoOkGetter, ResponseProtoStatus, ResponseProtoStatusText, ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT, defineScriptAccessorProperty, defineScriptEvaluatorProperty, deleteOriginalScriptProperty, deleteResolvedScriptURL, deleteScriptEvaluatorProperty, getOriginalScriptProperty, getResolvedScriptURL, getScriptSrcEvaluatorHookURL, isScriptEvaluated, isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined, setOriginalScriptScriptProperty, setResolvedScriptURL, trackScriptAsEvaluated, Transpiler, UNIVERSAL_CONTEXT_NAMES, compileSourceText, generateContextAssignmentCodeFromContextNames, transformSourceText, StorageProtoKey, StorageProtoGetItem, StorageProtoRemoveItem, StorageProtoSetItem, SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter, AttributeNameToResolvedURLRegistry, CookieStore, GlobalObject, SandboxEvaluator, SandboxRecord, ScriptElement, ScriptEvaluatorPropertyCallback, URLCreateObjectURL, URLRevokeObjectURL, rootWindow, WindowClearInterval, WindowDecodeURIComponent, WindowEncodeURIComponent, WindowFetch, rootWindowLocation, WindowSetInterval, rootWindowTop, WindowQueueMicrotask, WindowDocumentGetter, WindowFrameElementGetter, WindowLengthGetter, WindowLocationGetter, initWindowOpenChildWindow, ChildWindow, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, markForUnsafePropertyBlocking, throwIfMarkedAsUnsafeInChildWindow, isWindow, normalizeWindowOpenArguments, XhrCtor, XhrProtoAbort, XhrProtoOpen, XhrProtoSend, XhrProtoResponseTextGetter, XhrProtoStatusGetter, XhrProtoWithCredentialsSetter };
+export { AbortControllerCtor, AbortControllerProto, AbortControllerProtoAbort, AbortControllerProtoSignalGetter, AttrProtoNameGetter, AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter, AttrProtoValueGetter, AttrProtoValueSetter, normalizeNamespacedAttributeName, rootValidator, getValidator, BlobCtor, BlobProtoSlice, BlobProtoSizeGetter, BlobProtoTypeGetter, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER, rootDocument, DocumentProtoClose, DocumentProtoOpen, DocumentProtoCreateComment, DocumentProtoCreateDocumentFragment, DocumentProtoCreateElement, DocumentProtoCreateElementNS, DocumentProtoGetElementById, DocumentProtoBodyGetter, DocumentProtoCookieGetter, DocumentProtoCookieSetter, DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter, DocumentProtoHeadGetter, DocumentProtoImplementationGetter, DocumentFragmentProtoAppend, DocumentFragmentProtoGetElementById, DOMExceptionCtor, DATA_CLONE_ERROR_CODE, DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter, ElementAriaAttributesToPropertyName, ElementProtoRemove, ElementProtoClosest, ElementProtoGetAttribute, ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute, ElementProtoQuerySelector, ElementProtoQuerySelectorAll, ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNode, ElementProtoRemoveAttributeNS, ElementProtoSetAttribute, ElementProtoSetAttributeNS, ElementProtoToggleAttribute, ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter, ElementProtoTagNameGetter, EventCtor, ErrorEventCtor, EventProtoStopPropagation, EventProtoCurrentTargetGetter, EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter, HTMLElementProto, HTMLElementProtoInnerTextGetter, HTMLElementProtoStyleGetter, HTMLElementGlobalAttributesToPropertyName, HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor, HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter, NAMESPACE_DEFAULT, NAMESPACE_SVG, NAMESPACE_XHTML, NAMESPACE_XLINK, NodeProtoAppendChild, NodeProtoCloneNode, NodeProtoIsEqualNode, NodeProtoChildNodesGetter, NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter, NodeProtoLastChildGetter, NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter, NodeProtoParentNodeGetter, NodeProtoTextContentGetter, NodeProtoTextContentSetter, RangeProtoCreateContextualFragment, RequestProtoURLGetter, ResponseCtor, ResponseProtoOkGetter, ResponseProtoStatus, ResponseProtoStatusText, ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT, defineScriptAccessorProperty, defineScriptEvaluatorProperty, deleteOriginalScriptProperty, deleteResolvedScriptURL, deleteScriptEvaluatorProperty, getOriginalScriptProperty, getResolvedScriptURL, getScriptSrcEvaluatorHookURL, isScriptEvaluated, isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined, setOriginalScriptScriptProperty, setResolvedScriptURL, trackScriptAsEvaluated, Transpiler, UNIVERSAL_CONTEXT_NAMES, compileSourceText, generateContextAssignmentCodeFromContextNames, transformSourceText, StorageProtoKey, StorageProtoGetItem, StorageProtoRemoveItem, StorageProtoSetItem, SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter, AttributeNameToResolvedURLRegistry, CookieStore, GlobalObject, SandboxEvaluator, SandboxRecord, ScriptElement, ScriptEvaluatorPropertyCallback, URLCreateObjectURL, URLRevokeObjectURL, rootWindow, WindowClearInterval, WindowDecodeURIComponent, WindowEncodeURIComponent, WindowFetch, rootWindowLocation, WindowSetInterval, rootWindowTop, WindowQueueMicrotask, WindowDocumentGetter, WindowFrameElementGetter, WindowLengthGetter, WindowLocationGetter, initWindowOpenChildWindow, ChildWindow, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, markForUnsafePropertyBlocking, throwIfMarkedAsUnsafeInChildWindow, isWindow, normalizeWindowOpenArguments, XhrCtor, XhrProtoAbort, XhrProtoOpen, XhrProtoSend, XhrProtoResponseTextGetter, XhrProtoStatusGetter, XhrProtoWithCredentialsSetter };
 //# sourceMappingURL=index.mjs.d.ts.map

dist/index.mjs.js

 /*!
  * Copyright (C) 2019 salesforce.com, inc.
  */
-import { ObjectLookupOwnGetter as ObjectLookupOwnGetter$LWS, ReflectGetOwnPropertyDescriptor as ReflectGetOwnPropertyDescriptor$LWS, ReflectApply as ReflectApply$LWS, StringProtoEndsWith as StringProtoEndsWith$LWS, StringProtoStartsWith as StringProtoStartsWith$LWS, SymbolFor as SymbolFor$LWS, PromiseResolve as PromiseResolve$LWS, PromiseProtoThen as PromiseProtoThen$LWS, PromiseProtoCatch as PromiseProtoCatch$LWS, ReflectDefineProperty as ReflectDefineProperty$LWS, LockerSecurityError as LockerSecurityError$LWS, ObjectHasOwn as ObjectHasOwn$LWS, shallowCloneArray as shallowCloneArray$LWS, StringProtoToLowerCase as StringProtoToLowerCase$LWS, RegExpProtoTest as RegExpProtoTest$LWS, StringProtoReplace as StringProtoReplace$LWS, toSafeWeakMap as toSafeWeakMap$LWS, WeakMapCtor as WeakMapCtor$LWS, StringProtoIncludes as StringProtoIncludes$LWS, ArrayIsArray as ArrayIsArray$LWS, ArrayProtoFind as ArrayProtoFind$LWS, LOCKER_SERVICE_KEY_LOWERED as LOCKER_SERVICE_KEY_LOWERED$LWS, getUnmaskedFunction as getUnmaskedFunction$LWS, ObjectLookupOwnSetter as ObjectLookupOwnSetter$LWS, toSafeWeakSet as toSafeWeakSet$LWS, WeakSetCtor as WeakSetCtor$LWS, FunctionProtoBind as FunctionProtoBind$LWS, UNCOMPILED_LOCATION_NAME as UNCOMPILED_LOCATION_NAME$LWS, UNCOMPILED_TOP_NAME as UNCOMPILED_TOP_NAME$LWS, ReflectDeleteProperty as ReflectDeleteProperty$LWS, StringProtoCharCodeAt as StringProtoCharCodeAt$LWS, ArrayProtoJoin as ArrayProtoJoin$LWS, RegExpCtor as RegExpCtor$LWS, RegExpProtoExec as RegExpProtoExec$LWS, StringProtoSubstring as StringProtoSubstring$LWS, StringProtoSlice as StringProtoSlice$LWS, toRegExpEscapedString as toRegExpEscapedString$LWS, SANDBOX_EVAL_CONTEXT_NAME as SANDBOX_EVAL_CONTEXT_NAME$LWS, toRegExpEscapedIdentifierName as toRegExpEscapedIdentifierName$LWS, WEBPACK_REQUIRE_NAME as WEBPACK_REQUIRE_NAME$LWS, ArrayProtoToString as ArrayProtoToString$LWS, indexOfPragma as indexOfPragma$LWS } from '@locker/shared';
+import { ObjectLookupOwnGetter as ObjectLookupOwnGetter$LWS, ReflectGetOwnPropertyDescriptor as ReflectGetOwnPropertyDescriptor$LWS, ReflectApply as ReflectApply$LWS, StringProtoEndsWith as StringProtoEndsWith$LWS, StringProtoStartsWith as StringProtoStartsWith$LWS, SymbolFor as SymbolFor$LWS, PromiseResolve as PromiseResolve$LWS, PromiseProtoThen as PromiseProtoThen$LWS, PromiseProtoCatch as PromiseProtoCatch$LWS, ReflectDefineProperty as ReflectDefineProperty$LWS, LockerSecurityError as LockerSecurityError$LWS, ObjectHasOwn as ObjectHasOwn$LWS, shallowCloneArray as shallowCloneArray$LWS, StringProtoToLowerCase as StringProtoToLowerCase$LWS, RegExpProtoTest as RegExpProtoTest$LWS, StringProtoReplace as StringProtoReplace$LWS, getUnmaskedFunction as getUnmaskedFunction$LWS, toSafeWeakMap as toSafeWeakMap$LWS, WeakMapCtor as WeakMapCtor$LWS, StringProtoIncludes as StringProtoIncludes$LWS, ArrayIsArray as ArrayIsArray$LWS, ArrayProtoFind as ArrayProtoFind$LWS, LOCKER_SERVICE_KEY_LOWERED as LOCKER_SERVICE_KEY_LOWERED$LWS, ObjectLookupOwnSetter as ObjectLookupOwnSetter$LWS, toSafeWeakSet as toSafeWeakSet$LWS, WeakSetCtor as WeakSetCtor$LWS, FunctionProtoBind as FunctionProtoBind$LWS, UNCOMPILED_LOCATION_NAME as UNCOMPILED_LOCATION_NAME$LWS, UNCOMPILED_TOP_NAME as UNCOMPILED_TOP_NAME$LWS, ReflectDeleteProperty as ReflectDeleteProperty$LWS, StringProtoCharCodeAt as StringProtoCharCodeAt$LWS, ArrayProtoJoin as ArrayProtoJoin$LWS, RegExpCtor as RegExpCtor$LWS, RegExpProtoExec as RegExpProtoExec$LWS, StringProtoSubstring as StringProtoSubstring$LWS, StringProtoSlice as StringProtoSlice$LWS, toRegExpEscapedString as toRegExpEscapedString$LWS, SANDBOX_EVAL_CONTEXT_NAME as SANDBOX_EVAL_CONTEXT_NAME$LWS, toRegExpEscapedIdentifierName as toRegExpEscapedIdentifierName$LWS, WEBPACK_REQUIRE_NAME as WEBPACK_REQUIRE_NAME$LWS, ArrayProtoToString as ArrayProtoToString$LWS, indexOfPragma as indexOfPragma$LWS } from '@locker/shared';
 const AbortControllerCtor$LWS = AbortController;
@@ -44,2 +44,3 @@ const {
   createComment: DocumentProtoCreateComment$LWS,
+  createDocumentFragment: DocumentProtoCreateDocumentFragment$LWS,
   createElement: DocumentProtoCreateElement$LWS,
@@ -59,2 +60,6 @@ createElementNS: DocumentProtoCreateElementNS$LWS,
 const {
+  append: DocumentFragmentProtoAppend$LWS,
+  getElementById: DocumentFragmentProtoGetElementById$LWS
+} = DocumentFragment.prototype;
+const {
   prototype: ElementProto$LWS
@@ -139,22 +144,2 @@ } = Element;
 const ElementProtoTagNameGetter$LWS = ObjectLookupOwnGetter$LWS(ElementProto$LWS, 'tagName');
-const HTMLTemplateElementProtoContentGetter$LWS = ObjectLookupOwnGetter$LWS(HTMLTemplateElement.prototype, 'content');
-const {
-  prototype: NodeProto$LWS
-} = Node;
-const {
-  appendChild: NodeProtoAppendChild$LWS,
-  cloneNode: NodeProtoCloneNode$LWS,
-  isEqualNode: NodeProtoIsEqualNode$LWS
-} = NodeProto$LWS;
-const NodeProtoChildNodesGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'childNodes');
-const NodeProtoFirstChildGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'firstChild');
-const NodeProtoIsConnectedGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'isConnected');
-// Used by '@locker/near-membrane-dom'.
-const NodeProtoLastChildGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'lastChild');
-const NodeProtoNodeNameGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'nodeName');
-const NodeProtoOwnerDocumentGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'ownerDocument');
-const {
-  get: NodeProtoTextContentGetter$LWS,
-  set: NodeProtoTextContentSetter$LWS
-} = ReflectGetOwnPropertyDescriptor$LWS(NodeProto$LWS, 'textContent');
 
@@ -354,3 +339,40 @@ // Check for the noopener feature being enabled:
 }
-
+const HTMLElement$LWS = getUnmaskedFunction$LWS(rootWindow$LWS.HTMLElement);
+const {
+  prototype: HTMLElementProto$LWS
+} = HTMLElement$LWS;
+const HTMLElementProtoInnerTextGetter$LWS = ObjectLookupOwnGetter$LWS(HTMLElementProto$LWS, 'innerText');
+// Used by '@locker/near-membrane-dom'.
+const HTMLElementProtoStyleGetter$LWS = ObjectLookupOwnGetter$LWS(HTMLElementProto$LWS, 'style');
+const HTMLElementGlobalAttributesToPropertyName$LWS = {
+  __proto__: null,
+  accesskey: 'accessKey',
+  contenteditable: 'contentEditable',
+  enterkeyhint: 'enterKeyHint',
+  inputmode: 'inputMode',
+  tabindex: 'tabIndex'
+};
+const HTMLTemplateElementProtoContentGetter$LWS = ObjectLookupOwnGetter$LWS(HTMLTemplateElement.prototype, 'content');
+const {
+  prototype: NodeProto$LWS
+} = Node;
+const {
+  appendChild: NodeProtoAppendChild$LWS,
+  cloneNode: NodeProtoCloneNode$LWS,
+  isEqualNode: NodeProtoIsEqualNode$LWS
+} = NodeProto$LWS;
+const NodeProtoChildNodesGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'childNodes');
+const NodeProtoFirstChildGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'firstChild');
+const NodeProtoIsConnectedGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'isConnected');
+// Used by '@locker/near-membrane-dom'.
+const NodeProtoLastChildGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'lastChild');
+const NodeProtoNodeNameGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'nodeName');
+const NodeProtoOwnerDocumentGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'ownerDocument');
+const NodeProtoParentNodeGetter$LWS = ObjectLookupOwnGetter$LWS(NodeProto$LWS, 'parentNode');
+const {
+  get: NodeProtoTextContentGetter$LWS,
+  set: NodeProtoTextContentSetter$LWS
+} = ReflectGetOwnPropertyDescriptor$LWS(NodeProto$LWS, 'textContent');
+const rootDocumentDetachedFragment$LWS = ReflectApply$LWS(DocumentProtoCreateDocumentFragment$LWS, rootDocument$LWS, []);
+const rootDocumentDetachedContainer$LWS = ReflectApply$LWS(DocumentProtoCreateElement$LWS, rootDocument$LWS, ['div']);
 /* eslint-disable no-underscore-dangle */
@@ -371,3 +393,30 @@ class Validator$LWS {
     // eslint-disable-next-line class-methods-use-this
-    this.isInherentlyUnsecure = input$LWS => ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['iframe']) && ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['script']) && ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['srcdoc']);
+    this.isInherentlyUnsecure = input$LWS => {
+      const hasIframe$LWS = ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['iframe']) && ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['srcdoc']);
+      const hasScript$LWS = ReflectApply$LWS(StringProtoIncludes$LWS, input$LWS, ['script']);
+      // If neither an iframe or a script was detected, then this input is safe.
+      if (!hasIframe$LWS && !hasScript$LWS) {
+        return false;
+      }
+      // If the string contains both the words iframe and srcdoc, it is unsafe
+      if (hasIframe$LWS) {
+        return true;
+      }
+      // If the input contained the word "script", then we need to confirm that the string
+      // that was seen is actually markup.
+      //
+      // IMPORTANT: We CANNOT reuse this.template.left/right for this check. Template elements
+      // do not return innerText or textContent, which makes the following innerHTML/innerText
+      // check useless.
+      ReflectApply$LWS(DocumentFragmentProtoAppend$LWS, rootDocumentDetachedFragment$LWS, [rootDocumentDetachedContainer$LWS]);
+      ReflectApply$LWS(ElementProtoInnerHTMLSetter$LWS, rootDocumentDetachedContainer$LWS, [input$LWS]);
+      // This MUST BE CHECKED AFTER IT IS RENDERED. The nature of these attacks requires
+      // the actual source to be set to the innerHTML to allow the browser to render
+      const innerHTML$LWS = ReflectApply$LWS(ElementProtoInnerHTMLGetter$LWS, rootDocumentDetachedContainer$LWS, []);
+      const innerText$LWS = ReflectApply$LWS(HTMLElementProtoInnerTextGetter$LWS, rootDocumentDetachedContainer$LWS, []);
+      ReflectApply$LWS(ElementProtoRemove$LWS, rootDocumentDetachedContainer$LWS, []);
+      // If innerHTML contains "script", but innerText does not, then the string
+      // was hiding a script element through some kind of obfuscation, and is unsecure.
+      return ReflectApply$LWS(StringProtoIncludes$LWS, innerHTML$LWS, ['script']) && !ReflectApply$LWS(StringProtoIncludes$LWS, innerText$LWS, ['script']);
+    };
     this.isSharedElement = element$LWS => element$LWS === ReflectApply$LWS(DocumentProtoHeadGetter$LWS, this._document, []) || element$LWS === ReflectApply$LWS(DocumentProtoBodyGetter$LWS, this._document, []) || element$LWS === ReflectApply$LWS(DocumentProtoDocumentElementGetter$LWS, this._document, []);
@@ -483,5 +532,2 @@ this._constructors = {
 }]) !== undefined : ReflectApply$LWS(RegExpProtoTest$LWS, webKitUserAgentRegExp$LWS, [getUserAgent$LWS()]));
-const {
-  getElementById: DocumentFragmentProtoGetElementById$LWS
-} = DocumentFragment.prototype;
 
@@ -525,17 +571,3 @@ // Used by '@locker/near-membrane-shared-dom'.
 const HTMLAnchorElementProtoProtocolGetter$LWS = ObjectLookupOwnGetter$LWS(HTMLAnchorElementProto$LWS, 'protocol');
-const HTMLElement$LWS = getUnmaskedFunction$LWS(rootWindow$LWS.HTMLElement);
 const {
-  prototype: HTMLElementProto$LWS
-} = HTMLElement$LWS;
-// Used by '@locker/near-membrane-dom'.
-const HTMLElementProtoStyleGetter$LWS = ObjectLookupOwnGetter$LWS(HTMLElementProto$LWS, 'style');
-const HTMLElementGlobalAttributesToPropertyName$LWS = {
-  __proto__: null,
-  accesskey: 'accessKey',
-  contenteditable: 'contentEditable',
-  enterkeyhint: 'enterKeyHint',
-  inputmode: 'inputMode',
-  tabindex: 'tabIndex'
-};
-const {
   prototype: HTMLIFrameElementProto$LWS
@@ -1058,3 +1090,3 @@ } = HTMLIFrameElement;
 const XhrProtoWithCredentialsSetter$LWS = ObjectLookupOwnSetter$LWS(XhrProto$LWS, 'withCredentials');
-export { AbortControllerCtor$LWS as AbortControllerCtor, AbortControllerProto$LWS as AbortControllerProto, AbortControllerProtoAbort$LWS as AbortControllerProtoAbort, AbortControllerProtoSignalGetter$LWS as AbortControllerProtoSignalGetter, AttrProtoNameGetter$LWS as AttrProtoNameGetter, AttrProtoNamespaceURIGetter$LWS as AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter$LWS as AttrProtoOwnerElementGetter, AttrProtoValueGetter$LWS as AttrProtoValueGetter, AttrProtoValueSetter$LWS as AttrProtoValueSetter, BlobCtor$LWS as BlobCtor, BlobProtoSizeGetter$LWS as BlobProtoSizeGetter, BlobProtoSlice$LWS as BlobProtoSlice, BlobProtoTypeGetter$LWS as BlobProtoTypeGetter, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS as CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME$LWS as CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, DATA_CLONE_ERROR_CODE$LWS as DATA_CLONE_ERROR_CODE, DOMExceptionCtor$LWS as DOMExceptionCtor, DOMExceptionProtoCodeGetter$LWS as DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument$LWS as DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter$LWS as DOMTokenListProtoValueGetter, DocumentFragmentProtoGetElementById$LWS as DocumentFragmentProtoGetElementById, DocumentProtoBodyGetter$LWS as DocumentProtoBodyGetter, DocumentProtoClose$LWS as DocumentProtoClose, DocumentProtoCookieGetter$LWS as DocumentProtoCookieGetter, DocumentProtoCookieSetter$LWS as DocumentProtoCookieSetter, DocumentProtoCreateComment$LWS as DocumentProtoCreateComment, DocumentProtoCreateElement$LWS as DocumentProtoCreateElement, DocumentProtoCreateElementNS$LWS as DocumentProtoCreateElementNS, DocumentProtoDefaultViewGetter$LWS as DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter$LWS as DocumentProtoDocumentElementGetter, DocumentProtoGetElementById$LWS as DocumentProtoGetElementById, DocumentProtoHeadGetter$LWS as DocumentProtoHeadGetter, DocumentProtoImplementationGetter$LWS as DocumentProtoImplementationGetter, DocumentProtoOpen$LWS as DocumentProtoOpen, ElementAriaAttributesToPropertyName$LWS as ElementAriaAttributesToPropertyName, ElementProtoClosest$LWS as ElementProtoClosest, ElementProtoGetAttribute$LWS as ElementProtoGetAttribute, ElementProtoGetAttributeNode$LWS as ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS$LWS as ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute$LWS as ElementProtoHasAttribute, ElementProtoInnerHTMLGetter$LWS as ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter$LWS as ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter$LWS as ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter$LWS as ElementProtoOuterHTMLGetter, ElementProtoQuerySelector$LWS as ElementProtoQuerySelector, ElementProtoQuerySelectorAll$LWS as ElementProtoQuerySelectorAll, ElementProtoRemove$LWS as ElementProtoRemove, ElementProtoRemoveAttribute$LWS as ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNS$LWS as ElementProtoRemoveAttributeNS, ElementProtoRemoveAttributeNode$LWS as ElementProtoRemoveAttributeNode, ElementProtoSetAttribute$LWS as ElementProtoSetAttribute, ElementProtoSetAttributeNS$LWS as ElementProtoSetAttributeNS, ElementProtoTagNameGetter$LWS as ElementProtoTagNameGetter, ElementProtoToggleAttribute$LWS as ElementProtoToggleAttribute, ErrorEventCtor$LWS as ErrorEventCtor, EventCtor$LWS as EventCtor, EventProtoCurrentTargetGetter$LWS as EventProtoCurrentTargetGetter, EventProtoStopPropagation$LWS as EventProtoStopPropagation, EventTargetProtoAddEventListener$LWS as EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent$LWS as EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener$LWS as EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter$LWS as HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter$LWS as HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter$LWS as HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter$LWS as HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter$LWS as HTMLAnchorElementProtoProtocolGetter, HTMLElementGlobalAttributesToPropertyName$LWS as HTMLElementGlobalAttributesToPropertyName, HTMLElementProto$LWS as HTMLElementProto, HTMLElementProtoStyleGetter$LWS as HTMLElementProtoStyleGetter, HTMLIFrameElementProtoContentWindowGetter$LWS as HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter$LWS as HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor$LWS as HTMLScriptElementCtor, HTMLScriptElementProto$LWS as HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter$LWS as HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter$LWS as HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter$LWS as HTMLTemplateElementProtoContentGetter, IS_CHROMIUM_BROWSER$LWS as IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER$LWS as IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER$LWS as IS_WEBKIT_BROWSER, NAMESPACE_DEFAULT$LWS as NAMESPACE_DEFAULT, NAMESPACE_SVG$LWS as NAMESPACE_SVG, NAMESPACE_XHTML$LWS as NAMESPACE_XHTML, NAMESPACE_XLINK$LWS as NAMESPACE_XLINK, NodeProtoAppendChild$LWS as NodeProtoAppendChild, NodeProtoChildNodesGetter$LWS as NodeProtoChildNodesGetter, NodeProtoCloneNode$LWS as NodeProtoCloneNode, NodeProtoFirstChildGetter$LWS as NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter$LWS as NodeProtoIsConnectedGetter, NodeProtoIsEqualNode$LWS as NodeProtoIsEqualNode, NodeProtoLastChildGetter$LWS as NodeProtoLastChildGetter, NodeProtoNodeNameGetter$LWS as NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter$LWS as NodeProtoOwnerDocumentGetter, NodeProtoTextContentGetter$LWS as NodeProtoTextContentGetter, NodeProtoTextContentSetter$LWS as NodeProtoTextContentSetter, RangeProtoCreateContextualFragment$LWS as RangeProtoCreateContextualFragment, RequestProtoURLGetter$LWS as RequestProtoURLGetter, ResponseCtor$LWS as ResponseCtor, ResponseProtoOkGetter$LWS as ResponseProtoOkGetter, ResponseProtoStatus$LWS as ResponseProtoStatus, ResponseProtoStatusText$LWS as ResponseProtoStatusText, ResponseProtoText$LWS as ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT$LWS as SCRIPT_HOOK_SOURCE_TEXT, SVGScriptElementProtoHrefGetter$LWS as SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter$LWS as SVGScriptElementProtoHrefSetter, StorageProtoGetItem$LWS as StorageProtoGetItem, StorageProtoKey$LWS as StorageProtoKey, StorageProtoRemoveItem$LWS as StorageProtoRemoveItem, StorageProtoSetItem$LWS as StorageProtoSetItem, Transpiler$LWS as Transpiler, UNIVERSAL_CONTEXT_NAMES$LWS as UNIVERSAL_CONTEXT_NAMES, URLCreateObjectURL$LWS as URLCreateObjectURL, URLRevokeObjectURL$LWS as URLRevokeObjectURL, WindowClearInterval$LWS as WindowClearInterval, WindowDecodeURIComponent$LWS as WindowDecodeURIComponent, WindowDocumentGetter$LWS as WindowDocumentGetter, WindowEncodeURIComponent$LWS as WindowEncodeURIComponent, WindowFetch$LWS as WindowFetch, WindowFrameElementGetter$LWS as WindowFrameElementGetter, WindowLengthGetter$LWS as WindowLengthGetter, WindowLocationGetter$LWS as WindowLocationGetter, WindowQueueMicrotask$LWS as WindowQueueMicrotask, WindowSetInterval$LWS as WindowSetInterval, XhrCtor$LWS as XhrCtor, XhrProtoAbort$LWS as XhrProtoAbort, XhrProtoOpen$LWS as XhrProtoOpen, XhrProtoResponseTextGetter$LWS as XhrProtoResponseTextGetter, XhrProtoSend$LWS as XhrProtoSend, XhrProtoStatusGetter$LWS as XhrProtoStatusGetter, XhrProtoWithCredentialsSetter$LWS as XhrProtoWithCredentialsSetter, compileSourceText$LWS as compileSourceText, defineScriptAccessorProperty$LWS as defineScriptAccessorProperty, defineScriptEvaluatorProperty$LWS as defineScriptEvaluatorProperty, deleteOriginalScriptProperty$LWS as deleteOriginalScriptProperty, deleteResolvedScriptURL$LWS as deleteResolvedScriptURL, deleteScriptEvaluatorProperty$LWS as deleteScriptEvaluatorProperty, generateContextAssignmentCodeFromContextNames$LWS as generateContextAssignmentCodeFromContextNames, getOriginalScriptProperty$LWS as getOriginalScriptProperty, getResolvedScriptURL$LWS as getResolvedScriptURL, getScriptSrcEvaluatorHookURL$LWS as getScriptSrcEvaluatorHookURL, getValidator$LWS as getValidator, initWindowOpenChildWindow$LWS as initWindowOpenChildWindow, isScriptEvaluated$LWS as isScriptEvaluated, isScriptPropertyEvaluatorHookDefined$LWS as isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined$LWS as isScriptURLEvaluatorHookDefined, isWindow$LWS as isWindow, markForUnsafePropertyBlocking$LWS as markForUnsafePropertyBlocking, normalizeNamespacedAttributeName$LWS as normalizeNamespacedAttributeName, normalizeWindowOpenArguments$LWS as normalizeWindowOpenArguments, rootDocument$LWS as rootDocument, rootValidator$LWS as rootValidator, rootWindow$LWS as rootWindow, rootWindowLocation$LWS as rootWindowLocation, rootWindowTop$LWS as rootWindowTop, setOriginalScriptScriptProperty$LWS as setOriginalScriptScriptProperty, setResolvedScriptURL$LWS as setResolvedScriptURL, throwIfMarkedAsUnsafeInChildWindow$LWS as throwIfMarkedAsUnsafeInChildWindow, trackScriptAsEvaluated$LWS as trackScriptAsEvaluated, transformSourceText$LWS as transformSourceText };
-/*! version: 0.22.5 */
+export { AbortControllerCtor$LWS as AbortControllerCtor, AbortControllerProto$LWS as AbortControllerProto, AbortControllerProtoAbort$LWS as AbortControllerProtoAbort, AbortControllerProtoSignalGetter$LWS as AbortControllerProtoSignalGetter, AttrProtoNameGetter$LWS as AttrProtoNameGetter, AttrProtoNamespaceURIGetter$LWS as AttrProtoNamespaceURIGetter, AttrProtoOwnerElementGetter$LWS as AttrProtoOwnerElementGetter, AttrProtoValueGetter$LWS as AttrProtoValueGetter, AttrProtoValueSetter$LWS as AttrProtoValueSetter, BlobCtor$LWS as BlobCtor, BlobProtoSizeGetter$LWS as BlobProtoSizeGetter, BlobProtoSlice$LWS as BlobProtoSlice, BlobProtoTypeGetter$LWS as BlobProtoTypeGetter, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS as CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL, CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME$LWS as CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME, DATA_CLONE_ERROR_CODE$LWS as DATA_CLONE_ERROR_CODE, DOMExceptionCtor$LWS as DOMExceptionCtor, DOMExceptionProtoCodeGetter$LWS as DOMExceptionProtoCodeGetter, DOMImplementationProtoCreateDocument$LWS as DOMImplementationProtoCreateDocument, DOMTokenListProtoValueGetter$LWS as DOMTokenListProtoValueGetter, DocumentFragmentProtoAppend$LWS as DocumentFragmentProtoAppend, DocumentFragmentProtoGetElementById$LWS as DocumentFragmentProtoGetElementById, DocumentProtoBodyGetter$LWS as DocumentProtoBodyGetter, DocumentProtoClose$LWS as DocumentProtoClose, DocumentProtoCookieGetter$LWS as DocumentProtoCookieGetter, DocumentProtoCookieSetter$LWS as DocumentProtoCookieSetter, DocumentProtoCreateComment$LWS as DocumentProtoCreateComment, DocumentProtoCreateDocumentFragment$LWS as DocumentProtoCreateDocumentFragment, DocumentProtoCreateElement$LWS as DocumentProtoCreateElement, DocumentProtoCreateElementNS$LWS as DocumentProtoCreateElementNS, DocumentProtoDefaultViewGetter$LWS as DocumentProtoDefaultViewGetter, DocumentProtoDocumentElementGetter$LWS as DocumentProtoDocumentElementGetter, DocumentProtoGetElementById$LWS as DocumentProtoGetElementById, DocumentProtoHeadGetter$LWS as DocumentProtoHeadGetter, DocumentProtoImplementationGetter$LWS as DocumentProtoImplementationGetter, DocumentProtoOpen$LWS as DocumentProtoOpen, ElementAriaAttributesToPropertyName$LWS as ElementAriaAttributesToPropertyName, ElementProtoClosest$LWS as ElementProtoClosest, ElementProtoGetAttribute$LWS as ElementProtoGetAttribute, ElementProtoGetAttributeNode$LWS as ElementProtoGetAttributeNode, ElementProtoGetAttributeNodeNS$LWS as ElementProtoGetAttributeNodeNS, ElementProtoHasAttribute$LWS as ElementProtoHasAttribute, ElementProtoInnerHTMLGetter$LWS as ElementProtoInnerHTMLGetter, ElementProtoInnerHTMLSetter$LWS as ElementProtoInnerHTMLSetter, ElementProtoNamespaceURIGetter$LWS as ElementProtoNamespaceURIGetter, ElementProtoOuterHTMLGetter$LWS as ElementProtoOuterHTMLGetter, ElementProtoQuerySelector$LWS as ElementProtoQuerySelector, ElementProtoQuerySelectorAll$LWS as ElementProtoQuerySelectorAll, ElementProtoRemove$LWS as ElementProtoRemove, ElementProtoRemoveAttribute$LWS as ElementProtoRemoveAttribute, ElementProtoRemoveAttributeNS$LWS as ElementProtoRemoveAttributeNS, ElementProtoRemoveAttributeNode$LWS as ElementProtoRemoveAttributeNode, ElementProtoSetAttribute$LWS as ElementProtoSetAttribute, ElementProtoSetAttributeNS$LWS as ElementProtoSetAttributeNS, ElementProtoTagNameGetter$LWS as ElementProtoTagNameGetter, ElementProtoToggleAttribute$LWS as ElementProtoToggleAttribute, ErrorEventCtor$LWS as ErrorEventCtor, EventCtor$LWS as EventCtor, EventProtoCurrentTargetGetter$LWS as EventProtoCurrentTargetGetter, EventProtoStopPropagation$LWS as EventProtoStopPropagation, EventTargetProtoAddEventListener$LWS as EventTargetProtoAddEventListener, EventTargetProtoDispatchEvent$LWS as EventTargetProtoDispatchEvent, EventTargetProtoRemoveEventListener$LWS as EventTargetProtoRemoveEventListener, HTMLAnchorElementProtoHostnameGetter$LWS as HTMLAnchorElementProtoHostnameGetter, HTMLAnchorElementProtoHrefGetter$LWS as HTMLAnchorElementProtoHrefGetter, HTMLAnchorElementProtoHrefSetter$LWS as HTMLAnchorElementProtoHrefSetter, HTMLAnchorElementProtoPathnameGetter$LWS as HTMLAnchorElementProtoPathnameGetter, HTMLAnchorElementProtoProtocolGetter$LWS as HTMLAnchorElementProtoProtocolGetter, HTMLElementGlobalAttributesToPropertyName$LWS as HTMLElementGlobalAttributesToPropertyName, HTMLElementProto$LWS as HTMLElementProto, HTMLElementProtoInnerTextGetter$LWS as HTMLElementProtoInnerTextGetter, HTMLElementProtoStyleGetter$LWS as HTMLElementProtoStyleGetter, HTMLIFrameElementProtoContentWindowGetter$LWS as HTMLIFrameElementProtoContentWindowGetter, HTMLIFrameElementProtoSrcSetter$LWS as HTMLIFrameElementProtoSrcSetter, HTMLScriptElementCtor$LWS as HTMLScriptElementCtor, HTMLScriptElementProto$LWS as HTMLScriptElementProto, HTMLScriptElementProtoSrcGetter$LWS as HTMLScriptElementProtoSrcGetter, HTMLScriptElementProtoSrcSetter$LWS as HTMLScriptElementProtoSrcSetter, HTMLTemplateElementProtoContentGetter$LWS as HTMLTemplateElementProtoContentGetter, IS_CHROMIUM_BROWSER$LWS as IS_CHROMIUM_BROWSER, IS_OLD_CHROMIUM_BROWSER$LWS as IS_OLD_CHROMIUM_BROWSER, IS_WEBKIT_BROWSER$LWS as IS_WEBKIT_BROWSER, NAMESPACE_DEFAULT$LWS as NAMESPACE_DEFAULT, NAMESPACE_SVG$LWS as NAMESPACE_SVG, NAMESPACE_XHTML$LWS as NAMESPACE_XHTML, NAMESPACE_XLINK$LWS as NAMESPACE_XLINK, NodeProtoAppendChild$LWS as NodeProtoAppendChild, NodeProtoChildNodesGetter$LWS as NodeProtoChildNodesGetter, NodeProtoCloneNode$LWS as NodeProtoCloneNode, NodeProtoFirstChildGetter$LWS as NodeProtoFirstChildGetter, NodeProtoIsConnectedGetter$LWS as NodeProtoIsConnectedGetter, NodeProtoIsEqualNode$LWS as NodeProtoIsEqualNode, NodeProtoLastChildGetter$LWS as NodeProtoLastChildGetter, NodeProtoNodeNameGetter$LWS as NodeProtoNodeNameGetter, NodeProtoOwnerDocumentGetter$LWS as NodeProtoOwnerDocumentGetter, NodeProtoParentNodeGetter$LWS as NodeProtoParentNodeGetter, NodeProtoTextContentGetter$LWS as NodeProtoTextContentGetter, NodeProtoTextContentSetter$LWS as NodeProtoTextContentSetter, RangeProtoCreateContextualFragment$LWS as RangeProtoCreateContextualFragment, RequestProtoURLGetter$LWS as RequestProtoURLGetter, ResponseCtor$LWS as ResponseCtor, ResponseProtoOkGetter$LWS as ResponseProtoOkGetter, ResponseProtoStatus$LWS as ResponseProtoStatus, ResponseProtoStatusText$LWS as ResponseProtoStatusText, ResponseProtoText$LWS as ResponseProtoText, SCRIPT_HOOK_SOURCE_TEXT$LWS as SCRIPT_HOOK_SOURCE_TEXT, SVGScriptElementProtoHrefGetter$LWS as SVGScriptElementProtoHrefGetter, SVGScriptElementProtoHrefSetter$LWS as SVGScriptElementProtoHrefSetter, StorageProtoGetItem$LWS as StorageProtoGetItem, StorageProtoKey$LWS as StorageProtoKey, StorageProtoRemoveItem$LWS as StorageProtoRemoveItem, StorageProtoSetItem$LWS as StorageProtoSetItem, Transpiler$LWS as Transpiler, UNIVERSAL_CONTEXT_NAMES$LWS as UNIVERSAL_CONTEXT_NAMES, URLCreateObjectURL$LWS as URLCreateObjectURL, URLRevokeObjectURL$LWS as URLRevokeObjectURL, WindowClearInterval$LWS as WindowClearInterval, WindowDecodeURIComponent$LWS as WindowDecodeURIComponent, WindowDocumentGetter$LWS as WindowDocumentGetter, WindowEncodeURIComponent$LWS as WindowEncodeURIComponent, WindowFetch$LWS as WindowFetch, WindowFrameElementGetter$LWS as WindowFrameElementGetter, WindowLengthGetter$LWS as WindowLengthGetter, WindowLocationGetter$LWS as WindowLocationGetter, WindowQueueMicrotask$LWS as WindowQueueMicrotask, WindowSetInterval$LWS as WindowSetInterval, XhrCtor$LWS as XhrCtor, XhrProtoAbort$LWS as XhrProtoAbort, XhrProtoOpen$LWS as XhrProtoOpen, XhrProtoResponseTextGetter$LWS as XhrProtoResponseTextGetter, XhrProtoSend$LWS as XhrProtoSend, XhrProtoStatusGetter$LWS as XhrProtoStatusGetter, XhrProtoWithCredentialsSetter$LWS as XhrProtoWithCredentialsSetter, compileSourceText$LWS as compileSourceText, defineScriptAccessorProperty$LWS as defineScriptAccessorProperty, defineScriptEvaluatorProperty$LWS as defineScriptEvaluatorProperty, deleteOriginalScriptProperty$LWS as deleteOriginalScriptProperty, deleteResolvedScriptURL$LWS as deleteResolvedScriptURL, deleteScriptEvaluatorProperty$LWS as deleteScriptEvaluatorProperty, generateContextAssignmentCodeFromContextNames$LWS as generateContextAssignmentCodeFromContextNames, getOriginalScriptProperty$LWS as getOriginalScriptProperty, getResolvedScriptURL$LWS as getResolvedScriptURL, getScriptSrcEvaluatorHookURL$LWS as getScriptSrcEvaluatorHookURL, getValidator$LWS as getValidator, initWindowOpenChildWindow$LWS as initWindowOpenChildWindow, isScriptEvaluated$LWS as isScriptEvaluated, isScriptPropertyEvaluatorHookDefined$LWS as isScriptPropertyEvaluatorHookDefined, isScriptURLEvaluatorHookDefined$LWS as isScriptURLEvaluatorHookDefined, isWindow$LWS as isWindow, markForUnsafePropertyBlocking$LWS as markForUnsafePropertyBlocking, normalizeNamespacedAttributeName$LWS as normalizeNamespacedAttributeName, normalizeWindowOpenArguments$LWS as normalizeWindowOpenArguments, rootDocument$LWS as rootDocument, rootValidator$LWS as rootValidator, rootWindow$LWS as rootWindow, rootWindowLocation$LWS as rootWindowLocation, rootWindowTop$LWS as rootWindowTop, setOriginalScriptScriptProperty$LWS as setOriginalScriptScriptProperty, setResolvedScriptURL$LWS as setResolvedScriptURL, throwIfMarkedAsUnsafeInChildWindow$LWS as throwIfMarkedAsUnsafeInChildWindow, trackScriptAsEvaluated$LWS as trackScriptAsEvaluated, transformSourceText$LWS as transformSourceText };
+/*! version: 0.23.1 */

package.json

 {
     "name": "@locker/shared-dom",
-    "version": "0.22.5",
+    "version": "0.23.1",
     "license": "SEE LICENSE IN LICENSE.txt",
@@ -19,3 +19,3 @@ "author": "Salesforce UI Security Team",
     "dependencies": {
-        "@locker/shared": "0.22.5"
+        "@locker/shared": "0.23.1"
     },
@@ -22,0 +22,0 @@ "files": [

No alert changes

Improved metrics

Total package byte prevSize

183774

increased by3.62%

Lines of code

3133

increased by2.82%

Dependency changes

• + Added@locker/shared@0.23.1(transitive)

• - Removed@locker/shared@0.22.5(transitive)

• Updated@locker/shared@0.23.1