@lwrjs/client-modules 0.19.3 → 0.19.5

package/build/modules/lwr/lockerSandbox/lockerSandbox.js

@@ -1514,7 +1514,8 @@ const {
 } = PromiseCtor$LWS.prototype;
 const PromiseResolve$LWS = PromiseCtor$LWS.resolve.bind(PromiseCtor$LWS);
 const PromiseReject$LWS = PromiseCtor$LWS.reject.bind(PromiseCtor$LWS);
-/*! version: 0.24.6 */
+const trustedResources$LWS = toSafeSet$LWS(new SetCtor$LWS$1());
+/*! version: 0.25.3 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -1882,7 +1883,7 @@ const NodeProtoIsConnectedGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS
 ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'lastChild');
 const NodeProtoNodeNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'nodeName');
 const NodeProtoOwnerDocumentGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'ownerDocument');
-const NodeProtoParentNodeGetter$LWS = ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'parentNode');
+ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'parentNode');
 ReflectGetOwnPropertyDescriptor$LWS(NodeProto$LWS$1, 'textContent');
 const rootDocumentDetachedFragment$LWS = ReflectApply$LWS$1(DocumentProtoCreateDocumentFragment$LWS, rootDocument$LWS, []);
 const rootDocumentDetachedContainer$LWS = ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, rootDocument$LWS, ['div']);
@@ -1902,8 +1903,9 @@ class Validator$LWS {
     // There is no reason to ever allow any HTML or XML that contains all three of these substrings.
     // eslint-disable-next-line class-methods-use-this
     this.isInherentlyUnsecure = input$LWS => {
-      const hasIframe$LWS = hasTag$LWS(input$LWS, 'iframe') && ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, ['srcdoc']);
-      const hasScript$LWS = hasTag$LWS(input$LWS, 'script');
+      const normalizedInput$LWS = toSafeStringValue$LWS(input$LWS);
+      const hasIframe$LWS = hasTag$LWS(normalizedInput$LWS, 'iframe') && ReflectApply$LWS$1(StringProtoIncludes$LWS, normalizedInput$LWS, ['srcdoc']);
+      const hasScript$LWS = hasTag$LWS(normalizedInput$LWS, 'script');
       // If neither an iframe or a script was detected, then this input is safe.
       // istanbul ignore else: returns immediately
       if (!hasIframe$LWS && !hasScript$LWS) {
@@ -1914,6 +1916,10 @@ class Validator$LWS {
       if (hasIframe$LWS) {
         return true;
       }
+      // This is obnoxious... jsdom doesn't implement HTMLElement.prototype.innerText
+      if (!HTMLElementProtoInnerTextGetter$LWS && hasScript$LWS) {
+        return true;
+      }
       // If the input contained the word "script", then we need to confirm that the string
       // that was seen is actually markup.
       //
@@ -1921,7 +1927,7 @@ class Validator$LWS {
       // do not return innerText or textContent, which makes the following innerHTML/innerText
       // check useless.
       ReflectApply$LWS$1(DocumentFragmentProtoAppend$LWS, rootDocumentDetachedFragment$LWS, [rootDocumentDetachedContainer$LWS]);
-      ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, rootDocumentDetachedContainer$LWS, [input$LWS]);
+      ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, rootDocumentDetachedContainer$LWS, [normalizedInput$LWS]);
       // This MUST BE CHECKED AFTER IT IS RENDERED. The nature of these attacks requires
       // the actual source to be set to the innerHTML to allow the browser to render
       const innerHTML$LWS = ReflectApply$LWS$1(ElementProtoInnerHTMLGetter$LWS, rootDocumentDetachedContainer$LWS, []);
@@ -1964,7 +1970,12 @@ function deepIsEqualNode$LWS(leftRoot$LWS, rightRoot$LWS) {
   return false;
 }
 function hasTag$LWS(input$LWS, tag$LWS) {
-  return ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`<${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`:${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`<${tag$LWS}>`]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, input$LWS, [`:${tag$LWS}>`]);
+  let checkableInput$LWS = input$LWS;
+  if (isGaterEnabledFeature$LWS('changesSince.256')) {
+    const lowerCasedInput$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, input$LWS, []);
+    checkableInput$LWS = ReflectApply$LWS$1(StringProtoReplace$LWS, lowerCasedInput$LWS, [/\s+/g, ' ']);
+  }
+  return ReflectApply$LWS$1(StringProtoIncludes$LWS, checkableInput$LWS, [`<${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, checkableInput$LWS, [`:${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, checkableInput$LWS, [`<${tag$LWS}>`]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, checkableInput$LWS, [`:${tag$LWS}>`]);
 }
 const rootValidator$LWS = new Validator$LWS(rootDocument$LWS, rootWindow$LWS$1);
 const documentToValidatorMap$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1([[rootDocument$LWS, rootValidator$LWS]]));
@@ -2286,7 +2297,7 @@ const {
 const XhrProtoResponseTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'responseText');
 const XhrProtoStatusGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'status');
 ObjectLookupOwnSetter$LWS(XhrProto$LWS, 'withCredentials');
-/*! version: 0.24.6 */
+/*! version: 0.25.3 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -2307,6 +2318,7 @@ function isMIMETypeAllowed$LWS(mimeType$LWS) {
   }
   return false;
 }
+const DISALLOWED_ENDPOINTS_LIST$LWS = ['/aura', '/webruntime'];
 const TRUSTED_DOMAINS_REG_EXP$LWS = /\.(force|salesforce|visualforce|documentforce|my\.site|salesforce-sites)\.com$/;
 const URL_SCHEMES_LIST$LWS = toSafeArray$LWS$1(['about:', 'http:', 'https:']);
 const newlinesAndTabsRegExp$LWS = /[\u2028\u2029\n\r\t]/g;
@@ -2329,8 +2341,6 @@ function isSameOriginURL$LWS(resourceValue$LWS) {
 }
 // @TODO: W-7302311 Make paths and domains configurable.
 function isValidURL$LWS(parsedURL$LWS) {
-  // Need to add /services to isValidUrl unit test and locker/scripts/test/disallowed-endpoints.js once we remove the gate.
-  const DISALLOWED_ENDPOINTS_LIST$LWS = isGaterEnabledFeature$LWS('enableBlockServicesEndpoint') ? ['/aura', '/webruntime', '/services'] : ['/aura', '/webruntime'];
   const loweredPathname$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, parsedURL$LWS.pathname, []);
   for (let i$LWS = 0, {
       length: length$LWS
@@ -2362,7 +2372,7 @@ function sanitizeURLForElement$LWS(url$LWS) {
 function sanitizeURLString$LWS(urlString$LWS) {
   return urlString$LWS === '' ? urlString$LWS : ReflectApply$LWS$1(StringProtoReplace$LWS, urlString$LWS, [newlinesAndTabsRegExp$LWS, '']);
 }
-/*! version: 0.24.6 */
+/*! version: 0.25.3 */
 
 /*! @license DOMPurify 3.1.6 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.1.6/LICENSE */
 
@@ -3990,7 +4000,7 @@ try {
   // swallow
 }
 const trusted = createPolicy('trusted', policyOptions);
-/*! version: 0.24.6 */
+/*! version: 0.25.3 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -4251,7 +4261,7 @@ function blobSanitizer$LWS(sandboxKey$LWS) {
   }
   return getSanitizerForConfig$LWS(sandboxKey$LWS, 'STRING_BLOB_HTML');
 }
-/*! version: 0.24.6 */
+/*! version: 0.25.3 */
 
 /*!
  * Copyright (C) 2023 salesforce.com, inc.
@@ -4450,7 +4460,7 @@ function createScriptSrcURLSetter$LWS(targetElement$LWS) {
     ReflectApply$LWS$1(ElementProtoSetAttributeNS$LWS, targetElement$LWS, [attributeNamespaceURI$LWS, attributeName$LWS, src$LWS]);
   };
 }
-/*! version: 0.24.6 */
+/*! version: 0.25.3 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -5195,65 +5205,7 @@ document$LWS = globalObject$LWS.document) {
 function setCustomElementsRegistry$LWS(document$LWS, key$LWS) {
   currentRegistry$LWS = getSandboxCustomElementRegistry$LWS(document$LWS, key$LWS);
 }
-const DataTransferBlockedProperties$LWS = ['mozCursor', 'mozSourceNode', 'mozUserCancelled'];
-const elementShadowRootBySandboxKeyRegistry$LWS = {
-  __proto__: null
-};
-function registerShadowRootInSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
-  const {
-    [sandboxKey$LWS]: elementShadowRootRegistry$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1())
-  } = elementShadowRootBySandboxKeyRegistry$LWS;
-  elementShadowRootRegistry$LWS.add(shadowRoot$LWS);
-  if (!elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS]) {
-    elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS] = elementShadowRootRegistry$LWS;
-  }
-}
-function isShadowRootAccessibleInThisSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
-  const elementShadowRootRegistry$LWS = elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS];
-  if (!elementShadowRootRegistry$LWS) {
-    return false;
-  }
-  return elementShadowRootRegistry$LWS.has(shadowRoot$LWS);
-}
-function isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, container$LWS) {
-  let parentNode$LWS = container$LWS;
-  do {
-    if (isShadowRootAccessibleInThisSandbox$LWS(key$LWS, parentNode$LWS)) {
-      return true;
-    }
-  } while (parentNode$LWS = ReflectApply$LWS$1(NodeProtoParentNodeGetter$LWS, parentNode$LWS, []));
-  return false;
-}
-function initDistortionAbstractRangeEndContainerGetter$LWS({
-  globalObject: {
-    AbstractRange: AbstractRange$LWS
-  }
-}) {
-  const originalEndContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRange$LWS.prototype, 'endContainer');
-  return function distortionEndContainerGetter$LWS({
-    key: key$LWS
-  }) {
-    return [originalEndContainerGetter$LWS, function endContainer$LWS() {
-      const realEndContainer$LWS = ReflectApply$LWS$1(originalEndContainerGetter$LWS, this, []);
-      return isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, realEndContainer$LWS) ? realEndContainer$LWS : null;
-    }];
-  };
-}
-function initDistortionAbstractRangeStartContainerGetter$LWS({
-  globalObject: {
-    AbstractRange: AbstractRange$LWS
-  }
-}) {
-  const originalStartContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRange$LWS.prototype, 'startContainer');
-  return function distortionStartContainerGetter$LWS({
-    key: key$LWS
-  }) {
-    return [originalStartContainerGetter$LWS, function startContainer$LWS() {
-      const realStartContainer$LWS = ReflectApply$LWS$1(originalStartContainerGetter$LWS, this, []);
-      return isContainerWithinAShadowRootAccessibleInThisSandbox$LWS(key$LWS, realStartContainer$LWS) ? realStartContainer$LWS : null;
-    }];
-  };
-}
+const DataTransferProtoBlockedProperties$LWS = ['mozCursor', 'mozSourceNode', 'mozUserCancelled'];
 const attributeDistortionFactoriesCache$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1());
 const sandboxAttributeDistortionRegistryCache$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
 function finalizeAttributeDistortions$LWS(record$LWS) {
@@ -6235,7 +6187,7 @@ function initDistortionDocumentOpen$LWS({
       } = normalizedArgs$LWS;
       // In 256, limit this restriction to urls that can be treated as same-origin
       // istanbul ignore else: previous behavior will not be tested in collection coverage
-      if (isGaterEnabledFeature$LWS('enabledChangesSince.256')) {
+      if (isGaterEnabledFeature$LWS('changesSince.256')) {
         // This CANNOT be combined with the above condition, because doing so
         // will result in the else consequent body being executed in the case
         // where the gate is enabled and the url is not same origin,
@@ -6410,6 +6362,25 @@ function initDistortionElementAppend$LWS({
     return distortionEntry$LWS;
   };
 }
+const elementShadowRootBySandboxKeyRegistry$LWS = {
+  __proto__: null
+};
+function registerShadowRootInSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
+  const {
+    [sandboxKey$LWS]: elementShadowRootRegistry$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1())
+  } = elementShadowRootBySandboxKeyRegistry$LWS;
+  elementShadowRootRegistry$LWS.add(shadowRoot$LWS);
+  if (!elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS]) {
+    elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS] = elementShadowRootRegistry$LWS;
+  }
+}
+function isShadowRootAccessibleInThisSandbox$LWS(sandboxKey$LWS, shadowRoot$LWS) {
+  const elementShadowRootRegistry$LWS = elementShadowRootBySandboxKeyRegistry$LWS[sandboxKey$LWS];
+  if (!elementShadowRootRegistry$LWS) {
+    return false;
+  }
+  return elementShadowRootRegistry$LWS.has(shadowRoot$LWS);
+}
 function initDistortionElementAttachShadow$LWS({
   globalObject: {
     Element: {
@@ -7052,6 +7023,7 @@ function initDistortionElementSetHTML$LWS({
     return [originalSetHTML$LWS, function setHTML$LWS(...args$LWS) {
       const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
       if (!isOwnerXMLDocument$LWS) {
+        const normalizedValue$LWS = toSafeStringValue$LWS(args$LWS[0]);
         // istanbul ignore else: needs default platform behavior test
         if (isSharedElement$g$LWS(this)) {
           throw new LockerSecurityError$LWS(`Cannot setHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
@@ -7063,9 +7035,8 @@ function initDistortionElementSetHTML$LWS({
         setCustomElementsRegistry$LWS(document$LWS, key$LWS);
         // If options not specified, the default Sanitizer object is used.
         // This will be in addition to the sanitization we have.
-        const value$LWS = args$LWS[0];
         const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
-        args$LWS[0] = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
+        args$LWS[0] = lwsInternalPolicy$LWS.createHTML(normalizedValue$LWS, key$LWS, contentType$LWS);
         if (isInherentlyUnsecure$1$LWS(args$LWS[0])) {
           throw new LockerSecurityError$LWS(`Cannot 'setHTML' using an unsecure ${toSafeTemplateStringValue$LWS(args$LWS[0])}.`);
         }
@@ -7107,7 +7078,8 @@ function initDistortionElementSetHTMLUnsafe$LWS({
       get: originalInnerHTMLGetter$LWS,
       set: originalInnerHTMLSetter$LWS
     } = ReflectGetOwnPropertyDescriptor$LWS(Element$LWS.prototype, 'innerHTML');
-    return [originalSetHTMLUnsafe$LWS, function innerHTML$LWS(value$LWS) {
+    return [originalSetHTMLUnsafe$LWS, function setHTMLUnsafe$LWS(value$LWS) {
+      let normalizedValue$LWS = toSafeStringValue$LWS(value$LWS);
       const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
       if (!isOwnerXMLDocument$LWS) {
         // istanbul ignore else: needs default platform behavior test
@@ -7116,7 +7088,7 @@ function initDistortionElementSetHTMLUnsafe$LWS({
         }
         // This is necessary to support script.setHTMLUnsafe(...)
         if (this instanceof HTMLScriptElement$LWS || this instanceof SVGScriptElement) {
-          const scriptWasNotEvaluatedInScriptPropertySetter$LWS = scriptPropertySetters$LWS(this, 'innerHTML', trusted.createScript(value$LWS), originalInnerHTMLGetter$LWS, originalInnerHTMLSetter$LWS, distortions$LWS, sandboxEvaluator$LWS, trusted.createScript(SCRIPT_HOOK_SOURCE_TEXT$LWS));
+          const scriptWasNotEvaluatedInScriptPropertySetter$LWS = scriptPropertySetters$LWS(this, 'innerHTML', trusted.createScript(normalizedValue$LWS), originalInnerHTMLGetter$LWS, originalInnerHTMLSetter$LWS, distortions$LWS, sandboxEvaluator$LWS, trusted.createScript(SCRIPT_HOOK_SOURCE_TEXT$LWS));
           if (scriptWasNotEvaluatedInScriptPropertySetter$LWS) {
             return;
           }
@@ -7127,12 +7099,12 @@ function initDistortionElementSetHTMLUnsafe$LWS({
         // association to this sandbox.
         setCustomElementsRegistry$LWS(document$LWS, key$LWS);
         const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
-        value$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
+        normalizedValue$LWS = lwsInternalPolicy$LWS.createHTML(normalizedValue$LWS, key$LWS, contentType$LWS);
       }
-      if (isInherentlyUnsecure$LWS(value$LWS)) {
-        throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' using an unsecure ${toSafeTemplateStringValue$LWS(value$LWS)}.`);
+      if (isInherentlyUnsecure$LWS(normalizedValue$LWS)) {
+        throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' using an unsecure ${toSafeTemplateStringValue$LWS(normalizedValue$LWS)}.`);
       }
-      ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [value$LWS]);
+      ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [normalizedValue$LWS]);
     }];
   };
 }
@@ -7669,6 +7641,15 @@ function initDistortionHTMLIFrameElementSrcSetter$LWS({
       if (urlString$LWS && !isValidURLScheme$LWS(urlString$LWS)) {
         throw new LockerSecurityError$LWS('HTMLIFrameElement.src supports http://, https:// schemes, relative urls and about:blank.');
       }
+      if (isGaterEnabledFeature$LWS('changesSince.258')) {
+        const parsedURL$LWS = parseURL$LWS(urlString$LWS);
+        if (!isValidURL$LWS(parsedURL$LWS)) {
+          const {
+            normalizedURL: normalizedURL$LWS
+          } = parsedURL$LWS;
+          throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${toSafeTemplateStringValue$LWS(normalizedURL$LWS)}`);
+        }
+      }
       ReflectApply$LWS$1(HTMLIFrameElementProtoSrcSetter$LWS, this, [urlString$LWS]);
       if (isGaterEnabledFeature$LWS(ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS) && isNotAllowedToOverrideGaterEnabledFeature$LWS(record$LWS.key, ENABLE_SANDBOXED_SAMEORIGIN_IFRAME_GATE$LWS)) {
         enforceSandboxAllowScriptsForSameOriginIframeRealm$LWS(this);
@@ -8000,7 +7981,7 @@ function initDistortionHTMLScriptElementTextContentGetter$LWS({
   const descriptor$LWS = ReflectGetOwnPropertyDescriptor$LWS(HTMLScriptElement$LWS.prototype, 'textContent');
   // This may not be implemented in all browsers.
   // https://www.w3.org/TR/trusted-types/#enforcement-in-scripts
-  if (!isGaterEnabledFeature$LWS('enabledChangesSince.256') || !descriptor$LWS) {
+  if (!isGaterEnabledFeature$LWS('changesSince.256') || !descriptor$LWS) {
     return noop$LWS$1;
   }
   // istanbul ignore next: currently not implemented in Chrome (used for coverage collection)
@@ -8028,7 +8009,7 @@ function initDistortionHTMLScriptElementTextContentSetter$LWS({
   const descriptor$LWS = ReflectGetOwnPropertyDescriptor$LWS(HTMLScriptElement$LWS.prototype, 'textContent');
   // This may not be implemented in all browsers.
   // https://www.w3.org/TR/trusted-types/#enforcement-in-scripts
-  if (!isGaterEnabledFeature$LWS('enabledChangesSince.256') || !descriptor$LWS) {
+  if (!isGaterEnabledFeature$LWS('changesSince.256') || !descriptor$LWS) {
     return noop$LWS$1;
   }
   // istanbul ignore next: currently not implemented in Chrome (used for coverage collection)
@@ -9777,6 +9758,48 @@ function initDistortionWindowFetch$LWS({
   };
 }
 
+/* istanbul ignore next: only available in secure context */
+function initDistortionWindowFetchLater$LWS({
+  globalObject: {
+    fetchLater: originalFetchLater$LWS
+  }
+}) {
+  if (typeof originalFetchLater$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalFetchLater$LWS, function fetchLater$LWS(...args$LWS) {
+    if (!isGaterEnabledFeature$LWS('changesSince.258')) {
+      return ReflectApply$LWS$1(originalFetchLater$LWS, this, args$LWS);
+    }
+    // Let the native method handle missing parameters error or null/undefined URL case.
+    let {
+      0: url$LWS
+    } = args$LWS;
+    if (url$LWS !== null && url$LWS !== undefined) {
+      let parsedURL$LWS;
+      if (url$LWS instanceof Request) {
+        // Request will also normalize the url (partial to absolute url)
+        // similar to link element's href.
+        parsedURL$LWS = parseURL$LWS(ReflectApply$LWS$1(RequestProtoURLGetter$LWS, url$LWS, []));
+      } else {
+        parsedURL$LWS = parseURL$LWS(toSafeStringValue$LWS(url$LWS));
+        url$LWS = parsedURL$LWS.normalizedURL;
+        args$LWS[0] = url$LWS;
+      }
+      if (!isValidURL$LWS(parsedURL$LWS)) {
+        const {
+          normalizedURL: normalizedURL$LWS
+        } = parsedURL$LWS;
+        throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${toSafeTemplateStringValue$LWS(normalizedURL$LWS)}`);
+      }
+    }
+    return ReflectApply$LWS$1(originalFetchLater$LWS, this, args$LWS);
+  }];
+  return function distortionWindowFetchLater$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+
 // The rules for this proxy are as follows:
 //
 // If the key is a string...
@@ -10050,7 +10073,7 @@ function initDistortionWindowOpen$LWS({
     } = normalizedArgs$LWS;
     // In 256, limit this restriction to urls that can be treated as same-origin
     // istanbul ignore else: previous behavior will not be tested in collection coverage
-    if (isGaterEnabledFeature$LWS('enabledChangesSince.256')) {
+    if (isGaterEnabledFeature$LWS('changesSince.256')) {
       // This CANNOT be combined with the above condition, because doing so
       // will result in the else consequent body being executed in the case
       // where the gate is enabled and the url is not same origin,
@@ -10150,7 +10173,7 @@ function initDistortionWindowSetInterval$LWS({
               sandboxEvaluator$LWS(transformSourceText$LWS(sourceText$LWS), UNCOMPILED_CONTEXT$LWS);
             };
           } else {
-            if (isGaterEnabledFeature$LWS('enabledChangesSince.256') &&
+            if (isGaterEnabledFeature$LWS('changesSince.256') &&
             // @ts-ignore callback and eval have different type defs, but that's ok for this condition
             callback$LWS === eval) {
               throw new LockerSecurityError$LWS('Cannot pass unsafe eval reference.');
@@ -10188,7 +10211,7 @@ function initDistortionWindowSetTimeout$LWS({
               sandboxEvaluator$LWS(transformSourceText$LWS(sourceText$LWS), UNCOMPILED_CONTEXT$LWS);
             };
           } else {
-            if (isGaterEnabledFeature$LWS('enabledChangesSince.256') &&
+            if (isGaterEnabledFeature$LWS('changesSince.256') &&
             // @ts-ignore callback and eval have different type defs, but that's ok for this condition
             callback$LWS === eval) {
               throw new LockerSecurityError$LWS('Cannot pass unsafe eval reference.');
@@ -10423,14 +10446,12 @@ initDistortionSVGUseElementHrefAttribute$LWS, initDistortionSVGUseElementXlinkHr
 // TrustedTypePolicyFactory
 initDistortionTrustedTypePolicyFactoryCreatePolicy$LWS,
 // Window
-initDistortionWindowFetch$LWS, initDistortionWindowFramesGetter$LWS, initDistortionWindowGetComputedStyle$LWS, initDistortionWindowLengthGetter$LWS, initDistortionWindowOpen$LWS, initDistortionWindowPostMessage$LWS, initDistortionWindowStructuredClone$LWS,
+initDistortionWindowFetch$LWS, initDistortionWindowFetchLater$LWS, initDistortionWindowFramesGetter$LWS, initDistortionWindowGetComputedStyle$LWS, initDistortionWindowLengthGetter$LWS, initDistortionWindowOpen$LWS, initDistortionWindowPostMessage$LWS, initDistortionWindowStructuredClone$LWS,
 // Worker
 initDistortionWorkerCtor$LWS, initDistortionWorkerProto$LWS,
 // XHR
 initDistortionXMLHttpRequestOpen$LWS];
 const internalKeyedDistortionFactoryInitializers$LWS = [
-// AbstractRange
-initDistortionAbstractRangeEndContainerGetter$LWS, initDistortionAbstractRangeStartContainerGetter$LWS,
 // Attr
 initDistortionAttrValueSetter$LWS,
 // Aura
@@ -10494,26 +10515,28 @@ initDistortionElementAfter$LWS, initDistortionElementAppend$LWS, initDistortionE
 // initDistortionNodeAppendChild,
 initDistortionNodeInsertBefore$LWS]);
 const externalKeyedDistortionFactoryInitializers$LWS = internalKeyedDistortionFactoryInitializers$LWS;
-const distortionFactoryInitializerToggleSwitches$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1([[initDistortionCacheStorageDelete$LWS, 'caches'], [initDistortionCacheStorageHas$LWS, 'caches'], [initDistortionCacheStorageKeys$LWS, 'caches'], [initDistortionCacheStorageMatch$LWS, 'caches'], [initDistortionCacheStorageOpen$LWS, 'caches'], [initDistortionCookieStoreDelete$LWS, 'cookieStore'], [initDistortionCookieStoreGet$LWS, 'cookieStore'], [initDistortionCookieStoreGetAll$LWS, 'cookieStore'], [initDistortionCookieStoreOnChange$LWS, 'cookieStore'], [initDistortionCookieStoreSet$LWS, 'cookieStore'], [initDistortionCSSStyleRuleStyleGetter$LWS, 'style'], [initDistortionCustomElementRegistryDefine$LWS, 'customElements'], [initDistortionCustomElementRegistryGet$LWS, 'customElements'], [initDistortionCustomElementRegistryUpgrade$LWS, 'customElements'], [initDistortionCustomElementRegistryWhenDefined$LWS, 'customElements'], [initDistortionDocumentCookieGetter$LWS, 'documentCookie'], [initDistortionDocumentCookieSetter$LWS, 'documentCookie'], [initDistortionDocumentDomainSetter$LWS, 'documentDomain'], [initDistortionDocumentExecCommand$LWS, 'documentExecCommand'], [initDistortionDOMParserParseFromString$LWS, 'domParserParseFromString'], [initDistortionElementAfter$LWS, 'element'], [initDistortionElementAppend$LWS, 'element'], [initDistortionElementAttributesGetter$LWS, 'attributes'], [initDistortionElementBefore$LWS, 'element'], [initDistortionElementGetInnerHTML$LWS, 'innerHTML'], [initDistortionElementInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionElementInsertAdjacentElement$LWS, 'element'], [initDistortionElementInsertAdjacentHTML$LWS, 'element'], [initDistortionElementOuterHTMLSetter$LWS, 'element'], [initDistortionElementPrepend$LWS, 'element'], [initDistortionElementRemove$LWS, 'element'], [initDistortionElementReplaceChildren$LWS, 'element'], [initDistortionElementReplaceWith$LWS, 'element'], [initDistortionElementSetAttribute$LWS, 'attributes'], [initDistortionElementSetAttributeNode$LWS, 'attributes'], [initDistortionElementSetAttributeNodeNS$LWS, 'attributes'], [initDistortionElementSetAttributeNS$LWS, 'attributes'], [initDistortionElementSetHTML$LWS, 'element'], [initDistortionElementToggleAttribute$LWS, 'attributes'], [initDistortionHistoryPushState$LWS, 'history'], [initDistortionHistoryReplaceState$LWS, 'history'], [initDistortionHTMLElementDatasetGetter$LWS, 'dataset'], [initDistortionHTMLElementStyleGetter$LWS, 'style'], [initDistortionHTMLScriptElementSrcGetter$LWS, 'script'], [initDistortionHTMLScriptElementSrcSetter$LWS, 'script'], [initDistortionHTMLScriptElementTextSetter$LWS, 'script'], [initDistortionIDBObjectStoreAdd$LWS, 'indexedDB'], [initDistortionIDBObjectStorePut$LWS, 'indexedDB'], [initDistortionLocalStorage$LWS, 'storage'], [initDistortionMessagePortPostMessage$LWS, 'postMessage'], [initDistortionNamedNodeMapSetNamedItem$LWS, 'attributes'], [initDistortionNamedNodeMapSetNamedItemNS$LWS, 'attributes'], [initDistortionNavigatorSendBeacon$LWS, 'navigatorSendBeacon'], [initDistortionNodeInsertBefore$LWS, 'node'], [initDistortionNodeRemoveChild$LWS, 'node'], [initDistortionNodeReplaceChild$LWS, 'node'], [initDistortionNodeTextContentGetter$LWS, 'node'], [initDistortionNodeTextContentSetter$LWS, 'node'], [initDistortionNodeValueSetter$LWS, 'node'], [initDistortionNotificationCtor$LWS, 'notification'], [initDistortionPerformanceMark$LWS, 'performance'], [initDistortionPerformanceMarkCtor$LWS, 'performance'], [initDistortionPerformanceMeasure$LWS, 'performance'], [initDistortionRangeCreateContextualFragment$LWS, 'range'], [initDistortionRangeDeleteContents$LWS, 'range'], [initDistortionRangeExtractContents$LWS, 'range'], [initDistortionRangeInsertNode$LWS, 'range'], [initDistortionRangeSelectNode$LWS, 'range'], [initDistortionRangeSelectNodeContents$LWS, 'range'], [initDistortionRangeSetEnd$LWS, 'range'], [initDistortionRangeSetEndAfter$LWS, 'range'], [initDistortionRangeSetEndBefore$LWS, 'range'], [initDistortionRangeSetStart$LWS, 'range'], [initDistortionRangeSetStartAfter$LWS, 'range'], [initDistortionRangeSetStartBefore$LWS, 'range'], [initDistortionRangeSurroundContents$LWS, 'range'], [initDistortionSelectionCollapse$LWS, 'selection'], [initDistortionSelectionExtend$LWS, 'selection'], [initDistortionSelectionSelectAllChildren$LWS, 'selection'], [initDistortionSelectionSetBaseAndExtent$LWS, 'selection'], [initDistortionSelectionSetPosition$LWS, 'selection'], [initDistortionSessionStorage$LWS, 'storage'], [initDistortionShadowRootInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionStorage$LWS, 'storage'], [initDistortionStorageClear$LWS, 'storage'], [initDistortionStorageGetItem$LWS, 'storage'], [initDistortionStorageKey$LWS, 'storage'], [initDistortionStorageLength$LWS, 'storage'], [initDistortionStorageRemoveItem$LWS, 'storage'], [initDistortionStorageSetItem$LWS, 'storage'], [initDistortionSVGElementDatasetGetter$LWS, 'dataset'], [initDistortionSVGElementStyleGetter$LWS, 'style'], [initDistortionSVGScriptElementHrefGetter$LWS, 'script'], [initDistortionSVGScriptElementHrefSetter$LWS, 'script'], [initDistortionWindowFetch$LWS, 'windowFetch'], [initDistortionWindowFramesGetter$LWS, 'windowFrames'], [initDistortionWindowGetComputedStyle$LWS, 'style'], [initDistortionWindowLengthGetter$LWS, 'windowFrames'], [initDistortionWindowPostMessage$LWS, 'postMessage'], [initDistortionWindowSetInterval$LWS, 'setInterval'], [initDistortionWindowSetTimeout$LWS, 'setTimeout'], [initDistortionXMLHttpRequestResponseGetter$LWS, 'xhr'], [initDistortionXMLHttpRequestResponseXMLGetter$LWS, 'xhr']]));
-const DocumentBlockedProperties$LWS = ['createProcessingInstruction', 'exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onunhandledrejection', 'parseHTMLUnsafe', 'releaseCapture', 'releaseEvents', 'requestStorageAccess', 'webkitFullScreenKeyboardInputAllowed', 'write', 'writeln'];
-const ElementBlockedProperties$LWS = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
-const EventBlockedProperties$LWS = ['originalTarget', 'explicitOriginalTarget'];
+const distortionFactoryInitializerToggleSwitches$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1([[initDistortionCacheStorageDelete$LWS, 'caches'], [initDistortionCacheStorageHas$LWS, 'caches'], [initDistortionCacheStorageKeys$LWS, 'caches'], [initDistortionCacheStorageMatch$LWS, 'caches'], [initDistortionCacheStorageOpen$LWS, 'caches'], [initDistortionCookieStoreDelete$LWS, 'cookieStore'], [initDistortionCookieStoreGet$LWS, 'cookieStore'], [initDistortionCookieStoreGetAll$LWS, 'cookieStore'], [initDistortionCookieStoreOnChange$LWS, 'cookieStore'], [initDistortionCookieStoreSet$LWS, 'cookieStore'], [initDistortionCSSStyleRuleStyleGetter$LWS, 'style'], [initDistortionCustomElementRegistryDefine$LWS, 'customElements'], [initDistortionCustomElementRegistryGet$LWS, 'customElements'], [initDistortionCustomElementRegistryUpgrade$LWS, 'customElements'], [initDistortionCustomElementRegistryWhenDefined$LWS, 'customElements'], [initDistortionDocumentCookieGetter$LWS, 'documentCookie'], [initDistortionDocumentCookieSetter$LWS, 'documentCookie'], [initDistortionDocumentDomainSetter$LWS, 'documentDomain'], [initDistortionDocumentExecCommand$LWS, 'documentExecCommand'], [initDistortionDOMParserParseFromString$LWS, 'domParserParseFromString'], [initDistortionElementAfter$LWS, 'element'], [initDistortionElementAppend$LWS, 'element'], [initDistortionElementAttributesGetter$LWS, 'attributes'], [initDistortionElementBefore$LWS, 'element'], [initDistortionElementGetInnerHTML$LWS, 'innerHTML'], [initDistortionElementInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionElementInsertAdjacentElement$LWS, 'element'], [initDistortionElementInsertAdjacentHTML$LWS, 'element'], [initDistortionElementOuterHTMLSetter$LWS, 'element'], [initDistortionElementPrepend$LWS, 'element'], [initDistortionElementRemove$LWS, 'element'], [initDistortionElementReplaceChildren$LWS, 'element'], [initDistortionElementReplaceWith$LWS, 'element'], [initDistortionElementSetAttribute$LWS, 'attributes'], [initDistortionElementSetAttributeNode$LWS, 'attributes'], [initDistortionElementSetAttributeNodeNS$LWS, 'attributes'], [initDistortionElementSetAttributeNS$LWS, 'attributes'], [initDistortionElementSetHTML$LWS, 'element'], [initDistortionElementToggleAttribute$LWS, 'attributes'], [initDistortionHistoryPushState$LWS, 'history'], [initDistortionHistoryReplaceState$LWS, 'history'], [initDistortionHTMLElementDatasetGetter$LWS, 'dataset'], [initDistortionHTMLElementStyleGetter$LWS, 'style'], [initDistortionHTMLScriptElementSrcGetter$LWS, 'script'], [initDistortionHTMLScriptElementSrcSetter$LWS, 'script'], [initDistortionHTMLScriptElementTextSetter$LWS, 'script'], [initDistortionIDBObjectStoreAdd$LWS, 'indexedDB'], [initDistortionIDBObjectStorePut$LWS, 'indexedDB'], [initDistortionLocalStorage$LWS, 'storage'], [initDistortionMessagePortPostMessage$LWS, 'postMessage'], [initDistortionNamedNodeMapSetNamedItem$LWS, 'attributes'], [initDistortionNamedNodeMapSetNamedItemNS$LWS, 'attributes'], [initDistortionNavigatorSendBeacon$LWS, 'navigatorSendBeacon'], [initDistortionNodeInsertBefore$LWS, 'node'], [initDistortionNodeRemoveChild$LWS, 'node'], [initDistortionNodeReplaceChild$LWS, 'node'], [initDistortionNodeTextContentGetter$LWS, 'node'], [initDistortionNodeTextContentSetter$LWS, 'node'], [initDistortionNodeValueSetter$LWS, 'node'], [initDistortionNotificationCtor$LWS, 'notification'], [initDistortionPerformanceMark$LWS, 'performance'], [initDistortionPerformanceMarkCtor$LWS, 'performance'], [initDistortionPerformanceMeasure$LWS, 'performance'], [initDistortionRangeCreateContextualFragment$LWS, 'range'], [initDistortionRangeDeleteContents$LWS, 'range'], [initDistortionRangeExtractContents$LWS, 'range'], [initDistortionRangeInsertNode$LWS, 'range'], [initDistortionRangeSelectNode$LWS, 'range'], [initDistortionRangeSelectNodeContents$LWS, 'range'], [initDistortionRangeSetEnd$LWS, 'range'], [initDistortionRangeSetEndAfter$LWS, 'range'], [initDistortionRangeSetEndBefore$LWS, 'range'], [initDistortionRangeSetStart$LWS, 'range'], [initDistortionRangeSetStartAfter$LWS, 'range'], [initDistortionRangeSetStartBefore$LWS, 'range'], [initDistortionRangeSurroundContents$LWS, 'range'], [initDistortionSelectionCollapse$LWS, 'selection'], [initDistortionSelectionExtend$LWS, 'selection'], [initDistortionSelectionSelectAllChildren$LWS, 'selection'], [initDistortionSelectionSetBaseAndExtent$LWS, 'selection'], [initDistortionSelectionSetPosition$LWS, 'selection'], [initDistortionSessionStorage$LWS, 'storage'], [initDistortionShadowRootInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionStorage$LWS, 'storage'], [initDistortionStorageClear$LWS, 'storage'], [initDistortionStorageGetItem$LWS, 'storage'], [initDistortionStorageKey$LWS, 'storage'], [initDistortionStorageLength$LWS, 'storage'], [initDistortionStorageRemoveItem$LWS, 'storage'], [initDistortionStorageSetItem$LWS, 'storage'], [initDistortionSVGElementDatasetGetter$LWS, 'dataset'], [initDistortionSVGElementStyleGetter$LWS, 'style'], [initDistortionSVGScriptElementHrefGetter$LWS, 'script'], [initDistortionSVGScriptElementHrefSetter$LWS, 'script'], [initDistortionWindowFetch$LWS, 'windowFetch'], [initDistortionWindowFetchLater$LWS, 'windowFetchLater'], [initDistortionWindowFramesGetter$LWS, 'windowFrames'], [initDistortionWindowGetComputedStyle$LWS, 'style'], [initDistortionWindowLengthGetter$LWS, 'windowFrames'], [initDistortionWindowPostMessage$LWS, 'postMessage'], [initDistortionWindowSetInterval$LWS, 'setInterval'], [initDistortionWindowSetTimeout$LWS, 'setTimeout'], [initDistortionXMLHttpRequestResponseGetter$LWS, 'xhr'], [initDistortionXMLHttpRequestResponseXMLGetter$LWS, 'xhr']]));
+const DocumentBlockedProperties$LWS = ['parseHTMLUnsafe'];
+const DocumentProtoBlockedProperties$LWS = ['createProcessingInstruction', 'exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onunhandledrejection', 'parseHTMLUnsafe', 'releaseCapture', 'releaseEvents', 'requestStorageAccess', 'webkitFullScreenKeyboardInputAllowed', 'write', 'writeln'];
+const ElementProtoBlockedProperties$LWS = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
+const EventProtoBlockedProperties$LWS = ['originalTarget', 'explicitOriginalTarget'];
 const HTMLElementBlockedAttributes$LWS = ['nonce'];
-const HTMLElementBlockedProperties$LWS = ['nonce', 'onrejectionhandled', 'onunhandledrejection'];
-const HTMLEmbedElementBlockedProperties$LWS = ['getSVGDocument'];
+const HTMLElementProtoBlockedProperties$LWS = ['nonce', 'onrejectionhandled', 'onunhandledrejection'];
+const HTMLEmbedElementProtoBlockedProperties$LWS = ['getSVGDocument'];
 
 // https://www.w3schools.com/tags/tag_iframe.asp
 const HTMLIFrameElementBlockedAttributes$LWS = ['srcdoc'];
-const HTMLIFrameElementBlockedProperties$LWS = ['getSVGDocument', 'srcdoc'];
-const HTMLObjectElementBlockedProperties$LWS = ['getSVGDocument'];
+const HTMLIFrameElementProtoBlockedProperties$LWS = ['getSVGDocument', 'srcdoc'];
+const HTMLObjectElementProtoBlockedProperties$LWS = ['getSVGDocument'];
 const HTMLScriptElementBlockedAttributes$LWS = ['nonce'];
-const HTMLScriptElementBlockedProperties$LWS = ['nonce'];
+const HTMLScriptElementProtoBlockedProperties$LWS = ['nonce'];
 const SVGElementBlockedAttributes$LWS = ['nonce'];
-const SVGElementBlockedProperties$LWS = ['nonce'];
-const UIEventBlockedProperties$LWS = ['rangeParent'];
+const SVGElementProtoBlockedProperties$LWS = ['nonce'];
+const UIEventProtoBlockedProperties$LWS = ['rangeParent'];
+const WebAssemblyBlockedProperties$LWS = ['CompileError', 'Exception', 'Global', 'Instance', 'instantiate', 'instantiateStreaming', 'LinkError', 'Memory', 'Module', 'RuntimeError', 'Table', 'Tag', 'compile', 'compileStreaming', 'validate'];
 const WindowBlockedProperties$LWS = ['find', 'requestFileSystem', 'webkitRequestFileSystem'];
-const XSLTProcessorBlockedProperties$LWS = ['transformToDocument', 'transformToFragment'];
-/*! version: 0.24.6 */
+const XSLTProcessorProtoBlockedProperties$LWS = ['transformToDocument', 'transformToFragment'];
+/*! version: 0.25.3 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -10685,6 +10708,12 @@ function createDistortionToggleSwitchWrapper$LWS(sandboxKey$LWS, toggleSwitchNam
     return ReflectApply$LWS$1(constructOrApplyTarget$LWS, this, args$LWS);
   };
 }
+
+// When this feature is enabled, LWS must call global patching immediately
+/* istanbul ignore next: unreachable in test env */
+if (isGaterEnabledFeature$LWS('enableImmediateGlobalObjectPatching')) {
+  patchGlobalObject$LWS(rootWindow$LWS$1, rootDocument$LWS);
+}
 const distortionFactoriesCache$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
 const opaqueWindowPostMessageDistortionFactoryCache$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
 // WebKit based browsers have a bug that prematurely removes distortion entries
@@ -10777,23 +10806,28 @@ function getDistortionFactories$LWS(record$LWS) {
   addBlockedAttributeDistortionFactoryInitializers$LWS(HTMLIFrameElement$LWS, 'HTMLIFrameElement', HTMLIFrameElementBlockedAttributes$LWS, initializers$LWS);
   addBlockedAttributeDistortionFactoryInitializers$LWS(HTMLScriptElement$LWS, 'HTMLScriptElement', HTMLScriptElementBlockedAttributes$LWS, initializers$LWS);
   addBlockedAttributeDistortionFactoryInitializers$LWS(SVGElement$LWS, 'SVGElement', SVGElementBlockedAttributes$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, DataTransfer.prototype, DataTransferBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, Document$LWS.prototype, DocumentBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, Element$LWS.prototype, ElementBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, Event$LWS.prototype, EventBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLElement$LWS.prototype, HTMLElementBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLIFrameElement$LWS.prototype, HTMLIFrameElementBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLEmbedElement.prototype, HTMLEmbedElementBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLObjectElement.prototype, HTMLObjectElementBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLScriptElement$LWS.prototype, HTMLScriptElementBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, SVGElement$LWS.prototype, SVGElementBlockedProperties$LWS, initializers$LWS);
-  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, UIEvent$LWS.prototype, UIEventBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, DataTransfer.prototype, DataTransferProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, Document$LWS, DocumentBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, Document$LWS.prototype, DocumentProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, Element$LWS.prototype, ElementProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, Event$LWS.prototype, EventProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLElement$LWS.prototype, HTMLElementProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLIFrameElement$LWS.prototype, HTMLIFrameElementProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLEmbedElement.prototype, HTMLEmbedElementProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLObjectElement.prototype, HTMLObjectElementProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, HTMLScriptElement$LWS.prototype, HTMLScriptElementProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, SVGElement$LWS.prototype, SVGElementProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, UIEvent$LWS.prototype, UIEventProtoBlockedProperties$LWS, initializers$LWS);
+  addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, WebAssembly, WebAssemblyBlockedProperties$LWS, initializers$LWS);
   addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, globalObject$LWS, WindowBlockedProperties$LWS, initializers$LWS);
   // istanbul ignore else: this is a safety precaution that is unreachable via tests
   if (typeof XSLTProcessor$LWS === 'function') {
-    addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, XSLTProcessor$LWS.prototype, XSLTProcessorBlockedProperties$LWS, initializers$LWS);
+    addBlockedPropertyDistortionFactoryInitializers$LWS(record$LWS, XSLTProcessor$LWS.prototype, XSLTProcessorProtoBlockedProperties$LWS, initializers$LWS);
+  }
+  // When this feature is disabled, LWS must call global patching upon creation of first sandbox
+  if (!isGaterEnabledFeature$LWS('enableImmediateGlobalObjectPatching')) {
+    patchGlobalObject$LWS(globalObject$LWS, document$LWS);
   }
-  patchGlobalObject$LWS(globalObject$LWS, document$LWS);
   // Reuse the `initializers` array as the `factories` array.
   factories$LWS = initializers$LWS;
   for (let i$LWS = 0, {
@@ -15855,7 +15889,7 @@ function toSourceText$LWS(value$LWS, sourceType$LWS) {
   // tools from mistaking the regexp or the replacement string for an
   // actual source mapping URL.
   /\/\/# sandbox(?=MappingURL=.*?\s*$)/, '//# source']);
-  sourceText$LWS = `\n//# LWS Version = "0.24.6"\n${sourceText$LWS}`;
+  sourceText$LWS = `\n//# LWS Version = "0.25.3"\n${sourceText$LWS}`;
   return sourceType$LWS === 1 /* SourceType.Module */ && indexOfPragma$LWS(sourceText$LWS, 'use strict') === -1 ?
   // Append "'use strict'" to the extracted function body so it is
   // evaluated in strict mode.
@@ -16550,7 +16584,8 @@ function wrapPlatformResourceLoader$LWS(dep$LWS, key$LWS) {
       const sandbox$LWS = createRootWindowSandboxRecord$LWS({
         key: key$LWS
       });
-      if (isGaterEnabledFeature$LWS('enableTrustedMode') && config$LWS != null && config$LWS.trustedMode) {
+      const resourceName$LWS = ReflectApply$LWS$1(StringProtoSplit$LWS, url$LWS, ['/'])[3];
+      if (config$LWS != null && config$LWS.trustedMode && trustedResources$LWS.has(resourceName$LWS)) {
         const trustedGlobals$LWS = config$LWS.trustedGlobals;
         if ((trustedGlobals$LWS == null ? void 0 : trustedGlobals$LWS.length) > 0) {
           return dep$LWS.loadScript(cmp$LWS, urlResolved$LWS).then(() => {
@@ -16577,7 +16612,7 @@ function wrapPlatformResourceLoader$LWS(dep$LWS, key$LWS) {
   depRegistry$LWS.set(dep$LWS, secureDep$LWS);
   return secureDep$LWS;
 }
-/*! version: 0.24.6 */
+/*! version: 0.25.3 */
 
 export { $LWS, CORE_SANDBOX_KEY$LWS as CORE_SANDBOX_KEY, createRootWindowSandboxRecord$LWS as createRootWindowSandboxRecord, evaluateFunction$LWS as evaluateFunction, evaluateInCoreSandbox$LWS as evaluateInCoreSandbox, evaluateInSandbox$LWS as evaluateInSandbox, trusted, wrapDependency$LWS as wrapDependency };
 //# sourceMappingURL=lockerSandbox.js.map

package/package.json

@@ -4,7 +4,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.19.3",
+    "version": "0.19.5",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -33,11 +33,11 @@
         "build:platform": "node scripts/strip-for-core.js"
     },
     "dependencies": {
-        "@locker/sandbox": "0.24.6",
-        "@lwrjs/shared-utils": "0.19.3"
+        "@locker/sandbox": "0.25.3",
+        "@lwrjs/shared-utils": "0.19.5"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.19.3",
+        "@lwrjs/types": "0.19.5",
         "@rollup/plugin-node-resolve": "^15.2.3",
         "@rollup/plugin-sucrase": "^5.0.2",
         "@rollup/plugin-terser": "^0.4.4",
@@ -70,5 +70,5 @@
     "volta": {
         "extends": "../../../package.json"
     },
-    "gitHead": "2470689217830c5d706cf984830d6e62edf4d012"
+    "gitHead": "eb0367603d54470aed13c5476f99d60576f7741f"
 }