@lwrjs/client-modules 0.22.16 → 0.22.17

package/build/modules/lwr/lockerDefine/lockerDefine.js

@@ -1510,7 +1510,7 @@ const {
 const PromiseResolve$LWS = PromiseCtor$LWS.resolve.bind(PromiseCtor$LWS);
 const PromiseReject$LWS = PromiseCtor$LWS.reject.bind(PromiseCtor$LWS);
 const trustedResources$LWS = toSafeSet$LWS(new SetCtor$LWS$1());
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -1954,6 +1954,69 @@ const DOCTYPE_WITH_INTERNAL_SUBSET_REGEX$LWS = /<!doctype\s+\S+\s*\[/;
 // Matches: <!DOCTYPE root SYSTEM "..."> or <!DOCTYPE root PUBLIC "..." "...">
 // External DTDs can define entities that get expanded with malicious content.
 const DOCTYPE_EXTERNAL_ENTITY_REGEX$LWS = /<!doctype\s+\S+\s+(?:system|public)\s/;
+const DOCTYPE_OPENER$LWS = '<!doctype';
+const PI_OPENER$LWS = '<?';
+const PI_CLOSER$LWS = '?>';
+const COMMENT_OPENER$LWS = '<!--';
+const COMMENT_CLOSER$LWS = '-->';
+// Locate a DOCTYPE that sits in the document prolog — the only position where a
+// DTD is actually parsed and where entity definitions can take effect. A DTD is
+// only meaningful before the root element's start tag; anything after the root
+// element opens (text, CDATA sections, comments, processing instructions) is
+// inert character data and can never act as a DTD, no matter what it spells.
+//
+// Returns the prolog slice beginning at the DOCTYPE so the existing
+// dangerous-form regexes can classify it, or null when the prolog contains no
+// DOCTYPE. Walks the prolog token by token, skipping the XML declaration and
+// processing instructions (`<?...?>`) and comments (`<!-- ... -->`), and stops
+// at the first other `<` — that is the root element's start tag. Skipping
+// comments here is what defeats the `<!-- <![CDATA[ -->` decoy: a real prolog
+// DOCTYPE after a comment is still found, and a DOCTYPE buried inside a comment
+// is correctly ignored.
+function findPrologDoctype$LWS(normalizedInput$LWS) {
+  const {
+    length: length$LWS
+  } = normalizedInput$LWS;
+  let index$LWS = 0;
+  while (index$LWS < length$LWS) {
+    const char$LWS = ReflectApply$LWS$1(StringProtoCharAt$LWS, normalizedInput$LWS, [index$LWS]);
+    // Skip insignificant whitespace between prolog tokens.
+    if (char$LWS === ' ' || char$LWS === '\t' || char$LWS === '\n' || char$LWS === '\r') {
+      index$LWS += 1;
+      continue;
+    }
+    // Anything that is not a markup-opening `<` at this point is either the
+    // start of the root element's content model or malformed; in both cases
+    // there is no prolog DOCTYPE to find.
+    if (char$LWS !== '<') {
+      return null;
+    }
+    if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, normalizedInput$LWS, [DOCTYPE_OPENER$LWS, index$LWS])) {
+      return ReflectApply$LWS$1(StringProtoSlice$LWS$1, normalizedInput$LWS, [index$LWS]);
+    }
+    if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, normalizedInput$LWS, [COMMENT_OPENER$LWS, index$LWS])) {
+      const closerOffset$LWS = ReflectApply$LWS$1(StringProtoIndexOf$LWS, normalizedInput$LWS, [COMMENT_CLOSER$LWS, index$LWS + COMMENT_OPENER$LWS.length]);
+      // Unterminated comment: no well-formed prolog DOCTYPE can follow.
+      if (closerOffset$LWS === -1) {
+        return null;
+      }
+      index$LWS = closerOffset$LWS + COMMENT_CLOSER$LWS.length;
+      continue;
+    }
+    if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, normalizedInput$LWS, [PI_OPENER$LWS, index$LWS])) {
+      const closerOffset$LWS = ReflectApply$LWS$1(StringProtoIndexOf$LWS, normalizedInput$LWS, [PI_CLOSER$LWS, index$LWS + PI_OPENER$LWS.length]);
+      if (closerOffset$LWS === -1) {
+        return null;
+      }
+      index$LWS = closerOffset$LWS + PI_CLOSER$LWS.length;
+      continue;
+    }
+    // First `<` that is not a PI, comment, or DOCTYPE is the root element
+    // start tag. The prolog has ended without a DOCTYPE.
+    return null;
+  }
+  return null;
+}
 /* eslint-disable no-underscore-dangle */
 class Validator$LWS {
   constructor(document$LWS, {
@@ -1970,12 +2033,28 @@ class Validator$LWS {
     // Detect XML External Entity (XXE) injection attacks via DOCTYPE declarations.
     // Attackers can embed malicious script content inside ENTITY definitions that
     // get expanded when the XML/SVG is rendered, bypassing DOMPurify sanitization.
+    //
+    // A DTD only takes effect when it appears in the document prolog (before the
+    // root element). The original guard scanned the entire input for a dangerous
+    // DOCTYPE substring, which also rejected benign documents that merely quote a
+    // DOCTYPE as inert text — inside a CDATA section, an XML comment, or element
+    // text. The prolog-aware path keeps the dangerous-form classification
+    // (internal subset, SYSTEM/PUBLIC external reference) exactly as-is, but only
+    // applies it to a DOCTYPE that actually sits in the prolog. When the gate is
+    // off, the original whole-input scan is preserved.
     // eslint-disable-next-line class-methods-use-this
     this.isXMLEntityAttack = input$LWS => {
       const normalizedInput$LWS = normalizeInput$LWS(input$LWS, ' ');
       // Block DOCTYPE with:
       // - Internal DTD subset (e.g., <!DOCTYPE svg [<!ENTITY foo "...">]>)
       // - SYSTEM or PUBLIC external entity references
+      if (isGaterEnabledFeature$LWS('xmlEntityAttackPrologScan')) {
+        const prologDoctype$LWS = findPrologDoctype$LWS(normalizedInput$LWS);
+        if (prologDoctype$LWS === null) {
+          return false;
+        }
+        return ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_WITH_INTERNAL_SUBSET_REGEX$LWS, [prologDoctype$LWS]) || ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_EXTERNAL_ENTITY_REGEX$LWS, [prologDoctype$LWS]);
+      }
       return ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_WITH_INTERNAL_SUBSET_REGEX$LWS, [normalizedInput$LWS]) || ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_EXTERNAL_ENTITY_REGEX$LWS, [normalizedInput$LWS]);
     };
     // Detect namespaced script elements that execute in XML contexts.
@@ -2377,7 +2456,7 @@ const {
 const XhrProtoResponseTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'responseText');
 const XhrProtoStatusGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'status');
 ObjectLookupOwnSetter$LWS(XhrProto$LWS, 'withCredentials');
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -2429,13 +2508,18 @@ function isAttemptingToExploitURL$LWS(resourceValue$LWS) {
   const locationHref$LWS = rootWindow$LWS$1.location.href;
   return loweredResourceValue$LWS === '/' || loweredResourceValue$LWS[0] === '#' || loweredResourceValue$LWS[0] === '?' || ReflectApply$LWS$1(StringProtoStartsWith$LWS, loweredResourceValue$LWS, [`${locationHref$LWS}#`]) || ReflectApply$LWS$1(StringProtoStartsWith$LWS, loweredResourceValue$LWS, [`${locationHref$LWS}?`]);
 }
-// Validates that a URL doesn't target disallowed endpoints
+// Validates that a URL doesn't target disallowed endpoints.
 // @TODO: W-7302311 Make paths and domains configurable.
 function isAllowedEndpointURL$LWS(parsedURL$LWS) {
   const loweredPathname$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, parsedURL$LWS.pathname, []);
   // This MUST be done inside the function because the gate may not be enabled when the
   // module code is loaded and evaluated (as would be the case for test environments)
   if (isGaterEnabledFeature$LWS('changesSince.262')) {
+    // Cross-origin URLs bypass the denylist — they cannot carry the user's session
+    // credentials to this instance's platform-internal endpoints (W-23009170).
+    if (!isSameOriginURL$LWS(parsedURL$LWS.normalizedURL)) {
+      return true;
+    }
     DISALLOWED_ENDPOINTS_LIST$LWS.push('/_nc_external', '/force', '/setup');
   }
   for (let i$LWS = 0, {
@@ -2488,7 +2572,7 @@ function sanitizeURLForElement$LWS(url$LWS) {
 function sanitizeURLString$LWS(urlString$LWS) {
   return urlString$LWS === '' ? urlString$LWS : ReflectApply$LWS$1(StringProtoReplace$LWS, urlString$LWS, [newlinesAndTabsRegExp$LWS, '']);
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*! @license DOMPurify 3.2.4 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.4/LICENSE */
 
@@ -3900,7 +3984,7 @@ try {
   // swallow
 }
 const trusted = createPolicy('trusted', policyOptions);
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -4176,7 +4260,7 @@ function blobSanitizer$LWS(sandboxKey$LWS) {
   }
   return getSanitizerForConfig$LWS(sandboxKey$LWS, 'STRING_BLOB_HTML');
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2023 salesforce.com, inc.
@@ -4385,7 +4469,7 @@ function createScriptSrcURLSetter$LWS(targetElement$LWS) {
     ReflectApply$LWS$1(ElementProtoSetAttributeNS$LWS, targetElement$LWS, [attributeNamespaceURI$LWS, attributeName$LWS, src$LWS]);
   };
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -6084,7 +6168,7 @@ function initDistortionDocumentCreateTreeWalker$LWS({
     const {
       0: root$LWS
     } = args$LWS;
-    if (isGaterEnabledFeature$LWS('changesSince.262') && root$LWS && isSharedElement$B$LWS(root$LWS)) {
+    if (isGaterEnabledFeature$LWS('restrictCreateTreeWalker') && root$LWS && isSharedElement$B$LWS(root$LWS)) {
       throw new LockerSecurityError$LWS(`Cannot create TreeWalker rooted at shared element ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, root$LWS, [])}.`);
     }
     return ReflectApply$LWS$1(originalCreateTreeWalker$LWS, this, args$LWS);
@@ -11859,7 +11943,7 @@ const SVGElementProtoBlockedProperties$LWS = ['nonce'];
 const UIEventProtoBlockedProperties$LWS = ['rangeParent'];
 const WindowBlockedProperties$LWS = ['find', 'requestFileSystem', 'webkitRequestFileSystem'];
 const XSLTProcessorProtoBlockedProperties$LWS = ['transformToDocument', 'transformToFragment'];
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2021 salesforce.com, inc.
@@ -11868,7 +11952,7 @@ let pdpSchema$LWS;
 function getPdpSchema$LWS() {
   return pdpSchema$LWS;
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -17215,7 +17299,7 @@ function toSourceText$LWS(value$LWS, sourceType$LWS) {
   // tools from mistaking the regexp or the replacement string for an
   // actual source mapping URL.
   /\/\/# sandbox(?=MappingURL=.*?\s*$)/, '//# source']);
-  sourceText$LWS = `\n//# LWS Version = "0.27.5"\n${sourceText$LWS}`;
+  sourceText$LWS = `\n//# LWS Version = "0.27.7"\n${sourceText$LWS}`;
   return sourceType$LWS === 1 /* SourceType.Module */ && indexOfPragma$LWS(sourceText$LWS, 'use strict') === -1 ?
   // Append "'use strict'" to the extracted function body so it is
   // evaluated in strict mode.
@@ -18011,7 +18095,7 @@ function wrapPlatformResourceLoader$LWS(dep$LWS, key$LWS) {
   depRegistry$LWS.set(dep$LWS, secureDep$LWS);
   return secureDep$LWS;
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 const loaderDefine = (globalThis ).LWR.define;
 

package/build/modules/lwr/lockerSandbox/lockerSandbox.js

@@ -1510,7 +1510,7 @@ const {
 const PromiseResolve$LWS = PromiseCtor$LWS.resolve.bind(PromiseCtor$LWS);
 const PromiseReject$LWS = PromiseCtor$LWS.reject.bind(PromiseCtor$LWS);
 const trustedResources$LWS = toSafeSet$LWS(new SetCtor$LWS$1());
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -1954,6 +1954,69 @@ const DOCTYPE_WITH_INTERNAL_SUBSET_REGEX$LWS = /<!doctype\s+\S+\s*\[/;
 // Matches: <!DOCTYPE root SYSTEM "..."> or <!DOCTYPE root PUBLIC "..." "...">
 // External DTDs can define entities that get expanded with malicious content.
 const DOCTYPE_EXTERNAL_ENTITY_REGEX$LWS = /<!doctype\s+\S+\s+(?:system|public)\s/;
+const DOCTYPE_OPENER$LWS = '<!doctype';
+const PI_OPENER$LWS = '<?';
+const PI_CLOSER$LWS = '?>';
+const COMMENT_OPENER$LWS = '<!--';
+const COMMENT_CLOSER$LWS = '-->';
+// Locate a DOCTYPE that sits in the document prolog — the only position where a
+// DTD is actually parsed and where entity definitions can take effect. A DTD is
+// only meaningful before the root element's start tag; anything after the root
+// element opens (text, CDATA sections, comments, processing instructions) is
+// inert character data and can never act as a DTD, no matter what it spells.
+//
+// Returns the prolog slice beginning at the DOCTYPE so the existing
+// dangerous-form regexes can classify it, or null when the prolog contains no
+// DOCTYPE. Walks the prolog token by token, skipping the XML declaration and
+// processing instructions (`<?...?>`) and comments (`<!-- ... -->`), and stops
+// at the first other `<` — that is the root element's start tag. Skipping
+// comments here is what defeats the `<!-- <![CDATA[ -->` decoy: a real prolog
+// DOCTYPE after a comment is still found, and a DOCTYPE buried inside a comment
+// is correctly ignored.
+function findPrologDoctype$LWS(normalizedInput$LWS) {
+  const {
+    length: length$LWS
+  } = normalizedInput$LWS;
+  let index$LWS = 0;
+  while (index$LWS < length$LWS) {
+    const char$LWS = ReflectApply$LWS$1(StringProtoCharAt$LWS, normalizedInput$LWS, [index$LWS]);
+    // Skip insignificant whitespace between prolog tokens.
+    if (char$LWS === ' ' || char$LWS === '\t' || char$LWS === '\n' || char$LWS === '\r') {
+      index$LWS += 1;
+      continue;
+    }
+    // Anything that is not a markup-opening `<` at this point is either the
+    // start of the root element's content model or malformed; in both cases
+    // there is no prolog DOCTYPE to find.
+    if (char$LWS !== '<') {
+      return null;
+    }
+    if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, normalizedInput$LWS, [DOCTYPE_OPENER$LWS, index$LWS])) {
+      return ReflectApply$LWS$1(StringProtoSlice$LWS$1, normalizedInput$LWS, [index$LWS]);
+    }
+    if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, normalizedInput$LWS, [COMMENT_OPENER$LWS, index$LWS])) {
+      const closerOffset$LWS = ReflectApply$LWS$1(StringProtoIndexOf$LWS, normalizedInput$LWS, [COMMENT_CLOSER$LWS, index$LWS + COMMENT_OPENER$LWS.length]);
+      // Unterminated comment: no well-formed prolog DOCTYPE can follow.
+      if (closerOffset$LWS === -1) {
+        return null;
+      }
+      index$LWS = closerOffset$LWS + COMMENT_CLOSER$LWS.length;
+      continue;
+    }
+    if (ReflectApply$LWS$1(StringProtoStartsWith$LWS, normalizedInput$LWS, [PI_OPENER$LWS, index$LWS])) {
+      const closerOffset$LWS = ReflectApply$LWS$1(StringProtoIndexOf$LWS, normalizedInput$LWS, [PI_CLOSER$LWS, index$LWS + PI_OPENER$LWS.length]);
+      if (closerOffset$LWS === -1) {
+        return null;
+      }
+      index$LWS = closerOffset$LWS + PI_CLOSER$LWS.length;
+      continue;
+    }
+    // First `<` that is not a PI, comment, or DOCTYPE is the root element
+    // start tag. The prolog has ended without a DOCTYPE.
+    return null;
+  }
+  return null;
+}
 /* eslint-disable no-underscore-dangle */
 class Validator$LWS {
   constructor(document$LWS, {
@@ -1970,12 +2033,28 @@ class Validator$LWS {
     // Detect XML External Entity (XXE) injection attacks via DOCTYPE declarations.
     // Attackers can embed malicious script content inside ENTITY definitions that
     // get expanded when the XML/SVG is rendered, bypassing DOMPurify sanitization.
+    //
+    // A DTD only takes effect when it appears in the document prolog (before the
+    // root element). The original guard scanned the entire input for a dangerous
+    // DOCTYPE substring, which also rejected benign documents that merely quote a
+    // DOCTYPE as inert text — inside a CDATA section, an XML comment, or element
+    // text. The prolog-aware path keeps the dangerous-form classification
+    // (internal subset, SYSTEM/PUBLIC external reference) exactly as-is, but only
+    // applies it to a DOCTYPE that actually sits in the prolog. When the gate is
+    // off, the original whole-input scan is preserved.
     // eslint-disable-next-line class-methods-use-this
     this.isXMLEntityAttack = input$LWS => {
       const normalizedInput$LWS = normalizeInput$LWS(input$LWS, ' ');
       // Block DOCTYPE with:
       // - Internal DTD subset (e.g., <!DOCTYPE svg [<!ENTITY foo "...">]>)
       // - SYSTEM or PUBLIC external entity references
+      if (isGaterEnabledFeature$LWS('xmlEntityAttackPrologScan')) {
+        const prologDoctype$LWS = findPrologDoctype$LWS(normalizedInput$LWS);
+        if (prologDoctype$LWS === null) {
+          return false;
+        }
+        return ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_WITH_INTERNAL_SUBSET_REGEX$LWS, [prologDoctype$LWS]) || ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_EXTERNAL_ENTITY_REGEX$LWS, [prologDoctype$LWS]);
+      }
       return ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_WITH_INTERNAL_SUBSET_REGEX$LWS, [normalizedInput$LWS]) || ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_EXTERNAL_ENTITY_REGEX$LWS, [normalizedInput$LWS]);
     };
     // Detect namespaced script elements that execute in XML contexts.
@@ -2377,7 +2456,7 @@ const {
 const XhrProtoResponseTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'responseText');
 const XhrProtoStatusGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'status');
 ObjectLookupOwnSetter$LWS(XhrProto$LWS, 'withCredentials');
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -2429,13 +2508,18 @@ function isAttemptingToExploitURL$LWS(resourceValue$LWS) {
   const locationHref$LWS = rootWindow$LWS$1.location.href;
   return loweredResourceValue$LWS === '/' || loweredResourceValue$LWS[0] === '#' || loweredResourceValue$LWS[0] === '?' || ReflectApply$LWS$1(StringProtoStartsWith$LWS, loweredResourceValue$LWS, [`${locationHref$LWS}#`]) || ReflectApply$LWS$1(StringProtoStartsWith$LWS, loweredResourceValue$LWS, [`${locationHref$LWS}?`]);
 }
-// Validates that a URL doesn't target disallowed endpoints
+// Validates that a URL doesn't target disallowed endpoints.
 // @TODO: W-7302311 Make paths and domains configurable.
 function isAllowedEndpointURL$LWS(parsedURL$LWS) {
   const loweredPathname$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, parsedURL$LWS.pathname, []);
   // This MUST be done inside the function because the gate may not be enabled when the
   // module code is loaded and evaluated (as would be the case for test environments)
   if (isGaterEnabledFeature$LWS('changesSince.262')) {
+    // Cross-origin URLs bypass the denylist — they cannot carry the user's session
+    // credentials to this instance's platform-internal endpoints (W-23009170).
+    if (!isSameOriginURL$LWS(parsedURL$LWS.normalizedURL)) {
+      return true;
+    }
     DISALLOWED_ENDPOINTS_LIST$LWS.push('/_nc_external', '/force', '/setup');
   }
   for (let i$LWS = 0, {
@@ -2488,7 +2572,7 @@ function sanitizeURLForElement$LWS(url$LWS) {
 function sanitizeURLString$LWS(urlString$LWS) {
   return urlString$LWS === '' ? urlString$LWS : ReflectApply$LWS$1(StringProtoReplace$LWS, urlString$LWS, [newlinesAndTabsRegExp$LWS, '']);
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*! @license DOMPurify 3.2.4 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.4/LICENSE */
 
@@ -3900,7 +3984,7 @@ try {
   // swallow
 }
 const trusted = createPolicy('trusted', policyOptions);
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -4176,7 +4260,7 @@ function blobSanitizer$LWS(sandboxKey$LWS) {
   }
   return getSanitizerForConfig$LWS(sandboxKey$LWS, 'STRING_BLOB_HTML');
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2023 salesforce.com, inc.
@@ -4385,7 +4469,7 @@ function createScriptSrcURLSetter$LWS(targetElement$LWS) {
     ReflectApply$LWS$1(ElementProtoSetAttributeNS$LWS, targetElement$LWS, [attributeNamespaceURI$LWS, attributeName$LWS, src$LWS]);
   };
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -6084,7 +6168,7 @@ function initDistortionDocumentCreateTreeWalker$LWS({
     const {
       0: root$LWS
     } = args$LWS;
-    if (isGaterEnabledFeature$LWS('changesSince.262') && root$LWS && isSharedElement$B$LWS(root$LWS)) {
+    if (isGaterEnabledFeature$LWS('restrictCreateTreeWalker') && root$LWS && isSharedElement$B$LWS(root$LWS)) {
       throw new LockerSecurityError$LWS(`Cannot create TreeWalker rooted at shared element ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, root$LWS, [])}.`);
     }
     return ReflectApply$LWS$1(originalCreateTreeWalker$LWS, this, args$LWS);
@@ -11859,7 +11943,7 @@ const SVGElementProtoBlockedProperties$LWS = ['nonce'];
 const UIEventProtoBlockedProperties$LWS = ['rangeParent'];
 const WindowBlockedProperties$LWS = ['find', 'requestFileSystem', 'webkitRequestFileSystem'];
 const XSLTProcessorProtoBlockedProperties$LWS = ['transformToDocument', 'transformToFragment'];
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2021 salesforce.com, inc.
@@ -11868,7 +11952,7 @@ let pdpSchema$LWS;
 function getPdpSchema$LWS() {
   return pdpSchema$LWS;
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -17217,7 +17301,7 @@ function toSourceText$LWS(value$LWS, sourceType$LWS) {
   // tools from mistaking the regexp or the replacement string for an
   // actual source mapping URL.
   /\/\/# sandbox(?=MappingURL=.*?\s*$)/, '//# source']);
-  sourceText$LWS = `\n//# LWS Version = "0.27.5"\n${sourceText$LWS}`;
+  sourceText$LWS = `\n//# LWS Version = "0.27.7"\n${sourceText$LWS}`;
   return sourceType$LWS === 1 /* SourceType.Module */ && indexOfPragma$LWS(sourceText$LWS, 'use strict') === -1 ?
   // Append "'use strict'" to the extracted function body so it is
   // evaluated in strict mode.
@@ -18043,7 +18127,7 @@ function wrapPlatformResourceLoader$LWS(dep$LWS, key$LWS) {
   depRegistry$LWS.set(dep$LWS, secureDep$LWS);
   return secureDep$LWS;
 }
-/*! version: 0.27.5 */
+/*! version: 0.27.7 */
 
 export { $LWS, CORE_SANDBOX_KEY$LWS as CORE_SANDBOX_KEY, createRootWindowSandboxRecord$LWS as createRootWindowSandboxRecord, evaluateFunction$LWS as evaluateFunction, evaluateInCoreSandbox$LWS as evaluateInCoreSandbox, evaluateInSandbox$LWS as evaluateInSandbox, trusted, wrapDependency$LWS as wrapDependency };
 //# sourceMappingURL=lockerSandbox.js.map

package/package.json

@@ -4,7 +4,7 @@
     "publishConfig": {
         "access": "public"
     },
-    "version": "0.22.16",
+    "version": "0.22.17",
     "homepage": "https://developer.salesforce.com/docs/platform/lwr/overview",
     "repository": {
         "type": "git",
@@ -33,11 +33,11 @@
         "build:minify": "node scripts/minify-bundles.mjs"
     },
     "dependencies": {
-        "@locker/sandbox": "0.27.5",
-        "@lwrjs/shared-utils": "0.22.16"
+        "@locker/sandbox": "0.27.7",
+        "@lwrjs/shared-utils": "0.22.17"
     },
     "devDependencies": {
-        "@lwrjs/types": "0.22.16",
+        "@lwrjs/types": "0.22.17",
         "@rollup/plugin-node-resolve": "^15.2.3",
         "@rollup/plugin-sucrase": "^5.0.2",
         "@rollup/plugin-terser": "^0.4.4",
@@ -70,5 +70,5 @@
     "volta": {
         "extends": "../../../package.json"
     },
-    "gitHead": "347e219234c5b3ee39c8388e0258e8be656ea12f"
+    "gitHead": "cb61c362e500a24542c00ed1f751c288d258d42b"
 }