@lwrjs/client-modules 0.5.11-alpha.2 → 0.5.13

package/build/modules/lwr/lockerSandbox/lockerSandbox.js

@@ -96,13 +96,11 @@ const {
 
 const FunctionBind = (func, thisArg) => ReflectApply$3(FunctionProtoBind, func, [thisArg]);
 
-const {
-  create: ObjectCreate$1
-} = Object;
 const {
   ownKeys: ReflectOwnKeys$2,
   setPrototypeOf: ReflectSetPrototypeOf$2
 } = Reflect;
+const getTimestamp = typeof performance === 'undefined' ? DateNow : FunctionBind(performance.now, performance);
 
 function isObject(value) {
   return typeof value === 'object' && value !== null;
@@ -113,17 +111,24 @@ function isObjectLike(value) {
 }
 
 function shallowCloneOptions(options) {
-  const keys = ReflectOwnKeys$2(options);
-  const clone = ObjectCreate$1(null);
+  const ownKeys = ReflectOwnKeys$2(options);
+  const clone = {
+    __proto__: null
+  };
 
-  for (let i = 0, len = keys.length; i < len; i += 1) {
-    const key = keys[i];
+  for (let i = 0, len = ownKeys.length; i < len; i += 1) {
+    const key = ownKeys[i];
     clone[key] = options[key];
   }
 
   return clone;
 }
 
+function toSafeDescriptor(desc) {
+  ReflectSetPrototypeOf$2(desc, null);
+  return desc;
+}
+
 function toSafeDescriptorMap(descriptorMap) {
   // Descriptor maps are not susceptible to Object.prototype pollution because
   // the internal operation uses [[OwnPropertyKeys]]:
@@ -131,17 +136,20 @@ function toSafeDescriptorMap(descriptorMap) {
   //
   // However, their descriptors are because the internal operation uses
   // [[HasProperty]]: https://tc39.es/ecma262/#sec-topropertydescriptor.
-  const props = ReflectOwnKeys$2(descriptorMap);
+  const ownKeys = ReflectOwnKeys$2(descriptorMap);
 
-  for (let i = 0, len = props.length; i < len; i += 1) {
-    ReflectSetPrototypeOf$2(descriptorMap[props[i]], null);
+  for (let i = 0, len = ownKeys.length; i < len; i += 1) {
+    toSafeDescriptor(descriptorMap[ownKeys[i]]);
   }
 
   return descriptorMap;
 }
 
-const getTimestamp = typeof performance === 'undefined' ? DateNow : FunctionBind(performance.now, performance);
-
+const ZERO_WIDTH_JOINER = '\u200D';
+const LOCKER_IDENTIFIER_MARKER = `$LWS${ZERO_WIDTH_JOINER}`;
+const SANDBOX_EVAL_CONTEXT_NAME = '$lockerEvalContext$';
+const SANDBOX_EVAL_HELPERS_NAME = '$lockerEvalHelpers$';
+const UNCOMPILED_LOCATION_NAME = `uncompiledLocation${LOCKER_IDENTIFIER_MARKER}`;
 const {
   // eslint-disable-next-line @typescript-eslint/naming-convention
   __lookupGetter__: ObjectProto__lookupGetter__$1,
@@ -219,20 +227,20 @@ function maskDistortion(distortedFunc, rawFunc) {
 }
 
 function createRevokedProxy(object) {
-  const revocable = ProxyRevocable(object, ObjectCreate(null));
+  // @ts-ignore: TS doesn't like null as a ProxyHandler.
+  const revocable = ProxyRevocable(object, {
+    __proto__: null
+  });
   revocable.revoke();
   return revocable.proxy;
 }
-/* eslint-disable max-classes-per-file */
-
 
-const ErrorCtor$1 = Error;
-const RangeErrorCtor = RangeError;
-const TypeErrorCtor$2 = TypeError;
-
-class LockerSecurityError extends Error {}
+class LockerSecurityError extends Error {
+  constructor(message) {
+    super(`Lightning Web Security: ${message}`);
+  }
 
-class LockerRangeError extends LockerSecurityError {}
+}
 
 const {
   parse: JSONParse,
@@ -246,10 +254,9 @@ const LIVE_OBJECT_SYMBOL = SymbolFor('@@lockerLiveValue'); // This is used by pa
 
 function markLiveObject(object) {
   ReflectDefineProperty(object, LIVE_OBJECT_SYMBOL, {
-    value: undefined,
-    configurable: false,
-    enumerable: false,
-    writable: false
+    // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+    __proto__: null,
+    value: undefined
   });
   return object;
 }
@@ -257,12 +264,23 @@ function markLiveObject(object) {
 function isLiveObject(object) {
   return ObjectHasOwnProperty(object, LIVE_OBJECT_SYMBOL);
 }
+
+function liveObjectFromGetter(originalGetter, target) {
+  const object = ReflectApply$3(originalGetter, target, []);
+
+  if (isLiveObject(object)) {
+    return object;
+  }
+
+  return markLiveObject(object);
+}
 /**
- * @@lockerMagicValue is used to mark objects that have magical side effects
- * when setting properties, which would be broken by a Define Property
- * operation. A concrete example is the `style` property of an HTMLElement in
- * Safari <= 14. Defining this marker will signal to the membrane that
- * it must use a Set operation, instead of a Define Property operation.
+ * MAGIC_OBJECT_SYMBOL is used to mark objects that have magical side effects
+ * when setting properties, which would be broken by a Define Property operation.
+ * For example, the `style` object of an HTMLElement in Safari <= 14. This marker
+ * is a signal to the membrane that it must use a Set operation, instead of a
+ * Define Property operation.
+ *
  */
 
 
@@ -270,10 +288,9 @@ const MAGIC_OBJECT_SYMBOL = SymbolFor('@@lockerMagicValue');
 
 function markMagicObject(object) {
   ReflectDefineProperty(object, MAGIC_OBJECT_SYMBOL, {
-    value: undefined,
-    configurable: false,
-    enumerable: false,
-    writable: false
+    // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+    __proto__: null,
+    value: undefined
   });
   return object;
 }
@@ -304,12 +321,14 @@ function MapSet(map, key, value) {
 }
 
 const MathMin = Math.min;
+
 const {
   then: PromiseProtoThen
 } = Promise.prototype;
+const PromiseReject = Promise.reject.bind(Promise);
 
 function PromiseThen(promise, ...args) {
-  return ReflectApply$3(PromiseProtoThen, promise, [args]);
+  return ReflectApply$3(PromiseProtoThen, promise, args);
 }
 
 const StringCtor = String;
@@ -320,7 +339,6 @@ const {
   replace: StringProtoReplace,
   slice: StringProtoSlice$1,
   split: StringProtoSplit,
-  substring: StringProtoSubstring,
   startsWith: StringProtoStartsWith,
   toLowerCase: StringProtoToLowerCase,
   toUpperCase: StringProtoToUpperCase$1
@@ -350,27 +368,32 @@ function StringSplit(str, ...args) {
   return ReflectApply$3(StringProtoSplit, str, args);
 }
 
-function StringSubstring(str, ...args) {
-  return ReflectApply$3(StringProtoSubstring, str, args);
-}
-
 function StringStartsWith(str, ...args) {
   return ReflectApply$3(StringProtoStartsWith, str, args);
 }
 
 function StringToLowerCase(str) {
-  return ReflectApply$3(StringProtoToLowerCase, str, emptyArray$1);
+  return ReflectApply$3(StringProtoToLowerCase, str, []);
 }
 
 function StringToUpperCase(str) {
-  return ReflectApply$3(StringProtoToUpperCase$1, str, emptyArray$1);
+  return ReflectApply$3(StringProtoToUpperCase$1, str, []);
 }
 
-function capitalize(str) {
-  return str.length ? `${StringToUpperCase(str[0])}${StringSlice(str, 1)}` : '';
+function capitalizeFirstChar$1(str) {
+  const {
+    length
+  } = str;
+
+  if (!length) {
+    return str;
+  }
+
+  const upper = StringToUpperCase(str[0]);
+  return length === 1 ? upper : upper + StringSlice(str, 1);
 }
 
-function toString(value) {
+function toString$1(value) {
   try {
     return StringCtor(value);
   } catch (_unused) {
@@ -379,7 +402,7 @@ function toString(value) {
 }
 
 function toStringIfNotNullOrUndefined(value) {
-  return value === null || value === undefined ? value : toString(value);
+  return value === null || value === undefined ? value : toString$1(value);
 }
 
 const {
@@ -387,7 +410,7 @@ const {
 } = RegExp.prototype;
 
 function RegExpTest(regexp, content) {
-  return ReflectApply$3(RegExpProtoTest, regexp, [toString(content)]);
+  return ReflectApply$3(RegExpProtoTest, regexp, [toString$1(content)]);
 }
 
 
@@ -440,7 +463,7 @@ function WeakMapGet(weakMap, key) {
 function WeakMapSet(weakMap, key, value) {
   return ReflectApply$3(WeakMapProtoSet$1, weakMap, [key, value]);
 }
-/*! version: 0.14.17 */
+/*! version: 0.14.26 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -472,6 +495,34 @@ function AttrValueGetter(attr) {
 function AttrValueSetter(attr, value) {
   ReflectApply$3(AttrProtoValueSetter, attr, [value]);
 }
+/*! *****************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+
+
+function __classPrivateFieldGet$1(receiver, state, kind, f) {
+  if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a getter");
+  if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot read private member from an object whose class did not declare it");
+  return kind === "m" ? f : kind === "a" ? f.call(receiver) : f ? f.value : state.get(receiver);
+}
+
+function __classPrivateFieldSet$1(receiver, state, value, kind, f) {
+  if (kind === "m") throw new TypeError("Private method is not writable");
+  if (kind === "a" && !f) throw new TypeError("Private accessor was defined without a setter");
+  if (typeof state === "function" ? receiver !== state || !f : !state.has(receiver)) throw new TypeError("Cannot write private member to an object whose class did not declare it");
+  return kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value), value;
+}
 
 const {
   get: DocumentProtoCookieGetter,
@@ -484,7 +535,9 @@ const {
   getElementById: DocumentProtoGetElementById
 } = Document.prototype;
 const DocumentProtoBodyGetter$1 = ObjectLookupOwnGetter$1(Document.prototype, 'body');
+const DocumentProtoDocumentElementGetter = ObjectLookupOwnGetter$1(Document.prototype, 'documentElement');
 const DocumentProtoHeadGetter = ObjectLookupOwnGetter$1(Document.prototype, 'head');
+const DocumentProtoImplementationGetter = ObjectLookupOwnGetter$1(Document.prototype, 'implementation');
 const {
   execCommand: DocumentProtoExecCommand
 } = Document.prototype;
@@ -501,6 +554,10 @@ function DocumentCookieSetter(doc, newCookie) {
   ReflectApply$3(DocumentProtoCookieSetter, doc, [newCookie]);
 }
 
+function DocumentImplementation(doc) {
+  return ReflectApply$3(DocumentProtoImplementationGetter, doc, emptyArray$1);
+}
+
 function DocumentCreateComment(doc, data = '') {
   return ReflectApply$3(DocumentProtoCreateComment, doc, [data]);
 }
@@ -513,6 +570,10 @@ function DocumentCreateElementNS(doc, ...args) {
   return ReflectApply$3(DocumentProtoCreateElementNS, doc, args);
 }
 
+function DocumentDocumentElementGetter(doc) {
+  return ReflectApply$3(DocumentProtoDocumentElementGetter, doc, emptyArray$1);
+}
+
 function DocumentGetElementById(doc, id) {
   return ReflectApply$3(DocumentProtoGetElementById, doc, [id]);
 }
@@ -531,7 +592,6 @@ function nsCookieRootKey(ns) {
 
 const {
   attachShadow: ElementProtoAttachShadow,
-  insertAdjacentHTML: ElementProtoInsertAdjacentHTML,
   setAttribute: ElementProtoSetAttribute$1,
   setAttributeNS: ElementProtoSetAttributeNS,
   setAttributeNode: ElementProtoSetAttributeNode
@@ -554,6 +614,7 @@ const {
   set: ElementProtoOuterHTMLSetter
 } = ReflectGetOwnPropertyDescriptor$1(Element.prototype, 'outerHTML');
 const ElementProtoAttributesGetter = ObjectLookupOwnGetter$1(Element.prototype, 'attributes');
+const ElementProtoGetNamespaceURI = ObjectLookupOwnGetter$1(Element.prototype, 'namespaceURI');
 
 function ElementClosest(el, selectors) {
   return ReflectApply$3(ElementProtoClosest, el, [selectors]);
@@ -615,6 +676,10 @@ function ElementSetAttributeNS(el, namespace, name, value) {
   return ReflectApply$3(ElementProtoSetAttributeNS, el, [namespace, name, value]);
 }
 
+function ElementGetNamespaceURI(el) {
+  return ReflectApply$3(ElementProtoGetNamespaceURI, el, emptyArray$1);
+}
+
 const HTMLTemplateElementProtoContentGetter = ObjectLookupOwnGetter$1(HTMLTemplateElement.prototype, 'content');
 
 function HTMLTemplateElementContentGetter(template) {
@@ -671,11 +736,7 @@ function NodeTextContentSetter(node, textContent) {
   ReflectApply$3(NodeProtoTextContentSetter, node, [textContent]);
 }
 
-const {
-  document: document$1$1
-} = window;
-const leftTpl = DocumentCreateElement$1(document$1$1, 'template');
-const rightTpl = DocumentCreateElement$1(document$1$1, 'template');
+var _Validator_document, _Validator_constructors, _Validator_templates;
 
 function deepIsEqualNode(leftRoot, rightRoot) {
   const leftRootNode = leftRoot instanceof HTMLTemplateElement ? HTMLTemplateElementContentGetter(leftRoot) : leftRoot;
@@ -701,14 +762,63 @@ function deepIsEqualNode(leftRoot, rightRoot) {
   return false;
 }
 
-function isEqualDomString(leftString, rightString) {
-  ElementInnerHTMLSetter(leftTpl, leftString);
-  ElementInnerHTMLSetter(rightTpl, rightString);
-  return deepIsEqualNode(leftTpl, rightTpl);
+const globalObjectToValidatorMap = new WeakMapCtor();
+
+class Validator {
+  constructor(globalObject) {
+    _Validator_document.set(this, void 0);
+
+    _Validator_constructors.set(this, void 0);
+
+    _Validator_templates.set(this, void 0);
+
+    this.isEqualDomString = (leftString, rightString) => {
+      ElementInnerHTMLSetter(__classPrivateFieldGet$1(this, _Validator_templates, "f").left, leftString);
+      ElementInnerHTMLSetter(__classPrivateFieldGet$1(this, _Validator_templates, "f").right, rightString);
+      return deepIsEqualNode(__classPrivateFieldGet$1(this, _Validator_templates, "f").left, __classPrivateFieldGet$1(this, _Validator_templates, "f").right);
+    };
+
+    this.isSharedElement = element => element === DocumentHeadGetter(__classPrivateFieldGet$1(this, _Validator_document, "f")) || element === DocumentBodyGetter(__classPrivateFieldGet$1(this, _Validator_document, "f")) || element === DocumentDocumentElementGetter(__classPrivateFieldGet$1(this, _Validator_document, "f"));
+
+    this.isSharedElementChild = element => element instanceof __classPrivateFieldGet$1(this, _Validator_constructors, "f").HTMLLinkElement || element instanceof __classPrivateFieldGet$1(this, _Validator_constructors, "f").HTMLScriptElement;
+
+    this.isMediaSourceObject = object => // MediaSource may not be defined in some browsers
+    __classPrivateFieldGet$1(this, _Validator_constructors, "f").MediaSource && object instanceof __classPrivateFieldGet$1(this, _Validator_constructors, "f").MediaSource;
+
+    const {
+      document,
+      HTMLLinkElement,
+      HTMLScriptElement,
+      MediaSource
+    } = globalObject;
+
+    __classPrivateFieldSet$1(this, _Validator_constructors, {
+      HTMLLinkElement,
+      HTMLScriptElement,
+      MediaSource
+    }, "f");
+
+    __classPrivateFieldSet$1(this, _Validator_document, document, "f");
+
+    __classPrivateFieldSet$1(this, _Validator_templates, {
+      left: DocumentCreateElement$1(__classPrivateFieldGet$1(this, _Validator_document, "f"), 'template'),
+      right: DocumentCreateElement$1(__classPrivateFieldGet$1(this, _Validator_document, "f"), 'template')
+    }, "f");
+  }
+
 }
 
-function isSharedElement(element, doc = document$1$1) {
-  return element === DocumentHeadGetter(doc) || element === DocumentBodyGetter(doc);
+_Validator_document = new WeakMap(), _Validator_constructors = new WeakMap(), _Validator_templates = new WeakMap();
+
+function getValidator(globalObject) {
+  let validator = WeakMapGet(globalObjectToValidatorMap, globalObject);
+
+  if (!validator) {
+    validator = new Validator(globalObject);
+    WeakMapSet(globalObjectToValidatorMap, globalObject, validator);
+  }
+
+  return validator;
 }
 
 function JSONClone(value) {
@@ -742,9 +852,9 @@ CookieStore.prototype; // This has to be done 1-by-1 because putting a a full fi
 
 const CookieStoreProtoDelete = ObjectLookupOwnValue(CookieStoreProto, 'delete'); // istanbul ignore next
 
-const CookieStoreProtoGet = ObjectLookupOwnValue(CookieStoreProto, 'get'); // istanbul ignore next
+ObjectLookupOwnValue(CookieStoreProto, 'get'); // istanbul ignore next
 
-const CookieStoreProtoGetAll = ObjectLookupOwnValue(CookieStoreProto, 'getAll'); // istanbul ignore next
+ObjectLookupOwnValue(CookieStoreProto, 'getAll'); // istanbul ignore next
 
 const CookieStoreProtoSet = ObjectLookupOwnValue(CookieStoreProto, 'set');
 const {
@@ -759,6 +869,17 @@ function DocumentFragmentGetElementById(fragment, id) {
   return ReflectApply$3(DocumentFragmentProtoGetElementById, fragment, [id]);
 }
 
+const {
+  createDocument: DOMImplementationProtoCreateDocument
+} = DOMImplementation.prototype;
+
+function DOMImplementationCreateDocument(domImplementation, ...args) {
+  return ReflectApply$3(DOMImplementationProtoCreateDocument, domImplementation, args);
+}
+
+const {
+  parseFromString: DOMParserProtoParseFromString
+} = DOMParser.prototype;
 const DOMTokenListProtoValueGetter = ObjectLookupOwnGetter$1(DOMTokenList.prototype, 'value');
 
 function DOMTokenListValueGetter(tokenList) {
@@ -898,10 +1019,10 @@ const MessageEventProtoSourceGetter = ObjectLookupOwnGetter$1(MessageEvent.proto
 function MessageEventSourceGetter(messageEvent) {
   return ReflectApply$3(MessageEventProtoSourceGetter, messageEvent, emptyArray$1);
 }
-
-const {
-  setNamedItem: NamedNodeMapProtoSetNamedItem
-} = NamedNodeMap.prototype;
+const NAMESPACE_DEFAULT = 'default';
+const NAMESPACE_SVG = 'http://www.w3.org/2000/svg';
+const NAMESPACE_XHTML = 'http://www.w3.org/1999/xhtml';
+const NAMESPACE_XLINK = 'http://www.w3.org/1999/xlink';
 const {
   createContextualFragment: RangeProtoCreateContextualFragment
 } = Range.prototype;
@@ -913,6 +1034,14 @@ function RequestURLGetter(request) {
   return ReflectApply$3(RequestProtoURLGetter, request, emptyArray$1);
 }
 
+const {
+  set: ShadowRootProtoInnerHTMLSetter
+} = ReflectGetOwnPropertyDescriptor$1(ShadowRoot.prototype, 'innerHTML');
+
+function ShadowRootInnerHTMLSetter(el, html) {
+  ReflectApply$3(ShadowRootProtoInnerHTMLSetter, el, [html]);
+}
+
 const {
   key: StorageProtoKey,
   getItem: StorageProtoGetItem,
@@ -920,22 +1049,23 @@ const {
   setItem: StorageProtoSetItem
 } = Storage.prototype;
 /**
- * The following provides a temporary solution to handle
- * "Magic Object" behavior in Safari prior to version 15.
+ * The following detection is part of a temporary solution to handle
+ * "Magic Object" behavior in Safari <= 14.
  *
- * Properties of HTMLElement.prototype.style will lose their
- * "magic" (ie. updating the element's style="" attribute) if
- * a style property is written via Define Property operation.
+ * Properties of HTMLElement.prototype.style, and other CSS style declaration
+ * objects, will lose their "magic" (i.e. updating the element's style="" attribute)
+ * if a style property is assigned by a Define Property operation.
  *
- * In order to prevent near-membrane from using Reflect.defineProperty,
- * we must send a signal that tells it to use Reflect.set in very
- * limited special cases.
+ * This marker will signal to the membrane that it must use a Set operation,
+ * instead of a Define Property operation.
  *
  */
 
 const HAS_BREAKABLE_CSS_STYLE_DECLARATION_MAGIC_OBJECT = (() => {
   const div = document.createElement('div');
   ReflectDefineProperty(div.style, 'color', {
+    // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+    __proto__: null,
     value: 'red'
   });
   return div.getAttribute('style') === '';
@@ -951,7 +1081,7 @@ const {
   createObjectURL: URLCreateObjectURL,
   revokeObjectURL: URLRevokeObjectURL
 } = URL;
-const ALLOW_LIST_PATCHED = ['opener', 'parent', 'postMessage'];
+const ALLOW_LIST_PATCHED = ['opener', 'parent'];
 const ALLOW_LIST_RAW = ['close', 'closed', 'focus'];
 const DEFAULT_OVERWRITTEN_VALUE = {};
 const {
@@ -986,79 +1116,94 @@ function createPatchedWindow(rawWindow) {
 
   for (let i = 0, len = ALLOW_LIST_RAW.length; i < len; i += 1) {
     const key = ALLOW_LIST_RAW[i];
-    const originalDescriptor = ReflectGetOwnPropertyDescriptor$1(rawWindow, key);
+    const unsafeDesc = ReflectGetOwnPropertyDescriptor$1(rawWindow, key);
 
-    if (originalDescriptor) {
-      ReflectSetPrototypeOf$1(originalDescriptor, null);
+    if (unsafeDesc) {
+      const safeDesc = toSafeDescriptor(unsafeDesc);
       const {
         value: originalValue
-      } = originalDescriptor;
+      } = safeDesc;
 
       if (typeof originalValue === 'function') {
         const bound = FunctionBind(originalValue, rawWindow);
-        ReflectDefineProperty(bound, 'name', ReflectGetOwnPropertyDescriptor$1(originalValue, 'name'));
-        originalDescriptor.value = bound;
+        const unsafeNameDesc = ReflectGetOwnPropertyDescriptor$1(originalValue, 'name');
+
+        if (unsafeNameDesc) {
+          ReflectDefineProperty(bound, 'name', toSafeDescriptor(unsafeNameDesc));
+        }
+
+        unsafeDesc.value = bound;
       } else {
         const {
-          get: originalDescriptorGetter,
-          set: originalDescriptorSetter
-        } = originalDescriptor;
+          get: getter,
+          set: setter
+        } = safeDesc;
         let overwrittenValue = DEFAULT_OVERWRITTEN_VALUE;
 
-        if (typeof originalDescriptorGetter === 'function') {
-          originalDescriptor.get = function get() {
-            return overwrittenValue === DEFAULT_OVERWRITTEN_VALUE ? ReflectApply$3(originalDescriptorGetter, rawWindow, emptyArray$1) : overwrittenValue;
+        if (typeof getter === 'function') {
+          safeDesc.get = function get() {
+            return overwrittenValue === DEFAULT_OVERWRITTEN_VALUE ? ReflectApply$3(getter, rawWindow, emptyArray$1) : overwrittenValue;
           };
         }
 
-        if (typeof originalDescriptorSetter === 'function') {
-          originalDescriptor.set = function set(value) {
+        if (typeof setter === 'function') {
+          safeDesc.set = function set(value) {
             overwrittenValue = value;
           };
         }
       }
 
-      ReflectDefineProperty(patchedWindow, key, originalDescriptor);
+      ReflectDefineProperty(patchedWindow, key, safeDesc);
     }
   }
 
   for (let i = 0, len = ALLOW_LIST_PATCHED.length; i < len; i += 1) {
     const key = ALLOW_LIST_PATCHED[i];
-    const originalDescriptor = ReflectGetOwnPropertyDescriptor$1(rawWindow, key);
+    const unsafeDesc = ReflectGetOwnPropertyDescriptor$1(rawWindow, key);
 
-    if (originalDescriptor) {
-      ReflectSetPrototypeOf$1(originalDescriptor, null);
+    if (unsafeDesc) {
+      const safeDesc = toSafeDescriptor(unsafeDesc);
       const {
-        get: originalDescriptorGetter,
-        set: originalDescriptorSetter,
-        value: originalDescriptorValue
-      } = originalDescriptor;
+        get: getter,
+        set: setter
+      } = safeDesc;
       let overwrittenValue = DEFAULT_OVERWRITTEN_VALUE;
 
-      if (typeof originalDescriptorGetter === 'function') {
-        originalDescriptor.get = function get() {
+      if (typeof getter === 'function') {
+        safeDesc.get = function get() {
           if (overwrittenValue === DEFAULT_OVERWRITTEN_VALUE) {
-            return getPatchedWindow(ReflectApply$3(originalDescriptorGetter, rawWindow, emptyArray$1));
+            return getPatchedWindow(ReflectApply$3(getter, rawWindow, emptyArray$1));
           }
 
           return overwrittenValue;
         };
       }
 
-      if (typeof originalDescriptorSetter === 'function') {
-        originalDescriptor.set = function set(value) {
+      if (typeof setter === 'function') {
+        safeDesc.set = function set(value) {
           overwrittenValue = value;
         };
       }
 
-      if (key === 'postMessage' && typeof originalDescriptorValue === 'function') {
-        originalDescriptor.value = function postMessage(...args) {
-          return ReflectApply$3(patchedWindowPostMessageValue, rawWindow, args);
-        };
-      }
+      ReflectDefineProperty(patchedWindow, key, safeDesc);
+    }
+  }
+
+  const unsafePostMessageDesc = ReflectGetOwnPropertyDescriptor$1(rawWindow, 'postMessage');
+
+  if (unsafePostMessageDesc) {
+    const safeDesc = toSafeDescriptor(unsafePostMessageDesc);
+    const {
+      value: originalValue
+    } = safeDesc;
 
-      ReflectDefineProperty(patchedWindow, key, originalDescriptor);
+    if (typeof originalValue === 'function') {
+      safeDesc.value = function postMessage(...args) {
+        return ReflectApply$3(patchedWindowPostMessageValue, rawWindow, args);
+      };
     }
+
+    ReflectDefineProperty(patchedWindow, 'postMessage', safeDesc);
   }
 
   return patchedWindow;
@@ -1177,7 +1322,7 @@ function XhrStatusGetter(xhr) {
 function XhrWithCredentialsSetter(xhr, bool) {
   ReflectApply$3(XhrProtoWithCredentialsSetter, xhr, [bool]);
 }
-/*! version: 0.14.17 */
+/*! version: 0.14.26 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -1215,7 +1360,7 @@ function sanitizeURLForElement(url) {
 function sanitizeURLString(urlString) {
   return urlString === '' ? urlString : StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, '');
 }
-/*! version: 0.14.17 */
+/*! version: 0.14.26 */
 
 /*! @license DOMPurify | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/2.2.2/LICENSE */
 
@@ -2612,7 +2757,7 @@ function sanitizer(config, hooks) {
 }
 
 const ATTRIBUTES = ['href', 'xlink:href'];
-const SANITIZER_HOOKS = new MapCtor([['uponSanitizeAttribute', sanitizeHrefAttributeHook]]);
+const SANITIZER_HOOKS = new MapCtor([['uponSanitizeAttribute', sanitizeHrefAttributeHook], ['uponSanitizeElement', allowCustomTagHook]]);
 const URL_SCHEMES = ['http:', 'https:'];
 const {
   document: document$1
@@ -2622,7 +2767,11 @@ const normalizerAnchor = DocumentCreateElement$1(document$1, 'a'); // Queue for
 
 const queue = new SetCtor(); // Regex to find all non lowercase alphanumeric.
 
-const urlReplacer = /[^a-z0-9]+/gi;
+const urlReplacer = /[^a-z0-9]+/gi; // The Regex is based on the WHATWG spec:
+// https://html.spec.whatwg.org/multipage/custom-elements.html#valid-custom-element-name
+// However, DOMPurify sanitizes unicode characters (\u0000-\uFFFF) in tag name.
+
+const customTagRegex = /^[a-z]([-_.\w])*-([-.0-9_a-z\xB7\xC0-\xD6\xD8-\xF6\xF8-\u37D0\u37F-\u1FFF\u200C-\u200D\u203F-\u2040\u2070-\u218F\u2C00-\u2FEF\u3001-\uD7FF\uF900-\uFDCF\uFDF0-\uFFFD\u10000-\uEFFFF])*/;
 
 function checkExistingAndDequeue(container, normalizedHref) {
   if (SetHas(queue, normalizedHref.normalizedUrl)) {
@@ -2729,14 +2878,26 @@ function sanitize(dirty) {
   const sanitizer$1 = sanitizer(NODE_ALL_IN_PLACE, SANITIZER_HOOKS);
   sanitizer$1.sanitize(content);
   return ElementInnerHTMLGetter(htmlTemplate);
+}
+
+function sanitizeDocument(doc) {
+  const content = ElementOuterHTMLGetter(DocumentDocumentElementGetter(doc));
+  const contentSanitized = sanitize(content);
+  const newDoc = DOMImplementationCreateDocument(DocumentImplementation(doc), NAMESPACE_XHTML, 'html');
+  ElementInnerHTMLSetter(DocumentDocumentElementGetter(newDoc), contentSanitized);
+  return newDoc;
 } // Sanitize a URL representing a SVG href attribute value.
 
 
-function sanitizeHrefAttributeHook(node, data) {
+function sanitizeHrefAttributeHook(node, data, _config) {
+  const {
+    attrValue,
+    attrName
+  } = data;
   const nodeName = NodeNameGetter(node);
 
-  if (data.attrValue && nodeName === 'USE' && ArrayIncludes(ATTRIBUTES, data.attrName)) {
-    data.attrValue = sanitizeSvgHrefValue(data.attrValue);
+  if (attrValue && nodeName === 'USE' && ArrayIncludes(ATTRIBUTES, attrName)) {
+    data.attrValue = sanitizeSvgHrefValue(attrValue);
   }
 
   return data;
@@ -2766,11 +2927,23 @@ function sanitizeSvgHrefValue(url) {
   return url;
 }
 
-function sanitizeSvgInnerHtml(el, dirty) {
-  const ownerDoc = NodeOwnerDocumentGetter(el);
+function createSvgContainer(ownerDoc) {
+  return DocumentCreateElementNS(ownerDoc, NAMESPACE_SVG, 'svg');
+}
+
+function sanitizeSvgInnerHtml(stringOrSvg, dirty = '') {
+  let container;
+  const ownerDoc = typeof stringOrSvg === 'string' ? document$1 : NodeOwnerDocumentGetter(stringOrSvg);
   const comment = DocumentCreateComment(ownerDoc, '');
-  const closestSvg = ElementClosest(el, 'svg');
-  const container = closestSvg ? NodeClone(closestSvg, false) : DocumentCreateElementNS(ownerDoc, 'http://www.w3.org/2000/svg', 'svg');
+
+  if (typeof stringOrSvg === 'string') {
+    dirty = stringOrSvg;
+    container = createSvgContainer(ownerDoc);
+  } else {
+    const closestSvg = ElementClosest(stringOrSvg, 'svg');
+    container = closestSvg ? NodeClone(closestSvg, false) : createSvgContainer(ownerDoc);
+  }
+
   NodeAppendChild$1(container, comment);
   const outerHTML = ElementOuterHTMLGetter(container);
   const replacedOuterHTML = StringReplace(outerHTML, '<!---->', dirty);
@@ -2783,7 +2956,18 @@ function sanitizeSvgTextReturnDOM(dirty) {
   const sanitizer = svgSanitizer();
   return sanitizer.sanitize(dirty);
 }
-/*! version: 0.14.17 */
+
+function allowCustomTagHook(node, data, _config) {
+  const {
+    allowedTags,
+    tagName
+  } = data;
+
+  if (!allowedTags[tagName] && customTagRegex.test(tagName)) {
+    allowedTags[tagName] = true;
+  }
+}
+/*! version: 0.14.26 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -2793,11 +2977,15 @@ function ownKeys(object, enumerableOnly) { var keys = Object.keys(object); if (O
 function _objectSpread(target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i] != null ? arguments[i] : {}; if (i % 2) { ownKeys(Object(source), true).forEach(function (key) { _defineProperty(target, key, source[key]); }); } else if (Object.getOwnPropertyDescriptors) { Object.defineProperties(target, Object.getOwnPropertyDescriptors(source)); } else { ownKeys(Object(source)).forEach(function (key) { Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key)); }); } } return target; }
 
 function _defineProperty(obj, key, value) { if (key in obj) { Object.defineProperty(obj, key, { value: value, enumerable: true, configurable: true, writable: true }); } else { obj[key] = value; } return obj; }
+const CustomElementRegistryBlockedProperties = ['define'];
 /**
  * this registry is going to be used by Attr, NameNodeMap, setAttribute* distortions
  */
+// @ts-ignore: TS doesn't like null as a AttributeDistortionRegistry.
 
-const distortionsBySandboxKey = ObjectCreate(null); // we hold an array of factories
+const distortionsBySandboxKey = {
+  __proto__: null
+}; // we hold an array of factories
 // this array will be traversed when we create a new sandbox
 // the result of parsing this registry will be a new registry with initialized distortions
 
@@ -2806,25 +2994,15 @@ const factories = []; // symbol for Locker to lookup attribute distortions on El
 const lookupSymbol = Symbol('@@HasLockerElementAttributeDistortion');
 
 function storeDistortionInRegistry(registry, ElementCtor, attributeName, attributeNamespace, distortion) {
-  let byAttributeNamespace = registry[attributeName];
-
-  if (!byAttributeNamespace) {
-    byAttributeNamespace = ObjectCreate(null);
-  }
-
-  let byElementCtor = byAttributeNamespace[attributeNamespace];
-
-  if (!byElementCtor) {
-    byElementCtor = new MapCtor();
-  }
-
+  const byAttributeNamespace = registry[attributeName] || {
+    __proto__: null
+  };
+  const byElementCtor = byAttributeNamespace[attributeNamespace] || new MapCtor();
   MapSet(byElementCtor, ElementCtor, distortion);
   byAttributeNamespace[attributeNamespace] = byElementCtor;
   registry[attributeName] = byAttributeNamespace;
 }
 
-const DEFAULT_ELEMENT_NAMESPACE = 'default';
-
 function getAttributeDistortion(element, key, attributeName, attributeNamespace) {
   if (!(lookupSymbol in element)) {
     return undefined;
@@ -2862,8 +3040,11 @@ function getAttributeDistortion(element, key, attributeName, attributeNamespace)
 }
 
 function makeElementDistortionsForSandboxKey(key) {
-  // this registry is created per sandbox
-  const registry = ObjectCreate(null);
+  // This registry is created per sandbox.
+  // @ts-ignore: TS doesn't like null as a DistortionEntryByAttributeNamespace.
+  const registry = {
+    __proto__: null
+  };
   const entries = [];
   const {
     length
@@ -2883,11 +3064,10 @@ function makeElementDistortionsForSandboxKey(key) {
 } // utility for normalizing namespaces which default to HTML behavior
 // script.setAttributeNS(null, 'src', 'foo.js') has the same behavior as
 // script.setAttribute('src', 'foo.js')
-// eslint-disable-next-line arrow-body-style
 
 
 function normalizeNamespace(ns) {
-  return ns === null || ns === undefined || ns === '' ? DEFAULT_ELEMENT_NAMESPACE : ns;
+  return ns === null || ns === undefined || ns === '' ? NAMESPACE_DEFAULT : ns;
 }
 
 function registerElementSetDistortion(ElementCtor, options) {
@@ -2905,7 +3085,11 @@ function registerElementSetDistortion(ElementCtor, options) {
     storeDistortionInRegistry(registry, ElementCtor, attributeName, attributeNamespace, distortion);
 
     if (!(lookupSymbol in ElementProto)) {
-      ReflectDefineProperty(ElementProto, lookupSymbol, ObjectCreate(null));
+      ReflectDefineProperty(ElementProto, lookupSymbol, {
+        // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+        __proto__: null,
+        value: undefined
+      });
     }
 
     return null;
@@ -2919,7 +3103,7 @@ function abstractFactoryValueThrower(proto, propName) {
     const originalValue = ObjectLookupOwnValue(proto, propName);
 
     function value() {
-      throw new ErrorCtor$1('not allowed');
+      throw new LockerSecurityError(`Cannot access ${propName}.`);
     }
 
     return [originalValue, value];
@@ -2931,7 +3115,7 @@ function abstractFactoryGetThrower(proto, propName) {
     const originalGet = ObjectLookupOwnGetter$1(proto, propName);
 
     function get() {
-      throw new ErrorCtor$1('not allowed');
+      throw new LockerSecurityError(`Cannot access ${propName}.`);
     }
 
     return [originalGet, get];
@@ -2943,12 +3127,43 @@ function abstractFactorySetThrower(proto, propName) {
     const originalSet = ObjectLookupOwnSetter(proto, propName);
 
     function set() {
-      throw new ErrorCtor$1('not allowed');
+      throw new LockerSecurityError(`Cannot access ${propName}.`);
     }
 
     return [originalSet, set];
   };
 }
+
+function transformUncompiledSource(source) {
+  // Input `source` is uncompiled, so window.location returns null inside the sandbox. Our
+  // compiler solves this problem by transforming the red location reference into a blue location
+  // reference. The solution below emulates what our compiler does, but using a simple string
+  // replacement.
+  if (StringIncludes(source, SANDBOX_EVAL_CONTEXT_NAME)) {
+    // To avoid conflicts with anyone else using SANDBOX_EVAL_CONTEXT_NAME, we sniff the source code
+    // to see if it is present, and in that case we don't proceed with the string replacement.
+    return source;
+  }
+
+  let locationTransformed = false;
+  source = StringReplace(source, /\b(?:document|self|window)\.location(\s*[?*/%&^|+-]*=(?=[^=]))?/g, (_match, assignmentOperator) => {
+    locationTransformed = true;
+
+    if (assignmentOperator) {
+      return `${UNCOMPILED_LOCATION_NAME}.href${assignmentOperator}`;
+    }
+
+    return UNCOMPILED_LOCATION_NAME;
+  });
+
+  if (locationTransformed) {
+    // Prepend the SANDBOX_EVAL_CONTEXT_NAME to pluck the UNCOMPILED_LOCATION_NAME only if the
+    // source code actually uses (document|self|window).location
+    source = `const { ${UNCOMPILED_LOCATION_NAME} } = ${SANDBOX_EVAL_CONTEXT_NAME};${source}`;
+  }
+
+  return source;
+}
 /**
  * Wraps the source content of a script tag in the evaluator
  * Creates a blob: url with the wrapped content
@@ -2959,13 +3174,14 @@ function abstractFactorySetThrower(proto, propName) {
 
 
 function createScriptUrl(text, key) {
-  const payload = WindowStaticEncodeURIComponent(text);
+  const transformedText = transformUncompiledSource(text);
+  const payload = WindowStaticEncodeURIComponent(transformedText);
   const blobScript = `
     {
         const { $evaluator$ } = document.currentScript;
         const text = decodeURIComponent(\`${payload}\`);
         delete document.currentScript.$evaluator$;
-        $evaluator$('${toString(key)}', text);
+        $evaluator$('${toString$1(key)}', text, { ${UNCOMPILED_LOCATION_NAME}: location });
     }`;
   return URLCreateObjectURL(new BlobCtor([blobScript], {
     type: 'text/javascript'
@@ -2980,9 +3196,11 @@ function scriptDistortion(attributeName, options, datasetGetter) {
   const normalizerAnchor = DocumentCreateElement$1(document, 'a');
   return function distortion(value) {
     const originalValue = value;
+    const elementNamespaceURI = ElementGetNamespaceURI(this);
+    const attributeNamespaceURI = elementNamespaceURI === NAMESPACE_XHTML ? '' : NAMESPACE_XLINK;
 
     if (value === '') {
-      ElementSetAttribute$1(this, attributeName, value);
+      ElementSetAttributeNS(this, attributeNamespaceURI, attributeName, value);
       return;
     } // Normalize Value
 
@@ -2991,7 +3209,7 @@ function scriptDistortion(attributeName, options, datasetGetter) {
     value = HTMLAnchorElementHrefGetter(normalizerAnchor); // Create Synthetic Attribute
 
     const dataset = datasetGetter(this);
-    dataset[`distorted${capitalize(attributeName)}`] = originalValue; // Create XHR
+    dataset[`distorted${capitalizeFirstChar$1(attributeName)}`] = originalValue; // Create XHR
 
     const hostname = HTMLAnchorElementHostnameGetter(normalizerAnchor);
     const xhr = new XhrCtor();
@@ -3005,13 +3223,15 @@ function scriptDistortion(attributeName, options, datasetGetter) {
 
       if (status === 200) {
         const responseText = XhrResponseTextGetter(xhr);
-        const descriptor = ObjectCreate(null);
-        descriptor.configurable = true;
-        descriptor.value = evaluator;
-        ReflectDefineProperty(this, '$evaluator$', descriptor);
-        ElementSetAttribute$1(this, attributeName, createScriptUrl(responseText, key));
+        ReflectDefineProperty(this, '$evaluator$', {
+          // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+          __proto__: null,
+          configurable: true,
+          value: evaluator
+        });
+        ElementSetAttributeNS(this, attributeNamespaceURI, attributeName, createScriptUrl(responseText, key));
       } else if (status === 404) {
-        ElementSetAttribute$1(this, attributeName, `blob:http://localhost/not-found`);
+        ElementSetAttributeNS(this, attributeNamespaceURI, attributeName, 'blob:http://localhost/not-found');
       }
     });
     XhrOpen(xhr, 'GET', value);
@@ -3048,7 +3268,7 @@ function distortBlockedProperties(proto, propertyList) {
   return entries;
 }
 
-function distortBlockedAttributes(ctor, attributes, elNamespace = DEFAULT_ELEMENT_NAMESPACE) {
+function distortBlockedAttributes(ctor, attributes, elNamespace = NAMESPACE_DEFAULT) {
   for (let i = 0, len = attributes.length; i < len; i += 1) {
     const attributeName = attributes[i];
     registerElementSetDistortion(ctor, {
@@ -3056,7 +3276,7 @@ function distortBlockedAttributes(ctor, attributes, elNamespace = DEFAULT_ELEMEN
       attributeNamespace: elNamespace,
 
       distortion() {
-        throw new ErrorCtor$1(`Attribute "${attributeName}" not allowed on ${ctor.name}`);
+        throw new LockerSecurityError(`Attribute "${attributeName}" not allowed on ${ctor.name}`);
       }
 
     });
@@ -3088,7 +3308,7 @@ function withInstrumentation(fn, instrumentation, activityName, key) {
   };
 }
 
-function factoryPatchedAttrProtoValueSetter(globalObject, options) {
+function distortionAttrValueSetter(globalObject, options) {
   const {
     Attr
   } = globalObject;
@@ -3122,7 +3342,7 @@ function factoryPatchedAttrProtoValueSetter(globalObject, options) {
   return [originalAttributeValueSetter, value];
 }
 
-function patchAuraUtilGlobalEval(globalObject, options) {
+function distortionAuraUtilGlobalEval(globalObject, options) {
   var _globalObject$aura, _globalObject$aura$ut;
 
   const originalGlobalEval = (_globalObject$aura = globalObject.aura) === null || _globalObject$aura === void 0 ? void 0 : (_globalObject$aura$ut = _globalObject$aura.util) === null || _globalObject$aura$ut === void 0 ? void 0 : _globalObject$aura$ut.globalEval;
@@ -3151,6 +3371,9 @@ function patchAuraUtilGlobalEval(globalObject, options) {
   return [originalGlobalEval, globalEval];
 }
 
+const CHAR_CODE_EQUALS = 61;
+const COOKIE_DELIMITER = '; ';
+
 function prefixCookieName(detailsOrName, key) {
   if (isObjectLike(detailsOrName)) {
     const clonedDetails = shallowCloneOptions(detailsOrName);
@@ -3162,10 +3385,49 @@ function prefixCookieName(detailsOrName, key) {
 
   return detailsOrName;
 }
+
+var CookieSameSite;
+
+(function (CookieSameSite) {
+  CookieSameSite[CookieSameSite["strict"] = 0] = "strict";
+  CookieSameSite[CookieSameSite["lax"] = 1] = "lax";
+  CookieSameSite[CookieSameSite["none"] = 2] = "none";
+})(CookieSameSite || (CookieSameSite = {}));
+
+function unprefixCookieName(name, key) {
+  const rootKey = nsCookieRootKey(key); // First check that this cookie belongs to this sandbox,
+  // if not then return null.
+
+  if (!StringStartsWith(name, rootKey)) {
+    return null;
+  } // If this cookie belongs to this sandbox, remove the prefix key
+
+
+  const {
+    length: rootKeyLength
+  } = rootKey;
+  const rootKeySubstringLength = StringCharCodeAt(name, rootKeyLength) === CHAR_CODE_EQUALS ? rootKeyLength + 1 : rootKeyLength;
+  return StringSlice(name, rootKeySubstringLength);
+}
+
+function normalizeCookieListItem(cookie, key) {
+  if (cookie) {
+    const unprefixedCookieName = unprefixCookieName(cookie.name, key); // If unprefixCookieName() returns null, that means this cookie
+    // doesn't belong to the provided sandbox (based on the key)
+
+    if (unprefixedCookieName === null) {
+      return null;
+    }
+
+    cookie.name = unprefixedCookieName;
+  }
+
+  return cookie;
+}
 /* istanbul ignore next: only available in secure context */
 
 
-function factoryPatchedDeleteValue(globalObject, options) {
+function distortionCookieStoreDelete(globalObject, options) {
   const {
     CookieStore
   } = globalObject;
@@ -3199,7 +3461,7 @@ function factoryPatchedDeleteValue(globalObject, options) {
 /* istanbul ignore next: only available in secure context */
 
 
-function factoryPatchedGetValue(globalObject, options) {
+function distortionCookieStoreGet(globalObject, options) {
   const {
     CookieStore
   } = globalObject;
@@ -3208,9 +3470,9 @@ function factoryPatchedGetValue(globalObject, options) {
     return null;
   }
 
-  const originalGetValue = ObjectLookupOwnValue(CookieStore.prototype, 'get');
+  const originalGet = ObjectLookupOwnValue(CookieStore.prototype, 'get');
 
-  if (!originalGetValue) {
+  if (!originalGet) {
     return null;
   }
 
@@ -3225,15 +3487,15 @@ function factoryPatchedGetValue(globalObject, options) {
       args[0] = prefixCookieName(detailsOrName, key);
     }
 
-    return ReflectApply$3(CookieStoreProtoGet, this, args);
+    return PromiseThen(ReflectApply$3(originalGet, this, args), result => normalizeCookieListItem(result, key));
   };
 
-  return [originalGetValue, get];
+  return [originalGet, get];
 }
 /* istanbul ignore next: only available in secure context */
 
 
-function factoryPatchedGetAllValue(globalObject, options) {
+function distortionCookieStoreGetAll(globalObject, options) {
   const {
     CookieStore
   } = globalObject;
@@ -3242,9 +3504,9 @@ function factoryPatchedGetAllValue(globalObject, options) {
     return null;
   }
 
-  const originalGetAllValue = ObjectLookupOwnValue(CookieStore.prototype, 'getAll');
+  const originalGetAll = ObjectLookupOwnValue(CookieStore.prototype, 'getAll');
 
-  if (!originalGetAllValue) {
+  if (!originalGetAll) {
     return null;
   }
 
@@ -3257,32 +3519,55 @@ function factoryPatchedGetAllValue(globalObject, options) {
 
     if (detailsOrName !== null && detailsOrName !== undefined) {
       args[0] = prefixCookieName(args[0], key);
-      return ReflectApply$3(CookieStoreProtoGetAll, this, args);
     }
 
-    return PromiseThen(ReflectApply$3(CookieStoreProtoGetAll, this, args), result => {
-      const cookiesAll = result;
-      const cookiesSandbox = [];
+    return PromiseThen(ReflectApply$3(originalGetAll, this, args), result => {
+      const sandboxedCookies = [];
 
-      for (let i = 0, len = cookiesAll.length; i < len; i += 1) {
-        const cookie = cookiesAll[i];
-        const rootKey = nsCookieRootKey(key);
+      for (let i = 0, {
+        length
+      } = result; i < length; i += 1) {
+        const cookie = normalizeCookieListItem(result[i], key);
 
-        if (StringStartsWith(cookie.name, rootKey)) {
-          ArrayPush(cookiesSandbox, cookie);
+        if (cookie) {
+          ArrayPush(sandboxedCookies, cookie);
         }
       }
 
-      return cookiesSandbox;
+      return sandboxedCookies;
     });
   };
 
-  return [originalGetAllValue, getAll];
+  return [originalGetAll, getAll];
 }
 /* istanbul ignore next: only available in secure context */
 
 
-function factoryPatchedSetValue(globalObject, options) {
+function distortionCookieStoreOnChange(globalObject, _options) {
+  const {
+    CookieStore
+  } = globalObject;
+
+  if (CookieStore === undefined) {
+    return null;
+  }
+
+  const originalOnChangeSetter = ObjectLookupOwnSetter(CookieStore.prototype, 'onchange');
+
+  if (originalOnChangeSetter === undefined) {
+    return null;
+  }
+
+  function onchange() {
+    throw new LockerSecurityError('Cannot set cookieStore.onchange.');
+  }
+
+  return [originalOnChangeSetter, onchange];
+}
+/* istanbul ignore next: only available in secure context */
+
+
+function distortionCookieStoreSet(globalObject, options) {
   const {
     CookieStore
   } = globalObject;
@@ -3321,34 +3606,7 @@ function factoryPatchedSetValue(globalObject, options) {
   return [originalSetValue, set];
 }
 
-function patchedDefineValue(globalObject, options) {
-  const {
-    key
-  } = options;
-  const LOWER_CASED_NS = StringToLowerCase(key);
-  const {
-    CustomElementRegistry
-  } = globalObject;
-  const {
-    define: originalDefineValue
-  } = CustomElementRegistry.prototype;
-
-  function define(_name, _constructor, _options) {
-    const args = sanitizeArguments(arguments, [toString]);
-    const sanitizedName = args[0];
-    const lowerCasedName = StringToLowerCase(sanitizedName);
-
-    if (!StringStartsWith(lowerCasedName, `${LOWER_CASED_NS}-`)) {
-      throw new RangeErrorCtor('Disallowed name when calling customElements.define() ' + `with name "${sanitizedName}". Only names prefixed with ` + `"${LOWER_CASED_NS}-" are allowed.`);
-    }
-
-    ReflectApply$3(CustomElementRegistryProtoDefine, this, args);
-  }
-
-  return [originalDefineValue, define];
-}
-
-function patchedGetValue(globalObject, options) {
+function distortionCustomElementRegistryGet(globalObject, options) {
   const {
     key
   } = options;
@@ -3361,12 +3619,12 @@ function patchedGetValue(globalObject, options) {
   } = CustomElementRegistry.prototype;
 
   function get(_name) {
-    const args = sanitizeArguments(arguments, [toString]);
+    const args = sanitizeArguments(arguments, [toString$1]);
     const sanitizedName = args[0];
     const lowerCasedName = StringToLowerCase(sanitizedName);
 
     if (!StringStartsWith(lowerCasedName, `${LOWER_CASED_NS}-`)) {
-      throw new RangeErrorCtor('Disallowed name when calling customElements.get() ' + `with name "${sanitizedName}". Only names prefixed with ` + `"${LOWER_CASED_NS}-" are allowed.`);
+      throw new LockerSecurityError('Disallowed name when calling customElements.get() ' + `with name "${sanitizedName}". Only names prefixed with ` + `"${LOWER_CASED_NS}-" are allowed.`);
     }
 
     return ReflectApply$3(CustomElementRegistryProtoGet, this, args);
@@ -3374,8 +3632,6 @@ function patchedGetValue(globalObject, options) {
 
   return [originalGetValue, get];
 }
-
-const CHAR_CODE_EQUALS = 61;
 /**
  * Factory patched cookie getter. Must be invoked with namespace argument.
  * Will return a patched cookie getter bound to the namespace.
@@ -3383,7 +3639,8 @@ const CHAR_CODE_EQUALS = 61;
  * @returns Distortion: string
  */
 
-function factoryPatchedCookieGetter(globalObject, options) {
+
+function distortionDocumentCookieGetter(globalObject, options) {
   const {
     Document
   } = globalObject;
@@ -3393,25 +3650,21 @@ function factoryPatchedCookieGetter(globalObject, options) {
   const originalCookieGetter = ObjectLookupOwnGetter$1(Document.prototype, 'cookie');
 
   function get() {
-    const cookieStr = DocumentCookieGetter(this);
-    const cookies = StringSplit(cookieStr, '; ');
-    const rootKey = nsCookieRootKey(key);
-    const rootKeyLength = rootKey.length;
-    const nsCookies = [];
-
-    for (let i = 0, len = cookies.length; i < len; i += 1) {
-      const cookie = cookies[i];
-
-      if (StringStartsWith(cookie, rootKey)) {
-        if (StringCharCodeAt(cookie, rootKeyLength) !== CHAR_CODE_EQUALS) {
-          ArrayPush(nsCookies, StringSubstring(cookie, rootKeyLength));
-        } else if (StringCharCodeAt(cookie, rootKeyLength) === CHAR_CODE_EQUALS) {
-          ArrayPush(nsCookies, StringSubstring(cookie, rootKeyLength + 1));
-        }
+    const documentCookieValue = DocumentCookieGetter(this);
+    const cookies = StringSplit(documentCookieValue, COOKIE_DELIMITER);
+    const sandboxedCookies = [];
+
+    for (let i = 0, {
+      length
+    } = cookies; i < length; i += 1) {
+      const cookie = unprefixCookieName(cookies[i], key);
+
+      if (cookie) {
+        ArrayPush(sandboxedCookies, cookie);
       }
     }
 
-    return ArrayJoin(nsCookies, '; ');
+    return ArrayJoin(sandboxedCookies, COOKIE_DELIMITER);
   }
 
   return [originalCookieGetter, get];
@@ -3424,7 +3677,7 @@ function factoryPatchedCookieGetter(globalObject, options) {
  */
 
 
-function factoryPatchedCookieSetter(globalObject, options) {
+function distortionDocumentCookieSetter(globalObject, options) {
   const {
     Document
   } = globalObject;
@@ -3434,34 +3687,36 @@ function factoryPatchedCookieSetter(globalObject, options) {
   const originalCookieSetter = ObjectLookupOwnSetter(Document.prototype, 'cookie');
 
   function set(value) {
-    const cookieEntries = StringSplit(value, '; ');
-    let newCookieEntry = cookieEntries[0];
+    const cookieEntries = StringSplit(value, COOKIE_DELIMITER);
+    let {
+      0: newCookieEntry
+    } = cookieEntries;
 
-    if (StringStartsWith(newCookieEntry, '=')) {
-      newCookieEntry = StringSubstring(newCookieEntry, 1);
+    if (StringCharCodeAt(newCookieEntry, 0) === CHAR_CODE_EQUALS) {
+      newCookieEntry = StringSlice(newCookieEntry, 1);
     }
 
     cookieEntries[0] = nsCookieKey(newCookieEntry, key);
-    DocumentCookieSetter(this, ArrayJoin(cookieEntries, '; '));
+    DocumentCookieSetter(this, ArrayJoin(cookieEntries, COOKIE_DELIMITER));
   }
 
   return [originalCookieSetter, set];
 }
 
-function patchedDomainSetter(globalObject) {
+function distortionDocumentDomainSetter(globalObject) {
   const {
     Document
   } = globalObject;
   const originalDomainSetter = ObjectLookupOwnSetter(Document.prototype, 'domain');
 
   function domain() {
-    throw new LockerSecurityError('The operation is insecure.');
+    throw new LockerSecurityError('Cannot set document.domain.');
   }
 
   return [originalDomainSetter, domain];
 }
 
-function patchedExecCommandValue(globalObject) {
+function distortionDocumentExecCommand(globalObject) {
   const {
     Document
   } = globalObject;
@@ -3474,7 +3729,7 @@ function patchedExecCommandValue(globalObject) {
       const unsanitizedValue = args[2];
 
       if (unsanitizedValue !== null && unsanitizedValue !== undefined) {
-        args = sanitizeArguments(args, [toString]);
+        args = sanitizeArguments(args, [toString$1]);
         const command = args[0];
 
         if (StringToLowerCase(command) === 'inserthtml') {
@@ -3487,9 +3742,160 @@ function patchedExecCommandValue(globalObject) {
   }
 
   return [originalExecCommandValue, execCommand];
+} // Check for the noopener feature being enabled:
+// - noopener
+// - noopener=1
+// - noopener=yes
+
+
+const noopenerRegExp = /(^|,)(\s*noopener\s*=\s*(?:yes|1)\s*)(,|$)/g;
+
+function sanitizeWindowOpenArguments(args) {
+  const sanitizedArgs = sanitizeArguments(args, [toIgnore, toIgnore, toString$1]);
+
+  if (sanitizedArgs.length > 2) {
+    // Lowercase the features string because it is case insensitive.
+    // https://html.spec.whatwg.org/multipage/window-object.html#normalizing-the-feature-name
+    let windowFeatures = StringToLowerCase(sanitizedArgs[2]);
+
+    if (RegExpTest(noopenerRegExp, windowFeatures)) {
+      noopenerRegExp.lastIndex = 0; // Replacing noopener with an enabled state that is supported
+      // across all browsers. Firefox Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1566619
+
+      windowFeatures = StringReplace(windowFeatures, noopenerRegExp, (match, leading, feature, ending) => `${leading}noopener${ending}`);
+    }
+
+    sanitizedArgs[2] = windowFeatures;
+  }
+
+  return sanitizedArgs;
+}
+
+function distortionDocumentOpen(globalObject) {
+  const {
+    Document
+  } = globalObject;
+  const originalDocumentOpen = ObjectLookupOwnValue(Document.prototype, 'open');
+
+  function open(...args) {
+    if (args.length >= 3) {
+      // Distort three-argument document.open calls which is an alias for window.open
+      // https://developer.mozilla.org/en-US/docs/Web/API/Document/open#three-argument_document.open
+      const sanitizedArgs = sanitizeWindowOpenArguments(args);
+      const rawOpenWindow = ReflectApply$3(originalDocumentOpen, this, sanitizedArgs);
+      return getPatchedWindow(rawOpenWindow);
+    }
+
+    return ReflectApply$3(originalDocumentOpen, this, args);
+  }
+
+  return [originalDocumentOpen, open];
 }
 
-function patchedAttachShadow(globalObject) {
+function distortionDOMParserParseFromString(globalObject) {
+  const {
+    DOMParser
+  } = globalObject;
+  const {
+    parseFromString: originalParseFromString
+  } = DOMParser.prototype;
+
+  function parseFromString(...args) {
+    args = sanitizeArguments(args, [toString$1]); // DOMParser.prototype.parseFromString can only be called with exactly
+    // two arguments. If it receives one argument, it will fail. Some implementations
+    // will also fail if it receives more than two arguments. Since any call that does
+    // not have at least two arguments will fail no matter what, we only need to
+    // expend effort to sanitize when we know that the operation is definitely
+    // NOT going to fail.
+
+    if (args.length >= 2) {
+      // Override the value of the first argument with a sanitized version
+      // of that argument. If the provided mimeType indicates that the
+      // first argument is an svg, use the svg sanitizer instead of the
+      // default sanitizer.
+      args[0] = args[1] === 'image/svg+xml' ? sanitizeSvgInnerHtml(args[0]) : sanitize(args[0]);
+    }
+
+    return ReflectApply$3(DOMParserProtoParseFromString, this, args);
+  }
+
+  return [originalParseFromString, parseFromString];
+}
+
+function distortionElementAfter(globalObject) {
+  const {
+    Element
+  } = globalObject;
+  const {
+    after: originalAfter
+  } = Element.prototype;
+  const {
+    isSharedElement,
+    isSharedElementChild
+  } = getValidator(globalObject);
+
+  function after(...args) {
+    if (isSharedElement(this)) {
+      for (let i = 0, {
+        length
+      } = args; i < length; i += 1) {
+        const argValue = args[i];
+
+        if (!isSharedElementChild(argValue)) {
+          var _argValue$nodeName;
+
+          // @ts-ignore: .nodeName is definitely a property of Node.prototype
+          const nodeNameOrString = (_argValue$nodeName = argValue === null || argValue === void 0 ? void 0 : argValue.nodeName) !== null && _argValue$nodeName !== void 0 ? _argValue$nodeName : toString(argValue);
+          throw new LockerSecurityError(`Cannot insert ${nodeNameOrString} after ${this.nodeName}.`);
+        }
+      }
+    }
+
+    return ReflectApply$3(originalAfter, this, args);
+  }
+
+  return [originalAfter, after];
+}
+
+function distortionElementAppend(globalObject) {
+  const {
+    Element
+  } = globalObject;
+  const {
+    append: originalAppend
+  } = Element.prototype;
+  const {
+    isSharedElement,
+    isSharedElementChild
+  } = getValidator(globalObject);
+
+  function append(...args) {
+    if (isSharedElement(this)) {
+      // Element.prototype.append(...args) accepts an arbitrary number of arguments
+      // which can be comprised of Nodes and DOMStrings.
+      for (let i = 0, {
+        length
+      } = args; i < length; i += 1) {
+        const argValue = args[i]; // ...If any of the provided arguments is NOT a valid shared element child,
+        // which is limited to script and link, an exception is thrown.
+
+        if (!isSharedElementChild(argValue)) {
+          var _argValue$nodeName2;
+
+          // @ts-ignore: .nodeName is definitely a property of Node.prototype
+          const nodeNameOrString = (_argValue$nodeName2 = argValue === null || argValue === void 0 ? void 0 : argValue.nodeName) !== null && _argValue$nodeName2 !== void 0 ? _argValue$nodeName2 : toString$1(argValue);
+          throw new LockerSecurityError(`Cannot append ${nodeNameOrString} to ${this.nodeName}.`);
+        }
+      }
+    }
+
+    return ReflectApply$3(originalAppend, this, args);
+  }
+
+  return [originalAppend, append];
+}
+
+function distortionElementAttachShadow(globalObject) {
   const {
     Element
   } = globalObject;
@@ -3508,7 +3914,7 @@ function patchedAttachShadow(globalObject) {
         } = originalShadowRootInit;
 
         if (mode !== 'closed') {
-          throw new LockerRangeError(`Shadow root mode cannot be 'open'`);
+          throw new LockerSecurityError(`Shadow root mode cannot be 'open'`);
         } // Assign own properties and set prototype of shadowRootInit because
         // attachShadow() accepts inherited shadowRootInit properties.
 
@@ -3543,7 +3949,28 @@ function getPairedElement(attrInstance) {
   return WeakMapGet(registry, attrInstance);
 }
 
-function patchedAttributesGetter(globalObject) {
+function setNamedItemWithAttr(originalMethod, nodeNameMap, attr, options) {
+  const element = getPairedElement(nodeNameMap);
+
+  if (element) {
+    const {
+      key
+    } = options;
+    const attrName = AttrNameGetter(attr);
+    const attrNamespace = AttrNamespaceURIGetter(attr);
+    const normalizedNamespace = normalizeNamespace(attrNamespace);
+    const distortion = getAttributeDistortion(element, key, attrName, normalizedNamespace);
+
+    if (distortion) {
+      const attrValue = AttrValueGetter(attr);
+      return ReflectApply$3(distortion, element, [attrValue]);
+    }
+  }
+
+  return ReflectApply$3(originalMethod, nodeNameMap, [attr]);
+}
+
+function distortionElementAttributesGetter(globalObject) {
   const {
     Element
   } = globalObject;
@@ -3558,16 +3985,54 @@ function patchedAttributesGetter(globalObject) {
   return [originalAttributesGetter, attributes];
 }
 
-function patchedInnerHTMLSetter(globalObject) {
+function distortionElementBefore(globalObject) {
+  const {
+    Element
+  } = globalObject;
+  const {
+    before: originalBefore
+  } = Element.prototype;
+  const {
+    isSharedElement,
+    isSharedElementChild
+  } = getValidator(globalObject);
+
+  function before(...args) {
+    if (isSharedElement(this)) {
+      for (let i = 0, {
+        length
+      } = args; i < length; i += 1) {
+        const argValue = args[i];
+
+        if (!isSharedElementChild(argValue)) {
+          var _argValue$nodeName3;
+
+          // @ts-ignore: .nodeName is definitely a property of Node.prototype
+          const nodeNameOrString = (_argValue$nodeName3 = argValue === null || argValue === void 0 ? void 0 : argValue.nodeName) !== null && _argValue$nodeName3 !== void 0 ? _argValue$nodeName3 : toString(argValue);
+          throw new LockerSecurityError(`Cannot insert ${nodeNameOrString} before ${this.nodeName}.`);
+        }
+      }
+    }
+
+    return ReflectApply$3(originalBefore, this, args);
+  }
+
+  return [originalBefore, before];
+}
+
+function distortionElementInnerHTMLSetter(globalObject) {
   const {
     Element,
     SVGElement
   } = globalObject;
   const originalInnerHTMLSetter = ObjectLookupOwnSetter(Element.prototype, 'innerHTML');
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
 
   function innerHTML(value) {
     if (isSharedElement(this)) {
-      throw new LockerSecurityError(`Element.innerHTML cannot be set with ${this} elements!`);
+      throw new LockerSecurityError(`Cannot set innerHTML of ${this.nodeName}.`);
     }
 
     value = this instanceof SVGElement ? sanitizeSvgInnerHtml(this, value) : sanitize(value);
@@ -3577,44 +4042,187 @@ function patchedInnerHTMLSetter(globalObject) {
   return [originalInnerHTMLSetter, innerHTML];
 }
 
-function patchedInsertAdjacentHTMLValue(globalObject) {
+function distortionElementInsertAdjacentElement(globalObject) {
+  const {
+    Element
+  } = globalObject;
+  const {
+    insertAdjacentElement: originalInsertAdjacentElementValue
+  } = Element.prototype;
+  const {
+    isSharedElement,
+    isSharedElementChild
+  } = getValidator(globalObject);
+
+  function insertAdjacentElement(...args) {
+    if (args.length > 1) {
+      const element = args[1];
+
+      if (isSharedElement(this) && !isSharedElementChild(element)) {
+        throw new LockerSecurityError(`Cannot insert ${element.nodeName} adjacent to ${this.nodeName}.`);
+      }
+    }
+
+    return ReflectApply$3(originalInsertAdjacentElementValue, this, args);
+  }
+
+  return [originalInsertAdjacentElementValue, insertAdjacentElement];
+}
+
+function distortionElementInsertAdjacentHTML(globalObject) {
   const {
     Element
   } = globalObject;
   const {
     insertAdjacentHTML: originalInsertAdjacentHTMLValue
   } = Element.prototype;
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
+
+  function insertAdjacentHTML(...args) {
+    if (isSharedElement(this)) {
+      throw new LockerSecurityError(`Cannot insert adjacent HTML to ${this.nodeName}.`);
+    }
+
+    if (args.length > 1) {
+      args[1] = sanitize(args[1]);
+    }
+
+    ReflectApply$3(originalInsertAdjacentHTMLValue, this, args);
+  }
+
+  return [originalInsertAdjacentHTMLValue, insertAdjacentHTML];
+}
+
+function distortionElementOuterHTMLSetter(globalObject) {
+  const {
+    Element
+  } = globalObject;
+  const originalOuterHTMLSetter = ObjectLookupOwnSetter(Element.prototype, 'outerHTML');
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
+
+  function outerHTML(value) {
+    if (isSharedElement(this)) {
+      throw new LockerSecurityError(`Cannot set outerHTML of ${this.nodeName}.`);
+    }
+
+    value = sanitize(value);
+    ElementOuterHTMLSetter(this, value);
+  }
+
+  return [originalOuterHTMLSetter, outerHTML];
+}
+
+function distortionElementPrepend(globalObject) {
+  const {
+    Element
+  } = globalObject;
+  const {
+    prepend: originalPrepend
+  } = Element.prototype;
+  const {
+    isSharedElement,
+    isSharedElementChild
+  } = getValidator(globalObject);
+
+  function prepend(...args) {
+    if (isSharedElement(this)) {
+      // Element.prototype.prepend(...args) accepts an arbitrary number of arguments
+      // which can be comprised of Nodes and DOMStrings.
+      for (let i = 0, {
+        length
+      } = args; i < length; i += 1) {
+        const argValue = args[i]; // ...If any of the provided arguments is NOT a valid shared element child,
+        // which is limited to script and link, an exception is thrown.
+
+        if (!isSharedElementChild(argValue)) {
+          var _argValue$nodeName4;
+
+          // @ts-ignore: .nodeName is definitely a property of Node.prototype
+          const nodeNameOrString = (_argValue$nodeName4 = argValue === null || argValue === void 0 ? void 0 : argValue.nodeName) !== null && _argValue$nodeName4 !== void 0 ? _argValue$nodeName4 : toString(argValue);
+          throw new LockerSecurityError(`Cannot prepend ${nodeNameOrString} to ${this.nodeName}.`);
+        }
+      }
+    }
+
+    return ReflectApply$3(originalPrepend, this, args);
+  }
+
+  return [originalPrepend, prepend];
+}
+
+function distortionElementRemove(globalObject) {
+  const {
+    Element
+  } = globalObject;
+  const {
+    remove: originalRemove
+  } = Element.prototype;
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
+
+  function remove() {
+    if (isSharedElement(this)) {
+      throw new LockerSecurityError(`Cannot remove ${this.nodeName}.`);
+    }
+
+    ReflectApply$3(originalRemove, this, emptyArray$1);
+  }
+
+  return [originalRemove, remove];
+}
+
+function distortionElementReplaceChildren(globalObject) {
+  const {
+    Element
+  } = globalObject;
+  const {
+    replaceChildren: originalReplaceChildren
+  } = Element.prototype;
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
+
+  function replaceChildren(...args) {
+    if (isSharedElement(this)) {
+      throw new LockerSecurityError(`Cannot replace children of ${this.nodeName}.`);
+    }
 
-  function insertAdjacentHTML(position, value) {
-    const lowerCasedPosition = StringToLowerCase(toString(position));
-    const sanitizedValue = sanitize(value);
-    ReflectApply$3(ElementProtoInsertAdjacentHTML, this, [lowerCasedPosition, sanitizedValue]);
+    return ReflectApply$3(originalReplaceChildren, this, args);
   }
 
-  return [originalInsertAdjacentHTMLValue, insertAdjacentHTML];
+  return [originalReplaceChildren, replaceChildren];
 }
 
-function patchedOuterHTMLSetter(globalObject) {
+function distortionElementReplaceWith(globalObject) {
   const {
     Element
   } = globalObject;
-  const originalOuterHTMLSetter = ObjectLookupOwnSetter(Element.prototype, 'outerHTML');
+  const {
+    replaceWith: originalReplaceWith
+  } = Element.prototype;
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
 
-  function outerHTML(value) {
+  function replaceWith(...args) {
     if (isSharedElement(this)) {
-      throw new LockerSecurityError(`Element.outerHTML cannot be set with ${this} elements!`);
+      throw new LockerSecurityError(`Cannot replace ${this.nodeName}.`);
     }
 
-    value = sanitize(value);
-    ElementOuterHTMLSetter(this, value);
+    return ReflectApply$3(originalReplaceWith, this, args);
   }
 
-  return [originalOuterHTMLSetter, outerHTML];
+  return [originalReplaceWith, replaceWith];
 }
 
 function sanitizeAttrName(value) {
-  value = toString(value);
-  return StringToLowerCase(toString(value));
+  value = toString$1(value);
+  return StringToLowerCase(toString$1(value));
 }
 
 function sanitizeAttributeNode(attr) {
@@ -3626,7 +4234,7 @@ function sanitizeAttributeNode(attr) {
   }
 }
 
-function factorySetAttribute(globalObject, options) {
+function distortionElementSetAttribute(globalObject, options) {
   const {
     key
   } = options;
@@ -3638,14 +4246,14 @@ function factorySetAttribute(globalObject, options) {
   } = Element.prototype;
 
   let setAttribute = function setAttribute(_attrName, _attrValue) {
-    const args = sanitizeArguments(arguments, [sanitizeAttrName, toString]);
+    const args = sanitizeArguments(arguments, [sanitizeAttrName, toString$1]);
 
     if (args.length < 2) {
       ReflectApply$3(ElementProtoSetAttribute$1, this, args);
     }
 
     const [attrName, attrValue] = args;
-    const distortion = getAttributeDistortion(this, key, attrName, 'default');
+    const distortion = getAttributeDistortion(this, key, attrName, NAMESPACE_DEFAULT);
 
     if (distortion) {
       ReflectApply$3(distortion, this, [attrValue]);
@@ -3662,7 +4270,7 @@ function factorySetAttribute(globalObject, options) {
   return [originalSetAttributeValue, setAttribute];
 }
 
-function factoryPatchedSetAttributeNode(globalObject, options) {
+function distortionElementSetAttributeNode(globalObject, options) {
   const {
     key
   } = options;
@@ -3732,7 +4340,7 @@ function factoryPatchedSetAttributeNode(globalObject, options) {
   return [originalSetAttributeNodeValue, setAttributeNode];
 }
 
-function factoryPatchedSetAttributeNodeNS(globalObject, options) {
+function distortionElementSetAttributeNodeNS(globalObject, options) {
   const {
     key
   } = options;
@@ -3771,7 +4379,7 @@ function factoryPatchedSetAttributeNodeNS(globalObject, options) {
         ElementRemoveAttributeNode(this, oldAttr);
       }
 
-      const attrValue = toString(AttrValueGetter(attr));
+      const attrValue = toString$1(AttrValueGetter(attr));
       ReflectApply$3(distortion, this, [attrValue]);
       const newAttr = ElementGetAttributeNodeNS(this, attrNamespace, attrName); // remove distorted attribute
 
@@ -3802,7 +4410,7 @@ function factoryPatchedSetAttributeNodeNS(globalObject, options) {
   return [originalSetAttributeNodeNSValue, setAttributeNodeNS];
 }
 
-function factoryPatchedSetAttributeNSValue(globalObject, options) {
+function distortionElementSetAttributeNS(globalObject, options) {
   const {
     key
   } = options;
@@ -3819,7 +4427,7 @@ function factoryPatchedSetAttributeNSValue(globalObject, options) {
       return;
     }
 
-    const sanitizedArguments = sanitizeArguments(args, [toStringIfNotNullOrUndefined, sanitizeAttrName, toString]);
+    const sanitizedArguments = sanitizeArguments(args, [toStringIfNotNullOrUndefined, sanitizeAttrName, toString$1]);
     const sanitizedAttrNamespace = sanitizedArguments[0];
     const sanitizedAttrName = sanitizedArguments[1];
     const lookupNamespace = normalizeNamespace(sanitizedAttrNamespace);
@@ -3837,7 +4445,7 @@ function factoryPatchedSetAttributeNSValue(globalObject, options) {
   return [originalSetAttributeNSValue, setAttributeNS];
 }
 
-function patchedShadowRootGetter(globalObject) {
+function distortionElementShadowRootGetter(globalObject) {
   const {
     Element
   } = globalObject;
@@ -3871,7 +4479,7 @@ function createDistortedComposedPath(event) {
   return distortedComposedPath;
 }
 
-function patchEventProtoComposedPath(globalObject) {
+function distortionEventComposedPath(globalObject) {
   const {
     Event
   } = globalObject;
@@ -3886,7 +4494,7 @@ function patchEventProtoComposedPath(globalObject) {
   return [originalComposedPathValue, composedPath];
 }
 
-function patchEventProtoPathGetter(globalObject) {
+function distortionEventPathGetter(globalObject) {
   const {
     Event
   } = globalObject;
@@ -3903,11 +4511,50 @@ function patchEventProtoPathGetter(globalObject) {
   return [originalPathGetter, path];
 }
 
-function patchedInnerTextSetter(globalObject) {
+function distortionEventTargetAddEventListener(globalObject) {
+  const {
+    EventTarget,
+    CookieStore
+  } = globalObject;
+
+  if (CookieStore === undefined) {
+    return null;
+  }
+
+  const originalAddEventListener = ObjectLookupOwnValue(EventTarget.prototype, 'addEventListener');
+
+  function addEventListener(...args) {
+    if (this instanceof CookieStore) {
+      throw new LockerSecurityError('Cannot call cookieStore.addEventListener.');
+    }
+
+    return ReflectApply$3(originalAddEventListener, this, args);
+  }
+
+  return [originalAddEventListener, addEventListener];
+}
+
+function distortionHTMLElementDatasetGetter(globalObject) {
+  const {
+    HTMLElement
+  } = globalObject;
+  const originalDatasetGetter = ObjectLookupOwnGetter$1(HTMLElement.prototype, 'dataset');
+
+  function dataset() {
+    return liveObjectFromGetter(originalDatasetGetter, this);
+  }
+
+  return [originalDatasetGetter, dataset];
+}
+
+function distortionHTMLElementInnerTextSetter(globalObject) {
   const {
     HTMLElement
   } = globalObject;
   const originalInnerTextSetter = ObjectLookupOwnSetter(HTMLElement.prototype, 'innerText');
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
 
   if (!originalInnerTextSetter) {
     return null;
@@ -3915,7 +4562,7 @@ function patchedInnerTextSetter(globalObject) {
 
   const innerText = function innerText(value) {
     if (isSharedElement(this)) {
-      throw new LockerSecurityError(`HTMLElement.innerText cannot be set with ${this} elements!`);
+      throw new LockerSecurityError(`Cannot set innerText of ${this.nodeName}.`);
     }
 
     HTMLElementInnerTextSetter(this, value);
@@ -3927,11 +4574,14 @@ function patchedInnerTextSetter(globalObject) {
 // https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/outerText#Browser_compatibility
 
 
-function patchedOuterTextSetter(globalObject) {
+function distortionHTMLElementOuterTextSetter(globalObject) {
   const {
     HTMLElement
   } = globalObject;
   const originalOuterTextSetter = ObjectLookupOwnSetter(HTMLElement.prototype, 'outerText');
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
 
   if (!originalOuterTextSetter) {
     return null;
@@ -3939,7 +4589,7 @@ function patchedOuterTextSetter(globalObject) {
 
   const outerText = function outerText(value) {
     if (isSharedElement(this)) {
-      throw new LockerSecurityError(`HTMLElement.outerText cannot be set with ${this} elements!`);
+      throw new LockerSecurityError(`Cannot set outerText of ${this.nodeName}.`);
     }
 
     HTMLElementOuterTextSetter(this, value);
@@ -3948,7 +4598,7 @@ function patchedOuterTextSetter(globalObject) {
   return [originalOuterTextSetter, outerText];
 }
 
-function factoryPatchedStyleGetter(globalObject) {
+function distortionHTMLElementStyleGetter(globalObject) {
   const {
     HTMLElement
   } = globalObject;
@@ -3972,7 +4622,7 @@ function factoryPatchedStyleGetter(globalObject) {
   return [originalStyleGetter, style];
 }
 
-function patchedContentDocumentGetter$2(globalObject) {
+function distortionHTMLFrameElementContentDocumentGetter(globalObject) {
   const {
     HTMLFrameElement
   } = globalObject;
@@ -3988,7 +4638,7 @@ function patchedContentDocumentGetter$2(globalObject) {
   return [originalContentDocumentGetter, contentDocument];
 }
 
-function patchedContentWindowGetter$2(globalObject) {
+function distortionHTMLFrameElemenentContentWindowGetter(globalObject) {
   const {
     HTMLFrameElement
   } = globalObject;
@@ -4002,7 +4652,7 @@ function patchedContentWindowGetter$2(globalObject) {
   return [originalContentWindowGetter, contentWindow];
 }
 
-function patchedContentDocumentGetter$1(globalObject) {
+function distortionHTMLIFrameElementContentDocumentGetter(globalObject) {
   const {
     HTMLIFrameElement
   } = globalObject;
@@ -4018,7 +4668,7 @@ function patchedContentDocumentGetter$1(globalObject) {
   return [originalContentDocumentGetter, contentDocument];
 }
 
-function patchedContentWindowGetter$1(globalObject) {
+function distortionHTMLIFrameElementContentWindowGetter(globalObject) {
   const {
     HTMLIFrameElement
   } = globalObject;
@@ -4032,7 +4682,7 @@ function patchedContentWindowGetter$1(globalObject) {
   return [originalContentWindowGetter, contentWindow];
 }
 
-function factoryPatchedSrcSetter$1(globalObject) {
+function distortionHTMLIFrameElementSrcSetter(globalObject) {
   const {
     HTMLIFrameElement
   } = globalObject;
@@ -4050,7 +4700,7 @@ function factoryPatchedSrcSetter$1(globalObject) {
 
   registerElementSetDistortion(HTMLIFrameElement, {
     attributeName: 'src',
-    attributeNamespace: DEFAULT_ELEMENT_NAMESPACE,
+    attributeNamespace: NAMESPACE_DEFAULT,
     distortion: src
   });
   return [originalSrcSetter, src];
@@ -4063,14 +4713,14 @@ function isValidRelValue(value) {
   return !RegExpTest(IMPORT, value);
 }
 
-function factoryPatchedRelSetter(globalObject) {
+function distortionHTMLLinkElementRelSetter(globalObject) {
   const {
     HTMLLinkElement
   } = globalObject;
   const originalRelSetter = ObjectLookupOwnSetter(HTMLLinkElement.prototype, 'rel');
 
   function rel(value) {
-    value = toString(value);
+    value = toString$1(value);
 
     if (isValidRelValue(value)) {
       HTMLLinkElementRelSetter(this, value);
@@ -4083,13 +4733,13 @@ function factoryPatchedRelSetter(globalObject) {
 
   registerElementSetDistortion(HTMLLinkElement, {
     attributeName: 'rel',
-    attributeNamespace: DEFAULT_ELEMENT_NAMESPACE,
+    attributeNamespace: NAMESPACE_DEFAULT,
     distortion: rel
   });
   return [originalRelSetter, rel];
 }
 
-function patchedRelListSetter(globalObject) {
+function distortionHTMLLinkElementRelListSetter(globalObject) {
   const {
     DOMTokenList,
     HTMLLinkElement
@@ -4097,7 +4747,7 @@ function patchedRelListSetter(globalObject) {
   const originalRelListSetter = ObjectLookupOwnSetter(HTMLLinkElement.prototype, 'relList');
 
   function relList(relListValue) {
-    const value = relList instanceof DOMTokenList ? DOMTokenListValueGetter(relListValue) : toString(relListValue);
+    const value = relList instanceof DOMTokenList ? DOMTokenListValueGetter(relListValue) : toString$1(relListValue);
 
     if (isValidRelValue(value)) {
       HTMLLinkElementRelListSetter(this, value);
@@ -4113,7 +4763,7 @@ function patchedRelListSetter(globalObject) {
   return [originalRelListSetter, relList];
 }
 
-function patchedContentDocumentGetter(globalObject) {
+function distortionHTMLObjectElementContentDocumentGetter(globalObject) {
   const {
     HTMLObjectElement
   } = globalObject;
@@ -4129,7 +4779,7 @@ function patchedContentDocumentGetter(globalObject) {
   return [originalContentDocumentGetter, contentDocument];
 }
 
-function patchedContentWindowGetter(globalObject) {
+function distortionHTMLObjectElementContentWindowGetter(globalObject) {
   const {
     HTMLObjectElement
   } = globalObject;
@@ -4154,7 +4804,7 @@ function getDatasetSrcValue(el) {
   return distortedSrc === undefined ? '' : distortedSrc;
 }
 
-function patchedSrcGetter(globalObject) {
+function distortionHTMLScriptElementSrcGetter(globalObject) {
   const {
     HTMLScriptElement
   } = globalObject;
@@ -4167,7 +4817,7 @@ function patchedSrcGetter(globalObject) {
   return [originalSrcGetter, src];
 }
 
-function factoryPatchedSrcSetter(globalObject, options) {
+function distortionHTMLScriptElementSrcSetter(globalObject, options) {
   const {
     HTMLScriptElement
   } = globalObject;
@@ -4175,13 +4825,13 @@ function factoryPatchedSrcSetter(globalObject, options) {
   const src = scriptDistortion('src', options, HTMLElementDatasetGetter);
   registerElementSetDistortion(HTMLScriptElement, {
     attributeName: 'src',
-    attributeNamespace: DEFAULT_ELEMENT_NAMESPACE,
+    attributeNamespace: NAMESPACE_DEFAULT,
     distortion: src
   });
   return [originalSrcSetter, src];
 }
 
-function patchedSourceGetter(globalObject) {
+function distortionMessageEventSourceGetter(globalObject) {
   const {
     MessageEvent
   } = globalObject;
@@ -4189,45 +4839,43 @@ function patchedSourceGetter(globalObject) {
 
   function source() {
     const rawSource = MessageEventSourceGetter(this);
-    return toString(rawSource) === '[object Window]' ? getPatchedWindow(rawSource) : rawSource;
+    return toString$1(rawSource) === '[object Window]' ? getPatchedWindow(rawSource) : rawSource;
   }
 
   return [originalSourceGetter, source];
 }
 
-function factoryPatchedSetNamed(globalObject, options) {
-  const {
-    key
-  } = options;
+function distortionNamedNodeMapSetNamedItem(globalObject, options) {
   const {
     NamedNodeMap
   } = globalObject;
   const {
-    setNamedItem: originalSetNamedItemValue
+    setNamedItem: originalSetNamedItem
   } = NamedNodeMap.prototype;
 
   function setNamedItem(attr) {
-    const element = getPairedElement(this);
+    return setNamedItemWithAttr(originalSetNamedItem, this, attr, options);
+  }
 
-    if (element) {
-      const attrName = AttrNameGetter(attr);
-      const attrNamespace = AttrNamespaceURIGetter(attr);
-      const normalizedNamespace = normalizeNamespace(attrNamespace);
-      const distortion = getAttributeDistortion(element, key, attrName, normalizedNamespace);
+  return [originalSetNamedItem, setNamedItem];
+}
 
-      if (distortion) {
-        const attrValue = AttrValueGetter(attr);
-        return ReflectApply$3(distortion, element, [attrValue]);
-      }
-    }
+function distortionNamedNodeMapSetNamedItemNS(globalObject, options) {
+  const {
+    NamedNodeMap
+  } = globalObject;
+  const {
+    setNamedItemNS: originalSetNamedItemNS
+  } = NamedNodeMap.prototype;
 
-    return ReflectApply$3(NamedNodeMapProtoSetNamedItem, this, [attr]);
+  function setNamedItemNS(attr) {
+    return setNamedItemWithAttr(originalSetNamedItemNS, this, attr, options);
   }
 
-  return [originalSetNamedItemValue, setNamedItem];
+  return [originalSetNamedItemNS, setNamedItemNS];
 }
 
-function patchedServiceWorkerGetter(globalObject) {
+function distortionNavigatorServiceWorkerGetter(globalObject) {
   const {
     Navigator
   } = globalObject;
@@ -4244,25 +4892,28 @@ function patchedServiceWorkerGetter(globalObject) {
   return [originalServiceWorkerGetter, get];
 }
 
-function patchedTextContentSetter(globalObject) {
+function distortionNodeTextContentSetter(globalObject) {
   const {
     Node
   } = globalObject;
   const originalTextContentSetter = ObjectLookupOwnSetter(Node.prototype, 'textContent');
+  const {
+    isSharedElement
+  } = getValidator(globalObject);
 
   function textContent(value) {
     if (isSharedElement(this)) {
-      throw new LockerSecurityError(`Node.textContent cannot be set with ${this} elements!`);
+      throw new LockerSecurityError(`Cannot set textContent of ${this.nodeName} elements.`);
     }
 
-    value = toString(value);
+    value = toString$1(value);
     NodeTextContentSetter(this, value);
   }
 
   return [originalTextContentSetter, textContent];
 }
 
-function patchedCreateContextualFragmentValue(globalObject) {
+function distortionRangeCreateContextualFragment(globalObject) {
   const {
     Range
   } = globalObject;
@@ -4285,7 +4936,7 @@ function patchedCreateContextualFragmentValue(globalObject) {
   return [originalCreateContextualFragmentValue, createContextualFragment];
 }
 
-function patchedServiceWorkerPrototype(globalObject) {
+function distortionServiceWorkerContainer(globalObject) {
   const {
     ServiceWorkerContainer
   } = globalObject;
@@ -4300,7 +4951,20 @@ function patchedServiceWorkerPrototype(globalObject) {
   return [originalPrototype, createRevokedProxy(originalPrototype)];
 }
 
-function patchedModeGetter(globalObject) {
+function distortionShadowRootInnerHTMLSetter(globalObject) {
+  const {
+    ShadowRoot
+  } = globalObject;
+  const originalInnerHTMLSetter = ObjectLookupOwnSetter(ShadowRoot.prototype, 'innerHTML');
+
+  function innerHTML(value) {
+    ShadowRootInnerHTMLSetter(this, sanitize(value));
+  }
+
+  return [originalInnerHTMLSetter, innerHTML];
+}
+
+function distortionShadowRootModeGetter(globalObject) {
   const {
     ShadowRoot
   } = globalObject;
@@ -4313,7 +4977,7 @@ function patchedModeGetter(globalObject) {
   return [originalModeGetter, mode];
 }
 
-function patchedConstructor$1(globalObject) {
+function distortionSharedWorkerCtor(globalObject) {
   const {
     SharedWorker: SharedWorkerCtor
   } = globalObject;
@@ -4326,13 +4990,13 @@ function patchedConstructor$1(globalObject) {
   }
 
   const SharedWorker = function SharedWorker(url) {
-    throw new LockerRangeError(`Locker does not allow SharedWorker script at: ${url}`);
+    throw new LockerSecurityError(`Cannot create SharedWorker with ${url}.`);
   };
 
   return [originalSharedWorkerConstructor, SharedWorker];
 }
 
-function factoryPatchedPrototype(globalObject) {
+function distortionSharedWorkerProto(globalObject) {
   const {
     SharedWorker: SharedWorkerCtor
   } = globalObject;
@@ -4390,7 +5054,7 @@ function getStorageMetaOrThrowInvalidInvocation(storage) {
   const storageMeta = WeakMapGet(meta, storage);
 
   if (storageMeta === undefined) {
-    throw new TypeErrorCtor$2(`Illegal invocation`);
+    throw new LockerSecurityError(`Illegal invocation`);
   }
 
   return storageMeta;
@@ -4408,7 +5072,7 @@ function createStorageProxy(s) {
         return ReflectGet(target, key, receiver);
       }
 
-      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString(key));
+      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString$1(key));
 
       if (ObjectHasOwnProperty(storage, keyForNamespace)) {
         return ReflectGet(storage, keyForNamespace);
@@ -4428,7 +5092,7 @@ function createStorageProxy(s) {
         return ReflectSet(target, key, value);
       }
 
-      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString(key));
+      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString$1(key));
       ReflectApply$3(StorageProtoSetItem, storage, [keyForNamespace, value]);
       return true;
     },
@@ -4438,13 +5102,14 @@ function createStorageProxy(s) {
         storage,
         storageRootKey
       } = getStorageMetaOrThrowInvalidInvocation(target);
+      const safeDesc = toSafeDescriptor(descriptor);
 
       if (typeof key === 'symbol') {
-        return ObjectDefineProperty(target, key, descriptor);
+        return ReflectDefineProperty(target, key, safeDesc);
       }
 
-      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString(key));
-      return ReflectDefineProperty(storage, keyForNamespace, descriptor);
+      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString$1(key));
+      return ReflectDefineProperty(storage, keyForNamespace, safeDesc);
     },
 
     deleteProperty(target, key) {
@@ -4457,7 +5122,7 @@ function createStorageProxy(s) {
         return ReflectDeleteProperty(target, key);
       }
 
-      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString(key));
+      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString$1(key));
       return ReflectDeleteProperty(storage, keyForNamespace);
     },
 
@@ -4471,7 +5136,7 @@ function createStorageProxy(s) {
         return ReflectGetOwnPropertyDescriptor$1(target, key);
       }
 
-      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString(key));
+      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString$1(key));
       return ReflectGetOwnPropertyDescriptor$1(storage, keyForNamespace);
     },
 
@@ -4496,7 +5161,7 @@ function createStorageProxy(s) {
         return ReflectHas(target, key);
       }
 
-      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString(key));
+      const keyForNamespace = getStorageKeyForNamespace(storageRootKey, toString$1(key));
 
       if (ObjectHasOwnProperty(storage, keyForNamespace)) {
         return true;
@@ -4520,7 +5185,7 @@ function createStorageProxy(s) {
 
 class PatchedStorage {
   constructor() {
-    throw new ErrorCtor$1(`Illegal constructor`);
+    throw new LockerSecurityError(`Illegal constructor`);
   }
 
   get length() {
@@ -4564,7 +5229,7 @@ class PatchedStorage {
     let args = arguments;
 
     if (args.length) {
-      args = sanitizeArguments(args, [toString]);
+      args = sanitizeArguments(args, [toString$1]);
       args[0] = getStorageKeyForNamespace(storageRootKey, args[0]);
     }
 
@@ -4579,7 +5244,7 @@ class PatchedStorage {
     let args = arguments;
 
     if (args.length > 1) {
-      args = sanitizeArguments(args, [toString, toString]);
+      args = sanitizeArguments(args, [toString$1, toString$1]);
       args[0] = getStorageKeyForNamespace(storageRootKey, args[0]);
     }
 
@@ -4594,7 +5259,7 @@ class PatchedStorage {
     let args = arguments;
 
     if (args.length) {
-      args = sanitizeArguments(args, [toString]);
+      args = sanitizeArguments(args, [toString$1]);
       args[0] = getStorageKeyForNamespace(storageRootKey, args[0]);
     }
 
@@ -4617,7 +5282,9 @@ class PatchedStorage {
 }
 
 function createStorage(storage, storageRootKey) {
-  const obj = ObjectCreate(PatchedStorage.prototype);
+  const obj = {
+    __proto__: PatchedStorage.prototype
+  };
   markLiveObject(obj);
   const proxy = createStorageProxy(obj);
   const storageMeta = {
@@ -4639,8 +5306,8 @@ const {
 } = PatchedStorage.prototype;
 const patchedStorageProtoLengthGetter = ObjectLookupOwnGetter$1(PatchedStorage.prototype, 'length');
 
-function patchedStorageFactory(storageName) {
-  return function patchedStorage(globalObject, options) {
+function createDistortionStorageFactory(storageName) {
+  return function distortionStorageFactory(globalObject, options) {
     // @ts-ignore
     const storageObject = globalObject[storageName];
 
@@ -4658,7 +5325,7 @@ function patchedStorageFactory(storageName) {
   };
 }
 
-function storagePropertyLength(globalObject) {
+function distortionStorageLength(globalObject) {
   const {
     Storage
   } = globalObject;
@@ -4666,7 +5333,7 @@ function storagePropertyLength(globalObject) {
   return [originalLengthGetter, patchedStorageProtoLengthGetter];
 }
 
-function storageGetItemValue(globalObject) {
+function distortionStorageGetItem(globalObject) {
   const {
     Storage
   } = globalObject;
@@ -4676,7 +5343,7 @@ function storageGetItemValue(globalObject) {
   return [originalStorageGetItemValue, patchedStorageProtoGetItem];
 }
 
-function storageSetItemValue(globalObject) {
+function distortionStorageSetItem(globalObject) {
   const {
     Storage
   } = globalObject;
@@ -4686,7 +5353,7 @@ function storageSetItemValue(globalObject) {
   return [originalStorageSetItemValue, patchedStorageProtoSetItem];
 }
 
-function storageKeyValue(globalObject) {
+function distortionStorageKey(globalObject) {
   const {
     Storage
   } = globalObject;
@@ -4696,7 +5363,7 @@ function storageKeyValue(globalObject) {
   return [originalStorageKeyValue, patchedStorageProtoKey];
 }
 
-function storageRemoveItemValue(globalObject) {
+function distortionStorageRemoveItem(globalObject) {
   const {
     Storage
   } = globalObject;
@@ -4706,7 +5373,7 @@ function storageRemoveItemValue(globalObject) {
   return [originalStorageRemoveItemValue, patchedStorageProtoRemoveItem];
 }
 
-function storageClearValue(globalObject) {
+function distortionStorageClear(globalObject) {
   const {
     Storage
   } = globalObject;
@@ -4716,52 +5383,68 @@ function storageClearValue(globalObject) {
   return [originalStorageClearValue, patchedStorageProtoClear];
 }
 
-function storage(globalObject) {
+function distortionStorage(globalObject) {
   const {
     Storage
   } = globalObject;
   return [Storage, PatchedStorage];
 }
 
-const localStorageFactory = patchedStorageFactory('localStorage');
-const sessionStorageFactory = patchedStorageFactory('sessionStorage');
+const distortionLocalStorage = createDistortionStorageFactory('localStorage');
+const distortionSessionStorage = createDistortionStorageFactory('sessionStorage');
+
+function distortionSVGElementDatasetGetter(globalObject) {
+  const {
+    SVGElement
+  } = globalObject;
+  const originalDatasetGetter = ObjectLookupOwnGetter$1(SVGElement.prototype, 'dataset');
+
+  function dataset() {
+    return liveObjectFromGetter(originalDatasetGetter, this);
+  }
+
+  return [originalDatasetGetter, dataset];
+}
 
-function factoryPatchedHrefAttribute(globalObject, options) {
+function distortionSVGScriptElementHrefAttribute(globalObject, options) {
   const {
     SVGScriptElement
   } = globalObject;
   registerElementSetDistortion(SVGScriptElement, {
     attributeName: 'href',
-    attributeNamespace: DEFAULT_ELEMENT_NAMESPACE,
+    attributeNamespace: NAMESPACE_XLINK,
     distortion: scriptDistortion('href', options, SVGElementDatasetGetter)
   });
+  registerElementSetDistortion(SVGScriptElement, {
+    attributeName: 'xlink:href',
+    attributeNamespace: NAMESPACE_XLINK,
+    distortion: scriptDistortion('xlink:href', options, SVGElementDatasetGetter)
+  });
   return null;
 }
 
-const XLINK_NAMESPACE = 'http://www.w3.org/1999/xlink';
-
-function makeFactoryPatchedHrefAttribute(attributeName) {
-  return function factoryPatchedHrefAttribute(globalObject) {
+function createDistortionHrefAttributeFactory(attributeName) {
+  return function distortionHrefAttributeFactory(globalObject) {
     const {
       SVGUseElement
     } = globalObject;
 
     function distortion(value) {
       const sanitized = value === null || value === undefined || value === '' ? value : sanitizeSvgHrefValue(value);
-      ElementSetAttributeNS(this, XLINK_NAMESPACE, attributeName, sanitized);
+      ElementSetAttributeNS(this, NAMESPACE_XLINK, attributeName, sanitized);
     }
 
     registerElementSetDistortion(SVGUseElement, {
       attributeName,
-      attributeNamespace: XLINK_NAMESPACE,
+      attributeNamespace: NAMESPACE_XLINK,
       distortion
     });
     return null;
   };
 }
 
-const patchedSVGUseElementHrefAttributeSetter = makeFactoryPatchedHrefAttribute('href');
-const patchedSVGUseElementXlinkHrefAttributeSetter = makeFactoryPatchedHrefAttribute('xlink:href');
+const distortionSVGUseElementHrefAttribute = createDistortionHrefAttributeFactory('href');
+const distortionSVGUseElementXlinkHrefAttribute = createDistortionHrefAttributeFactory('xlink:href');
 const ALLOWED_MIME_TYPES = ['application/octet-stream', 'application/json', 'application/pdf', 'video/', 'audio/', 'image/', 'font/', 'text/plain', 'text/markdown', 'application/zip', 'application/x-bzip', 'application/x-rar-compressed', 'application/x-tar']; // alphanumeric characters only plus '-' and '+' characters
 // i.e text/xml, application/x-bzip, application/octet-stream, image/svg+xml
 
@@ -4782,21 +5465,41 @@ function isMIMETypeAllowed(type) {
   return false;
 }
 
-function patchedCreateObjectURL(globalObject) {
+function distortionURLCreateObjectURL(globalObject) {
   const {
     URL
   } = globalObject;
   const {
     createObjectURL: originalCreateObjectURL
   } = URL;
+  const {
+    isEqualDomString,
+    isMediaSourceObject
+  } = getValidator(globalObject);
 
   function createObjectURL(blobObject) {
     // Create a URL object first using the native APIs.
     // This will ensure native validation against undefined and other
     // non-accepted types.
-    let outURL = URLCreateObjectURL(blobObject);
+    let outURL = URLCreateObjectURL(blobObject); // MediaSource does not share the same proto object as Blob or File.
+    // It can still be used with createObjectURL however we need to treat it separately.
+    // MediaSource does not accept plain text input as Blob and File and does not have a MIME type.
+
+    if (isMediaSourceObject(blobObject)) {
+      return outURL;
+    }
+
     const type = BlobTypeGetter(blobObject);
 
+    if (type === '') {
+      // browsers interpret the empty MIME type differently.
+      // Chrome makes it text/plain.
+      // Firefox attempts to guess the content.
+      // Safari makes it application/octet-stream effectively forcing a download of the content.
+      // We need to normalize the behavior here.
+      return URLCreateObjectURL(BlobSlice(blobObject, 0, undefined, 'text/plain'));
+    }
+
     if (ArrayIncludes(HTML_MIME_TYPES, type)) {
       const normalizedBlob = BlobSlice(blobObject, 0, BlobSizeGetter(blobObject), `${type};charset=utf-8`);
       URLRevokeObjectURL(outURL);
@@ -4810,24 +5513,24 @@ function patchedCreateObjectURL(globalObject) {
 
       if (!isEqualDomString(responseText, sanitized)) {
         URLRevokeObjectURL(outURL);
-        throw new LockerSecurityError(`Locker: Cannot "createObjectURL" using a unsecure ${blobObject}!`);
+        throw new LockerSecurityError(`Cannot "createObjectURL" using a unsecure ${blobObject}!`);
       }
 
       return outURL;
     }
 
-    if (type === '' || isMIMETypeAllowed(type)) {
+    if (isMIMETypeAllowed(type)) {
       return outURL;
     }
 
     URLRevokeObjectURL(outURL);
-    throw new LockerSecurityError('Locker: Unsupported MIME type.');
+    throw new LockerSecurityError('Unsupported MIME type.');
   }
 
   return [originalCreateObjectURL, createObjectURL];
 }
 
-function patchedFetchValue(globalObject, options) {
+function distortionWindowFetch(globalObject, options) {
   const {
     fetch: originalFetchValue
   } = globalObject;
@@ -4844,14 +5547,14 @@ function patchedFetchValue(globalObject, options) {
         // similar to link element's href.
         parsedURL = parseURL(RequestURLGetter(url));
       } else {
-        const sanitizedURL = toString(url);
+        const sanitizedURL = toString$1(url);
         parsedURL = parseURL(sanitizedURL);
         url = parsedURL.normalizedURL;
         args[0] = url;
       }
 
       if (isInvalidURL(parsedURL)) {
-        const promise = Promise.reject(new LockerRangeError(`Request URL cannot be made to a disallowed endpoint: ${url}`));
+        const promise = PromiseReject(new LockerSecurityError(`Cannot request disallowed endpoint: ${url}`));
         return promise;
       }
     }
@@ -4868,7 +5571,7 @@ function patchedFetchValue(globalObject, options) {
 /* eslint-disable class-methods-use-this, max-classes-per-file */
 
 
-function factoryPatchedFrames(globalObject) {
+function distortionWindowFramesGetter(globalObject) {
   const originalWindowFramesGetter = ObjectLookupOwnGetter$1(globalObject, 'frames');
 
   if (originalWindowFramesGetter === undefined) {
@@ -5074,7 +5777,7 @@ function factoryPatchedFrames(globalObject) {
 
           for (const key in descriptors) {
             if (typeof key === 'string' && isFrame(descriptors[key].value)) {
-              keys.push(key);
+              ArrayPush(keys, key);
             }
           }
 
@@ -5105,7 +5808,7 @@ function factoryPatchedFrames(globalObject) {
   return [originalWindowFramesGetter, frames];
 }
 
-function factoryPatchedLength(globalObject) {
+function distortionWindowLengthGetter(globalObject) {
   const originalLengthGetter = ObjectLookupOwnGetter$1(globalObject, 'length');
 
   if (originalLengthGetter === undefined) {
@@ -5117,37 +5820,15 @@ function factoryPatchedLength(globalObject) {
   }
 
   return [originalLengthGetter, length];
-} // Check for the noopener feature being enabled:
-// - noopener
-// - noopener=1
-// - noopener=yes
-
-
-const noopenerRegExp = /(^|,)(\s*noopener\s*=\s*(?:yes|1)\s*)(,|$)/g;
+}
 
-function patchedOpenValue$1(globalObject) {
+function distortionWindowOpen(globalObject) {
   const {
     open: originalOpenValue
   } = globalObject;
 
   function open(...args) {
-    const sanitizedArgs = sanitizeArguments(args, [toIgnore, toIgnore, toString]);
-
-    if (sanitizedArgs.length > 2) {
-      // Lowercase the features string because it is case insensitive.
-      // https://html.spec.whatwg.org/multipage/window-object.html#normalizing-the-feature-name
-      let windowFeatures = StringToLowerCase(sanitizedArgs[2]);
-
-      if (RegExpTest(noopenerRegExp, windowFeatures)) {
-        noopenerRegExp.lastIndex = 0; // Replacing noopener with an enabled state that is supported
-        // across all browsers. Firefox Bug: https://bugzilla.mozilla.org/show_bug.cgi?id=1566619
-
-        windowFeatures = StringReplace(windowFeatures, noopenerRegExp, (match, leading, feature, ending) => `${leading}noopener${ending}`);
-      }
-
-      sanitizedArgs[2] = windowFeatures;
-    }
-
+    const sanitizedArgs = sanitizeWindowOpenArguments(args);
     const rawOpenWindow = ReflectApply$3(WindowStaticOpen, this, sanitizedArgs);
     return getPatchedWindow(rawOpenWindow);
   }
@@ -5155,7 +5836,7 @@ function patchedOpenValue$1(globalObject) {
   return [originalOpenValue, open];
 }
 
-function factoryPatchedOpener(globalObject) {
+function distortionWindowOpenerGetter(globalObject) {
   const originalOpenerGetter = ObjectLookupOwnGetter$1(globalObject, 'opener');
 
   if (originalOpenerGetter === undefined) {
@@ -5170,7 +5851,7 @@ function factoryPatchedOpener(globalObject) {
   return [originalOpenerGetter, opener];
 }
 
-function factoryPatchedParent(globalObject) {
+function distortionWindowParentGetter(globalObject) {
   const originalParentGetter = ObjectLookupOwnGetter$1(globalObject, 'parent');
 
   if (originalParentGetter === undefined) {
@@ -5185,7 +5866,7 @@ function factoryPatchedParent(globalObject) {
   return [originalParentGetter, parent];
 }
 
-function factoryPatchedPostMessage(globalObject) {
+function distortionWindowPostMessage(globalObject) {
   const originalPostMessageValue = ObjectLookupOwnValue(globalObject, 'postMessage');
 
   function postMessage(...args) {
@@ -5195,7 +5876,7 @@ function factoryPatchedPostMessage(globalObject) {
   return [originalPostMessageValue, postMessage];
 }
 
-function patchedSetIntervalValue(globalObject, options) {
+function distortionWindowSetInterval(globalObject, options) {
   const {
     evaluator,
     key
@@ -5210,7 +5891,7 @@ function patchedSetIntervalValue(globalObject, options) {
 
       if (myFunction !== null && myFunction !== undefined && typeof myFunction !== 'function') {
         // Snapshot myFunction source to prevent shapeshifting.
-        const myStringFunction = toString(myFunction); // Replace myFunction parameter.
+        const myStringFunction = toString$1(myFunction); // Replace myFunction parameter.
 
         args[0] = () => {
           evaluator(key, myStringFunction);
@@ -5224,7 +5905,7 @@ function patchedSetIntervalValue(globalObject, options) {
   return [originalSetIntervalValue, setInterval];
 }
 
-function patchedSetTimeoutValue(globalObject, options) {
+function distortionWindowSetTimeout(globalObject, options) {
   const {
     evaluator,
     key
@@ -5238,7 +5919,7 @@ function patchedSetTimeoutValue(globalObject, options) {
       const myFunction = args[0];
 
       if (myFunction !== null && myFunction !== undefined && typeof myFunction !== 'function') {
-        const myStringFunction = toString(myFunction);
+        const myStringFunction = toString$1(myFunction);
 
         args[0] = () => {
           evaluator(key, myStringFunction);
@@ -5256,19 +5937,19 @@ function patchedSetTimeoutValue(globalObject, options) {
   return [originalSetTimeoutValue, setTimeout];
 }
 
-function patchedConstructor(globalObject) {
+function distortionWorkerCtor(globalObject) {
   const {
     Worker: originalWorkerConstructor
   } = globalObject;
 
   function Worker(url) {
-    throw new LockerRangeError(`Locker does not allow Worker script at: ${url}`);
+    throw new LockerSecurityError(`Cannot create Worker with ${url}`);
   }
 
   return [originalWorkerConstructor, Worker];
 }
 
-function patchedPrototype(globalObject) {
+function distortionWorkerProto(globalObject) {
   const {
     Worker: {
       prototype: originalPrototype
@@ -5277,7 +5958,7 @@ function patchedPrototype(globalObject) {
   return [originalPrototype, createRevokedProxy(originalPrototype)];
 }
 
-function patchedOpenValue(globalObject, options) {
+function distortionXMLHttpRequestOpen(globalObject, options) {
   const {
     XMLHttpRequest
   } = globalObject;
@@ -5292,12 +5973,12 @@ function patchedOpenValue(globalObject, options) {
       return;
     }
 
-    const sanitizedArgs = sanitizeArguments(arguments, [toIgnore, toString]);
+    const sanitizedArgs = sanitizeArguments(arguments, [toIgnore, toString$1]);
     const sanitizedURL = sanitizedArgs[1];
     const parsedURL = parseURL(sanitizedURL);
 
     if (isInvalidURL(parsedURL)) {
-      throw new LockerRangeError(`Request URL cannot be made to a disallowed endpoint: ${parsedURL.normalizedURL}`);
+      throw new LockerSecurityError(`Cannot request disallowed endpoint: ${parsedURL.normalizedURL}`);
     } // Replace url parameter.
 
 
@@ -5312,42 +5993,88 @@ function patchedOpenValue(globalObject, options) {
   return [originalOpenValue, open];
 }
 
+function distortionXMLHttpRequestResponseGetter(globalObject) {
+  const {
+    Document,
+    XMLHttpRequest
+  } = globalObject;
+  const originalResponseGetter = ObjectLookupOwnGetter$1(XMLHttpRequest.prototype, 'response');
+
+  function response() {
+    const responseValue = ReflectApply$3(originalResponseGetter, this, emptyArray$1);
+    return response instanceof Document ? sanitizeDocument(responseValue) : responseValue;
+  }
+
+  return [originalResponseGetter, response];
+}
+
+function distortionXMLHttpRequestResponseXMLGetter(globalObject) {
+  const {
+    XMLHttpRequest
+  } = globalObject;
+  const originalResponseXMLGetter = ObjectLookupOwnGetter$1(XMLHttpRequest.prototype, 'responseXML');
+
+  function responseXML() {
+    const responseValue = ReflectApply$3(originalResponseXMLGetter, this, emptyArray$1);
+    return sanitizeDocument(responseValue);
+  }
+
+  return [originalResponseXMLGetter, responseXML];
+}
+/*
+Naming convention for DistortionFactory function types:
+
+    distortion[ObjectName][PropertyName] : used for property values
+    distortion[ObjectName][PropertyName]Getter : used for property getters
+    distortion[ObjectName][PropertyName]Setter : used for property setters
+    distortion[ObjectName]Ctor : used for object constructors
+    distortion[ObjectName]Proto : used for the object prototype itself
+*/
+
+
 const fundamentalDistortionFactories = [// Document
-patchedDomainSetter, patchedExecCommandValue, // Element
-patchedAttachShadow, patchedAttributesGetter, patchedInnerHTMLSetter, patchedOuterHTMLSetter, patchedInsertAdjacentHTMLValue, patchedShadowRootGetter, // Event
-patchEventProtoComposedPath, patchEventProtoPathGetter, // HTMLElement
-patchedInnerTextSetter, patchedOuterTextSetter, factoryPatchedStyleGetter, // HTMLFrameElement
-patchedContentDocumentGetter$2, patchedContentWindowGetter$2, // HTMLIFrameElement
-factoryPatchedSrcSetter$1, patchedContentDocumentGetter$1, patchedContentWindowGetter$1, // HTMLLinkElement
-factoryPatchedRelSetter, patchedRelListSetter, // HTMLObjectElement
-patchedContentDocumentGetter, patchedContentWindowGetter, // HTMLScriptElement
-patchedSrcGetter, // MessageEvent
-patchedSourceGetter, // Navigator
-patchedServiceWorkerGetter, // Node
-patchedTextContentSetter, // Range
-patchedCreateContextualFragmentValue, // ServiceWorkerContainer
-patchedServiceWorkerPrototype, // ShadowRoot
-patchedModeGetter, // SharedWorker
-patchedConstructor$1, factoryPatchedPrototype, // Storage
-storagePropertyLength, storageGetItemValue, storageSetItemValue, storageKeyValue, storageRemoveItemValue, storageClearValue, storage, // SVGUseElement
-patchedSVGUseElementHrefAttributeSetter, patchedSVGUseElementXlinkHrefAttributeSetter, // URL
-patchedCreateObjectURL, // Window
-patchedFetchValue, factoryPatchedFrames, factoryPatchedLength, patchedOpenValue$1, factoryPatchedOpener, factoryPatchedParent, factoryPatchedPostMessage, // Worker
-patchedConstructor, patchedPrototype, // XHR
-patchedOpenValue];
+distortionDocumentDomainSetter, distortionDocumentExecCommand, distortionDocumentOpen, // DOMParser
+distortionDOMParserParseFromString, // Element
+distortionElementAttachShadow, distortionElementAttributesGetter, distortionElementInnerHTMLSetter, distortionElementOuterHTMLSetter, distortionElementInsertAdjacentHTML, distortionElementRemove, distortionElementReplaceChildren, distortionElementReplaceWith, distortionElementShadowRootGetter, // Event
+distortionEventComposedPath, distortionEventPathGetter, // EventTarget
+distortionEventTargetAddEventListener, // HTMLElement
+distortionHTMLElementDatasetGetter, distortionHTMLElementInnerTextSetter, distortionHTMLElementOuterTextSetter, distortionHTMLElementStyleGetter, // HTMLFrameElement
+distortionHTMLFrameElementContentDocumentGetter, distortionHTMLFrameElemenentContentWindowGetter, // HTMLIFrameElement
+distortionHTMLIFrameElementSrcSetter, distortionHTMLIFrameElementContentDocumentGetter, distortionHTMLIFrameElementContentWindowGetter, // HTMLLinkElement
+distortionHTMLLinkElementRelSetter, distortionHTMLLinkElementRelListSetter, // HTMLObjectElement
+distortionHTMLObjectElementContentDocumentGetter, distortionHTMLObjectElementContentWindowGetter, // HTMLScriptElement
+distortionHTMLScriptElementSrcGetter, // MessageEvent
+distortionMessageEventSourceGetter, // Navigator
+distortionNavigatorServiceWorkerGetter, // Node
+distortionNodeTextContentSetter, // Range
+distortionRangeCreateContextualFragment, // ServiceWorkerContainer
+distortionServiceWorkerContainer, // ShadowRoot
+distortionShadowRootInnerHTMLSetter, distortionShadowRootModeGetter, // SharedWorker
+distortionSharedWorkerCtor, distortionSharedWorkerProto, // Storage
+distortionStorageLength, distortionStorageGetItem, distortionStorageSetItem, distortionStorageKey, distortionStorageRemoveItem, distortionStorageClear, distortionStorage, // SVGElement
+distortionSVGElementDatasetGetter, // SVGUseElement
+distortionSVGUseElementHrefAttribute, distortionSVGUseElementXlinkHrefAttribute, // URL
+distortionURLCreateObjectURL, // Window
+distortionWindowFetch, distortionWindowFramesGetter, distortionWindowLengthGetter, distortionWindowOpen, distortionWindowOpenerGetter, distortionWindowParentGetter, distortionWindowPostMessage, // Worker
+distortionWorkerCtor, distortionWorkerProto, // XHR
+distortionXMLHttpRequestOpen, distortionXMLHttpRequestResponseGetter, distortionXMLHttpRequestResponseXMLGetter];
 const fundamentalKeyedDistortionFactories = [// Aura
-patchAuraUtilGlobalEval, // Attr
-factoryPatchedAttrProtoValueSetter, // CookieStore
-factoryPatchedDeleteValue, factoryPatchedGetValue, factoryPatchedGetAllValue, factoryPatchedSetValue, // Document
-factoryPatchedCookieGetter, factoryPatchedCookieSetter, // CustomElementRegistry
-patchedDefineValue, patchedGetValue, // Element
-factorySetAttribute, factoryPatchedSetAttributeNSValue, factoryPatchedSetAttributeNode, factoryPatchedSetAttributeNodeNS, // HTMLScriptElement,
-factoryPatchedSrcSetter, // NamedNodeMap
-factoryPatchedSetNamed, // SVGScriptElement
-factoryPatchedHrefAttribute, // Window
-patchedSetIntervalValue, patchedSetTimeoutValue, // Storage
-localStorageFactory, sessionStorageFactory];
-const secondaryExternalDistortionFactories = [];
+distortionAuraUtilGlobalEval, // Attr
+distortionAttrValueSetter, // CookieStore
+distortionCookieStoreDelete, distortionCookieStoreGet, distortionCookieStoreGetAll, distortionCookieStoreOnChange, distortionCookieStoreSet, // Document
+distortionDocumentCookieGetter, distortionDocumentCookieSetter, // CustomElementRegistry
+distortionCustomElementRegistryGet, // Element
+distortionElementSetAttribute, distortionElementSetAttributeNS, distortionElementSetAttributeNode, distortionElementSetAttributeNodeNS, // HTMLScriptElement,
+distortionHTMLScriptElementSrcSetter, // NamedNodeMap
+distortionNamedNodeMapSetNamedItem, distortionNamedNodeMapSetNamedItemNS, // SVGScriptElement
+distortionSVGScriptElementHrefAttribute, // Window
+distortionWindowSetInterval, distortionWindowSetTimeout, // Storage
+distortionLocalStorage, distortionSessionStorage];
+const secondaryExternalDistortionFactories = [// Element
+distortionElementAfter, distortionElementAppend, distortionElementBefore, distortionElementInsertAdjacentElement, distortionElementPrepend // Node
+// The distortionNodeAppendChild distortion is temporarily disabled until W-10409618 is resolved
+// distortionNodeAppendChild,
+];
 const secondaryExternalKeyedDistortionFactories = [];
 const secondaryInternalDistortionsFactories = [];
 const secondaryInternalKeyedDistortionFactories = [];
@@ -5355,14 +6082,15 @@ const externalDistortionFactories = ArrayConcat(fundamentalDistortionFactories,
 const externalKeyedDistortionFactories = ArrayConcat(fundamentalKeyedDistortionFactories, secondaryExternalKeyedDistortionFactories);
 const internalDistortionFactories = ArrayConcat(fundamentalDistortionFactories, secondaryInternalDistortionsFactories);
 const internalKeyedDistortionFactories = ArrayConcat(fundamentalKeyedDistortionFactories, secondaryInternalKeyedDistortionFactories);
-var documentBlockedPropertyList = ['exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onsecuritypolicyviolation', 'onunhandledrejection', 'releaseCapture', 'releaseEvents', 'webkitFullScreenKeyboardInputAllowed', 'write', 'writeln'];
-var elementBlockedPropertyList = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
-var htmlElementBlockedPropertiesList = ['nonce', 'onrejectionhandled', 'onunhandledrejection'];
-var embedBlockedPropertiesList = ['getSVGDocument']; // https://www.w3schools.com/tags/tag_iframe.asp
-
-var iframeBlockedAttributeList = ['allowpaymentrequest', 'referrerpolicy', 'sandbox', 'srcdoc'];
-var iframeBlockedPropertiesList = ['allowPaymentRequest', 'csp', 'featurePolicy', 'getSVGDocument', 'referrerPolicy', 'sandbox', 'srcdoc'];
-var objectBlockedPropertiesList = ['getSVGDocument'];
+const DocumentBlockedProperties = ['createProcessingInstruction', 'exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onsecuritypolicyviolation', 'onunhandledrejection', 'releaseCapture', 'releaseEvents', 'webkitFullScreenKeyboardInputAllowed', 'write', 'writeln'];
+const ElementBlockedProperties = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
+const HTMLElementBlockedProperties = ['nonce', 'onrejectionhandled', 'onunhandledrejection'];
+const HTMLEmbedElementBlockedProperties = ['getSVGDocument']; // https://www.w3schools.com/tags/tag_iframe.asp
+
+const HTMLIFrameElementBlockedAttributes = ['allowpaymentrequest', 'referrerpolicy', 'sandbox', 'srcdoc'];
+const HTMLIFrameElementBlockedProperties = ['allowPaymentRequest', 'csp', 'featurePolicy', 'getSVGDocument', 'referrerPolicy', 'sandbox', 'srcdoc'];
+const HTMLObjectElementBlockedProperties = ['getSVGDocument'];
+const HTMLScriptElementBlockedProperties = ['nonce'];
 const externalDistortionCache = new WeakMapCtor();
 const internalDistortionCache = new WeakMapCtor();
 
@@ -5374,31 +6102,20 @@ function makeBlockedPropertyDistortionFactories(globalObject) {
     HTMLIFrameElement
   } = globalObject;
   const blockedPropertyDistortionFactories = [];
-  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(Document.prototype, documentBlockedPropertyList));
-  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(Element.prototype, elementBlockedPropertyList));
-  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLElement.prototype, htmlElementBlockedPropertiesList));
-  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLIFrameElement.prototype, iframeBlockedPropertiesList));
-  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLEmbedElement.prototype, embedBlockedPropertiesList));
-  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLObjectElement.prototype, objectBlockedPropertiesList));
-  distortBlockedAttributes(HTMLIFrameElement, iframeBlockedAttributeList);
+  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(CustomElementRegistry.prototype, CustomElementRegistryBlockedProperties));
+  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(Document.prototype, DocumentBlockedProperties));
+  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(Element.prototype, ElementBlockedProperties));
+  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLElement.prototype, HTMLElementBlockedProperties));
+  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLIFrameElement.prototype, HTMLIFrameElementBlockedProperties));
+  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLEmbedElement.prototype, HTMLEmbedElementBlockedProperties));
+  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLObjectElement.prototype, HTMLObjectElementBlockedProperties));
+  ReflectApply$3(ArrayProtoPush, blockedPropertyDistortionFactories, distortBlockedProperties(HTMLScriptElement.prototype, HTMLScriptElementBlockedProperties));
+  distortBlockedAttributes(HTMLIFrameElement, HTMLIFrameElementBlockedAttributes);
+  distortBlockedAttributes(HTMLScriptElement, HTMLScriptElementBlockedProperties);
   return blockedPropertyDistortionFactories;
 }
 
-const instrumentDistortionForSandbox = (sandboxKey, value, errorBeacon) => function instrumentedDistortionWrapper(...args) {
-  try {
-    return ReflectApply$3(value, this, args);
-  } catch (e) {
-    errorBeacon({
-      sandboxKey,
-      error: e
-    });
-    throw e;
-  }
-}; // @TODO: [Issue #373] Abstract common code in sandbox and distortion packages
-
-
-function createExternalDistortionEntries(globalObject, key, evaluator, config) {
-  const entries = [];
+function addDistortionEntry(globalObject, key, evaluator, config, entries, factory) {
   const {
     instrumentation,
     verboseInstrumentation
@@ -5408,9 +6125,43 @@ function createExternalDistortionEntries(globalObject, key, evaluator, config) {
     key,
     instrumentation: verboseInstrumentation ? instrumentation : undefined
   };
-  const {
-    error: errorBeacon
-  } = instrumentation;
+  const pair = factory(globalObject, options);
+
+  if (pair) {
+    const [rawValue, distortedValue] = pair;
+
+    if (rawValue) {
+      let maybeInstrumentedDistortedValue = distortedValue;
+
+      if (typeof distortedValue === 'function') {
+        const {
+          error: errorBeacon
+        } = instrumentation;
+        maybeInstrumentedDistortedValue = instrumentDistortionForSandbox(key, distortedValue, errorBeacon);
+      }
+
+      ArrayPush(entries, [rawValue, maybeMaskDistortion(maybeInstrumentedDistortedValue, rawValue)]);
+    }
+  }
+}
+
+function instrumentDistortionForSandbox(sandboxKey, fn, errorBeacon) {
+  return function instrumentedDistortionWrapper(...args) {
+    try {
+      return ReflectApply$3(fn, this, args);
+    } catch (e) {
+      errorBeacon({
+        sandboxKey,
+        error: e
+      });
+      throw e;
+    }
+  };
+} // @TODO: [Issue #373] Abstract common code in sandbox and distortion packages
+
+
+function createExternalDistortionEntries(globalObject, key, evaluator, config) {
+  const entries = [];
   const cached = WeakMapGet(externalDistortionCache, globalObject);
 
   if (cached) {
@@ -5420,24 +6171,12 @@ function createExternalDistortionEntries(globalObject, key, evaluator, config) {
 
     for (let i = 0, len = blockedPropertyDistortions.length; i < len; i += 1) {
       const factory = blockedPropertyDistortions[i];
-      const pair = factory(globalObject, options);
-
-      if (pair !== null) {
-        const [rawValue, distortedValue] = pair;
-        const instrumentedDistortedValue = typeof distortedValue === 'function' ? instrumentDistortionForSandbox(key, distortedValue, errorBeacon) : distortedValue;
-        ArrayPush(entries, [rawValue, maybeMaskDistortion(instrumentedDistortedValue, rawValue)]);
-      }
+      addDistortionEntry(globalObject, key, evaluator, config, entries, factory);
     }
 
     for (let i = 0, len = externalDistortionFactories.length; i < len; i += 1) {
       const factory = externalDistortionFactories[i];
-      const pair = factory(globalObject, options);
-
-      if (pair !== null) {
-        const [rawValue, distortedValue] = pair;
-        const instrumentedDistortedValue = typeof distortedValue === 'function' ? instrumentDistortionForSandbox(key, distortedValue, errorBeacon) : distortedValue;
-        ArrayPush(entries, [rawValue, maybeMaskDistortion(instrumentedDistortedValue, rawValue)]);
-      }
+      addDistortionEntry(globalObject, key, evaluator, config, entries, factory);
     }
 
     WeakMapSet(externalDistortionCache, globalObject, ArrayShallowClone(entries));
@@ -5445,13 +6184,7 @@ function createExternalDistortionEntries(globalObject, key, evaluator, config) {
 
   for (let i = 0, len = externalKeyedDistortionFactories.length; i < len; i += 1) {
     const factory = externalKeyedDistortionFactories[i];
-    const pair = factory(globalObject, options);
-
-    if (pair !== null) {
-      const [rawValue, distortedValue] = pair;
-      const instrumentedDistortedValue = typeof distortedValue === 'function' ? instrumentDistortionForSandbox(key, distortedValue, errorBeacon) : distortedValue;
-      ArrayPush(entries, [rawValue, maybeMaskDistortion(instrumentedDistortedValue, rawValue)]);
-    }
+    addDistortionEntry(globalObject, key, evaluator, config, entries, factory);
   }
 
   ReflectApply$3(ArrayProtoPush, entries, makeElementDistortionsForSandboxKey(key));
@@ -5461,18 +6194,6 @@ function createExternalDistortionEntries(globalObject, key, evaluator, config) {
 
 function createInternalDistortionEntries(globalObject, key, evaluator, config) {
   const entries = [];
-  const {
-    instrumentation,
-    verboseInstrumentation
-  } = config;
-  const options = {
-    evaluator,
-    key,
-    instrumentation: verboseInstrumentation ? instrumentation : undefined
-  };
-  const {
-    error: errorBeacon
-  } = instrumentation;
   const cached = WeakMapGet(internalDistortionCache, globalObject);
 
   if (cached) {
@@ -5482,24 +6203,12 @@ function createInternalDistortionEntries(globalObject, key, evaluator, config) {
 
     for (let i = 0, len = blockedPropertyDistortions.length; i < len; i += 1) {
       const factory = blockedPropertyDistortions[i];
-      const pair = factory(globalObject, options);
-
-      if (pair !== null) {
-        const [rawValue, distortedValue] = pair;
-        const instrumentedDistortedValue = typeof distortedValue === 'function' ? instrumentDistortionForSandbox(key, distortedValue, errorBeacon) : distortedValue;
-        ArrayPush(entries, [rawValue, maybeMaskDistortion(instrumentedDistortedValue, rawValue)]);
-      }
+      addDistortionEntry(globalObject, key, evaluator, config, entries, factory);
     }
 
     for (let i = 0, len = internalDistortionFactories.length; i < len; i += 1) {
       const factory = internalDistortionFactories[i];
-      const pair = factory(globalObject, options);
-
-      if (pair !== null) {
-        const [rawValue, distortedValue] = pair;
-        const instrumentedDistortedValue = typeof distortedValue === 'function' ? instrumentDistortionForSandbox(key, distortedValue, errorBeacon) : distortedValue;
-        ArrayPush(entries, [rawValue, maybeMaskDistortion(instrumentedDistortedValue, rawValue)]);
-      }
+      addDistortionEntry(globalObject, key, evaluator, config, entries, factory);
     }
 
     WeakMapSet(internalDistortionCache, globalObject, ArrayShallowClone(entries));
@@ -5507,19 +6216,13 @@ function createInternalDistortionEntries(globalObject, key, evaluator, config) {
 
   for (let i = 0, len = internalKeyedDistortionFactories.length; i < len; i += 1) {
     const factory = internalKeyedDistortionFactories[i];
-    const pair = factory(globalObject, options);
-
-    if (pair !== null) {
-      const [rawValue, distortedValue] = pair;
-      const instrumentedDistortedValue = typeof distortedValue === 'function' ? instrumentDistortionForSandbox(key, distortedValue, errorBeacon) : distortedValue;
-      ArrayPush(entries, [rawValue, maybeMaskDistortion(instrumentedDistortedValue, rawValue)]);
-    }
+    addDistortionEntry(globalObject, key, evaluator, config, entries, factory);
   }
 
   ReflectApply$3(ArrayProtoPush, entries, makeElementDistortionsForSandboxKey(key));
   return entries;
 }
-/*! version: 0.14.17 */
+/*! version: 0.14.26 */
 
 /*!
  * Copyright (C) 2021 salesforce.com, inc.
@@ -5552,7 +6255,7 @@ function __classPrivateFieldSet(receiver, state, value, kind, f) {
   return kind === "a" ? f.call(receiver, value) : f ? f.value = value : state.set(receiver, value), value;
 }
 
-var _startCallback, _stopCallback, _ended, _activityStart, _activityStop, _captureTimestamps;
+var _LockerActivity_startCallback, _LockerActivity_stopCallback, _LockerActivity_ended, _LockerActivity_activityStart, _LockerActivity_activityStop, _LockerActivity_captureTimestamps;
 
 let ticketSequence = 0;
 
@@ -5567,49 +6270,49 @@ class LockerActivity {
     /*
         private reference to external instrumentation service to start an activity.
     */
-    _startCallback.set(this, void 0);
+    _LockerActivity_startCallback.set(this, void 0);
     /*
         private reference to external instrumentation service to stop an activity.
     */
 
 
-    _stopCallback.set(this, void 0);
+    _LockerActivity_stopCallback.set(this, void 0);
     /*
         flag to indicate that stop() or error() has been called for the activity.
     */
 
 
-    _ended.set(this, void 0);
+    _LockerActivity_ended.set(this, void 0);
     /*
         activity start timestamp. Can be used for data aggregation.
     */
 
 
-    _activityStart.set(this, void 0);
+    _LockerActivity_activityStart.set(this, void 0);
     /*
         activity stop timestamp. Can be used for data aggregation.
     */
 
 
-    _activityStop.set(this, void 0);
+    _LockerActivity_activityStop.set(this, void 0);
     /*
         flag for recording the timestamps of start and stop.
     */
 
 
-    _captureTimestamps.set(this, void 0);
+    _LockerActivity_captureTimestamps.set(this, void 0);
 
-    __classPrivateFieldSet(this, _startCallback, startCallback);
+    __classPrivateFieldSet(this, _LockerActivity_startCallback, startCallback, "f");
 
-    __classPrivateFieldSet(this, _stopCallback, stopCallback);
+    __classPrivateFieldSet(this, _LockerActivity_stopCallback, stopCallback, "f");
 
-    __classPrivateFieldSet(this, _activityStart, 0);
+    __classPrivateFieldSet(this, _LockerActivity_activityStart, 0, "f");
 
-    __classPrivateFieldSet(this, _activityStop, 0);
+    __classPrivateFieldSet(this, _LockerActivity_activityStop, 0, "f");
 
-    __classPrivateFieldSet(this, _captureTimestamps, captureTimestamps);
+    __classPrivateFieldSet(this, _LockerActivity_captureTimestamps, captureTimestamps, "f");
 
-    __classPrivateFieldSet(this, _ended, false);
+    __classPrivateFieldSet(this, _LockerActivity_ended, false, "f");
 
     this.activityName = activityName;
     this.activityId = `${activityName}-${getActivityId()}`;
@@ -5620,12 +6323,12 @@ class LockerActivity {
 
 
   start(data) {
-    if (__classPrivateFieldGet(this, _captureTimestamps)) {
-      __classPrivateFieldSet(this, _activityStart, getTimestamp());
+    if (__classPrivateFieldGet(this, _LockerActivity_captureTimestamps, "f")) {
+      __classPrivateFieldSet(this, _LockerActivity_activityStart, getTimestamp(), "f");
     }
 
-    if (typeof __classPrivateFieldGet(this, _startCallback) === 'function') {
-      __classPrivateFieldGet(this, _startCallback).call(this, this, data);
+    if (typeof __classPrivateFieldGet(this, _LockerActivity_startCallback, "f") === 'function') {
+      __classPrivateFieldGet(this, _LockerActivity_startCallback, "f").call(this, this, data);
     }
   }
   /*
@@ -5634,12 +6337,12 @@ class LockerActivity {
 
 
   stop(data) {
-    if (__classPrivateFieldGet(this, _captureTimestamps)) {
-      __classPrivateFieldSet(this, _activityStop, getTimestamp());
+    if (__classPrivateFieldGet(this, _LockerActivity_captureTimestamps, "f")) {
+      __classPrivateFieldSet(this, _LockerActivity_activityStop, getTimestamp(), "f");
     }
 
-    if (!__classPrivateFieldGet(this, _ended) && typeof __classPrivateFieldGet(this, _stopCallback) === 'function') {
-      __classPrivateFieldGet(this, _stopCallback).call(this, this, data);
+    if (!__classPrivateFieldGet(this, _LockerActivity_ended, "f") && typeof __classPrivateFieldGet(this, _LockerActivity_stopCallback, "f") === 'function') {
+      __classPrivateFieldGet(this, _LockerActivity_stopCallback, "f").call(this, this, data);
     }
   }
   /*
@@ -5657,12 +6360,12 @@ class LockerActivity {
   }
 
   get duration() {
-    return __classPrivateFieldGet(this, _activityStop) > __classPrivateFieldGet(this, _activityStart) ? __classPrivateFieldGet(this, _activityStop) - __classPrivateFieldGet(this, _activityStart) : 0;
+    return __classPrivateFieldGet(this, _LockerActivity_activityStop, "f") > __classPrivateFieldGet(this, _LockerActivity_activityStart, "f") ? __classPrivateFieldGet(this, _LockerActivity_activityStop, "f") - __classPrivateFieldGet(this, _LockerActivity_activityStart, "f") : 0;
   }
 
 }
 
-_startCallback = new WeakMap(), _stopCallback = new WeakMap(), _ended = new WeakMap(), _activityStart = new WeakMap(), _activityStop = new WeakMap(), _captureTimestamps = new WeakMap(); // creates a new no-op InstrumentationHooks instance with methods mapped to Instrumentation Service.
+_LockerActivity_startCallback = new WeakMap(), _LockerActivity_stopCallback = new WeakMap(), _LockerActivity_ended = new WeakMap(), _LockerActivity_activityStart = new WeakMap(), _LockerActivity_activityStop = new WeakMap(), _LockerActivity_captureTimestamps = new WeakMap(); // creates a new no-op InstrumentationHooks instance with methods mapped to Instrumentation Service.
 
 class DefaultInstrumentation {
   // eslint-disable-next-line @typescript-eslint/no-unused-vars
@@ -5680,7 +6383,7 @@ class DefaultInstrumentation {
 
 
 const defaultInstrumentation = new DefaultInstrumentation();
-/*! version: 0.14.17 */
+/*! version: 0.14.26 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -7789,7 +8492,7 @@ function setEvalHelpers(helpers) {
 }
 
 function toModuleSource(value) {
-  let source = toString(value);
+  let source = toString$1(value);
 
   if (typeof value === 'function') {
     // Extract the function body with the regexp:
@@ -7824,21 +8527,30 @@ function toModuleSource(value) {
   return `'use strict';${source}`;
 }
 
-const defaultEndowmentsDescriptors = toSafeDescriptorMap({
-  $lockerEvalContext$: {
+const defaultEndowmentsDescriptors = {
+  [SANDBOX_EVAL_CONTEXT_NAME]: {
+    // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+    __proto__: null,
+
     get() {
       return clearEvalContext();
     }
 
   },
-  $lockerEvalHelpers$: {
+  [SANDBOX_EVAL_HELPERS_NAME]: {
+    // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+    __proto__: null,
+
     get() {
       return clearEvalHelpers();
     }
 
   }
-});
-const sandboxes = ObjectCreate(null);
+}; // @ts-ignore: TS doesn't like null as a SandboxRecord.
+
+const sandboxes = {
+  __proto__: null
+};
 
 function getSandbox(key) {
   return sandboxes[key];
@@ -7902,7 +8614,9 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
     ObjectDefineProperties(normalizedEndowments, toSafeDescriptorMap(ObjectGetOwnPropertyDescriptors$1(endowments)));
   }
 
-  const record = ObjectCreate(null);
+  const record = {
+    __proto__: null
+  };
   const distortionCallback = createDistortionCallback(record);
 
   if (!lockerBlueRealmGlobalObjectShape) {
@@ -7927,7 +8641,7 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
       // ignore the entry and continue.
 
       if (descriptor) {
-        descriptorMap[key] = descriptor;
+        descriptorMap[key] = toSafeDescriptor(descriptor);
       }
     }
 
@@ -7947,7 +8661,9 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
     instrumentation
   });
   record.env = environment;
-  record.helpers = ObjectCreate(null);
+  record.helpers = {
+    __proto__: null
+  };
   setEvalContext(redHelpersFactory => {
     ObjectAssign$3(record.helpers, redHelpersFactory({
       loadingPromises
@@ -7956,8 +8672,9 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
   // istanbul ignore next
 
   record.env.evaluate(`'use strict';
-        $lockerEvalContext$(${function redHelpersFactory(context) {
+        ${SANDBOX_EVAL_CONTEXT_NAME}(${function redHelpersFactory(context) {
     /* eslint-disable prefer-object-spread */
+    // eslint-disable-next-line @typescript-eslint/no-shadow, no-shadow
     const {
       loadingPromises
     } = context;
@@ -7989,14 +8706,26 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
     } = Event.prototype;
     const {
       addEventListener: EventTargetProtoAddEventListener
-    } = EventTarget.prototype;
+    } = EventTarget.prototype; // The Generator prototype object is %GeneratorFunction.prototype.prototype%.
+    // https://tc39.es/ecma262/#sec-generatorfunction.prototype.prototype
+    // eslint-disable-next-line @typescript-eslint/no-empty-function, func-names
+
+    const GeneratorProto = function* () {}.constructor.prototype.prototype;
+
+    const {
+      next: GeneratorProtoNext,
+      throw: GeneratorProtoThrow
+    } = GeneratorProto;
     const {
       appendChild: NodeProtoAppendChild
     } = Node.prototype;
     const {
       get: WeakMapProtoGet,
       set: WeakMapProtoSet
-    } = WeakMap.prototype;
+    } = WeakMap.prototype; // Generate a UID for this sandbox run for <script> elements
+
+    const LOCKER_ID_DATA_NAME = 'data-locker-id';
+    const LOCKER_ID_DATA_VALUE = `${crypto.getRandomValues(new Uint32Array(1))[0]}`;
     const docRef = document;
     const emptyArray = [];
     const headRef = docRef.head;
@@ -8021,6 +8750,14 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
       return ReflectApply(EventTargetProtoAddEventListener, target, args);
     }
 
+    function GeneratorNext(gen, value) {
+      return ReflectApply(GeneratorProtoNext, gen, [value]);
+    }
+
+    function GeneratorThrow(gen, value) {
+      return ReflectApply(GeneratorProtoThrow, gen, [value]);
+    }
+
     function NodeAppendChild(node, childNode) {
       return ReflectApply(NodeProtoAppendChild, node, [childNode]);
     } // eslint-disable-next-line @typescript-eslint/no-shadow, no-shadow
@@ -8035,21 +8772,27 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
     function WeakMapSet(weakMap, // eslint-disable-next-line @typescript-eslint/no-shadow, no-shadow
     key, value) {
       return ReflectApply(WeakMapProtoSet, weakMap, [key, value]);
-    } // The Generator prototype object is %GeneratorFunction.prototype.prototype%.
-    // https://tc39.es/ecma262/#sec-generatorfunction.prototype.prototype
-    // eslint-disable-next-line @typescript-eslint/no-empty-function, func-names
+    } // This helper is used to wrap the bodies of async functions
+    // that are transformed into generator functions. It's based
+    // on @babel/helpers `helpers.asyncToGenerator()`:
+    // https://github.com/babel/babel/blob/a967910/packages/babel-helpers/src/helpers.js#L255-L288
 
 
-    const GeneratorProto = function* () {}.constructor.prototype.prototype;
+    function asyncToGen(func, thisArg, args) {
+      return new PromiseCtor((resolve, reject) => {
+        const gen = ReflectApply(func, thisArg, args);
 
-    const {
-      next: GeneratorProtoNext,
-      throw: GeneratorProtoThrow
-    } = GeneratorProto;
+        function next(value) {
+          genStep(gen, resolve, reject, next, thrower, GeneratorNext, value);
+        }
 
-    const GeneratorNext = (gen, value) => ReflectApply(GeneratorProtoNext, gen, [value]);
+        function thrower(error) {
+          genStep(gen, resolve, reject, next, thrower, GeneratorThrow, error);
+        }
 
-    const GeneratorThrow = (gen, value) => ReflectApply(GeneratorProtoThrow, gen, [value]);
+        next(undefined);
+      });
+    }
 
     function genStep(gen, resolve, reject, next, thrower, GeneratorMethod, arg) {
       let info;
@@ -8068,26 +8811,6 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
       } else {
         PromiseResolve(value).then(next, thrower);
       }
-    } // This helper is used to wrap the bodies of async functions
-    // that are transformed into generator functions. It's based
-    // on @babel/helpers `helpers.asyncToGenerator()`:
-    // https://github.com/babel/babel/blob/a967910/packages/babel-helpers/src/helpers.js#L255-L288
-
-
-    function asyncToGen(func, thisArg, args) {
-      return new PromiseCtor((resolve, reject) => {
-        const gen = ReflectApply(func, thisArg, args);
-
-        function next(value) {
-          genStep(gen, resolve, reject, next, thrower, GeneratorNext, value);
-        }
-
-        function thrower(error) {
-          genStep(gen, resolve, reject, next, thrower, GeneratorThrow, error);
-        }
-
-        next(undefined);
-      });
     }
 
     function namespace(object) {
@@ -8104,14 +8827,8 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
       const superProto = ReflectGetPrototypeOf(clazz.prototype);
       const superMethod = superProto[methodName];
       return ReflectApply(superMethod, thisArg, args);
-    } // Generate a UID for this sandbox run for <script> elements
-
+    } // loadPromise returns a promise to load the given element.
 
-    const dataLockerId = 'data-locker-id';
-
-    const loadingError = url => `[Locker] resource loader error loading "${url}"`;
-
-    const lockerIdScript = `${crypto.getRandomValues(new Uint32Array(1))[0]}`; // loadPromise returns a promise to load the given element.
 
     function loadPromise(element, url) {
       const promise = new PromiseCtor((resolve, reject) => {
@@ -8120,7 +8837,7 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
         });
         EventTargetAddEventListener(element, 'error', evt => {
           EventStopPropagation(evt);
-          reject(loadingError(url));
+          reject(`[Locker] resource loader error loading "${url}"`);
         });
       });
       WeakMapSet(loadingPromises, element, promise);
@@ -8131,14 +8848,14 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
 
 
     function loadScript(_thisArg, url) {
-      let script = ElementQuerySelector(headRef, `script[data-distorted-src='${url}'][${dataLockerId}='${lockerIdScript}']`);
+      let script = ElementQuerySelector(headRef, `script[data-distorted-src='${url}'][${LOCKER_ID_DATA_NAME}='${LOCKER_ID_DATA_VALUE}']`);
 
       if (script) {
         return WeakMapGet(loadingPromises, script) || PromiseResolve();
       }
 
       script = DocumentCreateElement(docRef, 'script');
-      ElementSetAttribute(script, dataLockerId, lockerIdScript);
+      ElementSetAttribute(script, LOCKER_ID_DATA_NAME, LOCKER_ID_DATA_VALUE);
       script.type = 'text/javascript';
       script.src = url;
       return loadPromise(script, url);
@@ -8175,7 +8892,7 @@ function createSandbox(key, distortionFactory, endowments, instrumentation) {
 } // @TODO: [Issue #373] Abstract common code in sandbox and distortion packages
 
 
-function evaluateInSandbox(key, sourceText, context, endowments, instrumentationService, verboseInstrumentation) {
+function evaluateInSandbox(key, source, context, endowments, instrumentationService, verboseInstrumentation) {
   const instrumentation = instrumentationService || defaultInstrumentation;
   const {
     startActivity
@@ -8184,23 +8901,22 @@ function evaluateInSandbox(key, sourceText, context, endowments, instrumentation
     sandboxKey: key
   };
   const activityEvaluateInSandbox = startActivity('EvaluateInSandboxDuration', basicInstrumentationData);
-
-  if (typeof sourceText !== 'string') {
-    sourceText = toModuleSource(sourceText);
-  }
-
   let record = getSandbox(key);
 
-  if (!record) {
+  if (record === undefined) {
     if (!isObjectLike(endowments)) {
       endowments = undefined;
     }
 
     const config = ObjectCreate(null, {
       instrumentation: {
+        // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+        __proto__: null,
         value: instrumentation
       },
       verboseInstrumentation: {
+        // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+        __proto__: null,
         value: verboseInstrumentation
       }
     });
@@ -8223,12 +8939,13 @@ function evaluateInSandbox(key, sourceText, context, endowments, instrumentation
   setEvalContext(context);
   setEvalHelpers(record.helpers);
   let result;
+  const moduleSource = toModuleSource(source);
   const activityEvaluator = startActivity('externalEvaluatorDuration', basicInstrumentationData);
 
   try {
     // Protecting against errors during evaluation can guarantee
     // the state of the EvalContext to avoid leaking context values
-    result = record.env.evaluate(sourceText);
+    result = record.env.evaluate(moduleSource);
   } catch (e) {
     activityEvaluator.error({
       sandboxKey: key,
@@ -8247,7 +8964,7 @@ function evaluateInSandbox(key, sourceText, context, endowments, instrumentation
 
 const CORE_SANDBOX_KEY = 'lws-core-sandbox'; // @TODO: [Issue #373] Abstract common code in sandbox and distortion packages
 
-function evaluateInCoreSandbox(_key, sourceText, context, endowments, instrumentationService, verboseInstrumentation) {
+function evaluateInCoreSandbox(_key, source, context, endowments, instrumentationService, verboseInstrumentation) {
   const instrumentation = instrumentationService || defaultInstrumentation;
   const {
     startActivity
@@ -8256,23 +8973,22 @@ function evaluateInCoreSandbox(_key, sourceText, context, endowments, instrument
     sandboxKey: CORE_SANDBOX_KEY
   };
   const activityEvaluateInCoreSandbox = startActivity('EvaluateInCoreSandboxDuration', basicInstrumentationData);
-
-  if (typeof sourceText !== 'string') {
-    sourceText = toModuleSource(sourceText);
-  }
-
   let record = getSandbox(CORE_SANDBOX_KEY);
 
-  if (!record) {
+  if (record === undefined) {
     if (!isObjectLike(endowments)) {
       endowments = undefined;
     }
 
     const config = ObjectCreate(null, {
       instrumentation: {
+        // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+        __proto__: null,
         value: instrumentation
       },
       verboseInstrumentation: {
+        // @ts-ignore: TS doesn't like __proto__ on property descriptors.
+        __proto__: null,
         value: verboseInstrumentation
       }
     });
@@ -8295,12 +9011,13 @@ function evaluateInCoreSandbox(_key, sourceText, context, endowments, instrument
   setEvalContext(context);
   setEvalHelpers(record.helpers);
   let result;
+  const moduleSource = toModuleSource(source);
   const activityEvaluator = startActivity('internalEvaluatorDuration', basicInstrumentationData);
 
   try {
     // Protecting against errors during evaluation can guarantee
     // the state of the EvalContext to avoid leaking context values
-    result = record.env.evaluate(sourceText);
+    result = record.env.evaluate(moduleSource);
   } catch (e) {
     activityEvaluator.error({
       sandboxKey: CORE_SANDBOX_KEY,
@@ -8316,6 +9033,6 @@ function evaluateInCoreSandbox(_key, sourceText, context, endowments, instrument
   activityEvaluateInCoreSandbox.stop();
   return result;
 }
-/*! version: 0.14.17 */
+/*! version: 0.14.26 */
 
 export { CORE_SANDBOX_KEY, evaluateInCoreSandbox, evaluateInSandbox };