@salesforce/afv-skills 1.36.0 → 1.38.0

package/skills/experience-lwc-security-validate/references/lws-security-expert.md

@@ -0,0 +1,986 @@
+# LWSExpert
+
+## Description
+
+Use this tool to make LWC code secure.
+
+## Knowledge Base
+
+## Lightning Web Security (LWS) Analysis Assistant
+
+The following topics, each with their own grounding, are separated by a line of dashes and a new H1 header. Treat each topic as a separate grounding.
+These topics can be used to analyze any Lightning Web Components code, as well as any JavaScript or TypeScript code. The code being analyzed DOES NOT HAVE TO BE LWC CODE.
+
+---
+
+The following definitions are CRITICAL, DO NOT IGNORE THEM:
+
+- "Built-in object" refers to any object that is part of the core JavaScript language.
+- "Host object" refers to any object that is not a built-in object or a custom object created by the component. Host objects are defined by the "Web API" or "DOM API"
+- "Web API" or "DOM API" refers to the set of objects and methods defined by the HTML and DOM standards and includes all of the following: AbortController, AbortSignal, AbsoluteOrientationSensor, AbstractRange, Accelerometer, AICreateMonitor, alert, AnalyserNode, Animation, AnimationEffect, AnimationEvent, AnimationPlaybackEvent, AnimationTimeline, AsyncDisposableStack, atob, Attr, Audio, AudioBuffer, AudioBufferSourceNode, AudioContext, AudioData, AudioDecoder, AudioDestinationNode, AudioEncoder, AudioListener, AudioNode, AudioParam, AudioParamMap, AudioProcessingEvent, AudioScheduledSourceNode, AudioSinkInfo, AudioWorklet, AudioWorkletNode, AuthenticatorAssertionResponse, AuthenticatorAttestationResponse, AuthenticatorResponse, BackgroundFetchManager, BackgroundFetchRecord, BackgroundFetchRegistration, BarcodeDetector, BarProp, BaseAudioContext, BatteryManager, BeforeInstallPromptEvent, BeforeUnloadEvent, BiquadFilterNode, Blob, BlobEvent, Bluetooth, BluetoothCharacteristicProperties, BluetoothDevice, BluetoothRemoteGATTCharacteristic, BluetoothRemoteGATTDescriptor, BluetoothRemoteGATTServer, BluetoothRemoteGATTService, BluetoothUUID, blur, BroadcastChannel, BrowserCaptureMediaStreamTrack, btoa, ByteLengthQueuingStrategy, Cache, caches, CacheStorage, cancelAnimationFrame, cancelIdleCallback, CanvasCaptureMediaStreamTrack, CanvasGradient, CanvasPattern, CanvasRenderingContext2D, CaptureController, captureEvents, CaretPosition, CDATASection, ChannelMergerNode, ChannelSplitterNode, ChapterInformation, CharacterBoundsUpdateEvent, CharacterData, chrome, clearInterval, clearTimeout, clientInformation, Clipboard, ClipboardEvent, ClipboardItem, close, closed, CloseEvent, CloseWatcher, CommandEvent, Comment, CompositionEvent, CompressionStream, confirm, console, ConstantSourceNode, ContentVisibilityAutoStateChangeEvent, ConvolverNode, CookieChangeEvent, cookieStore, CookieStore, CookieStoreManager, CountQueuingStrategy, createImageBitmap, Credential, credentialless, CredentialsContainer, CropTarget, crossOriginIsolated, crypto, Crypto, CryptoKey, CSPViolationReportBody, CSS, CSSAnimation, CSSConditionRule, CSSContainerRule, CSSCounterStyleRule, CSSFontFaceRule, CSSFontFeatureValuesRule, CSSFontPaletteValuesRule, CSSGroupingRule, CSSImageValue, CSSImportRule, CSSKeyframeRule, CSSKeyframesRule, CSSKeywordValue, CSSLayerBlockRule, CSSLayerStatementRule, CSSMarginRule, CSSMathClamp, CSSMathInvert, CSSMathMax, CSSMathMin, CSSMathNegate, CSSMathProduct, CSSMathSum, CSSMathValue, CSSMatrixComponent, CSSMediaRule, CSSNamespaceRule, CSSNestedDeclarations, CSSNumericArray, CSSNumericValue, CSSPageRule, CSSPerspective, CSSPositionTryDescriptors, CSSPositionTryRule, CSSPositionValue, CSSPropertyRule, CSSRotate, CSSRule, CSSRuleList, CSSScale, CSSScopeRule, CSSSkew, CSSSkewX, CSSSkewY, CSSStartingStyleRule, CSSStyleDeclaration, CSSStyleRule, CSSStyleSheet, CSSStyleValue, CSSSupportsRule, CSSTransformComponent, CSSTransformValue, CSSTransition, CSSTranslate, CSSUnitValue, CSSUnparsedValue, CSSVariableReferenceValue, CSSViewTransitionRule, CustomElementRegistry, customElements, CustomEvent, CustomStateSet, DataTransfer, DataTransferItem, DataTransferItemList, DecompressionStream, DelayNode, DelegatedInkTrailPresenter, DeviceMotionEvent, DeviceMotionEventAcceleration, DeviceMotionEventRotationRate, DeviceOrientationEvent, devicePixelRatio, DevicePosture, DisposableStack, document, Document, DocumentFragment, documentPictureInPicture, DocumentPictureInPicture, DocumentPictureInPictureEvent, DocumentTimeline, DocumentType, DOMError, DOMException, DOMImplementation, DOMMatrix, DOMMatrixReadOnly, DOMParser, DOMPoint, DOMPointReadOnly, DOMQuad, DOMRect, DOMRectList, DOMRectReadOnly, DOMStringList, DOMStringMap, DOMTokenList, DragEvent, DynamicsCompressorNode, EditContext, Element, ElementInternals, EncodedAudioChunk, EncodedVideoChunk, ErrorEvent, event, Event, EventCounts, EventSource, EventTarget, external, External, EyeDropper, FeaturePolicy, FederatedCredential, fence, Fence, FencedFrameConfig, fetch, fetchLater, FetchLaterResult, File, FileList, FileReader, FileSystemDirectoryHandle, FileSystemFileHandle, FileSystemHandle, FileSystemObserver, FileSystemWritableFileStream, find, Float16Array, focus, FocusEvent, FontData, FontFace, FontFaceSetLoadEvent, FormData, FormDataEvent, FragmentDirective, frameElement, frames, GainNode, Gamepad, GamepadButton, GamepadEvent, GamepadHapticActuator, Geolocation, GeolocationCoordinates, GeolocationPosition, GeolocationPositionError, getComputedStyle, getScreenDetails, getSelection, GPU, GPUAdapter, GPUAdapterInfo, GPUBindGroup, GPUBindGroupLayout, GPUBuffer, GPUBufferUsage, GPUCanvasContext, GPUColorWrite, GPUCommandBuffer, GPUCommandEncoder, GPUCompilationInfo, GPUCompilationMessage, GPUComputePassEncoder, GPUComputePipeline, GPUDevice, GPUDeviceLostInfo, GPUError, GPUExternalTexture, GPUInternalError, GPUMapMode, GPUOutOfMemoryError, GPUPipelineError, GPUPipelineLayout, GPUQuerySet, GPUQueue, GPURenderBundle, GPURenderBundleEncoder, GPURenderPassEncoder, GPURenderPipeline, GPUSampler, GPUShaderModule, GPUShaderStage, GPUSupportedFeatures, GPUSupportedLimits, GPUTexture, GPUTextureUsage, GPUTextureView, GPUUncapturedErrorEvent, GPUValidationError, GravitySensor, Gyroscope, HashChangeEvent, Headers, HID, HIDConnectionEvent, HIDDevice, HIDInputReportEvent, Highlight, HighlightRegistry, history, History, HTMLAllCollection, HTMLAnchorElement, HTMLAreaElement, HTMLAudioElement, HTMLBaseElement, HTMLBodyElement, HTMLBRElement, HTMLButtonElement, HTMLCanvasElement, HTMLCollection, HTMLDataElement, HTMLDataListElement, HTMLDetailsElement, HTMLDialogElement, HTMLDirectoryElement, HTMLDivElement, HTMLDListElement, HTMLDocument, HTMLElement, HTMLEmbedElement, HTMLFencedFrameElement, HTMLFieldSetElement, HTMLFontElement, HTMLFormControlsCollection, HTMLFormElement, HTMLFrameElement, HTMLFrameSetElement, HTMLHeadElement, HTMLHeadingElement, HTMLHRElement, HTMLHtmlElement, HTMLIFrameElement, HTMLImageElement, HTMLInputElement, HTMLLabelElement, HTMLLegendElement, HTMLLIElement, HTMLLinkElement, HTMLMapElement, HTMLMarqueeElement, HTMLMediaElement, HTMLMenuElement, HTMLMetaElement, HTMLMeterElement, HTMLModElement, HTMLObjectElement, HTMLOListElement, HTMLOptGroupElement, HTMLOptionElement, HTMLOptionsCollection, HTMLOutputElement, HTMLParagraphElement, HTMLParamElement, HTMLPictureElement, HTMLPreElement, HTMLProgressElement, HTMLQuoteElement, HTMLScriptElement, HTMLSelectedContentElement, HTMLSelectElement, HTMLSlotElement, HTMLSourceElement, HTMLSpanElement, HTMLStyleElement, HTMLTableCaptionElement, HTMLTableCellElement, HTMLTableColElement, HTMLTableElement, HTMLTableRowElement, HTMLTableSectionElement, HTMLTemplateElement, HTMLTextAreaElement, HTMLTimeElement, HTMLTitleElement, HTMLTrackElement, HTMLUListElement, HTMLUnknownElement, HTMLVideoElement, IDBCursor, IDBCursorWithValue, IDBDatabase, IDBFactory, IDBIndex, IDBKeyRange, IDBObjectStore, IDBOpenDBRequest, IDBRequest, IDBTransaction, IDBVersionChangeEvent, IdentityCredential, IdentityCredentialError, IdentityProvider, IdleDeadline, IdleDetector, IIRFilterNode, Image, ImageBitmap, ImageBitmapRenderingContext, ImageCapture, ImageData, ImageDecoder, ImageTrack, ImageTrackList, indexedDB, Ink, InputDeviceCapabilities, InputDeviceInfo, InputEvent, IntersectionObserver, IntersectionObserverEntry, isSecureContext, Keyboard, KeyboardEvent, KeyboardLayoutMap, KeyframeEffect, LargestContentfulPaint, LaunchParams, launchQueue, LaunchQueue, LayoutShift, LayoutShiftAttribution, LinearAccelerationSensor, localStorage, location, Location, locationbar, Lock, LockManager, matchMedia, MathMLElement, MediaCapabilities, MediaDeviceInfo, MediaDevices, MediaElementAudioSourceNode, MediaEncryptedEvent, MediaError, MediaKeyMessageEvent, MediaKeys, MediaKeySession, MediaKeyStatusMap, MediaKeySystemAccess, MediaList, MediaMetadata, MediaQueryList, MediaQueryListEvent, MediaRecorder, MediaSession, MediaSource, MediaSourceHandle, MediaStream, MediaStreamAudioDestinationNode, MediaStreamAudioSourceNode, MediaStreamEvent, MediaStreamTrack, MediaStreamTrackAudioStats, MediaStreamTrackEvent, MediaStreamTrackGenerator, MediaStreamTrackProcessor, MediaStreamTrackVideoStats, menubar, MessageChannel, MessageEvent, MessagePort, MIDIAccess, MIDIConnectionEvent, MIDIInput, MIDIInputMap, MIDIMessageEvent, MIDIOutput, MIDIOutputMap, MIDIPort, MimeType, MimeTypeArray, MouseEvent, moveBy, moveTo, MutationObserver, MutationRecord, NamedNodeMap, NavigateEvent, navigation, Navigation, NavigationActivation, NavigationCurrentEntryChangeEvent, NavigationDestination, NavigationHistoryEntry, NavigationPreloadManager, NavigationTransition, navigator, Navigator, NavigatorLogin, NavigatorManagedData, NavigatorUAData, NetworkInformation, Node, NodeFilter, NodeIterator, NodeList, Notification, NotRestoredReasonDetails, NotRestoredReasons, Observable, OfflineAudioCompletionEvent, OfflineAudioContext, offscreenBuffering, OffscreenCanvas, OffscreenCanvasRenderingContext2D, onabort, onafterprint, onanimationend, onanimationiteration, onanimationstart, onappinstalled, onauxclick, onbeforeinput, onbeforeinstallprompt, onbeforematch, onbeforeprint, onbeforetoggle, onbeforeunload, onbeforexrselect, onblur, oncancel, oncanplay, oncanplaythrough, onchange, onclick, onclose, oncommand, oncontentvisibilityautostatechange, oncontextlost, oncontextmenu, oncontextrestored, oncuechange, ondblclick, ondevicemotion, ondeviceorientation, ondeviceorientationabsolute, ondrag, ondragend, ondragenter, ondragleave, ondragover, ondragstart, ondrop, ondurationchange, onemptied, onended, onerror, onfocus, onformdata, ongotpointercapture, onhashchange, oninput, oninvalid, onkeydown, onkeypress, onkeyup, onlanguagechange, onload, onloadeddata, onloadedmetadata, onloadstart, onlostpointercapture, onmessage, onmessageerror, onmousedown, onmouseenter, onmouseleave, onmousemove, onmouseout, onmouseover, onmouseup, onmousewheel, onoffline, ononline, onpagehide, onpagereveal, onpageshow, onpageswap, onpause, onplay, onplaying, onpointercancel, onpointerdown, onpointerenter, onpointerleave, onpointermove, onpointerout, onpointerover, onpointerrawupdate, onpointerup, onpopstate, onprogress, onratechange, onrejectionhandled, onreset, onresize, onscroll, onscrollend, onscrollsnapchange, onscrollsnapchanging, onsearch, onsecuritypolicyviolation, onseeked, onseeking, onselect, onselectionchange, onselectstart, onslotchange, onstalled, onstorage, onsubmit, onsuspend, ontimeupdate, ontoggle, ontransitioncancel, ontransitionend, ontransitionrun, ontransitionstart, onunhandledrejection, onunload, onvolumechange, onwaiting, onwebkitanimationend, onwebkitanimationiteration, onwebkitanimationstart, onwebkittransitionend, onwheel, open, opener, Option, OrientationSensor, origin, originAgentCluster, OscillatorNode, OTPCredential, outerHeight, outerWidth, OverconstrainedError, PageRevealEvent, PageSwapEvent, PageTransitionEvent, pageXOffset, pageYOffset, PannerNode, parent, PasswordCredential, Path2D, PaymentAddress, PaymentManager, PaymentMethodChangeEvent, PaymentRequest, PaymentRequestUpdateEvent, PaymentResponse, performance, Performance, PerformanceElementTiming, PerformanceEntry, PerformanceEventTiming, PerformanceLongAnimationFrameTiming, PerformanceLongTaskTiming, PerformanceMark, PerformanceMeasure, PerformanceNavigation, PerformanceNavigationTiming, PerformanceObserver, PerformanceObserverEntryList, PerformancePaintTiming, PerformanceResourceTiming, PerformanceScriptTiming, PerformanceServerTiming, PerformanceTiming, PeriodicSyncManager, PeriodicWave, Permissions, PermissionStatus, personalbar, PictureInPictureEvent, PictureInPictureWindow, Plugin, PluginArray, PointerEvent, PopStateEvent, postMessage, Presentation, PresentationAvailability, PresentationConnection, PresentationConnectionAvailableEvent, PresentationConnectionCloseEvent, PresentationConnectionList, PresentationReceiver, PresentationRequest, PressureObserver, PressureRecord, print, ProcessingInstruction, Profiler, ProgressEvent, PromiseRejectionEvent, prompt, ProtectedAudience, PublicKeyCredential, PushManager, PushSubscription, PushSubscriptionOptions, queryLocalFonts, queueMicrotask, RadioNodeList, Range, ReadableByteStreamController, ReadableStream, ReadableStreamBYOBReader, ReadableStreamBYOBRequest, ReadableStreamDefaultController, ReadableStreamDefaultReader, RelativeOrientationSensor, releaseEvents, RemotePlayback, ReportBody, reportError, ReportingObserver, Request, requestAnimationFrame, requestIdleCallback, resizeBy, ResizeObserver, ResizeObserverEntry, ResizeObserverSize, resizeTo, Response, RestrictionTarget, RTCCertificate, RTCDataChannel, RTCDataChannelEvent, RTCDtlsTransport, RTCDTMFSender, RTCDTMFToneChangeEvent, RTCEncodedAudioFrame, RTCEncodedVideoFrame, RTCError, RTCErrorEvent, RTCIceCandidate, RTCIceTransport, RTCPeerConnection, RTCPeerConnectionIceErrorEvent, RTCPeerConnectionIceEvent, RTCRtpReceiver, RTCRtpSender, RTCRtpTransceiver, RTCSctpTransport, RTCSessionDescription, RTCStatsReport, RTCTrackEvent, scheduler, Scheduler, Scheduling, screen, Screen, ScreenDetailed, ScreenDetails, screenLeft, ScreenOrientation, screenTop, screenX, screenY, ScriptProcessorNode, scroll, scrollbars, scrollBy, ScrollTimeline, scrollTo, scrollX, scrollY, SecurityPolicyViolationEvent, Selection, self, Sensor, SensorErrorEvent, Serial, SerialPort, ServiceWorker, ServiceWorkerContainer, ServiceWorkerRegistration, sessionStorage, setInterval, setTimeout, ShadowRoot, SharedArrayBuffer, sharedStorage, SharedStorage, SharedStorageAppendMethod, SharedStorageClearMethod, SharedStorageDeleteMethod, SharedStorageModifierMethod, SharedStorageSetMethod, SharedStorageWorklet, SharedWorker, showDirectoryPicker, showOpenFilePicker, showSaveFilePicker, SnapEvent, SourceBuffer, SourceBufferList, speechSynthesis, SpeechSynthesis, SpeechSynthesisErrorEvent, SpeechSynthesisEvent, SpeechSynthesisUtterance, SpeechSynthesisVoice, StaticRange, status, statusbar, StereoPannerNode, stop, Storage, StorageBucket, StorageBucketManager, StorageEvent, StorageManager, structuredClone, styleMedia, StylePropertyMap, StylePropertyMapReadOnly, StyleSheet, StyleSheetList, SubmitEvent, Subscriber, SubtleCrypto, SuppressedError, SVGAElement, SVGAngle, SVGAnimatedAngle, SVGAnimatedBoolean, SVGAnimatedEnumeration, SVGAnimatedInteger, SVGAnimatedLength, SVGAnimatedLengthList, SVGAnimatedNumber, SVGAnimatedNumberList, SVGAnimatedPreserveAspectRatio, SVGAnimatedRect, SVGAnimatedString, SVGAnimatedTransformList, SVGAnimateElement, SVGAnimateMotionElement, SVGAnimateTransformElement, SVGAnimationElement, SVGCircleElement, SVGClipPathElement, SVGComponentTransferFunctionElement, SVGDefsElement, SVGDescElement, SVGElement, SVGEllipseElement, SVGFEBlendElement, SVGFEColorMatrixElement, SVGFEComponentTransferElement, SVGFECompositeElement, SVGFEConvolveMatrixElement, SVGFEDiffuseLightingElement, SVGFEDisplacementMapElement, SVGFEDistantLightElement, SVGFEDropShadowElement, SVGFEFloodElement, SVGFEFuncAElement, SVGFEFuncBElement, SVGFEFuncGElement, SVGFEFuncRElement, SVGFEGaussianBlurElement, SVGFEImageElement, SVGFEMergeElement, SVGFEMergeNodeElement, SVGFEMorphologyElement, SVGFEOffsetElement, SVGFEPointLightElement, SVGFESpecularLightingElement, SVGFESpotLightElement, SVGFETileElement, SVGFETurbulenceElement, SVGFilterElement, SVGForeignObjectElement, SVGGElement, SVGGeometryElement, SVGGradientElement, SVGGraphicsElement, SVGImageElement, SVGLength, SVGLengthList, SVGLinearGradientElement, SVGLineElement, SVGMarkerElement, SVGMaskElement, SVGMatrix, SVGMetadataElement, SVGMPathElement, SVGNumber, SVGNumberList, SVGPathElement, SVGPatternElement, SVGPoint, SVGPointList, SVGPolygonElement, SVGPolylineElement, SVGPreserveAspectRatio, SVGRadialGradientElement, SVGRect, SVGRectElement, SVGScriptElement, SVGSetElement, SVGStopElement, SVGStringList, SVGStyleElement, SVGSVGElement, SVGSwitchElement, SVGSymbolElement, SVGTextContentElement, SVGTextElement, SVGTextPathElement, SVGTextPositioningElement, SVGTitleElement, SVGTransform, SVGTransformList, SVGTSpanElement, SVGUnitTypes, SVGUseElement, SVGViewElement, SyncManager, TaskAttributionTiming, TaskController, TaskPriorityChangeEvent, TaskSignal, Text, TextDecoder, TextDecoderStream, TextEncoder, TextEncoderStream, TextEvent, TextFormat, TextFormatUpdateEvent, TextMetrics, TextTrack, TextTrackCue, TextTrackCueList, TextTrackList, TextUpdateEvent, TimeRanges, ToggleEvent, toolbar, top, Touch, TouchEvent, TouchList, TrackEvent, TransformStream, TransformStreamDefaultController, TransitionEvent, TreeWalker, TrustedHTML, TrustedScript, TrustedScriptURL, TrustedTypePolicy, TrustedTypePolicyFactory, trustedTypes, UIEvent, URL, URLPattern, URLSearchParams, USB, USBAlternateInterface, USBConfiguration, USBConnectionEvent, USBDevice, USBEndpoint, USBInterface, USBInTransferResult, USBIsochronousInTransferPacket, USBIsochronousInTransferResult, USBIsochronousOutTransferPacket, USBIsochronousOutTransferResult, USBOutTransferResult, UserActivation, ValidityState, VideoColorSpace, VideoDecoder, VideoEncoder, VideoFrame, VideoPlaybackQuality, ViewTimeline, ViewTransition, ViewTransitionTypeSet, VirtualKeyboard, VirtualKeyboardGeometryChangeEvent, VisibilityStateEntry, visualViewport, VisualViewport, VTTCue, WakeLock, WakeLockSentinel, WaveShaperNode, WebAssembly, WebGL2RenderingContext, WebGLActiveInfo, WebGLBuffer, WebGLContextEvent, WebGLFramebuffer, WebGLObject, WebGLProgram, WebGLQuery, WebGLRenderbuffer, WebGLRenderingContext, WebGLSampler, WebGLShader, WebGLShaderPrecisionFormat, WebGLSync, WebGLTexture, WebGLTransformFeedback, WebGLUniformLocation, WebGLVertexArrayObject, webkitCancelAnimationFrame, WebKitCSSMatrix, webkitMediaStream, WebKitMutationObserver, webkitRequestAnimationFrame, webkitRequestFileSystem, webkitResolveLocalFileSystemURL, webkitRTCPeerConnection, webkitSpeechGrammar, webkitSpeechGrammarList, webkitSpeechRecognition, webkitSpeechRecognitionError, webkitSpeechRecognitionEvent, webkitURL, WebSocket, WebSocketError, WebSocketStream, WebTransport, WebTransportBidirectionalStream, WebTransportDatagramDuplexStream, WebTransportError, WGSLLanguageFeatures, WheelEvent, window, Window, WindowControlsOverlay, WindowControlsOverlayGeometryChangeEvent, Worker, Worklet, WritableStream, WritableStreamDefaultController, WritableStreamDefaultWriter, XMLDocument, XMLHttpRequest, XMLHttpRequestEventTarget, XMLHttpRequestUpload, XMLSerializer, XPathEvaluator, XPathExpression, XPathResult, XRAnchor, XRAnchorSet, XRBoundedReferenceSpace, XRCamera, XRCPUDepthInformation, XRDepthInformation, XRDOMOverlayState, XRFrame, XRHand, XRHitTestResult, XRHitTestSource, XRInputSource, XRInputSourceArray, XRInputSourceEvent, XRInputSourcesChangeEvent, XRJointPose, XRJointSpace, XRLayer, XRLightEstimate, XRLightProbe, XRPose, XRRay, XRReferenceSpace, XRReferenceSpaceEvent, XRRenderState, XRRigidTransform, XRSession, XRSessionEvent, XRSpace, XRSystem, XRTransientInputHitTestResult, XRTransientInputHitTestSource, XRView, XRViewerPose, XRViewport, XRWebGLBinding, XRWebGLDepthInformation, XRWebGLLayer, XSLTProcessor
+- "GlobalThisValue" is the Global Object defined in the ECMAScript specification.
+- For review purposes, a "GlobalThisValue" is any of the following: `window`, `window.top`, `window.parent`, `window.frames`, `globalThis`, `self` (when `self` is at the top level of the global scope), or `this` (when `this` is at the top level of the global scope or in `eval()`).
+- `document` is not a "GlobalThisValue", but the value of `defaultView` property is a "GlobalThisValue".
+
+---
+
+# Block Document CreateProcessingInstruction Analysis
+
+## Code Review: Identify and Block document.createProcessingInstruction usage.
+
+### My Job
+
+I identify ALL usage of document.createProcessingInstruction. This API introduces XML injection and XSS vulnerabilities.
+
+### What I Look For
+
+Calls to document.createProcessingInstruction in all contexts: Loops, conditionals, event handlers, async callbacks, template literals, string concatenation, hidden by unicode escape sequences and Reflection APIs.
+
+### Why It's Critical
+
+Creates XML injection vulnerabilities enabling XSS attacks through stylesheet injection, data URIs, and CSP bypass.
+
+### Safe Alternative
+
+Remove the dangerous code. If stylesheet loading is needed, use `document.createElement('link')` and append to `document.head` in JavaScript. Do not add `<link>` to any refactored markup (not allowed).
+
+---
+
+# Block Document Event Handler Analysis
+
+## Code Review: Identify and Block forbidden document event handler usage.
+
+### Rule
+
+Flag ONLY actual event handler registrations for these THREE forbidden events:
+
+- rejectionhandled
+- securitypolicyviolation
+- unhandledrejection
+
+### Correct Usage
+
+1. Remove all forbidden event handlers.
+2. Handle errors and rejections locally within the component scope.
+
+### Instructions
+
+1. Scan EVERY line for these patterns
+2. All contexts: Loops, conditionals, event handlers, async callbacks, template literals, string concatenation, hidden by unicode escape sequences
+3. Case-sensitive matching
+4. Flag EVERY occurrence - no exceptions
+5. Include the complete code context
+6. Report ALL violations found
+
+### Constraints
+
+1. **Preserve Logic**: Maintain all other code logic. Do not remove any code that is not related to the forbidden event handlers.
+2. **Complete Coverage**: Flag ALL instances of forbidden event handlers.
+
+---
+
+# Block Document Open
+
+## Code Review: Identify and Block critical security issues with document.open usage.
+
+### My Job
+
+I examine JavaScript and TypeScript code to find ALL instances of `document.open` called with zero, one, or two arguments. These methods are inherently dangerous and represent critical security vulnerabilities that must be removed.
+
+### What I Flag
+
+- `document.open()` with 0 args: BLOCKED - Clears document (security risk)
+- `document.open(url)` with 1 arg: BLOCKED - Opens in same window (navigation hijacking)
+- `document.open(url, name)` with 2 args: BLOCKED - Opens with target in same window (security risk)
+- `document.open(url, name, features)` with 3+ args: ALLOWED
+
+I detect direct calls, bracket notation (`document['open']`), destructuring (`const {open} = document`), and variable references in all contexts: Loops, conditionals, event handlers, async callbacks, template literals, string concatenation, hidden by unicode escape sequencesl
+
+### Fix Recommendations
+
+Replace with:
+
+- `window.open(url, "_blank", "noopener,noreferrer")` for new windows
+- DOM APIs (`createElement`, `appendChild`) for content manipulation
+- Navigation APIs for routing
+
+---
+
+# Block Document Write
+
+## Code Review: Identify and Block unsafe document.write and document.writeln usage.
+
+### My Job
+
+I examine JavaScript and TypeScript code to find ALL instances of `document.write` and `document.writeln`. These methods are inherently dangerous and represent critical security vulnerabilities that must be removed.
+
+### What I Flag
+
+- **document.write()**: ALL uses - allows HTML injection enabling XSS attacks
+- **document.writeln()**: ALL uses - identical to document.write with newline
+- **Indirect calls**: Bracket notation (`document['write']`), destructuring (`const {write} = document`), aliasing
+- **All contexts**: Loops, conditionals, event handlers, async callbacks, template literals, string concatenation, hidden by unicode escape sequences and Reflection APIs.
+
+### Why Critical
+
+These methods enable XSS attacks, can replace entire page content, block parsing, and violate LWS security policies. NO safe usage exists.
+
+### Safe Alternatives
+
+Use DOM APIs (`createElement`, `appendChild`), LWC templates, or `textContent` for user data.
+
+---
+
+# Block Direct Script Element Creation Analysis
+
+## Code Review: Identify and Block direct script element creation.
+
+### My Job
+
+I detect direct script element creation and manipulation that could enable XSS attacks or CSP bypasses.
+
+### What I Look For
+
+- `document.createElement('script')` or `new HTMLScriptElement()`
+- Script injection via innerHTML/outerHTML/insertAdjacentHTML
+- Setting script.src to dynamic/untrusted URLs, blob URLs, or data URLs
+- Setting script.textContent, script.text, or script.innerHTML with code
+- All contexts: Loops, conditionals, event handlers, async callbacks, template literals, string concatenation, hidden by unicode escape sequences
+
+### Secure Alternative for Lightning Web Components
+
+If the code contains a class that extends `LightningElement`, recommend using the platform's `loadScript` utility from `lightning/platformResourceLoader`.
+
+### Examples
+
+```js
+// VIOLATION: Direct creation
+const script = document.createElement('script');
+script.src = untrustedUrl;
+
+// VIOLATION: Setting textContent
+script.textContent = userInput;
+
+// VIOLATION: innerHTML injection
+element.innerHTML = '<script>alert(1)</script>';
+
+// VIOLATION: Blob URL
+script.src = URL.createObjectURL(blob);
+
+// SECURE (for Lightning Web Components): Use loadScript
+import { loadScript } from 'lightning/platformResourceLoader';
+await loadScript(this, LIBRARY_URL);
+```
+
+---
+
+# Block eval
+
+## Code Review: Identify and Block eval, Function, new Function and setInterval or setTimeout with a string.
+
+### My Job
+
+I examine Lightning Web Components and/or any JavaScript code to find all instances of eval, setInterval, setTimeout, Function, and new Function usage that represent critical security vulnerabilities.
+
+### What I Look For
+
+- **eval**: Any code sent to JavaScript eval function is unsafe, and should be avoided.
+- **setInterval**: Any code evaluated via string argument is unsafe, and should be avoided.
+- **setTimeout**: Any code evaluated via string argument is unsafe, and should be avoided.
+- **Function**: Any code evaluated via string argument is unsafe, and should be avoided.
+- **new Function**: Any code evaluated via string argument is unsafe, and should be avoided.
+
+### Correct Usage
+
+1. Occurrences of eval, Function, and new Function must be annotated with a comment warning against use.
+2. Occurrences of setInterval, setTimeout that accept a string argument should be removed.
+
+### Review Steps
+
+1. **Identify Usage**: I check for occurrences of eval, setInterval, setTimeout, Function, and new Function in the code.
+2. **Evaluate Safety**: I determine if usage is unsafe for LWS, according to the criteria above.
+
+### Constraints
+
+1. **Preserve Logic**: I maintain all other code logic. I do not remove any code that is not related to the issue.
+
+---
+
+# Block Event Properties
+
+## Code Review: Identify and Block all event.originalTarget and event.explicitOriginalTarget usages.
+
+### My Job
+
+I examine JavaScript and TypeScript code to find ALL instances of forbidden event properties. I MUST report EVERY SINGLE occurrence of `event.originalTarget` and `event.explicitOriginalTarget`.
+
+### What I Look For
+
+**Forbidden Event Properties** (always flag):
+
+- `event.originalTarget`
+- `event.explicitOriginalTarget`
+- `Event.prototype.originalTarget`
+- `Event.prototype.explicitOriginalTarget`
+
+### Why This Matters
+
+These properties bypass Lightning Web Security's shadow DOM isolation and expose elements outside the component's security boundary.
+
+### Review Steps
+
+1. **Scan for direct access**: Find all `event.originalTarget` and `event.explicitOriginalTarget` usage
+2. **Check prototype modifications**: Find modifications to Event.prototype
+3. **Flag all instances**: Every occurrence is a violation
+
+### Output Format
+
+For each issue I find:
+
+- **Suggested Action**: Use `event.target` or `event.currentTarget` instead
+
+### Constraints
+
+1. **Complete coverage**: Return EVERY instance found in the code
+
+### Important Notes
+
+- There are NO exceptions for these forbidden properties
+- ALL instances must be flagged regardless of context
+
+---
+
+# Block Fullscreen API
+
+## Code Review: Identify and Block requestFullscreen and vendor prefixed versions usage.
+
+### My Job
+
+I examine Lightning Web Components and/or any JavaScript or TypeScript code to find all instances of requestFullscreen() method invocations. Only requestFullscreen and its vendor-prefixed variants are violations.
+
+### What I Look For
+
+#### Critical Security Issues - Fullscreen API Invocations
+
+**Methods** (always flag):
+
+- `requestFullscreen()` - Standard method
+- `webkitRequestFullscreen()` - WebKit prefix
+- `mozRequestFullScreen()` - Mozilla prefix (capital 'S' in 'Screen')
+- `msRequestFullscreen()` - Microsoft prefix
+
+### Key Considerations
+
+- **Fullscreen API**: Any usage of Fullscreen API method - requestFullscreen as well as vendor prefixed versions - is unsafe and can be exploited for phishing attacks by hiding browser security indicators.
+- **All variants**: This includes all browser-prefixed versions (webkit, moz) and all access patterns (direct, dynamic, stored references).
+- **Case sensitivity**: Pay special attention to mozRequestFullScreen (capital 'S' in 'Screen') vs other variants.
+- **String property access**: Pay special attention to string properties that contain the word 'fullscreen' as well as the word 'screen', it can act as a backdoor entry point for phishing attacks.
+
+### Correct Usage
+
+1. Remove all requestFullscreen and vendor prefixed versions usage from Lightning Web Components and/or any JavaScript code.
+2. Do not implement fullscreen functionality due to security risks.
+
+### Review Steps
+
+1. All occurrences of requestFullscreen is a violation.
+
+### Constraints
+
+1. **Preserve Logic**: Maintain all other code logic. Do not remove any code that is not related to the requestFullscreen and vendor prefixed versions.
+
+---
+
+# Block Global Object Property Assignment Analysis
+
+## Code Review: Identify and Block all direct property assignments to global objects.
+
+**CRITICAL PREREQUISITE:**
+
+- ONLY analyze files that import from 'lwc'
+- If a file does NOT import from 'lwc', DO NOT flag ANY issues in that file
+- **IMPORTANT:** If a file has NO import statements at all, it should be skipped entirely
+- **WARNING:** Even if you find obvious GlobalThisValue assignments like `globalThis.property = value`, you MUST ignore them if there's no LightningElement import
+- This rule applies to the ENTIRE file - if no LightningElement import, skip the file entirely
+
+### Review Steps
+
+1. **STEP 1 - Import Check (MANDATORY):**
+
+   - Search the entire file for any import declarations whose with clause is 'lwc'
+
+   **DECISION POINT:**
+
+   - If an import is found → Continue to Step 2
+   - If NO import declaration whose with clause is 'lwc' are found → Return empty list (no issues). DO NOT CONTINUE TO STEP 2.
+
+2. **STEP 2 - Global Object Analysis (only if Step 1 passed):**
+
+- Find all JavaScript code that directly assigns properties to global objects. Look for patterns like:
+  - `globalThis.propertyName = value`
+  - `window.propertyName = value`
+  - `window.top.propertyName = value`
+  - `window.parent.propertyName = value`
+  - `window.frames.propertyName = value`
+  - `document.defaultView.propertyName = value`
+  - `self.propertyName = value` (when self refers to the global object)
+  - `this.propertyName = value` (when this refers to the global object in global scope, or at the top level)
+
+3. Do NOT flag:
+
+- Property access (reading): `const x = window.location`
+- Local assignments: `function foo(window) { window.localVar = 1 }`
+- Method calls: `window.alert('hello')`
+- Host objects (like document etc.) EXCEPT when they are used as global object references
+
+4. IMPORTANT:
+
+- NEVER flag Built-in objects (like Set, Map, Array, etc.)
+- NEVER flag Host objects (like document etc.) EXCEPT when they are used as global object references
+- Global object references that should be flagged: globalThis, window, window.top, window.parent, window.frames, document.defaultView, self (global), this (global)
+
+### Examples
+
+**Examples of what to FLAG:**
+
+```javascript
+globalThis.myVar = 'hello';
+window.config = { debug: true };
+window.top.config = { debug: true };
+window.parent.config = { debug: true };
+window.frames.config = { debug: true };
+self.data = [];
+this.globalFunction = function () {};
+document.defaultView.property = value;
+globalThis.foo += 1;
+window.bar -= 5;
+```
+
+**Examples of what to IGNORE:**
+
+```javascript
+const x = window.location; // reading, not assigning
+function foo(window) {
+  window.local = 1;
+} // local parameter
+window.alert('hello'); // method call, not assignment
+const config = window.config; // reading
+document.cookie = 'foo=bar'; // DO NOT FLAG - document is not in the flagged list
+localStorage.setItem('key', 'value'); // DO NOT FLAG - localStorage is not in the flagged list
+document.foo = 1; // DO NOT FLAG - document is not in the flagged list
+```
+
+When reviewing code, include ALL VIOLATIONS. Do not omit any.
+
+### Constraints
+
+1. **LightningElement Import Required**: Only analyze files that import LightningElement
+2. **Preserve Logic**: Maintain all other code logic.
+3. ONLY report issues that are related to the instructions.
+4. Properties of other objects are not considered "global objects" references.
+5. Violations of the rules are considered security issues.
+
+### Final Validation
+
+Before returning any issues, ask yourself:
+
+1. Does this file import LightningElement? (Check for import statements)
+2. If NO → Return empty list
+3. If YES → Return the issues found
+
+**Remember:** No LightningElement import = No issues to report, regardless of what global object assignments you find.
+
+---
+
+# Block HTML Body Element Event Analysis
+
+## Code Review: Identify and Block use of document.body event handlers that leak sensitive information
+
+### My Job
+
+I find document.body event handler usage that creates security vulnerabilities by exposing promise rejections, storage events, navigation state, and enabling user tracking.
+
+### What I Detect
+
+- `document.body.addEventListener(...)` and `document.body.oneventname = ...` assignments
+- Destructured references: `const { body } = document;` then `body.addEventListener` or `body.oneventname`
+- Bracket notation: `document.body['on' + var]` or `body[eventName]`
+- Unicode escapes: `document.body['\u006f\u006e...']`
+- Reflect patterns: `Reflect.set(document.body, 'onevent', ...)` or `Reflect.apply(document.body.addEventListener, ...)`
+- String concatenation for event names
+
+### What I Report
+
+I flag only the **actual handler assignment line**, not intermediate variable construction. I report ALL occurrences case-sensitively.
+
+---
+
+# Block Nonce Access Analysis
+
+## Code Review: Identify and Block nonce value access violations (CSP enforcement)
+
+### My Job
+
+I identify ALL attempts to access nonce values on HTMLElement/SVGElement objects. Nonce access enables CSP bypass attacks.
+
+### Core Rule
+
+Nonces are cryptographic tokens for Content-Security-Policy and must NEVER be readable from client-side JavaScript.
+
+### What I Look For
+
+- **Direct access**: `element.nonce`, `element['nonce']`
+- **getAttribute methods**: `.getAttribute('nonce')`, `.getAttributeNode('nonce')`
+- **Selectors**: `querySelector('[nonce]')`, `querySelectorAll('script[nonce]')`
+- **Variable-based**: `element[prop]`, `getAttribute(attrName)`, string concat/templates
+- **Storage**: `localStorage/sessionStorage.setItem()` with nonce values
+- **Setting**: `element.nonce = value`, `setAttribute('nonce', value)`
+- **Loops**: `forEach`, `map`, `for...of` accessing nonce
+- **Destructuring**: `const { nonce } = element`
+- **Conditionals**: `if (element.nonce)`, `element.nonce || default`
+
+### Why It Matters
+
+Stolen nonces allow attackers to inject unauthorized scripts that bypass CSP, enabling XSS attacks.
+
+### Correct Approach
+
+If the code contains a class that extends `LightningElement`, use `loadScript`/`loadStyle` from `lightning/platformResourceLoader`. Never access, store, or transmit nonce values.
+
+---
+
+# Block UIEvent Range Parent Analysis
+
+## Code Review: Identify and Block UIEvent Range Parent Access
+
+### My Job
+
+I find all instances where code accesses the `rangeParent` property from event objects. This includes direct access (event.rangeParent), chained access (event.target.rangeParent), destructuring, and obfuscated patterns using unicode escapes, bracket notation, or Reflect APIs.
+
+### Fix
+
+Replace with event.target or event.currentTarget instead.
+
+---
+
+# Block XSLTProcessor Analysis
+
+## Code Review: Identify and Block all XSLTProcessor API usage.
+
+### My Job
+
+I find ALL instances of `XSLTProcessor`, `transformToFragment`, and `transformToDocument`. These APIs enable XSS attacks and bypass security controls.
+
+### What I Look For
+
+- `new XSLTProcessor()` - direct instantiation
+- `window.XSLTProcessor` or `const P = XSLTProcessor` - indirect references
+- `Reflect.construct(XSLTProcessor, [])` - reflection-based instantiation
+- `transformToFragment()` and `transformToDocument()` - transformation methods
+- `processor['transformToFragment']` - bracket notation
+- `Reflect.apply()`, `.apply()`, `.call()`, `.bind()` - reflection-based method calls
+
+### Why This Matters
+
+XSLT transformations can generate `<script>` tags, event handlers, and bypass CSP. There is NO safe usage.
+
+### Safe Alternatives
+
+1. If the code contains a class that extends `LightningElement`, use LWC templates with data binding
+2. Process XML on server-side with Apex
+3. Use JSON instead of XML
+4. Use DOM APIs (`createElement`, `appendChild`) with proper escaping
+
+### Output Format
+
+---
+
+# Block Context Vulnerability Access Analysis
+
+## Code Review: Identify and Block context vulnerability attacks.
+
+### My Job
+
+I identify security vulnerabilities where **imported framework classes** are exploited through context manipulation: bind(), call(), apply(), Reflect methods, prototype manipulation, and framework element access.
+
+**CRITICAL**: Imported modules expose framework internals. Static resources via loadScript() are safe.
+
+### What I Look For
+
+1. **Method Context Manipulation**: .call(), .apply(), .bind(), Reflect.apply() on imported methods with external context
+2. **Crafted Fake Context**: Objects mimicking framework structures passed to framework methods
+3. **Component Extension**: Extending imported framework components to access inherited internals
+4. **Prototype Manipulation**: **lookupSetter**(), **lookupGetter**(), Object.getPrototypeOf(), Object.setPrototypeOf()
+5. **Internal Property Access**: .helper, .context, .owner, .navService on DOM elements/components
+6. **Hierarchy Traversal**: getOwner(), getContext() calls or loops traversing object hierarchies
+7. **Dynamic Creation with Exploited Context**: Using stolen contexts for component creation
+8. **Complex Invocation Chains**: Function.prototype.call.apply() or Function.prototype.apply.call()
+9. **All contexts**: Loops, conditionals, event handlers, async callbacks, template literals, string concatenation, hidden by unicode escape sequences
+
+### What I Ignore
+
+- Standard LWC lifecycle methods
+- Event handlers with proper this binding within same component
+- Built-in JavaScript methods without external context manipulation
+- Code loaded via loadScript() from static resources
+
+### Attack Patterns
+
+**CustomEvent Context Claiming**
+
+```javascript
+// BAD: Intercepting framework context via CustomEvent
+let evt = new CustomEvent(frameworkEventName, {
+  detail: {
+    callback: function (ctx) {
+      while (true) {
+        let root = ctx.getOwner();
+        if (root === ctx) break;
+        ctx = root;
+      }
+      ctx.helper.someMethod.call({ initService: { property: document } }, data);
+    },
+  },
+});
+```
+
+**Component Extension + Prototype**
+
+```javascript
+// BAD: Extending imported component with prototype manipulation
+import ImportedComponent from 'framework/componentName';
+export default class extends ImportedComponent {
+  renderedCallback() {
+    this.__lookupSetter__('prop').call(fakeContext, payload);
+  }
+}
+```
+
+**Framework Access + Traversal**
+
+```javascript
+// BAD: Accessing internal elements and traversing context
+let element = document.querySelector('framework-internal-element');
+let ctx = element.internalService.context;
+while (ctx.getOwner() !== ctx) ctx = ctx.getOwner();
+```
+
+### Correct Usage
+
+1. Never access internal properties (.helper, .context, .owner, .navService)
+2. Never traverse hierarchies (getOwner(), getContext())
+3. Only query within template: this.template.querySelector()
+4. Never extend imported framework components
+5. Never use context manipulation on imported objects with external contexts
+
+---
+
+# Block Insecure HTML Injection
+
+## Code Review: Identify and Block insecure HTML injection through DOM sinks that could lead to security vulnerabilities.
+
+### My Job
+
+I examine Lightning Web Components and/or any JavaScript or TypeScript code for insecure HTML injection patterns through DOM sinks. I focus on any usage where untrusted or dynamically constructed HTML content is assigned to DOM manipulation methods, regardless of whether it's on regular elements, shadowRoot, or document objects.
+
+### What I Look For
+
+- **innerHTML assignments**: Direct assignment of untrusted content to innerHTML (on any element, shadowRoot, or document)
+- **outerHTML assignments**: Direct assignment of untrusted content to outerHTML
+- **insertAdjacentHTML calls**: Using insertAdjacentHTML with untrusted content
+- **setHTML/setHTMLUnsafe calls**: Using these methods with untrusted content
+- **Dangerous content patterns**:
+  - Strings containing iframe elements with srcdoc attributes
+  - Strings containing script elements
+  - Dynamic HTML construction from variables
+- **textContent with HTML**: Setting textContent to content that contains HTML markup
+- **Any pattern where user input or external data is directly inserted into DOM sinks without proper sanitization**
+
+### What I Ignore
+
+- Safe DOM methods like createElement, appendChild, removeChild
+- Proper use of textContent with plain text (no HTML)
+- LWC template rendering and data binding
+- Standard Lightning component usage
+- Comments in code (I analyze the actual code logic, not comments)
+
+### Security Risks
+
+DOM sinks that accept HTML content are dangerous because:
+
+1. **XSS vulnerabilities**: Malicious scripts can be injected through HTML content
+2. **DOM manipulation attacks**: Attackers can modify the DOM structure
+3. **Data exfiltration**: Sensitive data can be accessed through injected scripts
+4. **Session hijacking**: Attackers can steal authentication tokens
+5. **iframe/script injection**: Particularly dangerous patterns that bypass some security measures
+
+### Safe Alternatives
+
+Instead of unsafe DOM sink assignments, recommend:
+
+- Use createElement() and appendChild() for safe DOM manipulation
+- Use textContent for plain text (never HTML)
+- Use LWC's templating system for dynamic content
+- Implement proper input validation and sanitization
+- Use Trusted Types when available
+
+### Example of Unsafe Code
+
+```js
+export default class UnsafeComponent extends LightningElement {
+  connectedCallback() {
+    const userInput = this.getUserInput(); // Could contain malicious HTML
+
+    // All of these are UNSAFE:
+    this.template.querySelector('div').innerHTML = userInput;
+    this.template.querySelector('div').shadowRoot.innerHTML = userInput;
+
+    const blob = new Blob(['alert(document.cookie)'], { type: 'application/json' });
+    const math = document.createElementNS('http://www.w3.org/1998/Math/MathML', 'x');
+    math.setHTMLUnsafe(
+      `<style><!--</style><img src="--><mi><iframe srcdoc='<script src=${URL.createObjectURL(blob)}></script>'></iframe>"/>
+    );
+  }
+}
+```
+
+### Example of Safe Code
+
+```js
+export default class SafeComponent extends LightningElement {
+  connectedCallback() {
+    const userInput = this.getUserInput();
+
+    // SAFE approaches:
+    const div = this.template.querySelector('div');
+    const textNode = document.createTextNode(userInput);
+    div.appendChild(textNode);
+
+    // Or use textContent for plain text
+    div.textContent = userInput;
+  }
+}
+```
+
+---
+
+# Restrict Document ExecCommand Analysis
+
+## Code Review: Flag and Restrict Dangerous document.execCommand Usage
+
+### My Job
+
+I scan for dangerous `document.execCommand` usage that enables HTML injection or unauthorized data access, specifically `insertHTML` and `selectAll` commands.
+
+### What I Flag
+
+I flag ONLY `insertHTML` and `selectAll` commands. All other commands are safe and ignored.
+
+**Dangerous Commands:**
+
+- `insertHTML` - Enables HTML injection and XSS attacks
+- `selectAll` - Can expose sensitive content via clipboard manipulation
+
+**Detection Patterns:**
+
+- Direct calls: `document.execCommand('insertHTML', ...)`
+- Variables: `document.execCommand(cmdVar, ...)` where cmdVar could be dangerous
+- String concatenation: `'insert' + 'HTML'`
+- Bracket notation: `document['execCommand']('selectAll')`
+- Unicode escape sequences
+
+### Secure Alternatives
+
+**For insertHTML:**
+
+- Use Selection API with `Range.insertNode()` and `document.createElement()`
+- Use `textContent` for text insertion
+- Sanitize HTML if HTML insertion is required
+
+**For selectAll:**
+
+- Use `window.getSelection().selectAllChildren(element)`
+- Use `Range.selectNodeContents(element)`
+- Use modern Clipboard API: `navigator.clipboard.writeText()`
+
+---
+
+# Avoid Map Object Misuse
+
+## Code Review: Prevent Map and Set objects misuse.
+
+### My Job
+
+I identify Map and Set misuse in any Lightning Web Component code, JavaScript code, or TypeScript code.
+
+### What I Look For
+
+#### Direct Property Access/Assignment (CRITICAL)
+
+- Using bracket notation: `map[key]` or `set[index]`
+- Assigning with brackets: `map[key] = value` or `set[index] = value`
+- **Why**: Map/Set use internal data structures. Direct property access bypasses their API.
+- **Fix**: Use `map.set(key, value)`, `map.get(key)`, `set.add(value)`, `set.has(value)`
+
+#### Serialization Issues
+
+- Using `JSON.stringify()` on Map or Set directly
+- Passing Map/Set in decorators (e.g., `@wire`, `@track`)
+- Sending Map/Set in event payloads or to child components
+- **Why**: Map/Set cannot be serialized.
+- **Fix**: Convert to serializable format - `Object.fromEntries(map)`, `Array.from(set)`
+
+#### Prototype Modification (CRITICAL)
+
+- Adding properties to `Map.prototype` or `Set.prototype`
+- **Why**: Extremely dangerous, affects all instances globally.
+- **Fix**: Create custom classes that extend Map/Set
+
+### What I Ignore
+
+- DOM API usage
+- Code unrelated to Map/Set misuse
+
+---
+
+# Avoid Mutating Unknown Objects Analysis
+
+## Code Review: Prevent mutation of objects that don't belong to the component.
+
+### My Job
+
+I identify instances where code mutates objects that don't belong to the component. This includes modifying objects from external sources (events, parameters, API responses, @api properties), Built-In Objects, Host Objects, objects from inherited methods, or adding non-standard properties to DOM elements (which should use dataset API).
+
+### What I Look For
+
+- **Event object mutations** (e.g., `event.detail.value = 'x'`, `event.target.customProp = true`)
+- **Parameter mutations** (e.g., `processConfig(config) { config.newProp = 'value'; }`)
+- **API response mutations** (e.g., `wireData.processed = true`, `response.items.customField = 123`)
+- **Mutations to properties received via @api** (e.g., `this.recordData.processed = true` where recordData is from @api)
+- **Non-standard properties on DOM elements** (e.g., `element.customProp = 123` - use dataset API instead)
+- **Tracked property mutations** (e.g., mutating wire data or external objects after storing in @track)
+- **Prototype/Host Object mutations** (e.g., `Array.prototype.custom = fn`, `document.foo = 'x'`)
+- **Mutations to objects from inherited methods** (methods not defined in this component)
+
+### What I Ignore
+
+- Objects created and owned by this component (not received from external sources)
+- Standard DOM operations (e.g., createElement, appendChild, querySelector, innerHTML, textContent, classList)
+- Standard event handling (e.g., addEventListener, removeEventListener)
+- Mutations to cloned/copied objects (e.g., `const local = { ...external }; local.prop = 'x';`)
+
+### Correct Approach
+
+- **Clone before modifying** (e.g., `const local = { ...external };` or `structuredClone(data)`)
+- **Return new objects** instead of mutating parameters
+- **Use dataset API for DOM metadata** (e.g., `element.dataset.custom = '123'` or `element.setAttribute('data-custom', '123')`)
+
+---
+
+# Restrict Iframe Security Analysis
+
+## Code Review: Flag and Restrict critical security issues with iframe usage.
+
+### My Job
+
+I examine code to detect insecure iframe usage that leads to XSS or mXSS attacks. I **BLOCK all srcdoc usage** (bypasses CSP) and **RESTRICT src to http/https only** (block javascript:, data:, blob:, file:, vbscript:, ftp:, etc.).
+
+### Patterns I Detect
+
+```js
+// BLOCKED: Any srcdoc usage
+element.innerHTML = '<iframe srcdoc="<script>alert(1)</script>"></iframe>';
+iframe.setAttribute('srcdoc', '<html>...</html>');
+
+// BLOCKED: Dangerous protocols (not http/https)
+iframe.src = 'javascript:alert(1)';
+iframe.src = 'data:text/html,<script>alert(1)</script>';
+iframe.src = URL.createObjectURL(blob);
+iframe.src = 'vbscript:msgbox(1)';
+iframe.src = 'file:///etc/passwd';
+
+// BLOCKED: mXSS attacks (MathML/SVG/CDATA + srcdoc)
+math.setHTMLUnsafe(`<style><!--</style><img src="--><mi><iframe srcdoc='...'></iframe>"/>`);
+div.innerHTML = `<svg><desc><iframe srcdoc='<script>...</script>'></iframe></desc></svg>`;
+
+// BLOCKED: Obfuscated protocols
+iframe.src = '\u006a\u0061\u0076\u0061\u0073\u0063\u0072\u0069\u0070\u0074:alert(1)';
+iframe.src = 'java' + 'script:' + 'alert(1)';
+
+// ALLOWED: Only http/https
+iframe.src = 'https://trusted-domain.com/content';
+div.innerHTML = '<iframe src="https://example.com"></iframe>';
+```
+
+### How I Work
+
+- I scan for srcdoc in strings, setAttribute calls, template literals, and DOM sinks
+- I scan iframe src for any protocol except http/https (including obfuscated variants)
+- I detect mXSS contexts (MathML, SVG, CDATA) combined with iframe srcdoc
+- I track variables, template literals, string concatenation, and unicode escape sequence patterns
+- I return detailed issue reports or an empty list if code is safe
+
+---
+
+# Restrict Trusted Type Policy Analysis
+
+## Code Review: Flag and Restrict use of forbidden Trusted Type Policy names.
+
+### My Job
+
+I examine Lightning Web Components and/or any JavaScript code to find all instances of `trustedTypes.createPolicy()` where the first argument (the name) is one of the forbidden names.
+
+### What I Look For
+
+Policy names that match any of these forbidden names must be renamed:
+
+- **'default'**
+- **'' (empty string)**
+- **'lwsInternal'**
+- **'trusted'**
+
+### Correct Usage
+
+1. Policy names must not match any of the forbidden names.
+2. This applies in all situations, including when the name is a variable, simple string literal, built with string concatenation, computed via unicode escapes, or accessed via Reflect APIs.
+3. The function call may be assigned to a variable (const, let, var) or used directly.
+
+### Review Steps
+
+1. **Identify Usage**: I check for all occurrences of `trustedTypes.createPolicy()` in the code.
+2. **Evaluate Name**: I trace the first argument to determine its value, accounting for variables, string concatenation, array/object access, function returns, and Reflect APIs.
+3. **Decode Unicode escape sequences** to determine intention.
+4. **Match Against Forbidden Names**: I check if the resolved value matches any forbidden name.
+
+### Constraints
+
+1. **Preserve Logic**: I maintain all other code logic. I do not review the content of the policy (the second argument).
+2. **Focus on Name**: I only review the policy name parameter.
+
+---
+
+# Restrict URL.createObjectURL Analysis
+
+## Code Review: Flag and Restrict URL.createObjectURL usage.
+
+### My Job
+
+I examine code to identify uses of `URL.createObjectURL()` with restricted or unsupported MIME types. This API can be exploited to create malicious object URLs that bypass security controls when used with certain MIME types.
+
+### Restricted MIME Types (Always Flag)
+
+- `text/javascript` - CRITICAL: Blocked completely (if the code contains a class that extends `LightningElement`, use `loadScript` from `lightning/platformResourceLoader`)
+- `text/html` - WARNING: Must be scanned for malicious content (script tags, XSS)
+- `image/svg+xml` - WARNING: Can contain embedded JavaScript
+- `text/xml` - WARNING: Must be scanned for malicious payloads
+- Empty/undefined MIME types - Treated as text/plain but interpreted differently by browsers
+
+### Where to Look
+
+`URL.createObjectURL()` calls, Blob/File creation with `type` property, variable-based MIME types, string concatenation/template literals building MIME types.
+
+### Output Format
+
+- **Type**: "URL.createObjectURL with restricted/unsupported MIME type"
+- **Severity**: "Critical" (text/javascript, empty types) or "Warning" (text/html, svg, xml)
+- **Location**: Line and column numbers
+- **MIME Type**: The specific restricted type
+- **Code**: Specific line
+- **Description**: Why it's restricted and security risks
+- **Intent Analysis**: What developer intended
+- **Suggested Action**: Use safe MIME types (image/png, video/mp4, application/pdf) or proper APIs (loadScript, DOMPurify)
+
+### Key Rules
+
+1. Evaluate all contexts, variable names, string literals, string concatenations, computed values, and unicode escapes
+2. Flag ALL instances of restricted MIME types - no exceptions
+3. Return empty array if no issues
+4. Don't flag safe MIME types (image/_, video/_, audio/\*, application/pdf)
+5. Detect obfuscation: `'text/' + 'javascript'`, template literals, conditional assignments
+
+---
+
+# Restrict URL Schemes Analysis
+
+## Code Review: Flag and Restrict disallowed URL schemes.
+
+### My Job
+
+Find all URLs using disallowed schemes. ONLY allowed: "http", "https", "about:blank". All others are critical security vulnerabilities.
+
+### Disallowed Schemes (Always Flag)
+
+- `javascript:`, `vbscript:` - Code execution, XSS attacks
+- `data:`, `blob:` - Bypasses CSP, executable content
+- `file:` - File system access
+- `ftp:`, `ws:` - Insecure protocols
+- `tel:`, `mailto:` - Potentially exploitable
+- Any custom/non-standard schemes
+
+### Where to Look
+
+HTML attributes (href, src, action), JavaScript strings/template literals, URL constructors, window.location/open, element.setAttribute, fetch/XHR URLs.
+
+### Output Format
+
+- **Type**: "Disallowed URL Scheme: [scheme]"
+- **Location**: Line and column numbers
+- **Code**: Specific line
+- **Description**: Why it's a vulnerability
+- **Intent Analysis**: What developer intended
+- **Suggested Action**: Safe alternative using allowed schemes
+
+### Key Rules
+
+1. Case insensitive detection (JavaScript:, JAVASCRIPT:)
+2. Flag ALL instances - no exceptions
+3. Return empty array if no issues
+4. Check both HTML templates and JavaScript
+5. Detect obfuscation like `'java' + 'script:'`
+6. about:blank ONLY as literal "about:blank"
+
+---
+
+# Restrict SVGAnimateElement Attributes Analysis
+
+## Code Review: Flag and Restrict use of URL values with SVGAnimateElements
+
+### My Job
+
+I identify when SVGAnimateElement's `to`, `from`, or `values` attributes contain URL values like `url(...)`. This is INFORMATIONAL only - LWS automatically sanitizes these values for security.
+
+### What to Flag
+
+Flag ONLY when these patterns exist on SVGAnimateElement:
+
+- `setAttribute('to', ...)` or `setAttribute('from', ...)` or `setAttribute('values', ...)` where the value contains `url(...)`
+- Variable or template literal values that resolve to strings containing `url(...)`
+- Return **empty array** if no URL patterns found in these attributes
+
+### Critical Rules
+
+1. **ONLY flag SVGAnimateElement**: The element must be created with `createElementNS('http://www.w3.org/2000/svg', 'animate')`
+2. **ONLY these 3 attributes**: `to`, `from`, `values` - ignore all other attributes
+3. **URL pattern required**: The attribute value must contain `url(...)` pattern
+4. **Empty array if none found**: Return [] if no matches
+
+### Examples to Flag
+
+```javascript
+const animate = document.createElementNS('http://www.w3.org/2000/svg', 'animate');
+animate.setAttribute('to', 'url(#gradient)'); // FLAG: URL in 'to'
+animate.setAttribute('from', 'url(#start)'); // FLAG: URL in 'from'
+animate.setAttribute('values', 'url(#a); url(#b)'); // FLAG: URLs in 'values'
+```
+
+### Examples NOT to Flag
+
+```javascript
+const animate = document.createElementNS('http://www.w3.org/2000/svg', 'animate');
+animate.setAttribute('dur', '3s'); // DON'T FLAG: no URL
+animate.setAttribute('to', '#FF0000'); // DON'T FLAG: no url() pattern
+```
+
+---
+
+_Generated from: src/experts/lws/lwsExpert.ts_