0

According to Salesforce's documentation, the distorted behavior of Document.prototype.execCommand is described as:

When an HTML document has been switched to designMode, its document object exposes an execCommand() method to run commands that manipulate the current editable region, such as form inputs or contentEditable elements.

The insertHTML command inserts new elements on the currently active editable element.

Lightning Web Security runs in the main window, where the , and elements are shared. If malicious code can insert any specified text as HTML into the DOM tree, even outside of the shared and elements, it can pollute the DOM. For this reason, any elements added to this shared DOM are sanitized to strip out malicious code.

Distorted Behavior

This distortion sanitizes the inserted HTML string.

Seems like there is a copy/paste error in their documentation.

Does anyone know what the actual distorted behavior is for Document.prototype.execCommand?

1 Answer 1

2

It does exactly what it says it does. It captures an execCommand call, checks if the first parameter is insertHTML, and if so, sanitizes the input using the LWS HTML sanitation function. After that, the real function is called using the first parameter, and the real or sanitized second parameter, if any. This is the same function that's called to make sure templates and other code can't execute direct scripts that may be outside of the LWS sandbox.

2
  • 1
    Ah, I missed that insertHTML is a valid parameter because when I looked at it (after being deep in LWS distortions all week), I saw innerHTML instead of insertHTML. I also assume you meant to type insertHTML instead of innerHTML as well. :) Jul 14, 2023 at 17:06
  • 1
    @SwisherSweet haha, I did. Muscle memory and all that.
    – sfdcfox
    Jul 14, 2023 at 17:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .