What is the LWS distorted behavior of Document.prototype.execCommand?

Question

According to Salesforce's documentation, the distorted behavior of Document.prototype.execCommand is described as:

When an HTML document has been switched to designMode, its document object exposes an execCommand() method to run commands that manipulate the current editable region, such as form inputs or contentEditable elements.

The insertHTML command inserts new elements on the currently active editable element.

Lightning Web Security runs in the main window, where the , and elements are shared. If malicious code can insert any specified text as HTML into the DOM tree, even outside of the shared and elements, it can pollute the DOM. For this reason, any elements added to this shared DOM are sanitized to strip out malicious code.

Distorted Behavior

This distortion sanitizes the inserted HTML string.

Seems like there is a copy/paste error in their documentation.

Does anyone know what the actual distorted behavior is for Document.prototype.execCommand?

Answer 1

It does exactly what it says it does. It captures an execCommand call, checks if the first parameter is insertHTML, and if so, sanitizes the input using the LWS HTML sanitation function. After that, the real function is called using the first parameter, and the real or sanitized second parameter, if any. This is the same function that's called to make sure templates and other code can't execute direct scripts that may be outside of the LWS sandbox.