Skip to content

fix(rrweb): Guard cross-origin Element read in ShadowDomManager.obs… - #322

Merged
s1gr1d merged 2 commits into
sentry-v2from
sig/unguarded-cross-origin
Sep 2, 2026
Merged

fix(rrweb): Guard cross-origin Element read in ShadowDomManager.obs…#322
s1gr1d merged 2 commits into
sentry-v2from
sig/unguarded-cross-origin

Conversation

@s1gr1d

@s1gr1d s1gr1d commented Sep 2, 2026

Copy link
Copy Markdown
Member

Closes #321

For a cross-origin iframe, contentWindow does not throw — the browser returns a truthy restricted proxy. So the !iframeWindow guard in observeAttachShadow passes, and the bare iframeWindow.Element read is the first real cross-origin access. It throws a SecurityError, or yields undefined and patchAttachShadow then throws a TypeError on element.prototype. Both escape into the host page's window.onerror.

Fixed by reading Element inside try/catch and bailing out when it is
unreachable, since replay cannot observe a frame the browser blocks.

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need this file? 🤔

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

l: we can likely delete this

@s1gr1d
s1gr1d merged commit 5275948 into sentry-v2 Sep 2, 2026
22 checks passed
@s1gr1d
s1gr1d deleted the sig/unguarded-cross-origin branch September 2, 2026 12:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Replay: unguarded cross-origin read in ShadowDomManager.observeAttachShadow throws into the host page

2 participants