Failed to read the 'contentDocument' property on older browsers => broken page

[jlowcs]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which SDK are you using?

@sentry/react

SDK Version

8.36.0

Framework Version

react 18.3.1

Link to Sentry event

https://changeorg.sentry.io/issues/6048039184/events/9fa3cc0ed21f4efab1dd24971ce140b0/

Reproduction Example/SDK Setup

No response

Steps to Reproduce

Hard to say.

We are noticing some Failed to read the 'contentDocument' property from 'HTMLIFrameElement': Blocked a frame with origin "..." errors coming from older browsers. This results in a broken page for us.

My guess is that those older browsers are throwing a SecurityError instead of returning null when accessing a iframe.contentDocument on an iframe that is hiding its content to Sentry (in this case a Stripe iframe).

This specific error is coming from this line, but there might be other instances of this accessor within the Sentry code.

Expected Result

Sentry should catch that error instead of letting it bubble.

Something like this:

function getIframeContentDocument(n) {
  try {
    return n.contentDocument;
  } catch (e) {
    return null;
  }
}

const iframeDoc = getIframeContentDocument(n)

Actual Result

Error is thrown and is breaking the page.

[mydea]

@billyvg / @chargome sounds reasonable to me to guard this in rrweb, what do you think? I checked and we do not use this in sentry-javascript itself, so try-catching this in rrweb sounds OK to me?

[chargome]

Yep catching sounds good to me here, I'll open up a pr today

[jlowcs]

The error is still showing up on 8.40.0. Looking at the source of it, it seems to be coming from https://github.com/getsentry/rrweb. Maybe rrweb was not bumped within sentry-javascript?

[billyvg]

@jlowcs Yeah it hasn't been bumped yet, will let you know when we do

[billyvg]

@jlowcs This should be released now in 8.43.0