Visiting MDN pages throws a Javascript SecurityException when session storage is disabled

[Richard-Mlynarik]

Summary

Visiting MDN pages throws a Javascript SecurityException when session storage is disabled.

You're missing some try/catch action around typeof window.sessionStorage !== "undefined" in some extraneous "gleaning" boat anchor code.

(I bet this happens in other places, too, but this is the one that blows out first.)

URL

https://developer.mozilla.org/en-US/docs/Web/CSS/white-space

Reproduction steps

1. Block cookies. OF COURSE. (Or block local storage alone, but Firefox seems to have bugs with doing that without blocking cookies as well.)
2. Enable browser Javascript "Web Developer Tools" (I use either Firefox or Safari, same outcome.)
3. "Pause on exceptions" (the default, I believe)
4. Visit any MDN Web/CSS page
5. Javascript throws an uncaught exception

Expected behavior

This is a minor issue, but I pretty much only visit MDN pages when I'm also using "Web Developer Tools"
and every time I do so in the same open tab I get an exception blow up while loading a "simple" (hahaha) page of documentation.

It would be nice if you caught all JS errors, especially in and around junk code dealing with state, telemetry, syncing, tracking and god only knows what else.

What the hell do you need to "glean" anyway? Just deliver the documentation. YOU HAD ONE JOB.

Actual behavior

Paused on exception
SecurityError: The operation is insecure.

Deep down inside @mozilla/glean / dist / core / glean / sync.js (Syncing WTF? I'm reading a single page of documentation, not jacking into cyberspace!)

Device

Desktop

Browser

Firefox

Browser version

Stable

Operating system

Mac OS

Screenshot

Anything else?

Javascript browser console log:

GEThttps://developer.mozilla.org/en-US/docs/Web/CSS/white-space#in_action
[HTTP/2 200 OK 328ms]

Cookie “” has been rejected by user set permissions. 2 white-space
Unable to read theme from localStorage DOMException: The operation is insecure. white-space:1:394
Request to access cookies or storage on “https://developer.mozilla.org/en-US/docs/Web/CSS/white-space#in_action” was blocked because of custom cookie permission.

GEThttps://developer.mozilla.org/static/js/ga.js
[HTTP/2 304 Not Modified 33ms]

Cookie “” has been rejected by user set permissions. ga.js
Cookie “” has been rejected by user set permissions. main.70c8cb70.js
GEThttps://developer.mozilla.org/static/js/main.70c8cb70.js
[HTTP/2 200 OK 0ms]

Cookie “” has been rejected as third-party. white-space.html
Cookie “” has been rejected as third-party. runner.html
GEThttps://interactive-examples.mdn.mozilla.net/pages/css/white-space.html
[HTTP/2 200 OK 293ms]

GEThttps://live.mdnplay.dev/en-US/docs/Web/CSS/white-space/runner.html?id=in_action
[HTTP/2 200 OK 196ms]

Clear-Site-Data header forced the clean up of “cookies” data. runner.html
Clear-Site-Data header forced the clean up of “storage” data. runner.html
Cookie “” has been rejected as third-party. runner.html
Content Security Policy: Ignoring ‘unsafe-eval’ or ‘wasm-unsafe-eval’ inside “script-src-elem”. runner.html
Cookie “” has been rejected as third-party. white-space.html
Cookie “” has been rejected by user set permissions. apple-touch-icon.6803c6f0.png
Cookie “” has been rejected by user set permissions. favicon-48x48.cbbd161b.png
Request to access cookie or storage on “https://live.mdnplay.dev/en-US/docs/Web/CSS/white-space/runner.html?id=in_action” was blocked because we are blocking all third-party storage access requests and content blocking is enabled.

Cookie “” has been rejected as third-party. codemirror.js
Cookie “” has been rejected as third-party. editor-css.js
Request to access cookie or storage on “https://interactive-examples.mdn.mozilla.net/pages/css/white-space.html” was blocked because we are blocking all third-party storage access requests and content blocking is enabled.

GEThttps://developer.mozilla.org/apple-touch-icon.6803c6f0.png
[HTTP/2 200 OK 0ms]

GEThttps://developer.mozilla.org/favicon-48x48.cbbd161b.png
[HTTP/2 200 OK 0ms]

GEThttps://interactive-examples.mdn.mozilla.net/js/codemirror.js?v=4a8a7c8
[HTTP/2 200 OK 0ms]

GEThttps://interactive-examples.mdn.mozilla.net/js/editor-css.js?v=4a8a7c8
[HTTP/2 200 OK 0ms]

Unable to read action-counts from localStorage DOMException: The operation is insecure. codemirror.js:2:452991
Unable to read theme from localStorage DOMException: The operation is insecure. codemirror.js:2:452991
GEThttps://developer.mozilla.org/static/media/chevron.05a124d379047e16d746.svg
Cookie “” has been rejected by user set permissions. menu.1ed93cf1ba8c04627c11.svg
GEThttps://developer.mozilla.org/static/media/menu.1ed93cf1ba8c04627c11.svg
[HTTP/2 200 OK 160ms]

Scroll anchoring was disabled in a scroll container because of too many consecutive adjustments (10) with too little total distance (2.8 px average, 28 px total). white-space
InstallTrigger is deprecated and will be removed in the future. sync.js:228:70
onmozfullscreenchange is deprecated. sync.js:228:70
onmozfullscreenerror is deprecated. sync.js:228:70

Validations

• I have read the Community Participation Guidelines.
• I have verified that there isn't already an issue that reports the same bug to avoid creating a duplicate.
• I have checked that this is a concrete bug. For Q&A open a GitHub Discussion.

[caugner]

It looks like this was fixed upstream in Glean.js 5.0.5, see:

• Bug 1943952 - update uses of sessionStorage and localStorage in core to be wrapped in a try/catch mozilla/glean.js#1993
• https://bugzilla.mozilla.org/show_bug.cgi?id=1943952

But as for ourselves, in Fred, we access sessionStorage twice without wrapping:

https://github.com/search?q=repo%3Amdn%2Ffred%20%2FsessionStorage%2F&type=code

So we should probably fix this, and ideally find a way to lint this.