Session replay: observeAttachShadow throws SecurityError on cross-origin iframes (unguarded contentWindow.Element) #5148

Activity

1. github-actions commented on Sep 29, 2026

   

   github-actionsBot

   on Sep 29, 2026 – with GitHub Actions

   Last edited by github-actions

   Contributor

   More actions

   AI triage for #5148

   Conclusion: Confirmed session-replay recorder bug: a cross-origin navigation can leave observeAttachShadow reading contentWindow.Element without the existing SecurityError containment.
   Confidence: 97%
   Suggested labels: feature/replay, javascript, needs-to-be-contributed-back, bug

   Thanks — confirmed from the current recorder source.

   ShadowDomManager.observeAttachShadow() checks contentWindow and contentDocument, then accesses contentWindow.Element outside a SecurityError guard. Both full-snapshot and mutation iframe-load callbacks invoke it immediately after IframeManager.attachIframe().

   The proposed blocked-iframe change is also warranted: serializeNodeWithId() stops serializing a blocked iframe's children via needBlock, but still unconditionally registers onceIframeLoaded. A later load callback can therefore still enter iframe serialization and shadow setup for an iframe selected by blockSelector.

   A minimal fix should preserve existing failure semantics by suppressing only DOMException SecurityErrors (as callSafely already does), while continuing to surface unrelated exceptions. Since this is a generic rrweb iframe-access issue in the vendored fork, it should also be considered for an upstream rrweb contribution.

   Investigation

   • observeAttachShadow() directly evaluates iframeElement.contentWindow.Element after truthiness checks; a cross-origin WindowProxy permits obtaining contentWindow but throws SecurityError when its named Element property is read.
   • The full-snapshot callback in record/index.ts and mutation callback in record/mutation.ts both call shadowDomManager.observeAttachShadow(iframe) after attaching an iframe.
   • IframeManager.attachIframe() already uses callSafely() around cross-origin window event-listener access. callSafely() specifically consumes DOMException errors named SecurityError and rethrows all other errors, which is the appropriate existing behavior to reuse.
   • In serializeNodeWithId(), needBlock prevents ordinary child traversal, but iframe handling occurs later and unconditionally calls onceIframeLoaded(). Thus a block-selected iframe still receives a deferred load listener.
   • Current tests cover same-origin iframe shadow-DOM observation and several iframe SecurityError cases in IframeManager, but do not cover a SecurityError thrown when observeAttachShadow() reads contentWindow.Element, nor listener omission for a blocked iframe.
   • Replay incident review: this changes recorder code delivered through the lazy recorder path, but it introduces no core/extension API, persisted-state, or signature dependency and should not affect recording volume. The main remaining risk is fleet-wide recorder behavior, so regression coverage should be included.

   Relevant files: packages/rrweb/rrweb/src/record/shadow-dom-manager.ts, packages/rrweb/rrweb/src/record/index.ts, packages/rrweb/rrweb/src/record/mutation.ts, packages/rrweb/rrweb/src/record/iframe-manager.ts, packages/rrweb/rrweb/src/utils.ts, packages/rrweb/rrweb-snapshot/src/snapshot.ts, packages/rrweb/rrweb/test/record/shadow-dom-manager.test.ts, packages/rrweb/rrweb-snapshot/test/snapshot.test.ts, .agents/skills/replay-incident-risk/INCIDENTS.md

   Fix assessment

   • Straightforward: no
   • Risk: medium
   • Reason: The defect is localized to one unguarded cross-origin WindowProxy access, with a reusable helper that retains non-SecurityError failures. Avoiding deferred iframe listeners for needBlock is likewise a narrow serializer change consistent with blocked-element behavior.
   • Suggested approach: Wrap the complete cross-origin access path in ShadowDomManager.observeAttachShadow() with the existing callSafely() helper. In serializeNodeWithId(), retain the iframe's needBlock state long enough to skip onceIframeLoaded() and onIframeListenerRegistered for blocked iframes. Add focused regression tests: one supplying an iframe whose contentWindow.Element getter throws DOMException('SecurityError'), and one asserting a block-selected iframe does not register a load listener. If practical, extend the existing real-browser cross-origin iframe coverage to assert no page error during an iframe navigation.

   Pi session

   The resumable JSONL pi session for this run was saved to a private gist: https://gist.github.com/marandaneto/2fdc6a854e210938b4d2a35b14c29d88

   Download it locally, then fork it into your own pi session:

   pi --fork path/to/session.jsonl

   Saved session:

   • call-1-1-2026-09-29T18-04-16-628Z_01a0ee56-bb74-768d-9af6-eca0eee90d3a.jsonl

   Close proposal

   None. No issue close action was taken.

   ---

   Generated by posthog-watcher-action using pi.
2. github-actions

   added

   bugSomething isn't workingSomething isn't working

   feature/replay

   javascriptPull requests that update javascript codePull requests that update javascript code

   needs-to-be-contributed-backrrweb fork change that should be contributed back to upstream rrweb-io/rrwebrrweb fork change that should be contributed back to upstream rrweb-io/rrweb

   on Sep 29, 2026
3. deepanshupal commented on Sep 29, 2026

   

   deepanshupal

   on Sep 29, 2026

   Contributor

   More actions

   I can handle the recorder exception with a narrow guard around observeAttachShadow and tests for cross-origin SecurityError, unrelated errors, and same-origin behavior. I won't change blocked-iframe listener registration in this patch. I noticed PostHog/posthog-rrweb is archived; where would you like the matching rrweb fix contributed?
4. dustinbyrne commented on Sep 29, 2026

   

   dustinbyrne

   on Sep 29, 2026

   Last edited by dustinbyrne

   Contributor

   More actions

   thanks @deepanshupal - we'll take a look shortly!

   where would you like the matching rrweb fix contributed

   changes can be made to the rrweb package in this repository, and updates ship via posthog-js when creating a changeset 🙌
5. dustinbyrne

   closed this as completedin #5150on Oct 3, 2026