Skip to content

The stack trace of a SecurityError is not reported #3119

@WesselKroos

Description

@WesselKroos

Package + Version

  • @sentry/browser
  • @sentry/node
  • raven-js
  • raven-node (raven for node)
  • other:

Version:

5.29.0

Description

A DOMException with the name SecurityError contains a stack in Chromium. This stack is not reported to Sentry.

Example of the exception:

DOMException:
  code: 18
  message: "Failed to execute 'getImageData' on 'OffscreenCanvasRenderingContext2D': The canvas has been tainted by cross- 
  origin data."
  name: "SecurityError"
  stack: "Error: Failed to execute 'getImageData' on 'OffscreenCanvasRenderingContext2D': The canvas has been tainted by cross-origin data.↵    at Extension.function3 (/scripts.js:5825:51)↵    at Extension.function2  (/scripts.js:4328:18)↵    at Extension.function1 (/scripts.js:4290:18)"

Debugging info

While debugging the script of @sentry/browser I noticed the following code prevents the stack trace from being included in the event:

function eventFromUnknownInput(exception, syntheticException, options) {
  ...
  f (isErrorEvent(exception) && exception.error) { // isErrorEvent = false && exception.error = undefined
    ... // In this case the stack trace would be attached to the event
  }
  if (isDOMError(exception) || isDOMException(exception)) { // isDOMError = false || isDOMException = true
    ...
    return event; // This event is returned. And in this case the stack trace is NOT attached to the event
  }
}

How to reproduce

  1. Create a video element with a src attribute that contains a url from another domain than the current webpage.
  2. Draw the video to a canvas element via the drawImage function.
  3. Execute the getImageData function on that canvas

Metadata

Metadata

Assignees

No one assigned

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions