Uploaded image for project: 'Jira Data Center'
  1. Jira Data Center
  2. JRASERVER-36335

Gadgets Window.postMessage listener throws JS error after unexpected message

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • Medium
    • 6.2
    • 6.1.5
    • None

    Description

      I am getting JS errors on the view issue page when I have the Evernote Web Clipper extension installed in Chrome. After some investigation here is what I have determined:

      There is this code in Gadgets (no idea why it's on the view issue page, but I digress):

          function setupChannel() {
              if (relayChannel === "dpm" || relayChannel === "wpm") {
                  window.addEventListener("message", function(packet) {
                      process(gadgets.json.parse(packet.data))
                  }, false)
              }
          }
      

      That is setting up an event listener for Window.postMessage events, presumably for communication between iframes. The problem is that it is assuming too much about what messages will be posted (this is a shared message bus, after all) and erroring out if the message looks different from what it expects.

      In this case the Evernote Web Clipper is also using Window.postMessage but obviously its messages are not intended to be processed by Gadgets.

      The gadgets code needs to be made robust:

      • check the packet.origin or something to filter out messages it does not expect, and
      • wrap a try/catch around the packet.data parsing.

      Obviously this can happen for other browsers and other extensions too.

      Attachments

        1. gadgets js error.png
          gadgets js error.png
          25 kB
        2. stack trace.png
          stack trace.png
          56 kB

        Issue Links

          Activity

            People

              rtekhov Roman Tekhov (Inactive)
              lmiranda Luis Miranda (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: