Bug: node.getAttribute Call Can Error in Firefox

[joealden]

I've recently been encountering crashes in Firefox after installing a new browser extension. The error is:

Uncaught Error: Permission denied to access property "getAttribute"

I've narrowed in down to this line:

aria-hidden/src/index.ts

Line 86 in 9220c8f

const attr = node.getAttribute(controlAttribute);

From some research, I found bitwarden/clients#7837, which seems to indicate that Firefox throws an errors when trying to access attributes within certain elements in a browser extension content script.

Would you be willing to handle this edge case? I'm thinking maybe just wrap what's in the else block with a try/catch?

@theKashey let me know if this should be filed in another repo (I'm using it via react-focus-on), but I believe the solution is needed here (as this is where the stack trace points to).

[theKashey]

👋 @joealden - what is the expected behavior?
I can add error suppression here with no problems, the question is more about how script is getting to the node causing problem.

As I understand - you are not "the extension", and it's more like that said extension is adding an extra markup you cannot access, which is quite strange.

In short - let's make this solution a little more resilient, but also we need to understand the origins of the problem.

[joealden]

Looking into this a bit more, I think this might kinda be a Firefox bug, or at least a problem with their implementation of WebExtensions in combination with other web features (maybe a "wont fix" scenario).

I can't find any proper documentation, but this commit provides some useful context + links to bugzilla reports: ProtonMail/WebClients@0bc8722

Looks like it is specific to web component registration within a content script that creates these "restricted" elements. I think the PR you have up is the best we'll be able to do unfortunately!

[joealden]

As I understand - you are not "the extension", and it's more like that said extension is adding an extra markup you cannot access, which is quite strange.

Correct - it's that if any user of a site that uses aria-hidden (either directly or by proxy) has an extension installed that is registering web components in a content script, this error will be thrown.

So I think the expected behaviour would be to just ignore the elements we aren't allowed to touch.

[theKashey]

A little strange, but even more weird things happens around

[theKashey]

[email protected] released with the fix