BlacklistUrls does not work in iOS9 Mobile Safari

[hokaccha]

• Review the documentation: https://docs.sentry.io/
• Search for existing issues: https://github.com/getsentry/sentry-javascript/issues
• Use the latest release: https://github.com/getsentry/sentry-javascript/releases

Package + Version

• @sentry/browser
• @sentry/node
• raven-js
• raven-node (raven for node)
• other:

Version:

4.4.2

Description

BlacklistUrls does not work in the edge case of iOS9 Mobile Safari.

source code: https://github.com/hokaccha/sentry-js-example/tree/master/ios9
demo: https://hokaccha.github.io/sentry-js-example/ios9/index.html

An error occurs within the event handler listening to the parent window inside an iframe. Since blacklistUrls is specified, most browsers do not send an error, but iOS9 Mobile Safari sends an error.

It seems that the checking target URL is [native code] in iOS 9.

iOS 9

iOS 10

[HazAT]

Thank you for this nice bug report and repro case :)

@kamilogorek Maybe we should check if the topmost frame is [native code] and skip to the next if that's the case.

[pinkasey]

I think I might be affected by this issue too (or similar) -
I have Facebook's crawlers visiting my site frequently
(see aFarkas/lazysizes#520),
and they usually use Mobile Safari:

I've tried to block urls that contain fbclib - and I still get this warning.
When I visit the url from my chrome browser, I don't get sentry warnings, but when the bots do - I get warnings.

I have a workaround -
Not initiating Sentry at all in case of fbclib in the url.

[kamilogorek]

@pinkasey can you provide a link to at least one event that came through to your sentry account? And show how your config looks like?

[pinkasey]

@kamilogorek
I can't link to an event in our private sentry account (how do I do that without giving you access to my account?),
But I'd like to share any information you may need.

Here's an example url in which it happens:
https://animals-now.org/en/live-transports/?fbclid=IwAR32icdD8Ai5Pooy9C8PaK9F8Qzp9ZWS8X4KHk4Bi5ZJov55Lr38_niQ2CQ

Few notes:

• the important part is the fbclid - facebook crawlers add it. The same issue happens in other pages that are visited with query-param fbclid
• It doesn't reproduce when I visit it - only the facebook crawlers cause an error, and only facebook crawlers still report the error via sentry, even though it should be excluded by blacklistURLs
• I suspect it's something to do with the headless iphone-emulator that FB uses to scan sites

URL for a specific event:
(I don't think you can access it, i put it here so I can go back to it if you need more info):
https://sentry.io/organizations/animalsnow/issues/1708326014/events/c6e5fc6dded445ce8853cc4c1eb6098d/?environment=unspecified&project=1403939

Some info from this specific event:
browser
Mobile Safari 11.0

device
iPhone

mechanism
onerror

os
iOS 11.4.1

release
1.0

url
https://animals-now.org/issues/fur/

user
ip:31.13.115.119

TypeError: Illegal invocation
mechanism: onerror
handled: no

HTMLDocument.document.createEvent at line 1:40898

[kamilogorek]

@pinkasey the regexp that you use in the configuration seems incorrect (it has to use JS regexp syntax).

Right now it says "blacklistUrls":["regex:[?&]fbclid=[a-zA-Z0-9_\\-]{10,62}"], where the correct syntax is "blacklistUrls":[/fbclid=[a-zA-Z0-9_-]{10,62}/] (the & check is unnecessary anyway).

However, I'm not sure if the query string will be included in the frame we extract from the stacktrace to filter the errors.

If this won't work, you can do a more "bullet-proof" solution:

Sentry.init({
  beforeSend: function (event) {
    // Drop all events if query string includes `fbclid` string
    if (location.search.indexOf('fbclid') !== -1) return null;
    // Otherwise just let it though
    return event;
  }
});

This will definitely solve the issue :)

[pinkasey]

@kamilogorek
Thanks!

I'm using
https://github.com/stayallive/wp-sentry
to include sentry in my Wordpress-site, and I followed his example with the regex - and it works.
I was surprized too.
How do I know it works -

• I visited a page in my site with fbclid query-param
• injected this button:
  <button class="fl-button-text" onclick="doEyalError('Eyal Error')">error</button>
• pressed the button - there was no call to sentry.
• Did the same with no fbclid param - I got a sentry error.

Thanks for your suggestion,
I've used wp-sentry's wp_sentry_hook to completely avoid initing Sentry when I find fbclib, If that doesn't work I'll try your suggestion.

Out of curiosity -

(the & check is unnecessary anyway)

Why is that?

[kamilogorek]

and it works

To be 100% sure it actually triggers Sentry filtering mechanism, you can add debug: true to the configuration, and it should tell you something like:

Event dropped due to being matched by the pattern: xyz

Why is that?

Because = is not a valid hostname character, so the only place where it can exist is already the query parameter. But it's just a nitpick :)

[pinkasey]

Because = is not a valid hostname character

That's some mind-blowing pro thinking there 😉 I didn't think of that.
I wanted to be sure its fbclid= and not XYZfbclid=, which, I don't mind monitoring for errors...
Thanks :)

[kamilogorek]

Closing the issue, as it seems like the original issue has been partially resolved or there is a working solution. I'd prefer someone to create a new issue with a fresh description if it's still an issue.
Please do not hesitate to ping me if it is still relevant, and I will happily reopen and work on it.
Cheers!