topic Re: Meetings embed widget script causing an error by accessing iframe's document in Marketing Integrations

Meetings embed widget script causing an error by accessing iframe's document

DKowalczyk — Tue, 16 Apr 2024 09:48:31 GMT

The script `https://static.hsappstatic.net/MeetingsEmbed/ex/MeetingsEmbedCode.js` responsible for embedding the Meetings widget iframe is causing the following error:

`Uncaught DOMException: Failed to read a named property 'document' from 'Window': Blocked a frame with origin "xxx" from accessing a cross-origin frame.
https://static.hsappstatic.net/MeetingsEmbed/ex/MeetingsEmbedCode.js:1:3022`

Were there any recent changes done to this script? Can I expect it to be fixed?

Re: Meetings embed widget script causing an error by accessing iframe's document

PamCotton — Tue, 16 Apr 2024 21:33:52 GMT

Hey @DKowalczyk, thank you for posting in our Community!

Do you have any additional information or specific details about when this issue started occurring, it would be helpful for our investigation. Also, if you have any urgent meetings or tasks affected by this, please let us know so that we can explore alternative solutions or workarounds.

The more information, screenshots, and details you can provide, the better I can advise on the next steps.

Thank you,

Pam

Re: Meetings embed widget script causing an error by accessing iframe's document

DKowalczyk — Wed, 17 Apr 2024 07:09:57 GMT

The issue seems to be in the attempt to add a meta HTML tag to the iframe's document with robots, noindex

Re: Meetings embed widget script causing an error by accessing iframe's document

vargasp — Thu, 18 Apr 2024 06:56:08 GMT

I'm having the same issue. One detail, it started to fail because my CSP was blocking a reference to

https://js-agent.newrelic.com/

After adding that domain to my script-src CSP, then I have the 'Uncaught DOMException: Failed to read a named property 'document' from 'Window'...' error, so it may be related.

This is how I inject the embedded widget in Angular:

ngOnInit(): void {
  const myScriptElement = document.createElement('script');
  myScriptElement.src =
    'https://static.hsappstatic.net/MeetingsEmbed/ex/MeetingsEmbedCode.js';
  document.body.appendChild(myScriptElement);
}

Re: Meetings embed widget script causing an error by accessing iframe's document

vargasp — Thu, 18 Apr 2024 08:21:05 GMT

My guess is that your MeetingsEmbedCode.js started using the New Relic agent at some point, which is introducing the referer domain (my web site) into a vulnerable context.

Fortunatelly, modern browsers are able to deal with this situation...

Re: Meetings embed widget script causing an error by accessing iframe's document

DKowalczyk — Fri, 19 Apr 2024 07:37:37 GMT

Hi guys,

Following up on this. It seems to be a bug introduced in the newest version of MeetingsEmbedCode.js - can you please advise?

Thanks!

Re: Meetings embed widget script causing an error by accessing iframe's document

alettieri — Fri, 19 Apr 2024 19:27:50 GMT

We're also experiencing this issue. According to our sentry logs, April 16th, 2024 was the first time we encountered this error.

It's looking like the embed code is accessing the `contentWindow`, document object. This is something that's generally only allowed if the contentWindow or iFrame is on the same origin. https://developer.mozilla.org/en-US/docs/Web/API/HTMLIFrameElement/contentWindow

Here is the code:

    c.addEventListener("load", function () {
          const t = document.createElement("meta");
          t.name = "robots";
          t.content = "noindex";
          c.contentWindow.document.head.appendChild(t);
    });

Re: Meetings embed widget script causing an error by accessing iframe's document

KKulkarni3 — Tue, 23 Apr 2024 00:33:45 GMT

Is there any development on this?

Facing same issue. This is how the code is embed in React.

<> <Helmet> <script type="text/javascript" src={HUBSPOT_MEETING_SCRIPT_URL}></script> </Helmet> <div className="meetings-iframe-container" data-src={__HUBSPOT_MEETING_CALENDAR_URL__}></div> </>

We also encountered this error for the first time on Sentry on April 16th, 2024

Re: Meetings embed widget script causing an error by accessing iframe's document

DKowalczyk — Wed, 24 Apr 2024 07:51:21 GMT

@PamCotton - just letting you know the community discovered an issue in your production script that haven't been addressed anyhow.

Re: Meetings embed widget script causing an error by accessing iframe's document

DecisioHealth — Fri, 07 Jun 2024 15:25:08 GMT

Having a similar issue, the iFrame does not load until there is mouse movement on the page. The script is

<div class="meetings-iframe-container" data-src="https://meetings.hubspot.com/user-profile/schedule-a-call?embed=true"></div>
<script type="text/javascript" src="https://static.hsappstatic.net/MeetingsEmbed/ex/MeetingsEmbedCode.js"></script>