Skip to content

fix(react): handle restricted localStorage and quota errors in draft storage - #1396

Open
Diwaspant132 wants to merge 2 commits into
RocketChat:developfrom
Diwaspant132:fix/draft-storage-iframe-safety
Open

Diwaspant132 wants to merge 2 commits into
RocketChat:developfrom
Diwaspant132:fix/draft-storage-iframe-safety

Conversation

@Diwaspant132

Copy link
Copy Markdown

fix(react): handle restricted localStorage and quota errors in draft storage

Acceptance Criteria fulfillment

  • Protect draftMessage.js against SecurityError in cross-origin iframes with 3rd-party storage blocked
  • Implement in-memory fallback store so drafts persist during the session when localStorage is unavailable
  • Guard localStorage.setItem against DOMException QuotaExceededError
  • Guard RCInstance.getHost() with optional chaining in ChatInput.js
  • Add comprehensive unit test suite in draftMessage.test.mjs (7 tests passing)

Description

When EmbeddedChat is embedded inside an iframe on third-party sites, modern browsers (Safari, Chrome with partitioned cookies, Brave) restrict access to window.localStorage, throwing an unhandled SecurityError: Access is denied for this document. Additionally, private browsing mode or storage quotas throw QuotaExceededError on setItem.

This patch:

  1. Wraps storage access in defensive try...catch blocks to prevent unhandled runtime crashes in restricted iframes.
  2. Introduces a transparent in-memory fallback to preserve composer drafts across room switching during the active user session when persistent storage is blocked.
  3. Safely guards RCInstance?.getHost?.() || '' in ChatInput.js to avoid TypeError when RCInstance is unmounted.
  4. Adds a unit test suite in packages/react/src/lib/draftMessage.test.mjs (7 unit tests covering basic operations, room/thread/user/host scoping, whitespace handling, iframe SecurityError fallback, QuotaExceededError, and SSR).

PR Test Details

Run unit tests:

yarn --cwd packages/react test

…storage

- Wrap localStorage access in draftMessage.js with try-catch to prevent SecurityError crashes in cross-origin iframes
- Implement in-memory fallback store when localStorage is restricted, disabled, or throws QuotaExceededError
- Add optional chaining to RCInstance.getHost() in ChatInput.js to prevent TypeError during uninitialized state
- Add unit test suite (7 tests) in draftMessage.test.mjs covering iframe SecurityError, QuotaExceededError, SSR, and draft scoping

Signed-off-by: Diwaspant132 <diwaspanta132@gmail.com>
@CLAassistant

CLAassistant commented Oct 20, 2026 •

Copy link
Copy Markdown

CLA assistant check
All committers have signed the CLA.

Comment thread packages/react/src/lib/draftMessage.js
@Aryan-Verma-999

Copy link
Copy Markdown
Collaborator

hey thanks for picking this up :)
please address the comment

@Diwaspant132

Copy link
Copy Markdown
Author

@Aryan-Verma-999 thanks for the review!

i've updated the changes with no conflict with base branch

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants