fix: prevent iframe (snapshot-labs#3521)

* fix: prevent iframe * feat: accept iframe only from knownHosts * fix: check if iframe --------- Co-authored-by: j0hnfl0w <[email protected]>
aimabiet97 · Mar 20, 2023 · e5fea6b · e5fea6b
1 parent 10a219c
commit e5fea6b
Showing 1 changed file with 14 additions and 0 deletions.
diff --git a/src/main.ts b/src/main.ts
@@ -17,6 +17,20 @@ import { createHead } from '@vueuse/head';
 
 const head = createHead();
 
+const knownHosts = ['app.safe.global'];
+const parentUrl =
+  window.location != window.parent.location
+    ? document.referrer ||
+      document.location.ancestorOrigins[
+        document.location.ancestorOrigins.length - 1
+      ]
+    : document.location.href;
+const parentHost = new URL(parentUrl).host;
+if (window !== window.parent && !knownHosts.includes(parentHost)) {
+  document.documentElement.style.display = 'none';
+  throw new Error(`Unknown host: ${parentHost}`);
+}
+
 const app = createApp({
   setup() {
     provide(DefaultApolloClient, apolloClient);