feat: Domains list to allow iframe on all subdomains (#4900)

snapshot-labs · Sep 30, 2024 · c17e254 · c17e254
1 parent 43875b2
commit c17e254
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/src/helpers/constants.ts b/src/helpers/constants.ts
@@ -23,6 +23,9 @@ export const KNOWN_HOSTS = [
   'safe.mainnet.frax.com'
 ];
 
+// All subdomains of these domains are allowed
+export const KNOWN_DOMAINS = ['blockscout.com'];
+
 export const SPACE_CATEGORIES = [
   'protocol',
   'social',

diff --git a/src/main.ts b/src/main.ts
@@ -10,7 +10,7 @@ import VueTippy from 'vue-tippy';
 import VueViewer from 'v-viewer';
 import { apolloClient } from '@/helpers/apollo';
 // import { initSentry } from '@/sentry';
-import { KNOWN_HOSTS } from '@/helpers/constants';
+import { KNOWN_DOMAINS, KNOWN_HOSTS } from '@/helpers/constants';
 import i18n from '@/helpers/i18n';
 import router from '@/router';
 import '@/assets/css/main.scss';
@@ -24,7 +24,11 @@ const parentUrl =
       ]
     : document.location.href;
 const parentHost = new URL(parentUrl).host;
-if (window !== window.parent && !KNOWN_HOSTS.includes(parentHost)) {
+if (
+  window !== window.parent &&
+  !KNOWN_HOSTS.includes(parentHost) &&
+  !KNOWN_DOMAINS.includes(parentHost.split('.').slice(-2).join('.'))
+) {
   document.documentElement.style.display = 'none';
   throw new Error(`Unknown host: ${parentHost}`);
 }