Function validateAllowedEmbeddingOrigins

3p/integration-lib.js:257–287

(window, allowedHostnames)

 * @visibleForTesting
 */
export function validateAllowedEmbeddingOrigins(window, allowedHostnames) {
  if (!window.document.referrer) {
    throw new Error('Referrer expected: ' + window.location.href);
  }
  const ancestors = window.location.ancestorOrigins;
  // We prefer the unforgable ancestorOrigins, but referrer is better than
  // nothing.
  const ancestor = ancestors ? ancestors[0] : window.document.referrer;
  let {hostname} = parseUrlDeprecated(ancestor);
  if (isProxyOrigin(ancestor)) {
    // If we are on the cache domain, parse the source hostname from
    // the referrer. The referrer is used because it should be
    // trustable.
    hostname = parseUrlDeprecated(
      getSourceUrl(window.document.referrer)
    ).hostname;
  }
  for (let i = 0; i < allowedHostnames.length; i++) {
    // Either the hostname is allowed
    if (allowedHostnames[i] == hostname) {
      return;
    }
    // Or it ends in .$hostname (aka is a sub domain of an allowed domain.
    if (endsWith(hostname, '.' + allowedHostnames[i])) {
      return;
    }
  }
  throw new Error(
    'Invalid embedding hostname: ' + hostname + ' not in ' + allowedHostnames
  );
}

/**
 * Throws if this window is a top level window.