Function getCustomBootstrapBaseUrl

src/3p-frame.js:344–375

* Returns the custom base URL for 3p bootstrap iframes if it exists. * Otherwise null. * @param {!Window} parentWindow * @param {!./service/ampdoc-impl.AmpDoc} ampdoc * @param {boolean=} opt_strictForUnitTest * @return {?string}

(
  parentWindow,
  ampdoc,
  opt_strictForUnitTest
)

 * @return {?string}
 */
function getCustomBootstrapBaseUrl(
  parentWindow,
  ampdoc,
  opt_strictForUnitTest
) {
  const meta = ampdoc.getMetaByName('amp-3p-iframe-src');
  if (!meta) {
    return null;
  }
  const url = assertHttpsUrl(meta, 'meta[name="amp-3p-iframe-src"]');
  userAssert(
    url.indexOf('?') == -1,
    '3p iframe url must not include query string %s in element %s.',
    url,
    meta
  );
  // This is not a security primitive, we just don't want this to happen in
  // practice. People could still redirect to the same origin, but they cannot
  // redirect to the proxy origin which is the important one.
  const parsed = parseUrlDeprecated(url);
  userAssert(
    (parsed.hostname == 'localhost' && !opt_strictForUnitTest) ||
      parsed.origin != parseUrlDeprecated(parentWindow.location.href).origin,
    '3p iframe url must not be on the same origin as the current document ' +
      '%s (%s) in element %s. See https://github.com/ampproject/amphtml' +
      '/blob/main/docs/spec/amp-iframe-origin-policy.md for details.',
    url,
    parsed.origin,
    meta
  );
  return `${url}?${mode.version()}`;
}

/**
 * Applies a sandbox to the iframe, if the required flags can be allowed.