iframe-proxy: respect scoped frame ancestors

Author: nedtwigg

docs/specs/dor-iframe.md

@@ -67,7 +67,7 @@ new technique, the proven one.
 | Target | Proxy behavior |
 | --- | --- |
 | **Loopback** (`localhost`/`127.0.0.1`/`[::1]`) http | Full instrument: strip `X-Frame-Options`, drop the page CSP, inject the shim, serve. The user spawned it; framing is the intent. |
-| **Remote** http, frameable | Best-effort render with the injected shim (flagged that `dor ab` is the better tool for arbitrary browsing). |
+| **Remote** http, frameable | Best-effort render with the injected shim (flagged that `dor ab` is the better tool for arbitrary browsing). A CSP `frame-ancestors *` is considered frameable; scoped sources such as `https://*.example.com` are restrictive. |
 | **Remote** http, refuses framing | **Never force-framed.** Serve a Dormouse error page with a one-click hint to `dor ab open <url>`. |
 | **Unreachable** (conn refused, DNS, non-2xx) | Serve a Dormouse error page ("is the dev server running?"). |
 | **`https://`** | Deferred. The panel reports `scheme` and points at `dor ab`. |
@@ -205,8 +205,10 @@ The same fences as the stream relay: loopback-only bind both sides; a per-surfac
 grant served by a dedicated **single-upstream** server (no open forwarder); the
 injected shim is fixed and Dormouse-owned (no user script ever reaches the page);
 header-stripping never force-frames a third-party site (a refusing remote is
-diverted to an error page, not stripped). **SSRF:** the proxy fetches a
-user-supplied URL, so it refuses link-local / cloud-metadata ranges
+diverted to an error page, not stripped). For CSP, only a standalone
+`frame-ancestors *` is permissive; wildcard host patterns remain restrictive.
+**SSRF:** the proxy fetches a user-supplied URL, so it refuses link-local /
+cloud-metadata ranges
 (`169.254.0.0/16`, `fe80::/10`) and trusts other ranges — the trust boundary is the
 user's own `dor iframe <url>`.
 

vscode-ext/src/iframe-proxy-host.ts

@@ -272,15 +272,25 @@ function instrumentHtml(body: string): string {
 }
 
 // A remote refuses framing if it sends any X-Frame-Options or a CSP
-// frame-ancestors that is not the permissive `*`. Conservative on purpose: when
-// in doubt we divert to an error page rather than show a guaranteed-blank frame.
+// frame-ancestors that is not the permissive standalone `*`. Conservative on
+// purpose: when in doubt we divert to an error page rather than show a
+// guaranteed-blank frame.
 function refusesFraming(headers: http.IncomingHttpHeaders): boolean {
   if (headers['x-frame-options']) return true;
   const csp = headers['content-security-policy'];
-  const cspText = Array.isArray(csp) ? csp.join(';') : (csp ?? '');
-  const match = /frame-ancestors([^;]*)/i.exec(cspText);
-  if (!match) return false;
-  return !/\*/.test(match[1]);
+  const policies = Array.isArray(csp) ? csp : csp ? [csp] : [];
+  return policies.some((policy) => hasRestrictiveFrameAncestors(policy));
+}
+
+function hasRestrictiveFrameAncestors(policy: string): boolean {
+  const directives = policy.split(';');
+  for (const directive of directives) {
+    const parts = directive.trim().split(/\s+/).filter(Boolean);
+    if (parts.length === 0 || parts[0].toLowerCase() !== 'frame-ancestors') continue;
+    const sources = parts.slice(1);
+    if (!sources.includes('*')) return true;
+  }
+  return false;
 }
 
 // --- WebSocket upgrade passthrough (dev-server HMR, openvscode-server) -------