From 02725cf31bed70560288675457063005402f4b62 Mon Sep 17 00:00:00 2001 From: aedes Date: Tue, 21 Apr 2026 17:05:51 +0300 Subject: [PATCH] feat: keep iframe clicks on our domain (proxy nav, strip _top, rewrite JS redirects) --- server.js | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/server.js b/server.js index b86feb5..675ce39 100644 --- a/server.js +++ b/server.js @@ -160,12 +160,22 @@ app.get('/proxy/*', async (req, res) => { if (ct.includes('text/html')) { let html = await r.text(); - // rewrite relative URLs to absolute so browser loads assets directly html = html - .replace(/(href|src|action)="\/(?!\/)/g, '$1="https://student.sechenov.ru/') + // navigation → stay inside iframe via our proxy + .replace(/\b(href|action)="\/(?!\/)/g, '$1="/proxy/') + // assets load directly from upstream (faster, no rewrite needed) + .replace(/\bsrc="\/(?!\/)/g, 'src="https://student.sechenov.ru/') .replace(/url\(["']?\/(?!\/)/g, 'url(https://student.sechenov.ru/') - // neutralize meta CSP if present - .replace(/]+http-equiv=["']?Content-Security-Policy["']?[^>]*>/gi, ''); + // strip framing-break targets + .replace(/\btarget=["'](_top|_parent|_blank)["']/gi, '') + // neutralize meta CSP/X-Frame + .replace(/]+http-equiv=["']?(Content-Security-Policy|X-Frame-Options)["']?[^>]*>/gi, '') + // intercept inline JS redirects + .replace(/\b(document|window|top|self)\.location(\.href)?\s*=\s*(['"])\/(?!\/)/g, "document.location.href=$3/proxy/") + .replace(/\blocation\.href\s*=\s*(['"])\/(?!\/)/g, "location.href=$1/proxy/") + .replace(/\blocation\.replace\(\s*(['"])\/(?!\/)/g, "location.replace($1/proxy/"); + // inject a so unrewritten relative URLs default to proxy root + html = html.replace(/]*>/i, m => m + '\n'); res.send(html); } else { // stream binary/text as-is