feat: keep iframe clicks on our domain (proxy nav, strip _top, rewrite JS redirects)

server.js

@@ -160,12 +160,22 @@ app.get('/proxy/*', async (req, res) => {
 
         if (ct.includes('text/html')) {
             let html = await r.text();
-            // rewrite relative URLs to absolute so browser loads assets directly
             html = html
-                .replace(/(href|src|action)="\/(?!\/)/g, '$1="https://student.sechenov.ru/')
+                // navigation → stay inside iframe via our proxy
+                .replace(/\b(href|action)="\/(?!\/)/g, '$1="/proxy/')
+                // assets load directly from upstream (faster, no rewrite needed)
+                .replace(/\bsrc="\/(?!\/)/g, 'src="https://student.sechenov.ru/')
                 .replace(/url\(["']?\/(?!\/)/g, 'url(https://student.sechenov.ru/')
-                // neutralize meta CSP if present
-                .replace(/<meta[^>]+http-equiv=["']?Content-Security-Policy["']?[^>]*>/gi, '');
+                // strip framing-break targets
+                .replace(/\btarget=["'](_top|_parent|_blank)["']/gi, '')
+                // neutralize meta CSP/X-Frame
+                .replace(/<meta[^>]+http-equiv=["']?(Content-Security-Policy|X-Frame-Options)["']?[^>]*>/gi, '')
+                // intercept inline JS redirects
+                .replace(/\b(document|window|top|self)\.location(\.href)?\s*=\s*(['"])\/(?!\/)/g, "document.location.href=$3/proxy/")
+                .replace(/\blocation\.href\s*=\s*(['"])\/(?!\/)/g, "location.href=$1/proxy/")
+                .replace(/\blocation\.replace\(\s*(['"])\/(?!\/)/g, "location.replace($1/proxy/");
+            // inject a <base> so unrewritten relative URLs default to proxy root
+            html = html.replace(/<head[^>]*>/i, m => m + '\n<base href="/proxy/">');
             res.send(html);
         } else {
             // stream binary/text as-is