Frame-breaking check at campaign submit: reject XFO/frame-ancestors blockers, SSRF-guarded

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-09-05 07:48:55 -05:00
parent 15b036b940
commit 5c945a1b09
3 changed files with 58 additions and 0 deletions
@@ -215,6 +215,8 @@
            <p><input id="cBudget" type="number" placeholder="Budget (credits)" min="10" style="width:100%"></p>
          </div>
          <p><input id="cTarget" placeholder="Target URL (https://…)" style="width:100%"></p>
+          <p class="small muted" style="margin-top:-6px">Banner and text targets are shown full screen in the
+            ad viewer, so the URL must allow framing — we check it the moment you submit.</p>
          <p id="cImageRow"><input id="cImage" placeholder="Image URL (banner/login ads)" style="width:100%"></p>
          <p id="cTitleRow" hidden><input id="cTitle" placeholder="Headline (max 60)" style="width:100%"></p>
          <p id="cBodyRow" hidden><input id="cBody" placeholder="Ad text (max 140)" style="width:100%"></p>