@forge/csp

Index: package/out/csp/csp-injection-service.js
===================================================================
--- package/out/csp/csp-injection-service.js
+++ package/out/csp/csp-injection-service.js
@@ -146,15 +146,15 @@
 exports.getAtlassianImageHost = getAtlassianImageHost;
 exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS = ['https://secure.gravatar.com', 'https://images.unsplash.com'];
 class CSPInjectionService {
     constructor() {
-        this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain }) => {
+        this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain }) => {
             const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv, icOptions);
             const fosCDNUrls = getFOSCDNUrls(microsEnv, icOptions);
             const defaultSrc = ["'self'", ...getFOSHostDownload(microsEnv, icOptions), ...fosCDNUrls].join(' ');
             const frameAncestors = [
                 "'self'",
-                ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain),
+                ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain),
                 ...getFOSHostDownload(microsEnv, icOptions),
                 ...fosCDNUrls
             ].join(' ');
             const frameSrc = [
@@ -280,9 +280,9 @@
         allowed.push(...getFOSHostUpload(microsEnv, icOptions));
         allowed.push(...getFOSCDNUrls(microsEnv, icOptions));
         return allowed;
     }
-    getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain) {
+    getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain) {
         let frameAncestors = [];
         const localhostWithPortRegex = /^localhost:\d+$/;
         switch (microsEnv) {
             case 'dev':
@@ -332,8 +332,11 @@
         }
         if (connectMacroParentDomain) {
             frameAncestors.push(connectMacroParentDomain);
         }
+        if (parentEmbeddingDomain) {
+            frameAncestors.push(parentEmbeddingDomain);
+        }
         if (hostname) {
             frameAncestors.push(hostname);
         }
         return frameAncestors;