Following MSRC case as malicious site can be injected as the embed iframe src, added embed URL validation to ensure the host is an allowed PBI src.
A valid embed url protocol is "https:"
The valid hosts names are ([retrieved from EV2-deployment repository - all of ida_PowerBIFeUrl key values](https://dev.azure.com/powerbi/PowerBIClients/_search?action=contents&text=ida_PowerBIFeUrl path%3A*envParams*&type=code&lp=code-Project&filters=ProjectFilters{PowerBIClients}RepositoryFilters{PowerBIClients-EV2-Deployment}&pageSize=25&result=DefaultCollection/PowerBIClients/PowerBIClients-EV2-Deployment/GBmaster//WFE/AppService/ADM/Public/INT/envParams.txt)):
- app.powerbi.com,
- app.powerbi.cn,
- app.powerbigov.us,
- app.mil.powerbigov.us,
- app.high.powerbigov.us,
- app.powerbi.eaglex.ic.gov,
- app.powerbi.microsoft.scloud,
- powerbi-df.analysis-df.windows.net,
- CST WFE URLs: 'https://{cst-name}.analysis.windows-int.net'
- daily.powerbi.com
- dxt.powerbi.com
- msit.powerbi.com
Embed URL validation should include fabric embed URL.
All of the above should be covered by the following regex expressions:
.+\.powerbi.com$
- daily.powerbi.com
- dxt.powerbi.com
- msit.powerbi.com
- app.powerbi.com
FF: ^app(.mil.|.high.|.)powerbigov.us$
- app.powerbigov.us,
- app.mil.powerbigov.us,
- app.high.powerbigov.us
Edog: .+\.analysis-df.windows.net$
Onebox and CSTs: .+\.analysis.windows-int.net$
Fabric URLs: .+\.fabric.microsoft.com$
**Please look into the test cases in utils.spec.ts to see the valid and invalid embe urls**
Related work items: #1245653
May Hartov
Shahak Yosef
