add changesets

Author: petebacondarwin

.changeset/breezy-tools-lose.md

@@ -0,0 +1,7 @@
+---
+"@cloudflare/workers-playground": patch
+---
+
+The workers playground's VSCodeEditor's `postMessage` `targetOrigin` is updated from `'\*'` to the specific `quickEditHost`.
+
+This prevents the workers-playground from accidentally posting to an incorrect iframe.

.changeset/tough-states-sip.md

@@ -0,0 +1,12 @@
+---
+"@cloudflare/quick-edit": patch
+---
+
+Add frame-ancestors CSP and postMessage origin validation to quick-edit
+
+Mitigate `postMessage` origin bypass:
+
+- Add Content-Security-Policy frame-ancestors header to quick-edit Worker responses, restricting which origins can embed the editor iframe
+- Add client-side origin validation to the window.onmessage handler in workbench.ts, rejecting PORT messages from untrusted origins
+- Inject allowed parent origins from server into HTML for client-side use
+- Localhost origins are conditionally included when running via wrangler dev