Update frames.erb for better XSS check

[avivkeller]

Description

Better XSS detection using URL.

Completed Tasks

• I have read the Contributing Guide.
• The pull request is complete (implemented / written).
• Git commits have been cleaned up (squash WIP / revert commits).
• I wrote tests and ran bundle exec rake locally (if code is attached to PR).

[lsegal]

Suggested change

	try {
	var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
	var name = match ? match[1] : '<%= url_for_main %>';
	var url = new URL(name, location.href);
	window.top.location.replace(url.origin === location.origin ? name : '<%= url_for_main %>');
	} catch (e) {
	window.top.location.replace('<%= url_for_main %>');
	}
	try {
	var mainUrl = '<%= url_for_main %>';
	var match = decodeURIComponent(window.location.hash).match(/^#!(.+)/);
	var name = match ? match[1] : mainUrl;
	var url = new URL(name, location.href);
	window.top.location.replace(url.origin === location.origin ? name : mainUrl);
	} catch (e) {
	window.top.location.replace(mainUrl);
	}

[avivkeller]

The assignment must be outside the try catch loop

[lsegal]

LGTM

[avivkeller]

Same here

[avivkeller]

Great! I'm sorry again for my initial mistake and I'm glad we worked it out!