...probably not?
Just re-reading the announcement leads me to suggest that they intentionally and explicitly wall this off from a sandboxing perspective.
Emphasis mine.
We isolate snippets from our sites to block access to your private Stack Exchange data:
- We use HTML5 sandboxed iframes in order to prevent many forms of malicious attack.
- We render the Snippets on an external domain (stacksnippets.net) in order to ensure that the same-origin policy is not in effect and to keep the snippets from accessing your logged-in session or cookies.
Even on stacksnippets.net, you get the blurb about what it shields from. Mostly, just evil things.
What is this domain for?
We use this domain to render user-provided code snippets. Some of our
websites have enabled interactive code snippets which can be run by
other users in order to see the output. This domain is used to host
the results of running those snippets. We host the results on a
different domain because we must prevent same-origin from being in
effect. If same-origin was possible, users could write code that
caused other users to do things that they didn't want to on their
Stack Exchange account. What kinds of things? Evil things. Things like
logging a user out, or updating their profile, or even possibly
posting questions or answers! So, this domain stops bad people from
doing bad things.
So this leads me to believe that - barring some kind of exploit that I'm sure the devs would love to chat with you about - a Stack Snippet would not have any way of knowing what post it originated from.
console.log(window.location.ancestorOrigins[0]);
, which will produce the domain of the site the snippet is posted on (e.g.https://meta.stackoverflow.com
), but nothing more specific than that.document.referrer
, in every browser. But that also returns only the origin in stack snippets, not the full path...