收紧移动壳WebView安全开关

移动壳 WebView 显式禁用多窗口、文件访问、混合内容、第三方 Cookie 和远程调试

移动壳检查脚本拒绝 WebView 安全开关被放宽

移动壳导航测试补充协议降级、协议相对外域和危险协议拦截

宿主壳方案和共享决策记录移动 WebView 安全边界

apps/mobile-shell/App.tsx

@@ -176,8 +176,16 @@ export default function App() {
           ref={webViewRef}
           source={{ uri: webUrl }}
           javaScriptEnabled
+          javaScriptCanOpenWindowsAutomatically={false}
           domStorageEnabled
+          mixedContentMode="never"
           originWhitelist={[allowedWebOrigin]}
+          allowFileAccess={false}
+          allowFileAccessFromFileURLs={false}
+          allowUniversalAccessFromFileURLs={false}
+          thirdPartyCookiesEnabled={false}
+          sharedCookiesEnabled={false}
+          webviewDebuggingEnabled={false}
           onMessage={handleMessage}
           onShouldStartLoadWithRequest={handleShouldStartLoad}
           onNavigationStateChange={(event) => {

apps/mobile-shell/scripts/check-config.mjs

@@ -295,6 +295,15 @@ for (const snippet of [
   'SafeAreaView',
   'MOBILE_SHELL_SAFE_AREA_EDGES',
   'resolveMobileShellBaseWebUrl',
+  'javaScriptCanOpenWindowsAutomatically={false}',
+  'mixedContentMode="never"',
+  'allowFileAccess={false}',
+  'allowFileAccessFromFileURLs={false}',
+  'allowUniversalAccessFromFileURLs={false}',
+  'thirdPartyCookiesEnabled={false}',
+  'sharedCookiesEnabled={false}',
+  'webviewDebuggingEnabled={false}',
+  'setSupportMultipleWindows={false}',
 ]) {
   if (!appSource.includes(snippet)) {
     throw new Error(`mobile shell App missing ${snippet}`);

apps/mobile-shell/src/mobileShellNavigation.test.ts

@@ -19,6 +19,12 @@ describe('shouldOpenInMobileShellWebView', () => {
     expect(
       shouldOpenInMobileShellWebView('/creation/puzzle', allowedOrigin),
     ).toBe(true);
+    expect(
+      shouldOpenInMobileShellWebView(
+        'http://app.genarrative.world/works/detail?work=PZ-1',
+        allowedOrigin,
+      ),
+    ).toBe(false);
     expect(
       shouldOpenInMobileShellWebView('about:blank', allowedOrigin),
     ).toBe(true);
@@ -33,6 +39,12 @@ describe('shouldOpenInMobileShellWebView', () => {
     expect(
       shouldOpenInMobileShellWebView('mailto:hi@example.com', allowedOrigin),
     ).toBe(false);
+    expect(
+      shouldOpenInMobileShellWebView('//example.com/evil', allowedOrigin),
+    ).toBe(false);
+    expect(
+      shouldOpenInMobileShellWebView('javascript:alert(1)', allowedOrigin),
+    ).toBe(false);
     expect(shouldOpenInMobileShellWebView('not a url', allowedOrigin)).toBe(
       false,
     );