收紧移动壳WebView安全开关

移动壳 WebView 显式禁用多窗口、文件访问、混合内容、第三方 Cookie 和远程调试

移动壳检查脚本拒绝 WebView 安全开关被放宽

移动壳导航测试补充协议降级、协议相对外域和危险协议拦截

宿主壳方案和共享决策记录移动 WebView 安全边界

apps/mobile-shell/src/mobileShellNavigation.test.ts

@@ -19,6 +19,12 @@ describe('shouldOpenInMobileShellWebView', () => {
     expect(
       shouldOpenInMobileShellWebView('/creation/puzzle', allowedOrigin),
     ).toBe(true);
+    expect(
+      shouldOpenInMobileShellWebView(
+        'http://app.genarrative.world/works/detail?work=PZ-1',
+        allowedOrigin,
+      ),
+    ).toBe(false);
     expect(
       shouldOpenInMobileShellWebView('about:blank', allowedOrigin),
     ).toBe(true);
@@ -33,6 +39,12 @@ describe('shouldOpenInMobileShellWebView', () => {
     expect(
       shouldOpenInMobileShellWebView('mailto:hi@example.com', allowedOrigin),
     ).toBe(false);
+    expect(
+      shouldOpenInMobileShellWebView('//example.com/evil', allowedOrigin),
+    ).toBe(false);
+    expect(
+      shouldOpenInMobileShellWebView('javascript:alert(1)', allowedOrigin),
+    ).toBe(false);
     expect(shouldOpenInMobileShellWebView('not a url', allowedOrigin)).toBe(
       false,
     );