校验移动壳HostBridge消息来源

移动壳 onMessage 按页面 URL 拦截非同源 HostBridge 消息

移动壳导航测试覆盖同源消息入口和异常来源丢弃

移动壳检查脚本要求保留消息来源校验

宿主壳方案和共享决策记录移动消息入口边界

apps/mobile-shell/src/mobileShellNavigation.test.ts

@@ -3,6 +3,7 @@ import { describe, expect, test } from 'vitest';
 import {
   resolveMobileShellExternalUrl,
   resolveMobileShellWebViewUrl,
+  shouldAcceptMobileShellHostBridgeMessage,
   shouldOpenInMobileShellWebView,
 } from './mobileShellNavigation';
 
@@ -84,4 +85,30 @@ describe('shouldOpenInMobileShellWebView', () => {
       resolveMobileShellWebViewUrl('about:blank', allowedOrigin),
     ).toBeNull();
   });
+
+  test('HostBridge 消息只接受同源主站页面', () => {
+    const allowedOrigin = 'https://app.genarrative.world';
+
+    expect(
+      shouldAcceptMobileShellHostBridgeMessage(
+        'https://app.genarrative.world/creation/puzzle',
+        allowedOrigin,
+      ),
+    ).toBe(true);
+    expect(
+      shouldAcceptMobileShellHostBridgeMessage('about:blank', allowedOrigin),
+    ).toBe(false);
+    expect(
+      shouldAcceptMobileShellHostBridgeMessage(
+        'https://example.com/evil',
+        allowedOrigin,
+      ),
+    ).toBe(false);
+    expect(
+      shouldAcceptMobileShellHostBridgeMessage(
+        'javascript:alert(1)',
+        allowedOrigin,
+      ),
+    ).toBe(false);
+  });
 });