校验移动壳HostBridge消息来源

移动壳 onMessage 按页面 URL 拦截非同源 HostBridge 消息

移动壳导航测试覆盖同源消息入口和异常来源丢弃

移动壳检查脚本要求保留消息来源校验

宿主壳方案和共享决策记录移动消息入口边界

apps/mobile-shell/src/mobileShellNavigation.ts

@@ -32,6 +32,14 @@ export function resolveMobileShellExternalUrl(rawUrl: string) {
   return normalizeHostBridgeExternalUrl(rawUrl);
 }
 
+export function shouldAcceptMobileShellHostBridgeMessage(
+  rawUrl: string,
+  allowedOrigin: string,
+) {
+  return rawUrl !== 'about:blank' &&
+    shouldOpenInMobileShellWebView(rawUrl, allowedOrigin);
+}
+
 export function resolveMobileShellWebViewUrl(
   rawUrl: string,
   allowedOrigin: string,