From beb2575dd2dcdc018f2bf31d7f37d9d2b3ea4c21 Mon Sep 17 00:00:00 2001
From: kdletters <kdletters@qq.com>
Date: Sat, 20 Jun 2026 22:32:43 +0800
Subject: [PATCH] =?UTF-8?q?=E9=94=81=E5=AE=9A=E7=A7=BB=E5=8A=A8=E5=A3=B3We?=
 =?UTF-8?q?bView=E6=9D=A5=E6=BA=90=E7=99=BD=E5=90=8D=E5=8D=95?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

补充移动壳 WebView originWhitelist 仅允许当前 H5 origin 的测试

扩展移动壳配置门禁防止来源白名单被放宽
---
 apps/mobile-shell/scripts/check-config.mjs    |  5 +++++
 apps/mobile-shell/src/shell/ShellApp.test.tsx | 13 +++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/apps/mobile-shell/scripts/check-config.mjs b/apps/mobile-shell/scripts/check-config.mjs
index 4bca38ea6..47e8717b4 100644
--- a/apps/mobile-shell/scripts/check-config.mjs
+++ b/apps/mobile-shell/scripts/check-config.mjs
@@ -1503,6 +1503,7 @@ for (const snippet of [
   'SafeAreaView',
   'MOBILE_SHELL_SAFE_AREA_EDGES',
   'resolveMobileShellBaseWebUrl',
+  'originWhitelist={[allowedWebOrigin]}',
   'javaScriptCanOpenWindowsAutomatically={false}',
   'mixedContentMode="never"',
   'allowFileAccess={false}',
@@ -1537,6 +1538,10 @@ if (!shellAppTestSource.includes('blocked WebView file downloads are logged for
   throw new Error('mobile shell tests must cover blocked WebView file download diagnostics');
 }
 
+if (!shellAppTestSource.includes('WebView origin whitelist is limited to the resolved H5 origin')) {
+  throw new Error('mobile shell tests must cover WebView origin whitelist boundaries');
+}
+
 for (const snippet of [
   "describe('mobile shell safe area'",
   "test('protects the WebView from every device edge'",
diff --git a/apps/mobile-shell/src/shell/ShellApp.test.tsx b/apps/mobile-shell/src/shell/ShellApp.test.tsx
index 5596908d4..5bf318e10 100644
--- a/apps/mobile-shell/src/shell/ShellApp.test.tsx
+++ b/apps/mobile-shell/src/shell/ShellApp.test.tsx
@@ -440,6 +440,19 @@ describe('ShellApp QR scanner HostBridge flow', () => {
 });
 
 describe('ShellApp HostBridge event injection', () => {
+  test('WebView origin whitelist is limited to the resolved H5 origin', async () => {
+    const ShellApp = await importShellApp();
+    render(<ShellApp />);
+
+    const webViewProps = shellHarness.webViewProps.current as {
+      originWhitelist?: string[];
+      source?: { uri?: string };
+    };
+    const webViewUrl = webViewProps.source?.uri ?? 'https://app.genarrative.world/';
+
+    expect(webViewProps.originWhitelist).toEqual([new URL(webViewUrl).origin]);
+  });
+
   test('AppState changes inject app.lifecycle events into WebView', async () => {
     const ShellApp = await importShellApp();
     render(<ShellApp />);