锁定移动壳WebView来源白名单

补充移动壳 WebView originWhitelist 仅允许当前 H5 origin 的测试扩展移动壳配置门禁防止来源白名单被放宽
2026-06-20 22:32:43 +08:00
parent 69ff4af4e6
commit beb2575dd2
2 changed files with 18 additions and 0 deletions
@@ -440,6 +440,19 @@ describe('ShellApp QR scanner HostBridge flow', () => {
 });

 describe('ShellApp HostBridge event injection', () => {
+  test('WebView origin whitelist is limited to the resolved H5 origin', async () => {
+    const ShellApp = await importShellApp();
+    render(<ShellApp />);
+
+    const webViewProps = shellHarness.webViewProps.current as {
+      originWhitelist?: string[];
+      source?: { uri?: string };
+    };
+    const webViewUrl = webViewProps.source?.uri ?? 'https://app.genarrative.world/';
+
+    expect(webViewProps.originWhitelist).toEqual([new URL(webViewUrl).origin]);
+  });
+
  test('AppState changes inject app.lifecycle events into WebView', async () => {
    const ShellApp = await importShellApp();
    render(<ShellApp />);