收紧移动壳外链协议白名单

Expo WebView 外域导航只允许安全外链协议交给系统

阻断危险协议避免外链页面保留宿主桥能力

补充移动壳导航测试和宿主壳文档

apps/mobile-shell/src/mobileShellNavigation.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, test } from 'vitest';
 
 import {
+  resolveMobileShellExternalUrl,
   resolveMobileShellWebViewUrl,
   shouldOpenInMobileShellWebView,
 } from './mobileShellNavigation';
@@ -37,6 +38,21 @@ describe('shouldOpenInMobileShellWebView', () => {
     );
   });
 
+  test('只有允许协议能交给系统外部应用打开', () => {
+    expect(resolveMobileShellExternalUrl(' https://example.com/path ')).toBe(
+      'https://example.com/path',
+    );
+    expect(resolveMobileShellExternalUrl('mailto:hi@example.com')).toBe(
+      'mailto:hi@example.com',
+    );
+    expect(resolveMobileShellExternalUrl('tel:+12345678')).toBe(
+      'tel:+12345678',
+    );
+    expect(resolveMobileShellExternalUrl('javascript:alert(1)')).toBeNull();
+    expect(resolveMobileShellExternalUrl('file:///etc/passwd')).toBeNull();
+    expect(resolveMobileShellExternalUrl('/relative/path')).toBeNull();
+  });
+
   test('HostBridge 主动导航只解析同源网页目标', () => {
     const allowedOrigin = 'https://app.genarrative.world';