a1afd33004
移动壳 onMessage 按页面 URL 拦截非同源 HostBridge 消息 移动壳导航测试覆盖同源消息入口和异常来源丢弃 移动壳检查脚本要求保留消息来源校验 宿主壳方案和共享决策记录移动消息入口边界
60 lines
1.2 KiB
TypeScript
60 lines
1.2 KiB
TypeScript
import { normalizeHostBridgeExternalUrl } from '../../../packages/shared/src/contracts/hostBridge';
|
|
|
|
export function shouldOpenInMobileShellWebView(
|
|
rawUrl: string,
|
|
allowedOrigin: string,
|
|
) {
|
|
if (rawUrl === 'about:blank') {
|
|
return true;
|
|
}
|
|
|
|
if (
|
|
!rawUrl.startsWith('/') &&
|
|
!rawUrl.startsWith('#') &&
|
|
!/^[a-z][a-z0-9+.-]*:/i.test(rawUrl)
|
|
) {
|
|
return false;
|
|
}
|
|
|
|
try {
|
|
const url = new URL(rawUrl, allowedOrigin);
|
|
if (url.protocol !== 'http:' && url.protocol !== 'https:') {
|
|
return false;
|
|
}
|
|
|
|
return url.origin === allowedOrigin;
|
|
} catch {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
export function resolveMobileShellExternalUrl(rawUrl: string) {
|
|
return normalizeHostBridgeExternalUrl(rawUrl);
|
|
}
|
|
|
|
export function shouldAcceptMobileShellHostBridgeMessage(
|
|
rawUrl: string,
|
|
allowedOrigin: string,
|
|
) {
|
|
return rawUrl !== 'about:blank' &&
|
|
shouldOpenInMobileShellWebView(rawUrl, allowedOrigin);
|
|
}
|
|
|
|
export function resolveMobileShellWebViewUrl(
|
|
rawUrl: string,
|
|
allowedOrigin: string,
|
|
) {
|
|
if (
|
|
rawUrl === 'about:blank' ||
|
|
!shouldOpenInMobileShellWebView(rawUrl, allowedOrigin)
|
|
) {
|
|
return null;
|
|
}
|
|
|
|
try {
|
|
return new URL(rawUrl, allowedOrigin).toString();
|
|
} catch {
|
|
return null;
|
|
}
|
|
}
|