Files
Genarrative/apps/mobile-shell/src/mobileShellNavigation.ts
T
kdletters a1afd33004 校验移动壳HostBridge消息来源
移动壳 onMessage 按页面 URL 拦截非同源 HostBridge 消息

移动壳导航测试覆盖同源消息入口和异常来源丢弃

移动壳检查脚本要求保留消息来源校验

宿主壳方案和共享决策记录移动消息入口边界
2026-06-18 09:23:53 +08:00

60 lines
1.2 KiB
TypeScript

import { normalizeHostBridgeExternalUrl } from '../../../packages/shared/src/contracts/hostBridge';
export function shouldOpenInMobileShellWebView(
rawUrl: string,
allowedOrigin: string,
) {
if (rawUrl === 'about:blank') {
return true;
}
if (
!rawUrl.startsWith('/') &&
!rawUrl.startsWith('#') &&
!/^[a-z][a-z0-9+.-]*:/i.test(rawUrl)
) {
return false;
}
try {
const url = new URL(rawUrl, allowedOrigin);
if (url.protocol !== 'http:' && url.protocol !== 'https:') {
return false;
}
return url.origin === allowedOrigin;
} catch {
return false;
}
}
export function resolveMobileShellExternalUrl(rawUrl: string) {
return normalizeHostBridgeExternalUrl(rawUrl);
}
export function shouldAcceptMobileShellHostBridgeMessage(
rawUrl: string,
allowedOrigin: string,
) {
return rawUrl !== 'about:blank' &&
shouldOpenInMobileShellWebView(rawUrl, allowedOrigin);
}
export function resolveMobileShellWebViewUrl(
rawUrl: string,
allowedOrigin: string,
) {
if (
rawUrl === 'about:blank' ||
!shouldOpenInMobileShellWebView(rawUrl, allowedOrigin)
) {
return null;
}
try {
return new URL(rawUrl, allowedOrigin).toString();
} catch {
return null;
}
}