Repository navigation
Keep the native bridge and push deep links on the endpoint's origin - #10
Merged
Merged
Conversation
The WebView keeps every navigation inside the shell, so IdP login pages and any site an app links to ran with the full bridge: they could read the push token, open the scanner or ask for a biometric confirmation. Android now injects the shim and answers its transport only while the main frame is on the configured endpoint's origin (BridgeOrigin, JVM-tested); iOS answers only main-frame calls from that origin, rejects the rest with "forbidden" and ignores calls from frames inside a page. The remaining Android gap (frames inside an app page) is written down as NEXT_STEPS E8. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt
zcl_test_mobile_push wrote both values into JSON string literals as they came: an alert with a quote or backslash produced invalid JSON (the push API answered 400), and crafted text could add its own "data" member with a different deep link the shells open on tap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt
MainActivity is exported as the launcher, so any app on the device could start it with the deep-link extra: a javascript: URL ran in the signed-in app page (loadUrl evaluates it in the current document), any other URL opened a foreign site inside the trusted shell. Both shells now take a deep link only when it has the configured endpoint's origin. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Security pass over the shells and the push client. One commit per fix:
@JavascriptInterfacetransport, only while the main frame is on the configured endpoint's origin. The check isBridgeOrigin(scheme, host and effective port), which has a new JVM test,BridgeOriginTest.forbiddenand ignores calls from frames inside a page, because an answer to one would land in the main frame and could settle one of that page's own pending calls.addJavascriptInterfacecannot tell frames apart. It is written down as NEXT_STEPS E8: closing it needsWebViewCompat.addWebMessageListener, which brings in a newandroidx.webkitdependency and needs a decision.bridge/README.md, AGENTS.md, DISTRIBUTION checklist, TESTING runbook and TEST_PROTOCOL.abap/push/zcl_test_mobile_push). A quote in the alert made the JSON invalid, and crafted text could add its owndata.url.MainActivityis the exported launcher activity, so any app on the device could start it with thedeeplink_urlextra. Ajavascript:URL then ran in the signed-in app page, becauseloadUrlevaluates it in the current document, and any other URL opened a foreign site inside the trusted shell. iOS applies the same rule to notification taps.Not device-tested; CI compiles both shells and runs the JVM tests and the bridge contract tests. TESTING.md §1 gained the foreign-origin check for the next device run.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Te3BRpRpxNhZAYnrQL6Gdt
Generated by Claude Code