fix(web): isolate untrusted remote content

[SeniorZhai]

What changed

• Restrict wallet-enabled WebViews to the reviewed HTTPS origin.
• Register wallet JavaScript bridges only for injectable pages.
• Block mixed content and validate fallback navigation.
• Validate app-card cover URLs and make save/share cache-only.

Why

Wallet bridges could remain available after cross-origin navigation, and the asset-origin check always evaluated true. App-card cover URLs could also trigger requests to local or private targets during rendering or save/share.

Impact

Cross-origin links open in the system browser. Unsafe app-card covers are ignored, and uncached covers cannot be saved or shared. The existing app-wide cleartext/HTTP network policy is unchanged.

Validation

• ./gradlew --no-configuration-cache :app:testGooglePlayDebugUnitTest --tests one.mixin.android.vo.AppCardDataTest
• ./gradlew --no-configuration-cache :app:compileGooglePlayDebugKotlin

[Copilot]

Pull request overview

Hardens embedded web content and app-card media handling against untrusted origins and network targets.

Changes:

• Restricts injectable WebViews to HTTPS origins and blocks mixed content.
• Validates app-card cover URLs before display.
• Makes app-card save/share operations cache-only.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
app/src/test/java/one/mixin/android/vo/AppCardDataTest.kt	Adds cover URL validation tests.
app/src/main/java/one/mixin/android/vo/AppCardData.kt	Introduces app-card image URL filtering.
app/src/main/java/one/mixin/android/ui/web/WebFragment.kt	Adds WebView origin restrictions and bridge gating.
app/src/main/java/one/mixin/android/ui/media/pager/MediaPagerActivity.kt	Resolves app-card images only from disk cache.
app/src/main/java/one/mixin/android/ui/conversation/holder/AppCard.kt	Filters cover URLs before rendering.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (3)

app/src/main/java/one/mixin/android/util/image/ImageNetworkPolicy.kt:66

• This condition blocks the entire 192.0.0.0/16, not just the non-public special-purpose ranges inside it. Globally routable hosts in that /16 (for example, 192.0.66.0/24) will therefore fail every Coil image request now that this policy is installed app-wide. Narrow this check to the actual reserved prefixes (and preserve the globally reachable exceptions in 192.0.0.0/24).

                bytes[0] == 192 && bytes[1] == 0 ||

app/src/main/java/one/mixin/android/util/image/ImageNetworkPolicy.kt:39

• The HTTPS check is only applied to the original app-card URL. OkHttp follows HTTPS-to-HTTP redirects by default, and this interceptor validates only the connected address, so an accepted cover can still be fetched over cleartext after a redirect. Revalidate the scheme on redirect requests (without blocking unrelated direct HTTP image loads, which the PR says remain supported).

private object PublicImageNetworkInterceptor : Interceptor {
    override fun intercept(chain: Interceptor.Chain): Response {
        val address = chain.connection()?.route()?.socketAddress?.address
        if (address == null || address.isBlockedImageAddress()) {
            throw IOException("Blocked non-public image target")
        }
        return chain.proceed(chain.request())

app/src/main/java/one/mixin/android/ui/media/pager/MediaPagerActivity.kt:471

• This returns the disk-cache backing file after use has closed the snapshot. Once the snapshot is closed, Coil may evict or replace that entry; save copies it shortly afterward, but sharing hands the URI to another app that may open it much later, so the share can fail if the cache changes. Copy the cached bytes to a stable temporary file while the snapshot is open and return that copy.

                imageLoader.diskCache?.openSnapshot(coverUrl)?.use { snapshot ->
                    snapshot.data.toFile()
                }