@livx.cc/appwrap 0.61.20 → 0.61.22

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@livx.cc/appwrap",
-  "version": "0.61.20",
+  "version": "0.61.22",
   "description": "Wrap any PWA into a native app with native capabilities (appwrap runtime + @livx.cc/native-kit).",
   "license": "MIT",
   "author": "Elya Livshitz",

package/runtime/app/shell/bridge-origin.ts

@@ -0,0 +1,39 @@
+import { SHELL_CONFIG } from './config';
+import { effectiveServerUrl } from './server-url';
+
+/**
+ * Bridge origin gate. The shell's WebView can show ANY page (a link, a redirect, a page the app opens), and
+ * every page in it can post to the `appwrap` channel — so without a gate a foreign page reads the app's
+ * keychain (`storage.secure`), files, cookies, contacts… The APP's own origin keeps the full bridge:
+ * the bundled `app://localhost`, the server loader's origin (incl. an allowlisted env override), and
+ * `appBoundDomains`. Any other origin (or an unknown one) gets only FOREIGN_ALLOWED: UI feedback and
+ * permission-prompted features that expose no stored app data.
+ */
+const FOREIGN_ALLOWED = [
+  'app.handshake', 'app.environment', 'device.info', 'network.status',
+  'haptics.', 'toast.', 'keyboard.', 'ui.', 'screen.', 'scanner.', 'push.', 'share.share',
+];
+
+/** `scheme://host[:port]` of a URL, lowercased, default ports dropped; '' if unparseable. */
+export function originOf(url: string | null | undefined): string {
+  const m = /^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)/i.exec(String(url || ''));
+  if (!m) return '';
+  const scheme = m[1].toLowerCase();
+  const host = (m[2].split('@').pop() || '').toLowerCase();
+  const dflt = scheme === 'https' ? ':443' : scheme === 'http' ? ':80' : '';
+  return `${scheme}://${dflt && host.endsWith(dflt) ? host.slice(0, -dflt.length) : host}`;
+}
+
+/** Is `origin` the app's own (full bridge)? Fail-closed: an empty/unknown origin is foreign. */
+export function isTrustedOrigin(origin: string | null | undefined): boolean {
+  const o = originOf(origin);
+  if (!o) return false;
+  if (o === 'app://localhost' || (SHELL_CONFIG.loader === 'file' && o === 'file://')) return true;
+  if (SHELL_CONFIG.loader === 'server' && o === originOf(effectiveServerUrl())) return true;
+  return (SHELL_CONFIG.appBoundDomains ?? []).some((h) => o === `https://${String(h).toLowerCase()}`);
+}
+
+/** May a page of `origin` call `method`? */
+export function bridgeAllows(origin: string | null | undefined, method: string): boolean {
+  return isTrustedOrigin(origin) || FOREIGN_ALLOWED.some((a) => (a.endsWith('.') ? method.startsWith(a) : method === a));
+}

package/runtime/app/shell/bridge.ts

@@ -1,5 +1,6 @@
 import { isAndroid, isIOS } from '@nativescript/core';
 import { CustomWebView } from './custom-webview';
+import { bridgeAllows } from './bridge-origin';
 
 // params: any — the bridge payload is an untyped JSON object decoded from the WebView; each handler
 // narrows it to its own param shape at the call site.
@@ -39,7 +40,7 @@ export class Bridge {
    */
   attach(webView: CustomWebView): void {
     this.webView = webView;
-    webView.onAppwrapMessage = (json) => this.onMessage(json);
+    webView.onAppwrapMessage = (json, origin) => this.onMessage(json, origin);
   }
 
   detach(): void {
@@ -68,7 +69,8 @@ export class Bridge {
    * renderer would silently stall the retry loop and we would be back to the 60s lie. */
   static responseAttemptTimeoutMs = 3_000;
 
-  private async onMessage(json: string): Promise<void> {
+  /** `origin` = the calling frame's origin, from the transport (never from the page's own payload). */
+  private async onMessage(json: string, origin: string): Promise<void> {
     let req: RequestEnvelope;
     try {
       req = JSON.parse(json);
@@ -78,6 +80,11 @@ export class Bridge {
     }
     if (req.kind !== 'request' || !req.id || !req.method) return;
 
+    if (!bridgeAllows(origin, req.method)) {
+      console.warn(`Bridge: ${req.method} denied for foreign origin ${origin || '(unknown)'}`);
+      this.respond(req.id, undefined, { code: 'FORBIDDEN', message: `${req.method} is not available to ${origin || 'this page'}` });
+      return;
+    }
     const handler = this.handlers.get(req.method);
     if (!handler) {
       this.respond(req.id, undefined, { code: 'UNSUPPORTED', message: `No handler for ${req.method}` });

package/runtime/app/shell/custom-webview.android.ts

@@ -49,14 +49,15 @@ function getChromeClientClass(): any {
   chromeClientClass = (android.webkit.WebChromeClient as any).extend({
     onJsPrompt(
       view: android.webkit.WebView,
-      _url: string,
+      url: string,
       message: string,
       _defaultValue: string,
       result: android.webkit.JsPromptResult
     ): boolean {
       if (typeof message === 'string' && message.startsWith(PROMPT_PREFIX)) {
         result.confirm('');
-        CustomWebView.forNative(view)?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length));
+        // `url` = the page that called prompt() (the bridge gates on its origin).
+        CustomWebView.forNative(view)?.onAppwrapMessage?.(message.slice(PROMPT_PREFIX.length), url);
         return true;
       }
       return false; // genuine page prompt — default handling
@@ -91,7 +92,7 @@ function getChromeClientClass(): any {
  */
 export class CustomWebView extends WebView {
   /** Set by the bridge before load; receives raw envelope JSON. */
-  onAppwrapMessage: ((json: string) => void) | null = null;
+  onAppwrapMessage: ((json: string, origin: string) => void) | null = null;
 
   /**
    * A TLS handshake this view REFUSED (onReceivedSslError → handler.cancel()), pending attribution to the

package/runtime/app/shell/custom-webview.ios.ts

@@ -38,7 +38,9 @@ class AppwrapScriptHandler extends NSObject implements WKScriptMessageHandler {
     const body = message.body;
     // Envelopes always travel as JSON strings (protocol v1)
     if (view?.onAppwrapMessage && typeof body === 'string') {
-      view.onAppwrapMessage(body);
+      // The CALLING frame's origin (WebKit-reported, not page-controlled) — the bridge gates on it.
+      const so = message.frameInfo?.securityOrigin;
+      view.onAppwrapMessage(body, so ? `${so.protocol}://${so.host}${so.port ? `:${so.port}` : ''}` : '');
     } else {
       // Nothing to dispatch to (bridge detached / view gone) or a non-string body ⇒ this request is
       // DROPPED and can never be answered — the caller's watchdog will report a false TIMEOUT for it.
@@ -195,7 +197,7 @@ export class CustomWebView extends WebView {
   }
 
   /** Set by the bridge before load; receives raw envelope JSON. */
-  onAppwrapMessage: ((json: string) => void) | null = null;
+  onAppwrapMessage: ((json: string, origin: string) => void) | null = null;
   private _scriptHandler!: AppwrapScriptHandler; // retained — WKUserContentController holds it weakly
   private _logHandler!: AppwrapLogHandler; // retained — debug console-forwarding handler
   private _schemeHandler!: WKURLSchemeHandler;

package/runtime/app/shell/custom-webview.ts

@@ -7,7 +7,7 @@ import { WebView } from '@nativescript/core';
  */
 export class CustomWebView extends WebView {
   /** Set by the bridge before load; receives raw envelope JSON. */
-  onAppwrapMessage: ((json: string) => void) | null = null;
+  onAppwrapMessage: ((json: string, origin: string) => void) | null = null;
 
   /** Pause/resume the render + JS-timer pipeline on app background/foreground. Platform-specific
    * (see custom-webview.android.ts); no-op on iOS, which suspends rAF on its own. */

package/runtime/app/shell/handlers-webview.ts

@@ -2,6 +2,7 @@ import { Utils, isIOS, isAndroid, Application } from '@nativescript/core';
 import { bridge } from './bridge';
 import { createUiDelegate } from './ios-ui-delegate';
 import { handleWebPermissionRequest } from './android-helpers';
+import { SHELL_CONFIG } from './config';
 
 const err = (code: string, message: string) => Object.assign(new Error(message), { code });
 
@@ -274,7 +275,7 @@ function registerAndroid(): void {
     (view as any)._appwrapClients = [client, chrome]; // keep JS peers alive (NS GC doesn't see the native hold)
     const bg = host?.getBackground?.();
     if (bg instanceof android.graphics.drawable.ColorDrawable) view.setBackgroundColor(bg.getColor());
-    android.webkit.WebView.setWebContentsDebuggingEnabled(true);
+    if (SHELL_CONFIG.debug) android.webkit.WebView.setWebContentsDebuggingEnabled(true); // remote DevTools only in debug builds, never store builds
     wv = view;
     frame.addView(view);
     layout();

package/runtime/tests/bridge-origin.test.ts

@@ -0,0 +1,68 @@
+import { describe, expect, mock, test } from 'bun:test';
+
+// Same superset @nativescript/core mock as the other runtime tests (shared module cache).
+mock.module('@nativescript/core', () => ({
+  Http: { request: async () => ({ content: null }) },
+  isIOS: false, isAndroid: false, WebView: class {},
+  ApplicationSettings: { getString: (_k: string, d = '') => d, setString: () => {}, remove: () => {} },
+  Dialogs: { confirm: async () => true, action: async () => '', alert: async () => undefined, prompt: async () => ({ result: false, text: '' }) },
+  Utils: { dispatchToMainThread: (fn: () => void) => fn() },
+  Application: { on: () => {}, suspendEvent: 's', resumeEvent: 'r', orientationChangedEvent: 'o', android: {} },
+  Connectivity: { startMonitoring: () => {} },
+}));
+
+const { SHELL_CONFIG } = await import('../app/shell/config');
+const { Bridge } = await import('../app/shell/bridge');
+const { bridgeAllows, originOf } = await import('../app/shell/bridge-origin');
+
+/** A request from a page of `origin`; resolves with the response envelope the bridge delivers. */
+async function call(method: string, origin: string) {
+  const b = new Bridge();
+  const view: any = { onAppwrapMessage: null };
+  b.attach(view);
+  b.register(method, () => 'secret');
+  let out: any;
+  b.evalJs = async (js: string) => { out = JSON.parse(JSON.parse(js.slice(js.indexOf('(') + 1, js.lastIndexOf(')')))); };
+  view.onAppwrapMessage(JSON.stringify({ v: 1, id: 'k', kind: 'request', method }), origin);
+  await new Promise((r) => setTimeout(r, 20));
+  return out;
+}
+
+describe('Bridge origin gate — a foreign page must not reach the app’s stored data', () => {
+  test('the app origin keeps the full bridge', async () => {
+    expect((await call('storage.secure.get', 'app://localhost')).result).toBe('secret');
+  });
+
+  test('a foreign page (a LAN/Tailscale server) is FORBIDDEN storage.secure, fs, webview cookies', async () => {
+    for (const m of ['storage.secure.get', 'storage.get', 'fs.read', 'webview.getCookies', 'clipboard.read', 'share.files']) {
+      const r = await call(m, 'http://192.168.1.5:7707');
+      expect(r.result).toBeUndefined();
+      expect(r.error.code).toBe('FORBIDDEN');
+    }
+  });
+
+  test('an unknown origin fails closed', async () => {
+    expect((await call('storage.secure.get', '')).error.code).toBe('FORBIDDEN');
+  });
+
+  test('a foreign page keeps UI feedback + permission-prompted features', () => {
+    for (const m of ['haptics.impact', 'keyboard.hide', 'share.share', 'ui.statusBar.setStyle', 'push.register', 'app.handshake'])
+      expect(bridgeAllows('https://evil.example', m)).toBe(true);
+  });
+
+  test('server loader: its own origin (default port, any path) is trusted; a lookalike is not', () => {
+    const prev = { loader: SHELL_CONFIG.loader, serverUrl: SHELL_CONFIG.serverUrl };
+    Object.assign(SHELL_CONFIG, { loader: 'server', serverUrl: 'https://app.example.com/start?x=1' });
+    try {
+      expect(bridgeAllows('https://app.example.com:443', 'storage.secure.get')).toBe(true);
+      expect(bridgeAllows('https://app.example.com.evil.io', 'storage.secure.get')).toBe(false);
+      expect(bridgeAllows('http://app.example.com', 'storage.secure.get')).toBe(false);
+    } finally { Object.assign(SHELL_CONFIG, prev); }
+  });
+
+  test('originOf normalises', () => {
+    expect(originOf('HTTP://U:p@Host:80/a?b#c')).toBe('http://host');
+    expect(originOf('app://localhost/index.html')).toBe('app://localhost');
+    expect(originOf('not a url')).toBe('');
+  });
+});

package/runtime/tests/bridge-response-delivery.test.ts

@@ -22,7 +22,7 @@ function harness(evalImpl: (js: string) => Promise<unknown>) {
   b.attach(view);
   b.evalJs = evalImpl;
   const delivered: any[] = [];
-  const send = (method: string, id = 'k1') => view.onAppwrapMessage(JSON.stringify({ v: 1, id, kind: 'request', method }));
+  const send = (method: string, id = 'k1') => view.onAppwrapMessage(JSON.stringify({ v: 1, id, kind: 'request', method }), 'app://localhost');
   /** Parse an envelope back out of the `window.__appwrapDeliver("…")` script the bridge builds. */
   const parse = (js: string) => JSON.parse(JSON.parse(js.slice(js.indexOf('(') + 1, js.lastIndexOf(')'))));
   return { b, send, delivered, parse };