fix(web): isolate untrusted remote content

app/src/main/java/one/mixin/android/ui/conversation/holder/AppCard.kt

@@ -55,6 +55,7 @@ import one.mixin.android.compose.CoilImage
 import one.mixin.android.compose.theme.MixinAppTheme
 import one.mixin.android.extension.defaultSharedPreferences
 import one.mixin.android.vo.AppCardData
+import one.mixin.android.vo.safeAppCardImageUrl
 import java.util.regex.Pattern
 
 @OptIn(ExperimentalFoundationApi::class)
@@ -92,9 +93,11 @@ fun AppCard(
                 interactionSource = remember { MutableInteractionSource() },
                 onClick = contentClick, onLongClick = contentLongClick
             )) {
-            if (!appCardData.coverUrl.isNullOrBlank()) {
+            val mediaCoverUrl = appCardData.coverUrl.safeAppCardImageUrl()
+            val nestedCoverUrl = appCardData.cover?.url.safeAppCardImageUrl()
+            if (mediaCoverUrl != null) {
                 CoilImage(
-                    model = appCardData.coverUrl,
+                    model = mediaCoverUrl,
                     placeholder = R.drawable.bot_default,
                     contentScale = ContentScale.Crop,
                     modifier = Modifier
@@ -118,9 +121,9 @@ fun AppCard(
                             }
                         )
                 )
-            } else if (appCardData.cover != null) {
+            } else if (appCardData.cover != null && nestedCoverUrl != null) {
                 CoilImage(
-                    model = appCardData.cover.url,
+                    model = nestedCoverUrl,
                     placeholder = appCardData.cover.thumbnailDrawable,
                     contentScale = ContentScale.Crop,
                     modifier = Modifier
@@ -386,7 +389,6 @@ fun ClickableTextWithUrlsAndBots(
         }
     }
 }
-
 internal fun appCardMentionDisplayText(
     identityNumber: String,
     mentionUserMap: Map<String, String>,

app/src/main/java/one/mixin/android/ui/media/pager/MediaPagerActivity.kt

@@ -42,8 +42,6 @@ import androidx.media3.common.util.UnstableApi
 import androidx.paging.PagedList
 import androidx.viewpager2.widget.ViewPager2
 import coil3.imageLoader
-import coil3.request.ImageRequest
-import coil3.request.SuccessResult
 import com.uber.autodispose.autoDispose
 import dagger.hilt.android.AndroidEntryPoint
 import kotlinx.coroutines.Dispatchers
@@ -86,7 +84,6 @@ import one.mixin.android.util.AnimationProperties
 import one.mixin.android.util.SensorOrientationChangeNotifier
 import one.mixin.android.util.SystemUIManager
 import one.mixin.android.util.VideoPlayer
-import one.mixin.android.util.image.withDiskCacheFile
 import one.mixin.android.util.reportEvent
 import one.mixin.android.util.rxpermission.RxPermissions
 import one.mixin.android.vo.FixedMessageDataSource
@@ -471,20 +468,14 @@ class MediaPagerActivity : BaseActivity(), DismissFrameLayout.OnDismissListener,
         val coverUrl = item.appCardMediaCoverUrl()
         if (coverUrl != null) {
             return try {
-                val loader = imageLoader
-                val result = loader.execute(ImageRequest.Builder(this).data(coverUrl).build())
-                if (result !is SuccessResult) {
-                    null
-                } else {
-                    loader.withDiskCacheFile(result) { cachedFile ->
-                        val destination = createAppCardCoverCacheFile()
-                        try {
-                            cachedFile.copy(destination)
-                            destination
-                        } catch (e: Exception) {
-                            destination.delete()
-                            throw e
-                        }
+                imageLoader.diskCache?.openSnapshot(coverUrl)?.use { snapshot ->
+                    val destination = createAppCardCoverCacheFile()
+                    try {
+                        snapshot.data.toFile().copy(destination)
+                        destination
+                    } catch (e: Exception) {
+                        destination.delete()
+                        throw e
                     }
                 }
             } catch (e: Exception) {

app/src/main/java/one/mixin/android/ui/search/SearchExploreFragment.kt

@@ -196,7 +196,7 @@ class SearchExploreFragment : BaseFragment(R.layout.fragment_search_explore) {
 
                 override fun onDappClick(dapp: Dapp) {
                     searchViewModel.saveRecentSearch(requireContext().defaultSharedPreferences, RecentSearch(RecentSearchType.DAPP, iconUrl = dapp.iconUrl, title = dapp.name, subTitle = dapp.homeUrl))
-                    WebActivity.show(requireContext(), dapp.homeUrl, null)
+                    WebActivity.show(requireContext(), dapp.homeUrl, null, allowWalletBridge = true)
                 }
 
                 override fun onTipClick() {
@@ -241,7 +241,7 @@ class SearchExploreFragment : BaseFragment(R.layout.fragment_search_explore) {
             binding.recent.setContent {
                 RecentSearchPage ({ dapp ->
                     searchViewModel.saveRecentSearch(requireContext().defaultSharedPreferences, RecentSearch(RecentSearchType.DAPP, iconUrl = dapp.iconUrl, title = dapp.name, subTitle = dapp.homeUrl))
-                    WebActivity.show(requireContext(), dapp.homeUrl, null)
+                    WebActivity.show(requireContext(), dapp.homeUrl, null, allowWalletBridge = true)
                 }, {search->
                     when(search.type){
                         RecentSearchType.BOT-> {
@@ -263,7 +263,12 @@ class SearchExploreFragment : BaseFragment(R.layout.fragment_search_explore) {
                             }
                         }
                         RecentSearchType.DAPP->{
-                            WebActivity.show(requireContext(), search.subTitle?:"", null)
+                            WebActivity.show(
+                                requireContext(),
+                                search.subTitle ?: "",
+                                null,
+                                allowWalletBridge = true,
+                            )
                         }
                         RecentSearchType.LINK->{
                             search.subTitle?.openAsUrlOrWeb(requireContext(), null, parentFragmentManager, lifecycleScope)

app/src/main/java/one/mixin/android/ui/search/SearchSingleFragment.kt

@@ -160,7 +160,7 @@ class SearchSingleFragment : BaseFragment(R.layout.fragment_search_single) {
                 override fun onDappClick(dapp: Dapp) {
                     searchViewModel.saveRecentSearch(requireContext().defaultSharedPreferences, RecentSearch(RecentSearchType.DAPP, iconUrl = dapp.iconUrl, title = dapp.name, subTitle = dapp.homeUrl))
                     RxBus.publish(SearchEvent())
-                    WebActivity.show(requireContext(), dapp.homeUrl, null)
+                    WebActivity.show(requireContext(), dapp.homeUrl, null, allowWalletBridge = true)
                 }
 
                 override fun onBotClick(bot: SearchBot) {

app/src/main/java/one/mixin/android/ui/web/FloatingManager.kt

@@ -145,6 +145,8 @@ data class WebClip(
     val conversationId: String?,
     @SerializedName("shareable")
     val shareable: Boolean?,
+    @SerializedName("injectable")
+    val injectable: Boolean,
     @Transient val webView: MixinWebView?,
     @Transient val isFinished: Boolean = false,
 )

app/src/main/java/one/mixin/android/ui/web/WebActivity.kt

@@ -17,6 +17,7 @@ import one.mixin.android.extension.blurBitmap
 import one.mixin.android.extension.colorFromAttribute
 import one.mixin.android.extension.isDarkColor
 import one.mixin.android.extension.isNightMode
+import one.mixin.android.extension.matchResourcePattern
 import one.mixin.android.extension.openCustomerServiceIfMatched
 import one.mixin.android.extension.supportsS
 import one.mixin.android.session.Session
@@ -27,6 +28,13 @@ import one.mixin.android.vo.AppCardData
 import one.mixin.android.vo.generateConversationId
 import one.mixin.android.widget.SixLayout
 
+private fun isTrustedAppWebUrl(url: String, app: App?): Boolean =
+    app != null &&
+        (
+            url.matchResourcePattern(app.resourcePatterns) ||
+                isTrustedWebUrl(url, secureWebOrigin(app.homeUri))
+        )
+
 @AndroidEntryPoint
 class WebActivity : BaseActivity() {
     companion object {
@@ -48,7 +56,8 @@ class WebActivity : BaseActivity() {
             app: App? = null,
             appCard: AppCardData? = null,
             saveName: Boolean? = null,
-            fixedTitle: String? = null
+            fixedTitle: String? = null,
+            allowWalletBridge: Boolean = false,
         ) {
             if (context.openCustomerServiceIfMatched(url)) {
                 return
@@ -72,6 +81,13 @@ class WebActivity : BaseActivity() {
                             putParcelable(WebFragment.ARGS_APP_CARD, appCard)
                             putBoolean(WebFragment.ARGS_SAVE_NAME, saveName ?: false)
                             putString(WebFragment.ARGS_FIXED_TITLE, fixedTitle)
+                            val bridgePolicy = webBridgePolicy(
+                                trustedAppUrl = appCard?.appId != null ||
+                                    isTrustedAppWebUrl(url, app),
+                                dappBrowser = allowWalletBridge,
+                            )
+                            putBoolean(WebFragment.ARGS_MIXIN_CONTEXT, bridgePolicy.mixinContext)
+                            putBoolean(WebFragment.ARGS_INJECTABLE, bridgePolicy.wallet)
                         },
                     )
                 },
@@ -183,6 +199,12 @@ class WebActivity : BaseActivity() {
         extras.putInt(WebFragment.ARGS_INDEX, index)
         extras.putParcelable(WebFragment.ARGS_APP, clip.app)
         clip.shareable?.let { extras.putBoolean(WebFragment.ARGS_SHAREABLE, it) }
+        val bridgePolicy = webBridgePolicy(
+            trustedAppUrl = isTrustedAppWebUrl(clip.url, clip.app),
+            dappBrowser = clip.injectable,
+        )
+        extras.putBoolean(WebFragment.ARGS_MIXIN_CONTEXT, bridgePolicy.mixinContext)
+        extras.putBoolean(WebFragment.ARGS_INJECTABLE, bridgePolicy.wallet)
         isExpand = true
         val safeColor: Int = clip.titleColor.apply {
             val isDark: Boolean = isDarkColor(this)

app/src/main/java/one/mixin/android/ui/web/WebBridgePolicy.kt

@@ -0,0 +1,15 @@
+package one.mixin.android.ui.web
+
+internal data class WebBridgePolicy(
+    val mixinContext: Boolean,
+    val wallet: Boolean,
+)
+
+internal fun webBridgePolicy(
+    trustedAppUrl: Boolean,
+    dappBrowser: Boolean,
+): WebBridgePolicy =
+    WebBridgePolicy(
+        mixinContext = trustedAppUrl,
+        wallet = trustedAppUrl || dappBrowser,
+    )