security: Bridge代理fetch+移除跨域设置+CSP头限制

Browse Source

CRITICAL修复:
- 移除allowFileAccessFromFileURLs/allowUniversalAccessFromFileURLs
- 移除mixedContentMode=ALWAYS_ALLOW
- WebViewClient注入CSP: default-src 'none';script-src 'unsafe-inline';connect-src 'none'
- 新增Bridge.fetchManifest(channel)/Bridge.fetchText(path)原生HTTP代理
- manifest JSON + version.txt通过Bridge读取,无需WebView跨域

...

This commit is contained in:

LukeMackin

2026-07-21 23:02:00 +08:00

parent db8cfdf6e3

commit b88311a2d0

2 changed files with 53 additions and 3 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

BIN

packages/client-android/android/.gradle/buildOutputCleanup/buildOutputCleanup.lock

Binary file not shown.