fix(web3): sanitize chain RPC URL before injecting into in-app browser (UXSS)

[jim-daf]

Sanitize the chain RPC URL before injecting it into in-app browser pages

Resolves #2686 - Universal XSS via wallet_addEthereumChain RPC URL.

The vulnerability

JsInjectorClient.loadInitJs(...) builds the JavaScript that is injected into
every page loaded in the AlphaWallet dApp browser by interpolating the active
chain's RPC URL into a template with String.format:

return String.format(initSrc, address, rpcUrl, chainId);

The RPC URL is whatever value the network record holds, which a malicious dApp
can control by calling wallet_addEthereumChain with a payload like:

rpcUrls: ['https://rpc-mumbai.matic.today/x"+alert(document.domain)+"']

After the user accepts the new chain (a benign-looking confirmation), every
subsequent page loaded in the in-app browser is poisoned with the attacker's
JavaScript, executed in the origin of that page — a classic stored UXSS.

What this PR does

app/src/main/java/com/alphawallet/app/web3/JsInjectorClient.java:

1. Adds sanitizeRpcUrl(String) which:
   • rejects empty input;
   • rejects URLs containing characters that have meaning inside a JavaScript
     string literal (", ', \, <, >, CR, LF, tab, other control
     bytes);
   • parses with OkHttp's HttpUrl.parse(...) and rejects anything that
     isn't a valid http/https URL;
   • returns the canonical, normalized URL and re-checks it for unsafe
     characters in case the parser decoded any.
2. Pipes the value resolved by
   EthereumNetworkRepository.getDefaultNodeURL(chainId) through that helper
   inside both setChainId and setTSChainId so the field stored on the
   client is always safe to splice.
3. Coalesces a null rpcUrl to "" in loadInitJs so String.format never
   sees null after the change.

[Copilot]

Pull request overview

This PR mitigates a stored universal-XSS (UXSS) vector in AlphaWallet’s in-app dApp browser by sanitizing the active chain’s RPC URL before it is interpolated into injected JavaScript.

Changes:

• Introduces sanitizeRpcUrl(String) to validate/normalize RPC URLs and reject inputs unsafe for JS string literal splicing.
• Applies RPC URL sanitization when setting chainId for both normal and TokenScript injection paths.
• Ensures loadInitJs never passes a null RPC URL into String.format.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.