Skip to content

Commit 48aab08

Browse files
SuyunmengSuyunmeng
authored
fix(ios): tighten App Store 2.5.2 compliance for WebView and ATS (#74)
1 parent a51ea0b commit 48aab08

3 files changed

Lines changed: 67 additions & 50 deletions

File tree

‎ios/README_iOS_CONFIG.md‎

Lines changed: 2 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,6 @@ OpenList需要访问本地HTTP服务（如 `http://127.0.0.1`），这在iOS中
8585
```xml
8686
<key>NSAppTransportSecurity</key>
8787
<dict>
88-
<key>NSAllowsArbitraryLoads</key>
89-
<true/>
9088
<key>NSExceptionDomains</key>
9189
<dict>
9290
<key>localhost</key>
@@ -103,13 +101,6 @@ OpenList需要访问本地HTTP服务（如 `http://127.0.0.1`），这在iOS中
103101
<key>NSExceptionMinimumTLSVersion</key>
104102
<string>TLSv1.0</string>
105103
</dict>
106-
<key>0.0.0.0</key>
107-
<dict>
108-
<key>NSExceptionAllowsInsecureHTTPLoads</key>
109-
<true/>
110-
<key>NSExceptionMinimumTLSVersion</key>
111-
<string>TLSv1.0</string>
112-
</dict>
113104
</dict>
114105
</dict>
115106
```
@@ -118,15 +109,14 @@ OpenList需要访问本地HTTP服务（如 `http://127.0.0.1`），这在iOS中
118109
1. **iOS App Transport Security (ATS)** 默认阻止所有HTTP连接
119110
2. **本地服务访问** - OpenList需要连接到 `http://127.0.0.1` 的本地服务
120111
3. **开发和调试** - 允许连接到本地开发服务器
121-
4. **安全性平衡** - 只允许特定的本地地址，而不是完全禁用ATS
112+
4. **安全性平衡** - 仅为本地环回地址提供例外，保持 ATS 默认保护
122113

123114
### 支持的本地地址：
124115
- `localhost` - 标准本地主机名
125116
- `127.0.0.1` - IPv4回环地址
126-
- `0.0.0.0` - 所有接口绑定地址
127117

128118
### 生产环境建议：
129-
如果生产版本不需要访问本地HTTP服务，可以考虑移除 `NSAllowsArbitraryLoads` 配置，只保留特定域名的例外。
119+
如果生产版本不需要访问本地HTTP服务，可以进一步移除 `NSExceptionDomains` 的本地例外配置。
130120

131121
## 8. 后台模式配置（如需要）
132122
在Info.plist中添加后台模式：

‎ios/Runner/Info.plist‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,6 @@
6767
<false/>
6868
<key>NSAppTransportSecurity</key>
6969
<dict>
70-
<key>NSAllowsArbitraryLoads</key>
71-
<true/>
7270
<key>NSExceptionDomains</key>
7371
<dict>
7472
<key>localhost</key>
@@ -85,13 +83,6 @@
8583
<key>NSExceptionMinimumTLSVersion</key>
8684
<string>TLSv1.0</string>
8785
</dict>
88-
<key>0.0.0.0</key>
89-
<dict>
90-
<key>NSExceptionAllowsInsecureHTTPLoads</key>
91-
<true/>
92-
<key>NSExceptionMinimumTLSVersion</key>
93-
<string>TLSv1.0</string>
94-
</dict>
9586
</dict>
9687
</dict>
9788
<key>UIBackgroundModes</key>

‎lib/pages/web/web.dart‎

Lines changed: 65 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
import 'dart:developer';
2+
import 'dart:io' show Platform;
23

34
import 'package:openlist_mobile/contant/native_bridge.dart';
45
import 'package:openlist_mobile/generated_api.dart';
@@ -34,7 +35,7 @@ class WebScreenState extends State<WebScreen> with WidgetsBindingObserver {
3435
// iOS specific: Enable page caching and state preservation
3536
cacheEnabled: true,
3637
sharedCookiesEnabled: true,
37-
limitsNavigationsToAppBoundDomains: false,
38+
limitsNavigationsToAppBoundDomains: Platform.isIOS,
3839
// Enable disk and memory cache for better state preservation
3940
cacheMode: CacheMode.LOAD_DEFAULT,
4041
// Prevent WebView from being suspended in background
@@ -48,6 +49,56 @@ class WebScreenState extends State<WebScreen> with WidgetsBindingObserver {
4849
bool _canGoBack = false;
4950
bool _isLoading = false;
5051

52+
static const Set<String> _inAppSafeSchemes = {
53+
"about",
54+
"data",
55+
"file",
56+
};
57+
58+
bool _isLoopbackHost(String host) {
59+
final normalized = host.toLowerCase();
60+
return normalized == "localhost" ||
61+
normalized == "127.0.0.1" ||
62+
normalized == "::1";
63+
}
64+
65+
bool _isAllowedInAppNavigation(Uri uri) {
66+
final scheme = uri.scheme.toLowerCase();
67+
68+
if (_inAppSafeSchemes.contains(scheme)) {
69+
return true;
70+
}
71+
72+
if (scheme == "http" || scheme == "https") {
73+
if (!Platform.isIOS) {
74+
return true;
75+
}
76+
return _isLoopbackHost(uri.host);
77+
}
78+
79+
return false;
80+
}
81+
82+
Future<void> _openExternalUri(String uriString) async {
83+
final silentMode = await NativeBridge.appConfig.isSilentJumpAppEnabled();
84+
if (silentMode) {
85+
NativeCommon().startActivityFromUri(uriString);
86+
return;
87+
}
88+
89+
if (!mounted) return;
90+
91+
Get.showSnackbar(GetSnackBar(
92+
message: S.current.jumpToOtherApp,
93+
duration: const Duration(seconds: 5),
94+
mainButton: TextButton(
95+
onPressed: () {
96+
NativeCommon().startActivityFromUri(uriString);
97+
},
98+
child: Text(S.current.goTo),
99+
)));
100+
}
101+
51102
onClickNavigationBar() {
52103
log("onClickNavigationBar");
53104
_webViewController?.reload();
@@ -156,38 +207,23 @@ class WebScreenState extends State<WebScreen> with WidgetsBindingObserver {
156207
shouldOverrideUrlLoading: (controller, navigationAction) async {
157208
log("shouldOverrideUrlLoading ${navigationAction.request.url}");
158209

159-
var uri = navigationAction.request.url!;
160-
if (![
161-
"http",
162-
"https",
163-
"file",
164-
"chrome",
165-
"data",
166-
"javascript",
167-
"about"
168-
].contains(uri.scheme)) {
169-
log("shouldOverrideUrlLoading ${uri.toString()}");
170-
final silentMode =
171-
await NativeBridge.appConfig.isSilentJumpAppEnabled();
172-
if (silentMode) {
173-
NativeCommon().startActivityFromUri(uri.toString());
174-
} else {
175-
Get.showSnackbar(GetSnackBar(
176-
message: S.current.jumpToOtherApp,
177-
duration: const Duration(seconds: 5),
178-
mainButton: TextButton(
179-
onPressed: () {
180-
NativeCommon()
181-
.startActivityFromUri(uri.toString());
182-
},
183-
child: Text(S.current.goTo),
184-
)));
185-
}
210+
final uri = navigationAction.request.url;
211+
if (uri == null) {
212+
return NavigationActionPolicy.CANCEL;
213+
}
214+
215+
if (_isAllowedInAppNavigation(uri)) {
216+
return NavigationActionPolicy.ALLOW;
217+
}
186218

219+
final scheme = uri.scheme.toLowerCase();
220+
if (Platform.isIOS && scheme == "javascript") {
221+
log("Blocked javascript navigation on iOS: ${uri.toString()}");
187222
return NavigationActionPolicy.CANCEL;
188223
}
189224

190-
return NavigationActionPolicy.ALLOW;
225+
await _openExternalUri(uri.toString());
226+
return NavigationActionPolicy.CANCEL;
191227
},
192228
onReceivedError: (controller, request, error) async {
193229
log("WebView error: ${error.description}");

0 commit comments

Comments
 (0)