To improve app security, validate URLs before the container calls them. Calls to URLs that are not on the whitelist are blocked.
Validate URLs before calling the following interfaces:
public class MPNebula {
/**
* Starts an online URL.
*
* @param url The online URL.
*/
public static void startUrl(String url);
/**
* Starts an online URL.
*
* @param url The online URL.
* @param param The startup parameters.
*/
public static void startUrl(String url, Bundle param);
}
// Create a page.
public static final void openH5(String url) {
if (TextUtils.isEmpty(url)) {
return;
}
H5Service h5Service = LauncherApplicationAgent.getInstance().getMicroApplicationContext()
.findServiceByInterface(H5Service.class.getName());
H5Bundle bundle = new H5Bundle();
Bundle param = new Bundle();
// The online URL to open.
param.putString(H5Param.LONG_URL,url);
bundle.setParams(param);
if (h5Service != null) {
// Create the page synchronously.
H5Page h5Page=h5Service.createPage(activity,bundle);
// Create the page asynchronously.
h5Service.createPageAsync(activity, bundle, h5PageReadyListener);
}
}Important
Perform precise URL matching. At a minimum, match the scheme and host of the URI. Use regular expression (regex) matching with caution, or avoid it entirely. Do not use imprecise functions such as contains, startsWith, endsWith, or indexOf.