ReactNativeWebview origin validation

[sirdeggen]

Serious Sonar Issue to Take Cautiously
https://sonarcloud.io/project/issues?s=IMPACT_RANK&severities=BLOCKER%2CCRITICAL%2CMAJOR%2CMINOR&sinceLeakPeriod=true&issueStatuses=OPEN%2CCONFIRMED&types=VULNERABILITY&id=bsv-blockchain_ts-stack&open=AaADYhNuXIT1OSYe3mrK

[sirdeggen]

Resolved by #485, merged to main as 705a761.

The state SonarCloud had analysed when this was filed (55f9eb2) read e.data from any message event with no origin check at all. #482 added a configured-domain comparison minutes later, but the default wildcard target that WalletClient discovery uses still verified nothing, and nothing ever checked which browsing context sent the message.

ReactNativeWebView now calls isBridgeDelivered before JSON.parse(e.data):

• the event must carry no source (a host-synthesized MessageEvent), come from this window, or come from the frame bridging for it;
• a relaying host frame is a separate browsing context, so its browser-attested origin must be this document's origin (window.origin) or the configured wallet origin;
• an exact configured domain still pins responses with the same error string as before.

Framed documents, openers, and sandboxed frames reporting the opaque "null" origin can no longer answer a BRC-100 invocation. The wire format is unchanged — same stringified CWI envelope, same type/id/isInvocation matching, same WalletError identities — and the React Native host behaviours that worked before still work, each covered by a test: bridge injections with no origin and no source, window.postMessage(response, '*'), synthesized events that stamp their own origin token, and host-frame relays.

One thing worth a maintainer's eye: closing this issue should be confirmed against the next main analysis on SonarCloud. sonarcloud.io is blocked by the egress policy of the environment the fix was developed in, so the finding's state could not be read directly; findings were reproduced locally with eslint-plugin-sonarjs and the exact-head repository quality gate reported zero new Sonar findings on the merged head.

---

Generated by Claude Code