Mobile Bridge

// Hosts allowed to reach the bridge: any sub-domain of paylead.fr / .tech / .eu
val allowedHost = Regex("""\.paylead\.(fr|tech|eu)$""")

webView.addJavascriptInterface(PayleadBridgeInterface(webView), "PayleadBridge")

webView.webViewClient = object : WebViewClient() {
    override fun shouldOverrideUrlLoading(
        view: WebView, request: WebResourceRequest
    ): Boolean {
        val host = request.url.host ?: return true
        return !allowedHost.containsMatchIn(host) // true = navigation blocked
    }
}

class PayleadBridgeInterface(private val webView: WebView) {
    @JavascriptInterface
    fun postMessage(json: String) {
        webView.post {
            // Defense in depth: re-check the current URL on every call
            val host = Uri.parse(webView.url).host ?: return@post
            if (!allowedHost.containsMatchIn(host)) return@post

            val request = try { JSONObject(json) } catch (_: Exception) { return@post }
            if (request.optString("jsonrpc") != "2.0") return@post
            val method = request.optString("method").ifEmpty { return@post }
            val id = request.optString("id").ifEmpty { return@post }
            val params = request.optJSONObject("params") ?: JSONObject()
            // Validate params against the method's JSON Schema (schema.json).
            // On failure respond with error code -32602 (Invalid params).
            if (!validateParams(method, params)) return@post

            handleBridgeMethod(method, params) { result ->
                val response = JSONObject().apply {
                    put("jsonrpc", "2.0"); put("result", result); put("id", id)
                }
                webView.post {
                    // Safe: JSONObject.quote() properly escapes the JSON string
                    webView.evaluateJavascript(
                        "window.payleadBridge.response(${JSONObject.quote(response.toString())})", null
                    )
                }
            }
        }
    }
}

final controller = WebViewController()
  ..setJavaScriptMode(JavaScriptMode.unrestricted)
  ..addJavaScriptChannel(
    'PayleadBridge',
    onMessageReceived: (JavaScriptMessage message) => _handlePostMessage(message.message),
  );

Future<void> _dispatch(Map<String, dynamic> response) async {
  final jsonStr = jsonEncode(response); // dart:convert — never manual string concatenation
  final escaped = jsonStr.replaceAll('\\', '\\\\').replaceAll("'", "\\'");
  // `controller` here must be the live controller — see warning below
  await controller.runJavaScript("window.payleadBridge.response('$escaped');");
}