CP-12388: setup deepLink whitelist (#3334)

Author: ruijialin-avalabs

packages/core-mobile/app/contexts/DeeplinkContext/consts.ts

@@ -0,0 +1,45 @@
+/**
+ * This is the whitelist of deeplinks that are allowed to be opened in the app
+ * It is used to prevent malicious deeplinks from being opened in the app
+ * It is also used to prevent deeplinks from being opened in the app that are not allowed
+ **/
+export const DEEPLINK_WHITELIST = [
+  'core://solanaLaunch',
+  'core://stakecomplete',
+  'core://watchlist',
+  'core://portfolio',
+  'core://onrampcompleted',
+  'core://offrampcompleted',
+  'core://receive',
+  'core://trackTokenDetail',
+  'core://track',
+  'core://meld/onramp',
+  'core://meld/offramp',
+  'core://stake',
+  'core://claimStakeReward',
+  'core://addStake',
+  'core://discoverCollectibles',
+  'core://collectibleManagement',
+  'core://tokenManagement',
+  'core://send',
+  'core://swap',
+  'core://walletConnectScan',
+  'core://activity',
+  'core://browser',
+  'core://browser/tabs',
+  'core://browser/history',
+  'core://accountSettings',
+  'core://accountSettings/selectCurrency',
+  'core://accountSettings/selectAppearance',
+  'core://accountSettings/securityAndPrivacy',
+  'core://accountSettings/connectedSites',
+  'core://accountSettings/changePin',
+  'core://accountSettings/manageAccounts',
+  'core://accountSettings/manageNetworks',
+  'core://accountSettings/addressBook',
+  'core://accountSettings/selectAvatar',
+  'core://accountSettings/notificationPreferences',
+  'core://accountSettings/importWallet',
+  'core://accountSettings/importPrivateKey',
+  'core://accountSettings/importSeedWallet'
+]

packages/core-mobile/app/contexts/DeeplinkContext/utils/handleDeeplink.ts

@@ -11,6 +11,11 @@ import { dismissMeldStack } from 'features/meld/utils'
 import { offrampSend } from 'store/meld/slice'
 import { closeInAppBrowser } from 'utils/openInAppBrowser'
 import { ACTIONS, DeepLink, PROTOCOLS } from '../types'
+import { DEEPLINK_WHITELIST } from '../consts'
+
+const lowercasedDeeplinkWhitelist = DEEPLINK_WHITELIST.map(url =>
+  url.toLowerCase()
+)
 
 export const handleDeeplink = ({
   deeplink,
@@ -74,6 +79,11 @@ export const handleDeeplink = ({
         closeInAppBrowser()
         dismissMeldStack(action, searchParams)
       } else {
+        const baseUrl = deeplink.url.split('?')[0]?.toLowerCase()
+        if (baseUrl && !lowercasedDeeplinkWhitelist.includes(baseUrl)) {
+          Logger.warn(`${deeplink.url} is not allowed to be opened in the app`)
+          return
+        }
         const path = deeplink.url.split(':/')[1]
         path && navigateFromDeeplinkUrl(path)
       }