[tomas-martins-crossmint]

This pull request makes the signer webview trust only the signer page it loaded. Messages from iframes or from any other origin are dropped, and the page can't navigate away from the signer origin

The signer page has no iframes and never navigates, so apps see no difference. The trusted origin comes from the URL the SDK loads, so production and staging both work with no list to keep up to date

Changes

• DefaultWebViewCommunicationProxy handles a message only when it comes from the main frame and the origin of the loaded URL
• A new webView(_:decidePolicyFor:decisionHandler:) allows main frame navigation only within that origin
• Dropped messages log signer.message.dropped and blocked navigations log signer.navigation.blocked
• Tests load a fake signer page and a fake foreign page with an iframe in a real webview, and check that only the signer page's main frame messages reach the handler

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The changes appear safe to merge.

_{Reviews (2) · Last reviewed commit: "Test signer navigation through WebKit an..." · Reviewed by Greptile}