feat: incoming message origin validation for android

[michaeljsXu]

What changes are you making?

Add incoming message origin validation to Android, including exact origins, wildcard subdomains, default-port normalization, and IPv6 support. The cart origin and shop.app remain implicitly trusted when validation is enabled.

The SDK rejects non-HTTPS checkout loads and main-frame redirects, reports rejected messages through an optional callback, and isolates callback failures from checkout processing.

How to test

From platforms/android:

./gradlew :lib:testDebugUnitTest :lib:lintDebug :lib:apiCheck

[michaeljsXu]

• docs: incoming message origin validation across platforms #478
• feat: incoming message origin validation for react native #477
• feat: incoming message origin validation for ios #476
• feat: incoming message origin validation for android #475 👈 (View in Graphite)
• feat: incoming mesage origin validation for web #474
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

Package Size

Platform	Artifact	Base	Head	Delta
Android	release AAR	255.4 KiB	270.6 KiB	+15.2 KiB

Android file breakdown

File	Base	Head	Delta
classes.jar	270.1 KiB	286.1 KiB	+16.0 KiB
res/layout/checkout_view_content.xml	2.2 KiB	2.2 KiB	0 B
res/layout/checkout_sheet_content.xml	2.0 KiB	2.0 KiB	0 B
res/values/values.xml	1.2 KiB	1.2 KiB	0 B
R.txt	1.1 KiB	1.1 KiB	0 B
proguard.txt	798 B	798 B	0 B
AndroidManifest.xml	578 B	578 B	0 B
res/drawable/close.xml	431 B	431 B	0 B
res/menu/checkout_menu.xml	354 B	354 B	0 B
META-INF/com/android/build/gradle/aar-metadata.properties	157 B	157 B	0 B

Measured from the PR base SHA and PR head SHA. The file breakdown shows uncompressed sizes within each package artifact, so individual files do not sum to the compressed artifact total. This comment reports package artifact sizes only; it is not a final app binary-size report.

[bitrise]

Install this build

Open Tophat, select your target device, then click Install. Links open on the Mac running Tophat.

SDK	Install
Kotlin	Install with Tophat

Checkout Kit E2E results

Status	Suite	Target	Platform	OS version tag	Device
✅	tests/shared/launch-smoke.yaml	kotlin	android	latest	Google Pixel 9 Android 17.0

[kiftio]

Pretty minor thing.. But toIntOrNull() returns null when :

• no port was specified
• the specified port overflows Int

Which would mean an invalid value like https://*.example.com:999999999999

would basically drop the port part, and match on the default HTTP port, accepting messages from essentially a different origin.

Should we do something like this

   val parsedPort: Int? = when {
       port.isEmpty() -> null
       else -> port.toIntOrNull() ?: return null
   }

   OriginPattern.Wildcard(
       scheme = normalizedScheme,
       suffix = suffix.lowercase(),
       port = normalizedPort(normalizedScheme, parsedPort),
   )

With results

1. https://*.example.com
- parsedPort = null
- valid wildcard, default HTTPS port

https://*.example.com:8443
- parsedPort = 8443
- valid wildcard, port 8443

https://*.example.com:999999999999
- toIntOrNull() = null
- return null from parsePattern()
- invalid wildcard is ignored

[tiagocandido]

Good catch. Overflowing wildcard ports are now rejected, tests added.