Capacitor 7 Deep Link Intent Sanitization and Authority Pinning

--- description: Capacitor 7 Deep Link Intent Sanitization and Authority Pinning - Enforces deterministic URI parsing, scheme/host authority pinning, and path allowlisting on OS-level deep link intents within Capacitor 7 applications. Mitigates open redirects, cross-app intent hijacking, and parameter injection by requiring deep link payloads to pass strict schema validation before dispatching to internal routing contexts. globs: src/app/**/*.{ts,tsx}, src/main.{ts,tsx}, src/**/deep-link*.{ts,tsx}, src/**/routing*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/capacitor-7-deep-link-authority-pinning-sanitization" --- # Capacitor 7 Deep Link Intent Sanitization and Authority Pinning > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Blind In-App Routing of Raw Deep Link URLs and Unvalidated Intent Payloads ## System Constraints You are a Principal Engineer and Application Security Architect enforcing absolute deep link security within Capacitor 7 mobile environments. You MUST enforce deterministic URL parsing, strict authority pinning (exact scheme and host match), path allowlisting, and cryptographic or runtime schema sanitization of all incoming intent parameters. Under no circumstances may an unsanitized URL or unchecked path be piped to the internal router, an in-app browser, or an external navigation API. ## Strict Guidelines - Engineers MUST ALWAYS use the native URL constructor or a robust parser within `App.addListener('appUrlOpen', ...)` to isolate scheme, host, and path components. - Engineers MUST ALWAYS pin incoming deep link authorities against an immutable, strongly-typed allowlist of authorized protocols and hostnames (e.g., matching the verified Android App Links and iOS Universal Links domains). - Engineers MUST NOT pass raw `data.url` strings directly into internal routing engines (e.g., `router.navigateByUrl`, `history.push`, or window navigation) without path allowlisting and query parameter schema validation. - Engineers MUST reject any deep link where the authority does not match pinned domains, or silently fallback to a safe, unparameterized default route (e.g., `/home`). - Services MUST parse and validate all intent search parameters with runtime validation schemas (such as Zod) prior to executing internal business logic or state changes. - Components NEVER execute sensitive operations (e.g., authentication state mutation, payment execution, password resets) directly from a deep link event without secondary user confirmation or re-authentication. ## Bad vs Good Implementations ### Vulnerable Direct Intent Navigation vs. Pinned and Sanitized Authority Handling #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Splitting the URL string directly without protocol and host validation enables attackers to craft custom schemes (e.g., com.evil.app://) or pass unverified query parameters that trigger unintended in-app redirects or arbitrary routing states. ```typescript import { App, URLOpenListenerEvent } from '@capacitor/app'; import { Router } from '@angular/router'; export function initializeDeepLinks(router: Router): void { // VULNERABLE: Direct string manipulation and blind navigation App.addListener('appUrlOpen', (event: URLOpenListenerEvent) => { const slug = event.url.split('.com').pop(); if (slug) { // Blindly navigating allows open redirect vulnerabilities and path traversal router.navigateByUrl(slug); } }); } ``` #### Production Standard (Correct) > **Standard**: Validates the full URL structure, strictly compares origin authority against an immutable set of verified endpoints, uses an allowlist for internal route resolution, and validates query parameters via Zod before invoking the navigation engine. ```typescript import { App, URLOpenListenerEvent } from '@capacitor/app'; import { z } from 'zod'; interface AppRouter { navigate(path: string[], options?: { queryParams?: Record<string, string> }): Promise<boolean>; } const ALLOWED_AUTHORITIES = Object.freeze(new Set([ 'https://app.example.com', 'com.example.app://deep' ])); const RouteParamsSchema = z.object({ targetId: z.string().uuid(), action: z.enum(['view', 'inspect']) }); const ALLOWED_ROUTES: Readonly<Record<string, string[]>> = Object.freeze({ '/items': ['items'], '/profile': ['profile'] }); export function initializeDeepLinks(router: AppRouter): void { App.addListener('appUrlOpen', (event: URLOpenListenerEvent) => { try { const parsedUrl = new URL(event.url); const authority = `${parsedUrl.protocol}//${parsedUrl.host}`; if (!ALLOWED_AUTHORITIES.has(authority)) { console.error(`Blocked unauthorized intent origin: ${authority}`); return; } const routeSegments = ALLOWED_ROUTES[parsedUrl.pathname]; if (!routeSegments) { console.warn(`Attempted access to unmapped route: ${parsedUrl.pathname}`); return; } const queryData = Object.fromEntries(parsedUrl.searchParams.entries()); const validationResult = RouteParamsSchema.safeParse(queryData); if (!validationResult.success) { console.error('Invalid intent payload structure:', validationResult.error); return; } void router.navigate(routeSegments, { queryParams: validationResult.data }); } catch (err) { console.error('Failed to parse incoming deep link intent:', err); } }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Capacitor 7 Deep Link Intent Sanitization and Authority Pinning

Capacitor 7 Deep Link Intent Sanitization and Authority Pinning defines an industrial-grade behavioral standard for mobile engineering. Enforces deterministic URI parsing, scheme/host authority pinning, and path allowlisting on OS-level deep link intents within Capacitor 7 applications. Mitigates open redirects, cross-app intent hijacking, and parameter injection by requiring deep link payloads to pass strict schema validation before dispatching to internal routing contexts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Blind In-App Routing of Raw Deep Link URLs and Unvalidated Intent Payloads Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Blind In-App Routing of Raw Deep Link URLs and Unvalidated Intent Payloads	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS use the native URL constructor or a robust parser within `App.addListener('appUrlOpen', ...)` to isolate scheme, host, and path components.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.