TikTok webview allowlist-bypass — lrd0036

Bare boguefala.us was blocked "unsafe". The allowlist match is indexOf (substring) on hostname+pathname, so embedding an allowlisted token should slip past. WIN = red PoC page renders inside TikTok. On the page, a populated webkit.messageHandlers = the native bridge was injected into our origin.

1 · baseline (should still be blocked)

2 · hostname-substring bypass (host contains "tiktok.com")

3 · path-injection bypass (path contains allowlisted token)

4 · userinfo / fragment parser confusion

5 · controls