feat: remote module security

[NathanWalker]

Matching: NativeScript/ios#331

In general, fixing incomplete URL substring sanitization means never treating the entire URL as an opaque string when validating hosts. Instead, parse each URL with a standard URL parser, extract the host or hostname, and compare that to an explicit allowlist of known-good hosts (or exact URL prefixes), avoiding substring checks that can be bypassed with crafted domains or paths.

In this file, the risky pattern appears only in the test that validates the remoteModuleAllowlist contents:

for (var i = 0; i < allowlist.length; i++) {
    if (allowlist[i].indexOf("esm.sh") !== -1) hasEsmSh = true;
    if (allowlist[i].indexOf("cdn.example.com") !== -1) hasCdn = true;
}

We can keep the test’s intent (“the allowlist contains an entry for esm.sh and one for cdn.example.com”) while eliminating substring-matching on the whole URL. The most robust way, without changing existing functionality, is:

1. Attempt to parse each allowlist[i] as a URL using the standard URL constructor available in modern JavaScript runtimes.
2. If parsing succeeds, check url.hostname === "esm.sh" or url.hostname === "cdn.example.com".
3. If parsing fails (e.g., the allowlist contains bare host strings rather than full URLs), fall back to comparing the raw string to those hostnames. This ensures the test still passes with current configurations while avoiding substring issues on actual URLs.

This change is local to the it("should parse security remoteModuleAllowlist from package.json", ...) test block in testRemoteModuleSecurity.js around lines 96–102. No new external libraries are needed; we only rely on the built-in URL global.

---