resolveExternalUrl function

ExternalUrlDecision resolveExternalUrl(
  1. String url
)

Decides whether an OPEN_EXTERNAL_URL url should be opened externally.

Defense-in-depth: the web content is trusted, but we still refuse anything outside allowedExternalUrlSchemes so a compromised or injected page can't drive arbitrary app-to-app deep links (tel:, mailto:, market:, custom schemes, etc.) through LaunchMode.externalApplication.

Implementation

ExternalUrlDecision resolveExternalUrl(String url) {
  if (url.isEmpty) return ExternalUrlDecision.empty;

  final uri = Uri.tryParse(url);
  if (uri == null ||
      !allowedExternalUrlSchemes.contains(uri.scheme.toLowerCase())) {
    return ExternalUrlDecision.disallowedScheme;
  }

  return ExternalUrlDecision.launch;
}