加固后怎样复测 WebView JS Bridge

import android.webkit.JavascriptInterface
import android.webkit.WebView
import android.webkit.WebViewClient
import android.net.Uri
import org.junit.Assert.assertTrue
import org.junit.Assert.fail
import org.junit.Test
import org.junit.runner.RunWith
import org.junit.runners.Parameterized
import java.lang.reflect.Method

@RunWith(Parameterized::class)
class BridgeExposureTest(private val targetBridgeClass: String) {
    companion object {
        @JvmStatic
        @Parameterized.Parameters(name = "bridgeClass={0}")
        fun bridgeClasses(): Collection<Array<String>> {
            // 基线清单：所有预期暴露给 JS 的类全限定名
            return listOf(arrayOf("com.example.bridge.AppBridge"))
        }
    }

    @Test
    fun verifyBridgeMethodsNotObfuscated() {
        val clazz = Class.forName(targetBridgeClass)
        val exposedMethods = clazz.declaredMethods
            .filter { it.getAnnotation(JavascriptInterface::class.java) != null }

        assertTrue("${targetBridgeClass} 中至少存在一个 @JavascriptInterface 方法",
            exposedMethods.isNotEmpty())

        for (method in exposedMethods) {
            // 验证方法名与预期一致（基线中预定义）
            val expectedName = getExpectedName(method)
            if (method.name != expectedName) {
                fail("方法 ${method.name} 混淆后名称异常，预期为 $expectedName")
            }
        }
    }

    @Test
    fun verifyWebViewOriginWhitelist() {
        val webView = obtainWebViewInstance()
        val allowedDomains = listOf("example.com", "trusted.com")
        var interceptFailed = false

        webView.webViewClient = object : WebViewClient() {
            override fun shouldOverrideUrlLoading(view: WebView, url: String): Boolean {
                val uri = Uri.parse(url)
                if (uri.host !in allowedDomains) {
                    interceptFailed = true
                    throw SecurityException("来源 $url 未通过白名单校验")
                }
                return false
            }
        }
        // 触发来自非白名单域的测试
        try {
            webView.loadUrl("https://untrusted.com/test_bridge.html")
            if (!interceptFailed) {
                fail("非白名单域名未被拦截")
            }
        } catch (e: SecurityException) {
            // 预期行为
        }
    }

    private fun getExpectedName(method: Method): String {
        // 从基线配置文件中读取预期名称，此处简化
        return method.name
    }

    private fun obtainWebViewInstance(): WebView {
        // 通过 Activity 获取 WebView 实例的实现略
        throw NotImplementedError("Implement based on test environment")
    }
}