feat: 重构和优化多个组件，增强性能和可维护性

src/components/iframe-bridge.tsx

@@ -10,6 +10,33 @@ import {
   resolvePostMessageTargetOrigin,
 } from "@/lib/iframe-origins";
 
+function sanitizeUrlForParent(href: string): string {
+  try {
+    const url = new URL(href);
+    url.searchParams.delete("token");
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return href;
+  }
+}
+
+function resolveSafeInAppPath(path: string): string | null {
+  if (!path.startsWith("/") || path.startsWith("//")) {
+    return null;
+  }
+
+  try {
+    const url = new URL(path, window.location.origin);
+    if (url.origin !== window.location.origin) {
+      return null;
+    }
+
+    return `${url.pathname}${url.search}${url.hash}`;
+  } catch {
+    return null;
+  }
+}
+
 /**
  * iframe 通信桥接组件
  *
@@ -49,7 +76,7 @@ export function IframeBridge({ children }: { children: ReactNode }): ReactNode {
    */
   const notifyReady = useCallback((): void => {
     sendToParent("READY", {
-      url: window.location.href,
+      url: sanitizeUrlForParent(window.location.href),
       userAgent: navigator.userAgent,
     });
   }, [sendToParent]);
@@ -147,7 +174,10 @@ export function IframeBridge({ children }: { children: ReactNode }): ReactNode {
         // 主站导航请求
         case "MAIN_NAVIGATE":
           if (data.path && typeof data.path === "string") {
-            window.history.pushState({}, "", data.path);
+            const nextPath = resolveSafeInAppPath(data.path);
+            if (nextPath) {
+              window.history.pushState({}, "", nextPath);
+            }
           }
           break;