MM-54489 restrict mobile oauth/saml redirect to native app schemes (#24554)

* MM-54489 restrict mobile oauth/saml redirect to native app schemes

* replace slices package with contains function in utils

* use the existing Contains utility function

* Fix unit tests

* more test cases

* fix cfg.NativeAppSettings.AppCustomURLSchemes assignment

* Append mmauth to cfg.NativeAppSettings.AppCustomURLSchemes in unit test

server/channels/utils/api.go

@@ -16,6 +16,7 @@ import (
 
 	"github.com/mattermost/mattermost/server/public/model"
 	"github.com/mattermost/mattermost/server/public/shared/i18n"
+	"github.com/mattermost/mattermost/server/public/utils"
 )
 
 func CheckOrigin(r *http.Request, allowedOrigins string) bool {
@@ -112,13 +113,8 @@ func RenderMobileAuthComplete(w http.ResponseWriter, redirectURL string) {
 
 func RenderMobileError(config *model.Config, w http.ResponseWriter, err *model.AppError, redirectURL string) {
 	var link = template.HTMLEscapeString(redirectURL)
-	var invalidSchemes = map[string]bool{
-		"data":       true,
-		"javascript": true,
-		"vbscript":   true,
-	}
 	u, redirectErr := url.Parse(redirectURL)
-	if redirectErr != nil || invalidSchemes[u.Scheme] {
+	if redirectErr != nil || !utils.Contains(config.NativeAppSettings.AppCustomURLSchemes, u.Scheme) {
 		link = *config.ServiceSettings.SiteURL
 	}
 	RenderMobileMessage(w, `