Active upload or privileged preview may execute untrusted content
Investigates uploaded or imported active content that may execute in storefront, embedded admin, customer-account, or operator preview surfaces.
| Detail | Value |
|---|---|
| Check ID | ACTIVE_UPLOADS_AND_PRIVILEGED_PREVIEWS |
| Severity | High |
| How it runs | Agent review |
Anchor to How to fixHow to fix
Sanitize or re-encode active content and isolate previews from privileged origins.
Don’t
- Accept SVG, HTML, or XML and serve it back from the app's own origin.
- Trust the
Content-Typethe uploader sent, or the extension on the filename. - Preview a merchant-supplied document inside the embedded admin, where it inherits that origin's authority.
- Rely on antivirus scanning alone as the control.
Do
- Re-encode what you accept. An uploaded image becomes a new PNG or JPEG your code writes; an SVG becomes a raster file or is rejected.
- Serve user files from a separate origin, with an explicit
Content-TypeandContent-Disposition: attachment. - Verify the file signature, not the extension or the declared MIME type, and store under a name you generate.
- Render previews in a sandboxed iframe that holds no admin session.
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?