Cross-site scripting risk
Investigates lower-trust data rendered as executable browser content in app-owned pages.
| Detail | Value |
|---|---|
| Check ID | CROSS_SITE_SCRIPTING |
| Severity | High |
| How it runs | Agent review |
Anchor to How to fixHow to fix
Escape, serialize, validate, or sanitize each untrusted value for the context where it's output.
For more detail, see OWASP Cross Site Scripting Prevention Cheat Sheet.
Don’t
- Render product titles, metafields, customer input, or any other data you don't control as raw HTML.
- Rely on HTML escaping when a value goes into an event handler attribute, a URL, or a
<script>block. Each of those contexts needs its own encoding. - Put a user-supplied URL in an
hreforsrcwithout checking its scheme. Ajavascript:URL runs code when it's clicked or loaded.
Do
- Escape or serialize each value where it's output, for the context it lands in: HTML text, attribute, URL, or script.
- Keep your framework's autoescaping on. When you need to allow some HTML, sanitize it with an allowlist, such as DOMPurify, and allow only the tags you need.
- Validate URLs against the schemes and hosts you expect before you render them as links or sources.
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?