Cross-site scripting risk
Investigates lower-trust data rendered as executable browser content in app-owned pages.
| Detail | Value |
|---|---|
| Check ID | CROSS_SITE_SCRIPTING |
| Severity | High |
| How it runs | Agent review |
Metafields and metaobjects outside your app-owned namespace are lower-trust input, even when your app is the only app that writes them, because other installed apps can overwrite them. HTML or script stored in a shared namespace isn't trusted content. To find these values, see SHARED_NAMESPACE_METAFIELD_RENDER.
Metafields and metaobjects outside your app-owned namespace are lower-trust input, even when your app is the only app that writes them, because other installed apps can overwrite them. HTML or script stored in a shared namespace isn't trusted content. To find these values, see SHARED_NAMESPACE_METAFIELD_RENDER.
Anchor to How to fixHow to fix
Escape, serialize, validate, or sanitize each untrusted value for the context where it's output.
For more detail, see OWASP Cross Site Scripting Prevention Cheat Sheet.
Don’t
- Render product titles, metafields, customer input, or any other data you don't control as raw HTML.
- Rely on HTML escaping when a value goes into an event handler attribute, a URL, or a
<script>block. Each of those contexts needs its own encoding. - Put a user-supplied URL in an
hreforsrcwithout checking its scheme. Ajavascript:URL runs code when it's clicked or loaded. - Treat HTML stored in a shared metafield namespace, such as
custom, as trusted because your app wrote it. Other installed apps can overwrite it.
Do
- Escape or serialize each value where it's output, for the context it lands in: HTML text, attribute, URL, or script.
- Keep your framework's autoescaping on. When you need to allow some HTML, sanitize it with an allowlist, such as DOMPurify, and allow only the tags you need.
- Validate URLs against the schemes and hosts you expect before you render them as links or sources.
- Render untrusted content as text, the best practice that this check supports
shopify app security check, the command that runs this check- All app security checks
- Shared-namespace metafield rendered as active content, which reports values that other apps can write