Unsafe Liquid metafield or setting output
Detects metafield and merchant-setting output without context-appropriate escaping or serialization.
| Detail | Value |
|---|---|
| Check ID | LIQUID_UNSAFE_RENDER |
| Severity | Medium |
| How it runs | Deterministic scan and agent review |
| Applies to | Apps with a theme app extension |
Anchor to Vulnerable exampleVulnerable example
extensions/promo-banner/blocks/banner.liquid
{% comment %}
Merchant setting rendered straight into markup.
{% endcomment %}
<div title="{{ block.settings.title }}">{{ block.settings.title }}</div>
{% comment %}
And into a script, where it becomes executable.
{% endcomment %}
<script>
const config = {{ product.metafields.app.config }};
</script>
Anchor to How to fixHow to fix
Use escape for HTML text and attributes, json for JavaScript data, or metafield_tag for supported rich content.
extensions/promo-banner/blocks/banner.liquid
{% comment %} escape for HTML text and attributes. {% endcomment %}
<div title="{{ block.settings.title | escape }}">
{{ block.settings.title | escape }}
</div>
{% comment %}
json for anything crossing into JavaScript.
{% endcomment %}
<script>
const config = {{ product.metafields.app.config.value | json }};
</script>
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?