---
title: ScriptTag URL may be request controlled
description: >-
  Investigates ScriptTag writes whose source URL may be controlled by untrusted
  input.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/script-tag-url-injection
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/script-tag-url-injection.md
---

# Script​Tag URL may be request controlled

Investigates ScriptTag writes whose source URL may be controlled by untrusted input.

| Detail | Value |
| - | - |
| Check ID | `SCRIPT_TAG_URL_INJECTION` |
| Severity | High |
| How it runs | Agent review |

***

## Vulnerable example

## app/routes/app.pixel.tsx

```tsx
import type { ActionFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";


export const action = async ({ request }: ActionFunctionArgs) => {
  const { admin } = await authenticate.admin(request);


  const src = String((await request.formData()).get("scriptUrl"));


  // A ScriptTag runs on every storefront page view. A
  // request-controlled src turns one form post into script
  // execution for every visitor.
  return admin.graphql(
    `#graphql
      mutation AddPixel($input: ScriptTagInput!) {
        scriptTagCreate(input: $input) { userErrors { message } }
      }`,
    { variables: { input: { src, displayScope: "ONLINE_STORE" } } },
  );
};
```

***

## How to fix

Remove ScriptTag usage or restrict sources to trusted versioned assets.

## extensions/storefront-pixel/blocks/pixel.liquid

```liquid
{% comment %}
  Delete the ScriptTag mutation and ship storefront JavaScript as
  a theme app extension asset instead. The URL is a versioned
  file you control, the merchant can see and remove the block,
  and no request input can change what runs.
{% endcomment %}
<script src="{{ 'pixel.js' | asset_url }}" defer></script>


{% schema %}
{ "name": "Analytics pixel", "target": "head" }
{% endschema %}
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***