Text setting may be rendered as unsafe HTML
Investigates merchant-configurable text rendered as HTML without sanitization.
| Detail | Value |
|---|---|
| Check ID | TEXT_SETTING_HTML_SMUGGLING |
| Severity | High |
| How it runs | Agent review |
Anchor to Vulnerable exampleVulnerable example
app/components/BannerPreview.tsx
type Props = { settings: { headline: string } };
export function BannerPreview({ settings }: Props) {
// A merchant-editable text setting rendered as raw HTML.
// A value like <img src=x onerror=...> runs on the client.
return (
<div dangerouslySetInnerHTML={{ __html: settings.headline }} />
);
}
Anchor to How to fixHow to fix
Render settings as text or sanitize with a strict allowlist.
app/components/BannerPreview.tsx
type Props = { settings: { headline: string } };
export function BannerPreview({ settings }: Props) {
// Render the setting as text. If the feature really needs rich
// text, sanitize with a strict allowlist on the server before
// it is stored.
return <div>{settings.headline}</div>;
}
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?