Skip to main content

Theme extension cross-site scripting risk

Investigates untrusted values rendered without safe escaping in theme extensions.

Detail	Value
Check ID	`THEME_EXTENSION_XSS`
Severity	High
How it runs	Agent review
Applies to	Apps with a theme app extension

Caution

Metafields and metaobjects outside your app-owned namespace are lower-trust input, even when your app is the only app that writes them, because other installed apps can overwrite them. HTML or script stored in a shared namespace isn't trusted content. To find these values, see SHARED_NAMESPACE_METAFIELD_RENDER.

Anchor to Vulnerable exampleVulnerable example

extensions/reviews/blocks/review-list.liquid

{% comment %}

Customer-supplied review text, rendered raw into an attribute

and an event handler. Either one executes on every storefront

visit.

{% endcomment %}

{% for review in product.metafields["$app"].reviews.value %}

<button onclick="showReview('{{ review.body }}')">

{{ review.body }}

</button>

{% endfor %}

Anchor to How to fixHow to fix

Escape untrusted values and avoid raw HTML rendering.

extensions/reviews/blocks/review-list.liquid

{% comment %}

Escape the text, and hand data to JavaScript through a data

attribute rather than an inline handler.

{% endcomment %}

{% for review in product.metafields["$app"].reviews.value %}

<button class="js-review" data-review="{{ review.body | escape }}">

{{ review.body | escape }}

</button>

{% endfor %}

<script src="{{ 'reviews.js' | asset_url }}" defer></script>

Anchor to RelatedRelated

Escape every value for its context, the best practice that this check supports
shopify app security check, the command that runs this check
All app security checks
Shared-namespace metafield rendered as active content, which reports values that other apps can write

Was this page helpful?