Shop domain validation regex is not anchored
Detects unanchored myshopify.com regexes that allow domain spoofing and token theft.
| Detail | Value |
|---|---|
| Check ID | WEAK_SHOP_VALIDATION |
| Severity | High |
| How it runs | Agent review |
Anchor to Vulnerable exampleVulnerable example
app/utils/shop.server.ts
// Unanchored: "evil.com/x.myshopify.com" and
// "shop.myshopify.com.evil.test" both match, so a forged shop
// value passes validation and reaches token lookup.
const SHOP_PATTERN = /[a-zA-Z0-9-]+\.myshopify\.com/;
export function isValidShop(shop: string) {
return SHOP_PATTERN.test(shop);
}
Anchor to How to fixHow to fix
Anchor the regex with ^ and $ to prevent prefix/suffix attacks.
For more detail, see Authorization code grant.
app/utils/shop.server.ts
// Anchored at both ends, so the whole string has to be the shop
// domain.
const SHOP_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9-]*\.myshopify\.com$/;
export function isValidShop(shop: string) {
return SHOP_PATTERN.test(shop);
}
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?