Treat runtime configuration as data
Ship code in your extension's assets, and treat anything your extension fetches from your servers at runtime as untrusted data.
If your extension fetches configuration when the storefront loads, then anyone who can change that configuration changes what runs on every store at once, through a staff account, an internal tool, or an unauthenticated endpoint. Code in your extension's assets is versioned and deployed with your app, so a change to it goes through your release process.
- Never run code that your extension fetches at runtime. Don't pass fetched values to
eval,new Function,innerHTML, or a script element that you create, and don't load scripts from URLs in the response. - Treat every configuration response as untrusted data. Validate its shape, and render its values with text-only APIs such as
textContent. - Keep behavior in your extension's assets, and keep configuration to plain data that selects among behaviors you shipped.
- List the servers that your app loads from or sends requests to in your app configuration file. We use the list to protect your app and monitor storefronts for malicious requests.
Anchor to VerifyVerify
The app security checks catch innerHTML sinks. No check detects code that runs fetched configuration, so search your extension's JavaScript for eval, new Function, and dynamically created script elements.
Was this page helpful?