shopify_api 16.3.0 → 16.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6ef28917f2c106b9f37d8bbe2d84a870da064c05dc9a1c962adabc3e1c554990
-  data.tar.gz: 3f09f7a81bd0fb124e449c2025a228588a0d2e23f9ccff7db26ef321e33685f8
+  metadata.gz: 15b9053636bf36a285462a2843dae8e7603dfcac4429e5e98810bfd0538679b0
+  data.tar.gz: d5488b89b1fa4135536142cc729656515ca338c5fd61e30df15d9026d2dd52a9
 SHA512:
-  metadata.gz: 617d78c0c104967dfda7f676807563d1c41e01c76ffa063d66728c77f2463fc13cc8e7b1316743c09997c793c98a4c679b1c2848098864131ddabf09653ba509
-  data.tar.gz: 0c1ec1644cca56fcb2df2f5d55fefa5f692cbe7f8b2800e398a5cb1e7be462ff84e9d14065090e2441f0c725565c9916919b2fa1fd7c965e63e00fbbe8ef344a
+  metadata.gz: 1d3a1818a57ffe3be7dc30ca153e63c0e37e2cb2198db19d0d711db2f256857f1fff60307a3c8896b26252964679b9b6170c111debefc45be655eb40cbec3569
+  data.tar.gz: ee2bedb0b6fa998ac04fdcba3a4b5927a4c0c626ab2d686cc6aba6c3005944cdf1288a3622a186cc457a49e25715c0afeae9f8f7dd0f195a9d38d8d21011b47e

data/.github/workflows/gardener-notify-slack.yml

@@ -1,6 +1,6 @@
 name: Gardener - Notify Slack
 # Runs after `Gardener - Notify Event` completes and does the real work:
-# applies the devtools-gardener label and posts a summary to Slack.
+# applies the devtools-gardener label and posts a repo-prefixed linked title to Slack.
 #
 # The workflow_run trigger runs this job in the default-branch context with
 # full GITHUB_TOKEN permissions and Actions secret access — this is what
@@ -59,57 +59,16 @@ jobs:
           SLACK_BOT_TOKEN: ${{ secrets.SLACK_GARDENER_BOT_TOKEN }}
           SLACK_CHANNEL_ID: ${{ vars.GARDENER_SLACK_CHANNEL_ID }}
         run: |
-          KIND=$(jq -r 'if has("pull_request") then "PR" else "Issue" end' event.json)
-          # Pull the body out, truncate, then convert GitHub Markdown to
-          # Slack mrkdwn. Links and fenced code blocks are stashed before
-          # the HTML-escape pass so their contents survive verbatim (a `&`
-          # inside a URL must stay raw, and code content shouldn't be
-          # mangled). Blockquote `> ` markers are also stashed so the
-          # `>` → `>` escape doesn't break them. Everything else is
-          # HTML-escaped so user-supplied `<`, `>`, `&` can't collide
-          # with Slack link syntax or injected mentions like <!channel>.
-          BODY=$(jq -r '(.issue // .pull_request).body // ""' event.json)
-          if [ ${#BODY} -gt 1000 ]; then
-            BODY="${BODY:0:1000}…"
-          fi
-          BODY=$(printf '%s' "$BODY" | perl -0777 -pe '
-            my @u;
-            s{\[([^\]]+)\]\(([^)]+)\)}{push @u, $2; "\x01$#u\x02$1\x03"}ge;
-            my @c;
-            s{^```[^\n]*\n(.*?)\n```$}{push @c, $1; "\x04$#c\x05"}gems;
-            s/^> /\x06/gm;
-            s/^#{1,6}\s+(.+)$/*$1*/gm;
-            s/\*\*(.+?)\*\*/*$1*/g;
-            s/^(\s*)- \[x\]\s+/$1✓ /gm;
-            s/^(\s*)[-*]\s+/$1• /gm;
-            s/&/&amp;/g;
-            s/</&lt;/g;
-            s/>/&gt;/g;
-            s/\x06/> /g;
-            s{\x01(\d+)\x02(.*?)\x03}{"<$u[$1]|$2>"}ge;
-            s{\x04(\d+)\x05}{"```\n$c[$1]\n```"}ge;
-          ')
           jq \
             --arg channel "$SLACK_CHANNEL_ID" \
-            --arg kind "$KIND" \
-            --arg body "$BODY" \
             '
               def escape: gsub("&";"&amp;") | gsub("<";"&lt;") | gsub(">";"&gt;");
 
               (.issue // .pull_request) as $i
-              | ([$i.labels[]?.name | select(. != "devtools-gardener")]
-                  | map("`\(.)`") | join(" ")) as $labels
-              | (if $kind == "PR"
-                  then " · \($i.changed_files) files, +\($i.additions)/-\($i.deletions)"
-                       + (if $i.draft then " · draft" else "" end)
-                  else "" end) as $meta
-              | [ "*<\($i.html_url)|\($kind) #\($i.number)>* — \(($i.title | escape))",
-                  "_opened by \($i.user.login)\($meta)_" ]
-                + (if $body != "" then [$body] else [] end)
-                + (if $labels != "" then [$labels] else [] end)
-              | join("\n") as $msg
-              | { channel: $channel, text: "\($kind) #\($i.number): \($i.title)",
-                  blocks: [{ type: "section", text: { type: "mrkdwn", text: $msg } }] }
+              | { channel: $channel,
+                  text: "\(.repository.name) · <\($i.html_url)|\($i.title | escape)>",
+                  unfurl_links: false,
+                  unfurl_media: false }
             ' event.json | curl -sf -X POST \
               -H "Authorization: Bearer $SLACK_BOT_TOKEN" \
               -H 'Content-type: application/json; charset=utf-8' \

data/CHANGELOG.md

@@ -3,6 +3,11 @@
 Note: For changes to the API, see https://shopify.dev/changelog?filter=api
 ## Unreleased
 
+## 16.3.1 (2026-10-22)
+- [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Auth.embedded_app_url` now raises `ShopifyAPI::Errors::InvalidShopError` unless the decoded `host` is a trusted Shopify Admin host (see `ShopifyAPI::Utils::ShopValidator`). URLs for supported Admin hosts are unchanged.
+- [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Auth::Oauth.begin_auth` now validates and normalizes `shop` with `ShopifyAPI::Utils::ShopValidator.sanitize!`, and raises `ShopifyAPI::Errors::InvalidShopError` for untrusted domains.
+- [#1472](https://github.com/Shopify/shopify-api-ruby/pull/1472) `ShopifyAPI::Utils::ShopValidator` now rejects hosts with non-hostname characters and reads the store handle from the segment after `/store/` in Admin URLs (`admin.shopify.com/store/<handle>`), rejecting a missing or invalid handle.
+
 ## 16.3.0 (2026-08-04)
 - [#1443](https://github.com/Shopify/shopify-api-ruby/pull/1443) Add `ShopifyAPI::Utils::ShopValidator` with `sanitize_shop_domain` and `sanitize!`.
 - [#1443](https://github.com/Shopify/shopify-api-ruby/pull/1443) Derive the target shop for `ShopifyAPI::Auth::TokenExchange.exchange_token` from the session token's `dest` claim. The `shop` argument is now deprecated and will be removed in the next major version.

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_api (16.3.0)
+    shopify_api (16.3.1)
       activesupport
       addressable (~> 2.7)
       concurrent-ruby

data/lib/shopify_api/auth/oauth.rb

@@ -33,6 +33,8 @@ module ShopifyAPI
           end
           raise Errors::UnsupportedOauthError, "Cannot perform OAuth for private apps." if Context.private?
 
+          shop = Utils::ShopValidator.sanitize!(shop)
+
           state = SecureRandom.alphanumeric(NONCE_LENGTH)
 
           cookie = SessionCookie.new(value: state, expires: Time.now + 60)

data/lib/shopify_api/auth.rb

@@ -1,10 +1,19 @@
 # typed: strict
 # frozen_string_literal: true
 
+require "addressable/uri"
+
 module ShopifyAPI
   module Auth
     extend T::Sig
 
+    # Hostname characters, plus an optional port. Anything else before the first "/" is rejected.
+    EMBEDDED_HOST_AUTHORITY_REGEX = T.let(/\A[a-zA-Z0-9._-]+(:\d{1,5})?\z/, Regexp)
+
+    # Printable ASCII only: no whitespace, control bytes or non-ASCII bytes.
+    EMBEDDED_HOST_ALLOWED_BYTES_REGEX = T.let(/\A[\x21-\x7e]+\z/n, Regexp)
+    private_constant :EMBEDDED_HOST_AUTHORITY_REGEX, :EMBEDDED_HOST_ALLOWED_BYTES_REGEX
+
     class << self
       extend T::Sig
 
@@ -19,8 +28,29 @@ module ShopifyAPI
         end
 
         decoded_host = Base64.decode64(host)
+        unless trusted_embedded_host?(decoded_host)
+          raise Errors::InvalidShopError, "host must decode to a trusted Shopify Admin host"
+        end
+
         "https://#{decoded_host}/apps/#{Context.api_key}"
       end
+
+      private
+
+      sig { params(decoded_host: String).returns(T::Boolean) }
+      def trusted_embedded_host?(decoded_host)
+        return false unless decoded_host.b.match?(EMBEDDED_HOST_ALLOWED_BYTES_REGEX)
+
+        authority = T.must(decoded_host.split("/", 2).first)
+        return false unless authority.match?(EMBEDDED_HOST_AUTHORITY_REGEX)
+
+        uri = Addressable::URI.parse("https://#{decoded_host}")
+        return false unless uri.userinfo.nil? && uri.authority == authority
+
+        !Utils::ShopValidator.sanitize_shop_domain(uri.to_s).nil?
+      rescue Addressable::URI::InvalidURIError
+        false
+      end
     end
   end
 end

data/lib/shopify_api/utils/shop_validator.rb

@@ -17,6 +17,10 @@ module ShopifyAPI
         T::Array[String],
       )
 
+      HOSTNAME_REGEX = T.let(/\A[a-z0-9_-]+(\.[a-z0-9_-]+)*\.?\z/, Regexp)
+      STORE_HANDLE_REGEX = T.let(/\A[a-z0-9][a-z0-9-]*\z/, Regexp)
+      private_constant :HOSTNAME_REGEX, :STORE_HANDLE_REGEX
+
       class << self
         extend T::Sig
 
@@ -29,6 +33,7 @@ module ShopifyAPI
         def sanitize_shop_domain(shop_domain, myshopify_domain: nil)
           uri = uri_from_shop_domain(shop_domain, myshopify_domain)
           return nil if uri.nil? || uri.host.nil? || uri.host.empty?
+          return nil unless T.cast(uri.host, String).match?(HOSTNAME_REGEX)
 
           trusted_domains(myshopify_domain).each do |trusted_domain|
             host = T.cast(uri.host, String)
@@ -107,9 +112,13 @@ module ShopifyAPI
           T.cast(uri.host, String).split(".").first == "admin"
         end
 
-        sig { params(uri: Addressable::URI).returns(String) }
+        sig { params(uri: Addressable::URI).returns(T.nilable(String)) }
         def myshopify_domain_from_unified_admin(uri)
-          shop = uri.path.to_s.split("/").last
+          segments = uri.path.to_s.split("/")
+          store_index = segments.index("store")
+          shop = store_index && segments[store_index + 1]
+          return unless shop&.match?(STORE_HANDLE_REGEX)
+
           "#{shop}.myshopify.com"
         end
       end

data/lib/shopify_api/version.rb

@@ -2,5 +2,5 @@
 # frozen_string_literal: true
 
 module ShopifyAPI
-  VERSION = "16.3.0"
+  VERSION = "16.3.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: shopify_api
 version: !ruby/object:Gem::Version
-  version: 16.3.0
+  version: 16.3.1
 platform: ruby
 authors:
 - Shopify
@@ -1703,7 +1703,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.22
 specification_version: 4
 summary: The gem for accessing the Shopify API
 test_files: []