shopify_app 21.3.0 → 21.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 89cc2a310a1182a7efc057933dafe337c0ba070732f40d920245741be7666c17
-  data.tar.gz: 2f981c756c218d2971687cd7e3f86a62b69b77fb49e343610523c8d8c77bb143
+  metadata.gz: 00bf2ba9c43324a703b21367459c592b93d092f2926f2d6862bfb7efb9494853
+  data.tar.gz: 7792d5fd3f1a5af452357c0c6f26b8c245e471171e86a95dad5559bdb87ab6d8
 SHA512:
-  metadata.gz: db13b7a1991ef855604d7734a79b4812f010bddc4937636c7c96594f8cbecd8daafd562ea3be6cd137887d799bb1d654eb951509334d04e17056b8c4582d4c14
-  data.tar.gz: 386345a2947c3e0c42f2ad9f2433e2702a823ede57bdd4efe73899703141c1fc58855bb451b3785c07536177f997385f6513a60e8fa1808a8de146cc33b1a294
+  metadata.gz: f963fc4af5645f47d072aff3d0aa9cf47b7f1c20d422fcf43ec4466804d24a18916864d96372c407c1ef7c2e8963a3b5946763534bde5070ebd767ce1da3957d
+  data.tar.gz: 79cd7bd816b1b9759d6531f9c9a65fe81d6d7c9ed1e671c127c44b2f74a2b962d27d0eb5ac9b8c48378f012aec88451d9c533bfca345d14a6c8f0193993378a4

data/CHANGELOG.md

@@ -1,6 +1,10 @@
 Unreleased
 ----------
 
+21.3.1 (Dec 12, 2022)
+----------
+* Fix bug with stores using the new unified admin that were falsely being flagged as phishing attempts [#1608](https://github.com/Shopify/shopify_app/pull/1608)
+
 21.3.0 (Dec 9, 2022)
 ----------
 * Move covered scopes check into user access strategy [#1600](https://github.com/Shopify/shopify_app/pull/1600)

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    shopify_app (21.3.0)
+    shopify_app (21.3.1)
       activeresource
       browser_sniffer (~> 2.0)
       jwt (>= 2.2.3)

data/lib/shopify_app/utils.rb

@@ -2,14 +2,22 @@
 
 module ShopifyApp
   module Utils
+    TRUSTED_SHOPIFY_DOMAINS = [
+      "shopify.com",
+      "myshopify.io",
+      "myshopify.com",
+    ].freeze
+
     def self.sanitize_shop_domain(shop_domain)
       myshopify_domain = ShopifyApp.configuration.myshopify_domain
       name = shop_domain.to_s.downcase.strip
       name += ".#{myshopify_domain}" if !name.include?(myshopify_domain.to_s) && !name.include?(".")
       name.sub!(%r|https?://|, "")
+      trusted_domains = TRUSTED_SHOPIFY_DOMAINS.dup.push(myshopify_domain)
 
       u = URI("http://#{name}")
-      u.host if u.host&.match(/^[a-z0-9][a-z0-9\-]*[a-z0-9]\.#{Regexp.escape(myshopify_domain)}$/)
+      regex = /^[a-z0-9][a-z0-9\-]*[a-z0-9]\.(#{trusted_domains.join("|")})$/
+      u.host if u.host&.match(regex)
     rescue URI::InvalidURIError
       nil
     end

data/lib/shopify_app/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ShopifyApp
-  VERSION = "21.3.0"
+  VERSION = "21.3.1"
 end

data/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shopify_app",
-  "version": "21.0.0",
+  "version": "21.3.1",
   "repository": "git@github.com:Shopify/shopify_app.git",
   "author": "Shopify",
   "license": "MIT",

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: shopify_app
 version: !ruby/object:Gem::Version
-  version: 21.3.0
+  version: 21.3.1
 platform: ruby
 authors:
 - Shopify
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2022-12-09 00:00:00.000000000 Z
+date: 2022-12-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activeresource