@shopify/shopify-app-remix 2.5.0 → 2.5.1

package/build/cjs/server/authenticate/admin/helpers/render-app-bridge.js

@@ -4,6 +4,7 @@ Object.defineProperty(exports, '__esModule', { value: true });
 
 var appBridgeUrl = require('../../helpers/app-bridge-url.js');
 var addResponseHeaders = require('../../helpers/add-response-headers.js');
+var validateRedirectUrl = require('./validate-redirect-url.js');
 
 function renderAppBridge({
   config
@@ -11,7 +12,7 @@ function renderAppBridge({
   let redirectToScript = '';
   if (redirectTo) {
     var _redirectTo$target;
-    const destination = new URL(redirectTo.url, config.appUrl);
+    const destination = validateRedirectUrl.sanitizeRedirectUrl(config.appUrl, redirectTo.url);
     const target = (_redirectTo$target = redirectTo.target) !== null && _redirectTo$target !== void 0 ? _redirectTo$target : '_top';
     redirectToScript = `<script>window.open(${JSON.stringify(destination.toString())}, ${JSON.stringify(target)})</script>`;
   }

package/build/cjs/server/authenticate/admin/helpers/validate-redirect-url.js

@@ -0,0 +1,45 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var shopifyApi = require('@shopify/shopify-api');
+
+const FILE_URI_MATCH = /\/\/\//;
+const INVALID_RELATIVE_URL = /[/\\][/\\]/;
+const WHITESPACE_CHARACTER = /\s/;
+const VALID_PROTOCOLS = ['https:', 'http:'];
+function isSafe(domain, redirectUrl, requireSSL = true) {
+  if (typeof redirectUrl !== 'string') {
+    return false;
+  }
+  if (FILE_URI_MATCH.test(redirectUrl) || WHITESPACE_CHARACTER.test(redirectUrl)) {
+    return false;
+  }
+  let url;
+  try {
+    url = new URL(redirectUrl, domain);
+  } catch (error) {
+    return false;
+  }
+  if (INVALID_RELATIVE_URL.test(url.pathname)) {
+    return false;
+  }
+  if (!VALID_PROTOCOLS.includes(url.protocol)) {
+    return false;
+  }
+  if (requireSSL && url.protocol !== 'https:') {
+    return false;
+  }
+  return true;
+}
+function sanitizeRedirectUrl(domain, redirectUrl, options = {}) {
+  if (isSafe(domain, redirectUrl, options.requireSSL)) {
+    return new URL(redirectUrl, domain);
+  } else if (options.throwOnInvalid === false) {
+    return undefined;
+  } else {
+    throw new shopifyApi.ShopifyError('Invalid URL. Refusing to redirect');
+  }
+}
+
+exports.sanitizeRedirectUrl = sanitizeRedirectUrl;

package/build/cjs/server/version.js

@@ -2,6 +2,6 @@
 
 Object.defineProperty(exports, '__esModule', { value: true });
 
-const SHOPIFY_REMIX_LIBRARY_VERSION = '2.5.0';
+const SHOPIFY_REMIX_LIBRARY_VERSION = '2.5.1';
 
 exports.SHOPIFY_REMIX_LIBRARY_VERSION = SHOPIFY_REMIX_LIBRARY_VERSION;

package/build/ts/server/authenticate/admin/helpers/render-app-bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"render-app-bridge.d.ts","sourceRoot":"","sources":["../../../../../../src/server/authenticate/admin/helpers/render-app-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAI3C,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,GAAG,CAAC;AAEtC,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAClB,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,wBAAgB,eAAe,CAC7B,EAAC,MAAM,EAAC,EAAE,WAAW,EACrB,OAAO,EAAE,OAAO,EAChB,UAAU,CAAC,EAAE,iBAAiB,GAC7B,KAAK,CA2BP"}
+{"version":3,"file":"render-app-bridge.d.ts","sourceRoot":"","sources":["../../../../../../src/server/authenticate/admin/helpers/render-app-bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,WAAW,EAAC,MAAM,gBAAgB,CAAC;AAM3C,OAAO,KAAK,EAAC,cAAc,EAAC,MAAM,GAAG,CAAC;AAEtC,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;IAClB,MAAM,CAAC,EAAE,cAAc,CAAC;CACzB;AAED,wBAAgB,eAAe,CAC7B,EAAC,MAAM,EAAC,EAAE,WAAW,EACrB,OAAO,EAAE,OAAO,EAChB,UAAU,CAAC,EAAE,iBAAiB,GAC7B,KAAK,CA4BP"}

package/build/ts/server/authenticate/admin/helpers/render-app-bridge.js

@@ -3,12 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderAppBridge = void 0;
 var app_bridge_url_1 = require("../../helpers/app-bridge-url");
 var add_response_headers_1 = require("../../helpers/add-response-headers");
+var validate_redirect_url_1 = require("./validate-redirect-url");
 function renderAppBridge(_a, request, redirectTo) {
     var _b;
     var config = _a.config;
     var redirectToScript = '';
     if (redirectTo) {
-        var destination = new URL(redirectTo.url, config.appUrl);
+        var destination = (0, validate_redirect_url_1.sanitizeRedirectUrl)(config.appUrl, redirectTo.url);
         var target = (_b = redirectTo.target) !== null && _b !== void 0 ? _b : '_top';
         redirectToScript = "<script>window.open(".concat(JSON.stringify(destination.toString()), ", ").concat(JSON.stringify(target), ")</script>");
     }

package/build/ts/server/authenticate/admin/helpers/render-app-bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"render-app-bridge.js","sourceRoot":"","sources":["../../../../../../src/server/authenticate/admin/helpers/render-app-bridge.ts"],"names":[],"mappings":";;;AACA,+DAA0D;AAC1D,2EAA8E;AAS9E,SAAgB,eAAe,CAC7B,EAAqB,EACrB,OAAgB,EAChB,UAA8B;;QAF7B,MAAM,YAAA;IAIP,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,UAAU,EAAE,CAAC;QACf,IAAM,WAAW,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3D,IAAM,MAAM,GAAG,MAAA,UAAU,CAAC,MAAM,mCAAI,MAAM,CAAC;QAE3C,gBAAgB,GAAG,8BAAuB,IAAI,CAAC,SAAS,CACtD,WAAW,CAAC,QAAQ,EAAE,CACvB,eAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAY,CAAC;IAC3C,CAAC;IAED,IAAM,eAAe,GAAG,IAAI,OAAO,CAAC;QAClC,cAAc,EAAE,yBAAyB;KAC1C,CAAC,CAAC;IACH,IAAA,iDAA0B,EACxB,eAAe,EACf,MAAM,CAAC,aAAa,EACpB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAC9C,CAAC;IAEF,MAAM,IAAI,QAAQ,CAChB,yCAC0B,MAAM,CAAC,MAAM,sBAAU,IAAA,6BAAY,GAAE,iCAC3D,gBAAgB,WACnB,EACD,EAAC,OAAO,EAAE,eAAe,EAAC,CAC3B,CAAC;AACJ,CAAC;AA/BD,0CA+BC"}
+{"version":3,"file":"render-app-bridge.js","sourceRoot":"","sources":["../../../../../../src/server/authenticate/admin/helpers/render-app-bridge.ts"],"names":[],"mappings":";;;AACA,+DAA0D;AAC1D,2EAA8E;AAE9E,iEAA4D;AAS5D,SAAgB,eAAe,CAC7B,EAAqB,EACrB,OAAgB,EAChB,UAA8B;;QAF7B,MAAM,YAAA;IAIP,IAAI,gBAAgB,GAAG,EAAE,CAAC;IAC1B,IAAI,UAAU,EAAE,CAAC;QACf,IAAM,WAAW,GAAG,IAAA,2CAAmB,EAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;QAEvE,IAAM,MAAM,GAAG,MAAA,UAAU,CAAC,MAAM,mCAAI,MAAM,CAAC;QAE3C,gBAAgB,GAAG,8BAAuB,IAAI,CAAC,SAAS,CACtD,WAAW,CAAC,QAAQ,EAAE,CACvB,eAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAY,CAAC;IAC3C,CAAC;IAED,IAAM,eAAe,GAAG,IAAI,OAAO,CAAC;QAClC,cAAc,EAAE,yBAAyB;KAC1C,CAAC,CAAC;IACH,IAAA,iDAA0B,EACxB,eAAe,EACf,MAAM,CAAC,aAAa,EACpB,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAC9C,CAAC;IAEF,MAAM,IAAI,QAAQ,CAChB,yCAC0B,MAAM,CAAC,MAAM,sBAAU,IAAA,6BAAY,GAAE,iCAC3D,gBAAgB,WACnB,EACD,EAAC,OAAO,EAAE,eAAe,EAAC,CAC3B,CAAC;AACJ,CAAC;AAhCD,0CAgCC"}

package/build/ts/server/authenticate/admin/helpers/validate-redirect-url.d.ts

@@ -0,0 +1,8 @@
+interface Options {
+    requireSSL?: boolean;
+    throwOnInvalid?: boolean;
+}
+type SanitizedRedirectUrl<OptionsArg extends Options> = OptionsArg['throwOnInvalid'] extends false ? URL | undefined : URL;
+export declare function sanitizeRedirectUrl<OptionsArg extends Options>(domain: string, redirectUrl: unknown, options?: OptionsArg): SanitizedRedirectUrl<OptionsArg>;
+export {};
+//# sourceMappingURL=validate-redirect-url.d.ts.map

package/build/ts/server/authenticate/admin/helpers/validate-redirect-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-redirect-url.d.ts","sourceRoot":"","sources":["../../../../../../src/server/authenticate/admin/helpers/validate-redirect-url.ts"],"names":[],"mappings":"AAEA,UAAU,OAAO;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,KAAK,oBAAoB,CAAC,UAAU,SAAS,OAAO,IAClD,UAAU,CAAC,gBAAgB,CAAC,SAAS,KAAK,GAAG,GAAG,GAAG,SAAS,GAAG,GAAG,CAAC;AA8CrE,wBAAgB,mBAAmB,CAAC,UAAU,SAAS,OAAO,EAC5D,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,OAAO,EACpB,OAAO,GAAE,UAA6B,GACrC,oBAAoB,CAAC,UAAU,CAAC,CAQlC"}

package/build/ts/server/authenticate/admin/helpers/validate-redirect-url.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeRedirectUrl = void 0;
+var shopify_api_1 = require("@shopify/shopify-api");
+var FILE_URI_MATCH = /\/\/\//;
+var INVALID_RELATIVE_URL = /[/\\][/\\]/;
+var WHITESPACE_CHARACTER = /\s/;
+var VALID_PROTOCOLS = ['https:', 'http:'];
+function isSafe(domain, redirectUrl, requireSSL) {
+    if (requireSSL === void 0) { requireSSL = true; }
+    if (typeof redirectUrl !== 'string') {
+        return false;
+    }
+    if (FILE_URI_MATCH.test(redirectUrl) ||
+        WHITESPACE_CHARACTER.test(redirectUrl)) {
+        return false;
+    }
+    var url;
+    try {
+        url = new URL(redirectUrl, domain);
+    }
+    catch (error) {
+        return false;
+    }
+    if (INVALID_RELATIVE_URL.test(url.pathname)) {
+        return false;
+    }
+    if (!VALID_PROTOCOLS.includes(url.protocol)) {
+        return false;
+    }
+    if (requireSSL && url.protocol !== 'https:') {
+        return false;
+    }
+    return true;
+}
+function sanitizeRedirectUrl(domain, redirectUrl, options) {
+    if (options === void 0) { options = {}; }
+    if (isSafe(domain, redirectUrl, options.requireSSL)) {
+        return new URL(redirectUrl, domain);
+    }
+    else if (options.throwOnInvalid === false) {
+        return undefined;
+    }
+    else {
+        throw new shopify_api_1.ShopifyError('Invalid URL. Refusing to redirect');
+    }
+}
+exports.sanitizeRedirectUrl = sanitizeRedirectUrl;
+//# sourceMappingURL=validate-redirect-url.js.map

package/build/ts/server/authenticate/admin/helpers/validate-redirect-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-redirect-url.js","sourceRoot":"","sources":["../../../../../../src/server/authenticate/admin/helpers/validate-redirect-url.ts"],"names":[],"mappings":";;;AAAA,oDAAkD;AAUlD,IAAM,cAAc,GAAG,QAAQ,CAAC;AAChC,IAAM,oBAAoB,GAAG,YAAY,CAAC;AAC1C,IAAM,oBAAoB,GAAG,IAAI,CAAC;AAClC,IAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;AAE5C,SAAS,MAAM,CACb,MAAc,EACd,WAAoB,EACpB,UAAsC;IAAtC,2BAAA,EAAA,iBAAsC;IAEtC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IACE,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC;QAChC,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC,EACtC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAQ,CAAC;IAEb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,UAAU,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,mBAAmB,CACjC,MAAc,EACd,WAAoB,EACpB,OAAsC;IAAtC,wBAAA,EAAA,UAAsB,EAAgB;IAEtC,IAAI,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACpD,OAAO,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAqC,CAAC;IAC1E,CAAC;SAAM,IAAI,OAAO,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAC5C,OAAO,SAA6C,CAAC;IACvD,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,0BAAY,CAAC,mCAAmC,CAAC,CAAC;IAC9D,CAAC;AACH,CAAC;AAZD,kDAYC"}

package/build/ts/server/version.d.ts

@@ -1,2 +1,2 @@
-export declare const SHOPIFY_REMIX_LIBRARY_VERSION = "2.5.0";
+export declare const SHOPIFY_REMIX_LIBRARY_VERSION = "2.5.1";
 //# sourceMappingURL=version.d.ts.map

package/build/ts/server/version.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SHOPIFY_REMIX_LIBRARY_VERSION = void 0;
-exports.SHOPIFY_REMIX_LIBRARY_VERSION = '2.5.0';
+exports.SHOPIFY_REMIX_LIBRARY_VERSION = '2.5.1';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shopify/shopify-app-remix",
-  "version": "2.5.0",
+  "version": "2.5.1",
   "description": "Shopify Remix - to simplify the building of Shopify Apps with Remix",
   "repository": {
     "type": "git",