@shopify/shopify-app-remix 6.0.0 → 6.0.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shopify/shopify-app-remix",
-  "version": "6.0.0",
+  "version": "6.0.2",
   "description": "Shopify Remix - to simplify the building of Shopify Apps with Remix",
   "engines": {
     "node": ">=22.0.0"
@@ -73,16 +73,16 @@
     "@shopify/generate-docs": "^1.2.3",
     "@shopify/polaris": "^12.18.0",
     "@shopify/react-testing": "^6.0.0",
-    "@shopify/shopify-app-session-storage-memory": "^8.0.0",
+    "@shopify/shopify-app-session-storage-memory": "^8.0.1",
     "@types/react": "^19.2.17",
     "jest-fetch-mock": "^3.2.0"
   },
   "dependencies": {
     "@remix-run/server-runtime": "^2.17.5",
-    "@shopify/admin-api-client": "^2.0.0",
-    "@shopify/shopify-api": "^15.0.0",
-    "@shopify/shopify-app-session-storage": "^7.0.0",
-    "@shopify/storefront-api-client": "^2.0.0",
+    "@shopify/admin-api-client": "^2.0.1",
+    "@shopify/shopify-api": "^15.0.1",
+    "@shopify/shopify-app-session-storage": "^7.0.1",
+    "@shopify/storefront-api-client": "^2.0.1",
     "compare-versions": "^6.1.1",
     "isbot": "^5.2.0"
   },

package/src/server/authenticate/admin/authenticate.ts

@@ -1,4 +1,4 @@
-import {JwtPayload, Session} from '@shopify/shopify-api';
+import {JwtPayload, Session, ShopifyError} from '@shopify/shopify-api';
 
 import type {BasicParams} from '../../types';
 import type {AppConfigArg} from '../../config-types';
@@ -30,6 +30,7 @@ import {
   createAdminApiContext,
   ensureAppIsEmbeddedIfRequired,
   ensureSessionTokenSearchParamIfRequired,
+  isTrustedExitIframeDestination,
   redirectFactory,
   renderAppBridge,
   validateShopAndHostParams,
@@ -69,7 +70,17 @@ export function authStrategyFactory<ConfigArg extends AppConfigArg>({
     const url = new URL(request.url);
 
     if (url.pathname === config.auth.exitIframePath) {
-      const destination = url.searchParams.get('exitIframe')!;
+      const destination = url.searchParams.get('exitIframe');
+
+      if (!isTrustedExitIframeDestination(config.appUrl, destination)) {
+        logger.warning(
+          'Rejected exit-iframe redirect to an untrusted destination',
+          {shop: getShopFromRequest(request), destination},
+        );
+        throw new ShopifyError(
+          'Invalid exit-iframe destination. Refusing to redirect.',
+        );
+      }
 
       logger.debug('Rendering exit iframe page', {
         shop: getShopFromRequest(request),

package/src/server/authenticate/admin/helpers/index.ts

@@ -12,3 +12,4 @@ export * from './redirect';
 export * from './render-app-bridge';
 export * from './trigger-after-auth-hook';
 export * from './validate-shop-and-host-params';
+export * from './validate-redirect-url';

package/src/server/authenticate/admin/helpers/validate-redirect-url.ts

@@ -65,3 +65,62 @@ export function sanitizeRedirectUrl<OptionsArg extends Options>(
     throw new ShopifyError('Invalid URL. Refusing to redirect');
   }
 }
+
+const SHOPIFY_ADMIN_HOST = 'admin.shopify.com';
+const SHOP_ADMIN_HOST_REGEX = /\.myshopify\.com$/i;
+
+/**
+ * Determines whether an exit-iframe destination is one we trust enough to
+ * redirect to.
+ *
+ * The destination comes straight from the request URL, so it is limited to:
+ *
+ * - the app's own origin, including relative paths (used by the OAuth flow), or
+ * - the Shopify admin: `admin.shopify.com`, or `<shop>.myshopify.com` under
+ *   `/admin` (where billing confirmation URLs live).
+ *
+ * Other Shopify-owned hosts are intentionally excluded, including storefronts
+ * (`<shop>.myshopify.com/`), the CDN (`cdn.shopify.com`) and the community
+ * forums (`community.shopify.com`), because their content is not controlled by
+ * the app or the admin. Anything not explicitly allowed is refused.
+ */
+export function isTrustedExitIframeDestination(
+  appUrl: string,
+  destination: unknown,
+): destination is string {
+  if (typeof destination !== 'string' || destination.trim() === '') {
+    return false;
+  }
+
+  let destinationUrl: URL;
+  let appOrigin: string;
+  try {
+    destinationUrl = new URL(destination, appUrl);
+    appOrigin = new URL(appUrl).origin;
+  } catch (_error) {
+    return false;
+  }
+
+  // The app's own origin (including relative paths) is always allowed.
+  if (destinationUrl.origin === appOrigin) {
+    return true;
+  }
+
+  // Every other destination must be a Shopify admin URL served over https with
+  // no custom port.
+  if (destinationUrl.protocol !== 'https:' || destinationUrl.port !== '') {
+    return false;
+  }
+
+  const {hostname, pathname} = destinationUrl;
+
+  if (hostname === SHOPIFY_ADMIN_HOST) {
+    return true;
+  }
+
+  return SHOP_ADMIN_HOST_REGEX.test(hostname) && isAdminPath(pathname);
+}
+
+function isAdminPath(pathname: string): boolean {
+  return pathname === '/admin' || pathname.startsWith('/admin/');
+}

package/src/server/version.ts

@@ -1 +1 @@
-export const SHOPIFY_REMIX_LIBRARY_VERSION = '6.0.0';
+export const SHOPIFY_REMIX_LIBRARY_VERSION = '6.0.2';