Merge pull request #20 from Shopify/changes-to-release

Harden App Home Redirect URL handling.

Author: byrichardpowell

CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.2]
+
+- Harden App Home Redirect URL handling.
+
 ## [1.0.1]
 
 - Redact log response for exchange and refresh methods.

shopify_app/_version.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "1.0.1"
+__version__ = "1.0.2"

shopify_app/helpers/app_home_redirect.py

@@ -70,7 +70,7 @@ def app_home_redirect(
             shop=shop,
             log=LogWithReq(
                 code="invalid_redirect_url",
-                detail=f"Redirect URL must be a relative path starting with '/'. Received {redirect_url}. Respond 400 Bad Request using the provided response.",
+                detail="Redirect URL was not a safe root-relative path. Respond 400 Bad Request using the provided response.",
                 req=req,
             ),
             response=Res(status=400, body="Bad Request", headers={}),
@@ -171,6 +171,11 @@ def _is_valid_relative_url(redirect_url: str) -> bool:
     if redirect_url.startswith("//"):
         return False
 
+    # Browsers remove tabs, line feeds, and carriage returns during URL
+    # preprocessing, which can turn an accepted URL into a protocol-relative URL
+    if any(control in redirect_url for control in ("\t", "\n", "\r")):
+        return False
+
     # Must not be backslash-prefixed (/\evil.com) — browsers normalize \ to /
     # per the WHATWG URL Standard, turning it into a protocol-relative URL
     if len(redirect_url) > 1 and redirect_url[1] == "\\":