From 33fac4b529dccf9d083af7f1f3f21ef11bb8fd1b Mon Sep 17 00:00:00 2001 From: Waleed Latif Date: Sun, 26 Apr 2026 20:42:25 -0700 Subject: [PATCH] fix(security): credential-set invite email check + shopify authorize XSS --- apps/sim/app/api/auth/shopify/authorize/route.ts | 6 ++++-- .../api/credential-sets/invite/[token]/route.ts | 16 ++++++++++++++++ 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/apps/sim/app/api/auth/shopify/authorize/route.ts b/apps/sim/app/api/auth/shopify/authorize/route.ts index de8ce76b6f9..c32dd313521 100644 --- a/apps/sim/app/api/auth/shopify/authorize/route.ts +++ b/apps/sim/app/api/auth/shopify/authorize/route.ts @@ -32,7 +32,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => { const returnUrl = request.nextUrl.searchParams.get('returnUrl') if (!shopDomain) { - const returnUrlParam = returnUrl ? encodeURIComponent(returnUrl) : '' + const safeReturnUrl = + returnUrl && isSameOrigin(returnUrl) ? encodeURIComponent(returnUrl) : '' + const returnUrlJsLiteral = JSON.stringify(safeReturnUrl) return new NextResponse( ` @@ -120,7 +122,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {