From 60652e621c158b082bc64a120b2e877698a5eb81 Mon Sep 17 00:00:00 2001 From: Waleed Date: Sun, 26 Apr 2026 20:52:42 -0700 Subject: [PATCH] fix(security): credential-set invite email check + shopify authorize XSS (#4302) --- apps/sim/app/api/auth/shopify/authorize/route.ts | 6 ++++-- .../api/credential-sets/invite/[token]/route.ts | 16 ++++++++++++++++ 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/apps/sim/app/api/auth/shopify/authorize/route.ts b/apps/sim/app/api/auth/shopify/authorize/route.ts index de8ce76b6f..c32dd31352 100644 --- a/apps/sim/app/api/auth/shopify/authorize/route.ts +++ b/apps/sim/app/api/auth/shopify/authorize/route.ts @@ -32,7 +32,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => { const returnUrl = request.nextUrl.searchParams.get('returnUrl') if (!shopDomain) { - const returnUrlParam = returnUrl ? encodeURIComponent(returnUrl) : '' + const safeReturnUrl = + returnUrl && isSameOrigin(returnUrl) ? encodeURIComponent(returnUrl) : '' + const returnUrlJsLiteral = JSON.stringify(safeReturnUrl) return new NextResponse( ` @@ -120,7 +122,7 @@ export const GET = withRouteHandler(async (request: NextRequest) => {