Skip to content
This repository has been archived by the owner on Apr 11, 2024. It is now read-only.

Add methods to sanitize shops and hosts #434

Merged
merged 4 commits into from
Jul 27, 2022
Merged

Conversation

paulomarg
Copy link
Contributor

WHY are these changes introduced?

When receiving user input data, apps should be able to easily validate that they are in the expected format / safe.

WHAT is this pull request doing?

Adding Utils methods sanitizeShop and sanitizeHost to make it easier for apps to validate / fail requests on a single call.

I ended up opting not to reuse validateShop because I like the ergonomics of

try {
  const shop = Shopify.Utils.sanitizeShop(req.query.shop, true); // Second arg is throwOnInvalid
} catch (e) {
  // Custom error handling
}

// or even no try-catch to just bork since it's a bad request anyway
const shop = Shopify.Utils.sanitizeShop(req.query.shop, true);

better than

const shop = req.query.shop;
if (!Shopify.Utils.validateShop()) {
  throw new Error("this message will be repeated quite a few times");
}

Type of change

  • Minor: New feature (non-breaking change which adds functionality)

Checklist

  • I have added a changelog entry, prefixed by the type of change noted above
  • I have added/updated tests for this change
  • I have documented new APIs/updated the documentation for modified APIs (for public APIs)

@paulomarg paulomarg requested a review from a team as a code owner July 25, 2022 14:53
@paulomarg paulomarg force-pushed the enhance_shop_sanitization branch from ff3470c to af46302 Compare July 25, 2022 14:54
src/auth/session/storage/custom.ts Outdated Show resolved Hide resolved
@paulomarg paulomarg force-pushed the enhance_shop_sanitization branch from 4d67065 to 090a1fe Compare July 27, 2022 13:37
@paulomarg paulomarg merged commit 1bb138f into main Jul 27, 2022
@paulomarg paulomarg deleted the enhance_shop_sanitization branch July 27, 2022 13:45
@shopify-shipit shopify-shipit bot temporarily deployed to production July 28, 2022 19:27 Inactive
# for free to subscribe to this conversation on GitHub. Already have an account? #.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants