From 1406d2208c4d5c84e3c0d250aaf4c01b4f982c19 Mon Sep 17 00:00:00 2001
From: Richard Powell <richard.powell@shopify.com>
Date: Thu, 3 Sep 2026 14:10:43 -0400
Subject: [PATCH] Create new Release.

---
 CHANGELOG.md                             | 4 ++++
 src/Internal/Helpers/AppHomeRedirect.php | 8 +++++++-
 src/Version.php                          | 2 +-
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index e3c625f..72ba5f9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.2]
+
+- Harden App Home Redirect URL handling.
+
 ## [1.0.1]
 
 - Redact log response for exchange and refresh methods.
diff --git a/src/Internal/Helpers/AppHomeRedirect.php b/src/Internal/Helpers/AppHomeRedirect.php
index 80e5c3e..69d1056 100644
--- a/src/Internal/Helpers/AppHomeRedirect.php
+++ b/src/Internal/Helpers/AppHomeRedirect.php
@@ -81,7 +81,7 @@ public static function redirect(
                 shop: $shop,
                 log: new LogWithReq(
                     code: 'invalid_redirect_url',
-                    detail: "Redirect URL must be a relative path starting with '/'. Received {$redirectUrl}. Respond 400 Bad Request using the provided response.",
+                    detail: 'Redirect URL was not a safe root-relative path. Respond 400 Bad Request using the provided response.',
                     req: Request::redactForLog($request)
                 ),
                 response: new ResponseInfo(
@@ -189,6 +189,12 @@ private static function isValidRelativeUrl(string $redirectUrl): bool
             return false;
         }
 
+        // Browsers remove tabs, line feeds, and carriage returns during URL
+        // preprocessing, which can turn an accepted URL into a protocol-relative URL
+        if (strpbrk($redirectUrl, "\t\n\r") !== false) {
+            return false;
+        }
+
         // Must not be backslash-prefixed (/\evil.com) — browsers normalize \ to /
         // per the WHATWG URL Standard, turning it into a protocol-relative URL
         if (strlen($redirectUrl) > 1 && $redirectUrl[1] === '\\') {
diff --git a/src/Version.php b/src/Version.php
index b6827ab..d3d8033 100644
--- a/src/Version.php
+++ b/src/Version.php
@@ -4,4 +4,4 @@
 
 namespace Shopify\App;
 
-const VERSION = '1.0.1';
+const VERSION = '1.0.2';