Harden App Home Redirect URL handling.

CHANGELOG.md

@@ -5,6 +5,10 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.2]
+
+- Harden App Home Redirect URL handling.
+
 ## [1.0.1]
 
 - Redact log response for exchange and refresh methods.

src/Internal/Helpers/AppHomeRedirect.php

@@ -81,7 +81,7 @@ public static function redirect(
                 shop: $shop,
                 log: new LogWithReq(
                     code: 'invalid_redirect_url',
-                    detail: "Redirect URL must be a relative path starting with '/'. Received {$redirectUrl}. Respond 400 Bad Request using the provided response.",
+                    detail: 'Redirect URL was not a safe root-relative path. Respond 400 Bad Request using the provided response.',
                     req: Request::redactForLog($request)
                 ),
                 response: new ResponseInfo(
@@ -189,6 +189,12 @@ private static function isValidRelativeUrl(string $redirectUrl): bool
             return false;
         }
 
+        // Browsers remove tabs, line feeds, and carriage returns during URL
+        // preprocessing, which can turn an accepted URL into a protocol-relative URL
+        if (strpbrk($redirectUrl, "\t\n\r") !== false) {
+            return false;
+        }
+
         // Must not be backslash-prefixed (/\evil.com) — browsers normalize \ to /
         // per the WHATWG URL Standard, turning it into a protocol-relative URL
         if (strlen($redirectUrl) > 1 && $redirectUrl[1] === '\\') {

src/Version.php

@@ -4,4 +4,4 @@
 
 namespace Shopify\App;
 
-const VERSION = '1.0.1';
+const VERSION = '1.0.2';