[Security] Harden notifications URL validation#8029
Conversation
This change ensures that the URL used for fetching CLI notifications, whether default or provided via the `SHOPIFY_CLI_NOTIFICATIONS_URL` environment variable, is a valid HTTPS URL. This prevents potential loading of malicious content from insecure or invalid sources. - Validates `SHOPIFY_CLI_NOTIFICATIONS_URL` using `globalThis.URL`. - Enforces `https:` protocol for notifications. - Falls back to default Shopify CDN URL if the provided URL is invalid or insecure. - Adds unit tests to verify the hardening.
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
github-actions
Bot
added
the
no-changelog
1 participant
This PR hardens the
url()function inpackages/cli-kit/src/public/node/notifications-system.tsby adding validation for theSHOPIFY_CLI_NOTIFICATIONS_URLenvironment variable. It ensures that the URL is valid and uses thehttps:protocol, falling back to the default Shopify CDN URL otherwise. This mitigates the risk of loading notifications from insecure or malicious sources. Unit tests have been added to verify this behavior.PR created automatically by Jules for task 18035364240484933283 started by @gonzaloriestra