[Security] Harden notifications URL validation

packages/cli-kit/src/public/node/notifications-system.test.ts

@@ -1,10 +1,12 @@
 import {
   Notification,
+  fetchNotifications,
   fetchNotificationsInBackground,
   filterNotifications,
   showNotificationsIfNeeded,
 } from './notifications-system.js'
 import {renderError, renderInfo, renderWarning} from './ui.js'
+import {fetch} from './http.js'
 import {sniffForJson} from './path.js'
 import {exec} from './system.js'
 import {cacheRetrieve} from '../../private/node/conf-store.js'
@@ -14,6 +16,7 @@ vi.mock('./ui.js')
 vi.mock('../../private/node/conf-store.js')
 vi.mock('./path.js')
 vi.mock('./system.js')
+vi.mock('./http.js')
 
 const betweenVersins1and2: Notification = {
   id: 'betweenVersins1and2',
@@ -456,3 +459,42 @@ describe('fetchNotificationsInBackground', () => {
     )
   })
 })
+
+describe('fetchNotifications', () => {
+  test('uses the default URL when SHOPIFY_CLI_NOTIFICATIONS_URL is not secure', async () => {
+    // Given
+    vi.stubEnv('SHOPIFY_CLI_NOTIFICATIONS_URL', 'http://malicious.com/notifications.json')
+    vi.mocked(fetch).mockResolvedValue({
+      status: 200,
+      text: () => Promise.resolve(JSON.stringify({notifications: []})),
+    } as any)
+
+    // When
+    await fetchNotifications()
+
+    // Then
+    expect(fetch).toHaveBeenCalledWith(
+      'https://cdn.shopify.com/static/cli/notifications.json',
+      undefined,
+      expect.anything(),
+    )
+    vi.unstubAllEnvs()
+  })
+
+  test('uses the provided URL when SHOPIFY_CLI_NOTIFICATIONS_URL is secure', async () => {
+    // Given
+    const secureUrl = 'https://my-secure-repo.com/notifications.json'
+    vi.stubEnv('SHOPIFY_CLI_NOTIFICATIONS_URL', secureUrl)
+    vi.mocked(fetch).mockResolvedValue({
+      status: 200,
+      text: () => Promise.resolve(JSON.stringify({notifications: []})),
+    } as any)
+
+    // When
+    await fetchNotifications()
+
+    // Then
+    expect(fetch).toHaveBeenCalledWith(secureUrl, undefined, expect.anything())
+    vi.unstubAllEnvs()
+  })
+})

packages/cli-kit/src/public/node/notifications-system.ts

@@ -24,7 +24,25 @@ const COMMANDS_TO_SKIP = [
 ]
 
 function url(): string {
-  return process.env.SHOPIFY_CLI_NOTIFICATIONS_URL ?? URL
+  const envUrl = process.env.SHOPIFY_CLI_NOTIFICATIONS_URL
+  if (envUrl) {
+    try {
+      const parsedUrl = new globalThis.URL(envUrl)
+      // We only allow https for notifications to prevent loading malicious content from insecure sources.
+      if (parsedUrl.protocol === 'https:') {
+        return envUrl
+      }
+      outputDebug(
+        `The notifications URL provided via SHOPIFY_CLI_NOTIFICATIONS_URL (${envUrl}) is not secure (https). Falling back to default.`,
+      )
+      // eslint-disable-next-line no-catch-all/no-catch-all
+    } catch {
+      outputDebug(
+        `The notifications URL provided via SHOPIFY_CLI_NOTIFICATIONS_URL (${envUrl}) is not a valid URL. Falling back to default.`,
+      )
+    }
+  }
+  return URL
 }
 
 const NotificationSchema = zod.object({