Skip to content

Commit 00a5e08

Browse files
waleedlatif1claude
andcommitted
fix(security): widen shopify subdomain regex to allow up to 63 chars
Shopify and RFC 1123 allow labels up to 63 chars; the previous {1,58} quantifier capped the subdomain at 60 chars and rejected valid 61–63 char shops with a 400. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
1 parent 75bff52 commit 00a5e08

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

apps/sim/lib/api/contracts/oauth-connections.ts

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -143,7 +143,7 @@ export const oauthAuthorizeParamsResponseSchema = z.object({
143143
response_type: z.literal('code'),
144144
})
145145

146-
const SHOPIFY_SHOP_DOMAIN_REGEX = /^[a-z0-9][a-z0-9-]{1,58}[a-z0-9]\.myshopify\.com$/
146+
const SHOPIFY_SHOP_DOMAIN_REGEX = /^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]\.myshopify\.com$/
147147
export const shopifyShopDomainSchema = z.string().regex(SHOPIFY_SHOP_DOMAIN_REGEX)
148148

149149
export const listOAuthConnectionsContract = defineRouteContract({

0 commit comments

Comments
 (0)