Product descriptions are untrusted, but Dawn and Horizon render them raw and Liquid can't sanitize them

Dev Platform App Security
1

Follow-up to Securing your app together.

My understanding so far:

  • Product descriptions and non-app-scoped metafields are untrusted, because any app with write_products can write them.
  • Liquid has no sanitize filter, so untrusted HTML can only be rendered as plain text there (metafield_text, strip_html | escape).
  • To keep the formatting, the only option is {{ product.description | json }}, a sanitizer in JavaScript, and then inserting the result.

Dawn and Horizon output product.description raw, so this affects every store on Shopify’s own themes, not only apps. A theme can’t fix it in Liquid, and the JavaScript route takes the description out of the server-rendered HTML and adds a sanitizer to every product page.

Will this be fixed for Dawn and Horizon as well? Is the plan a Liquid sanitize filter, or sanitizing descriptionHtml when it is written?

2

Sanitizing this will break a lot of integrations from app and merchant-added content. Especially those that use JavaScript. Since Online Store 2.0 this will be far less that it used to be, as there are arguably better integration points/techniques than using the product description, but many of those depend on single_line_text_field being inserted via the “Dynamic source” option, which can contain JavaScript too. And for many cases, I know of no user-friendly alternatives to this e.g., adding app-generated content to a product accordion or to a rich text editor as mixed merchanted-added/app-generated content.