Simplify theme capabilities and reject encoded IP origins

Author: isaacroldan

packages/app/src/cli/models/extensions/schemas.ts

@@ -21,7 +21,7 @@ const IframeCapabilitySchema = zod.object({
   sources: zod.array(zod.string()).optional(),
 })
 
-export const CapabilitiesSchema = zod.object({
+const CapabilitiesSchema = zod.object({
   // Theme app extensions declare `network_access` as a table that lists the origins they contact (see the theme
   // specification). Every other extension declares a boolean, which is all this shared schema accepts. The wider
   // type lets the theme specification reuse `BaseConfigType`.

packages/app/src/cli/models/extensions/specifications/theme.test.ts

@@ -52,13 +52,20 @@ describe('theme', () => {
       expect(parse({}).data?.capabilities?.network_access).toBeUndefined()
     })
 
-    test('ignores a boolean network_access, as before', () => {
-      const result = parse({network_access: true})
+    test.each([true, false])('ignores a boolean network_access of %s, as before', (networkAccess) => {
+      const result = parse({network_access: networkAccess})
 
       expect(result.state).toBe('ok')
       expect(result.data?.capabilities?.network_access).toBeUndefined()
     })
 
+    test('ignores capabilities that do not apply to theme extensions', () => {
+      const result = parse({network_access: {allowed_sources: []}, api_access: true, block_progress: true})
+
+      expect(result.state).toBe('ok')
+      expect(result.data?.capabilities).toEqual({network_access: {allowed_sources: []}})
+    })
+
     test('requires allowed_sources when the network_access table is declared', () => {
       const result = parse({network_access: {}})
 
@@ -99,6 +106,13 @@ describe('theme', () => {
       ['a wildcard that is not the leading label', 'https://api.*.example.com'],
       ['a single-label host', 'https://localhost'],
       ['an IP address', 'https://127.0.0.1'],
+      ['an IP address with a hexadecimal final label', 'https://127.0.0x1'],
+      ['an IP address in hexadecimal notation', 'https://0x7f.0x1'],
+      ['a link-local IP address in hexadecimal notation', 'https://0xa9.0xfe.0xa9.0xfe'],
+      ['a wildcard on an IP address', 'https://*.127.0.0.1'],
+      ['a wildcard on an IP address in hexadecimal notation', 'https://*.0x7f.0x1'],
+      ['a host that cannot be parsed as a URL', 'https://example.0xabc'],
+      ['a wildcard on a host that cannot be parsed as a URL', 'https://*.example.0xabc'],
       ['an invalid label', 'https://-api.example.com'],
       ['an empty label', 'https://api..example.com'],
       ['a trailing dot', 'https://api.example.com./'],

packages/app/src/cli/models/extensions/specifications/theme.ts

@@ -1,12 +1,14 @@
 import {createExtensionSpecification} from '../specification.js'
-import {BaseSchema, CapabilitiesSchema} from '../schemas.js'
+import {BaseSchema} from '../schemas.js'
 import {themeExtensionFiles} from '../../../utilities/extensions/theme.js'
 import {ExtensionInstance} from '../extension-instance.js'
 import {fileSize} from '@shopify/cli-kit/node/fs'
 import {dirname, relativePath} from '@shopify/cli-kit/node/path'
 import {AbortError} from '@shopify/cli-kit/node/error'
 import {outputContent, outputToken} from '@shopify/cli-kit/node/output'
 import {zod} from '@shopify/cli-kit/node/schema'
+import {safeParseURL} from '@shopify/cli-kit/common/url'
+import {isIP} from 'node:net'
 
 export const MAX_ALLOWED_SOURCES = 20
 const MAX_HOST_LENGTH = 253
@@ -34,8 +36,8 @@ export function normalizeAllowedSource(source: string): string | undefined {
 
   const labels = host.split('.')
   if (labels.length < 2 || !labels.every((label) => HOST_LABEL_PATTERN.test(label))) return undefined
-  // A numeric last label means an IP address (or a TLD that doesn't exist).
-  if (/^\d+$/.test(labels[labels.length - 1]!)) return undefined
+  const parsedOrigin = safeParseURL(`https://${host}`)
+  if (!parsedOrigin || isIP(parsedOrigin.hostname) !== 0) return undefined
 
   let portSuffix = ''
   if (port !== undefined) {
@@ -71,7 +73,7 @@ const ThemeNetworkAccessSchema = zod.object(
   {invalid_type_error: 'network_access must be a table with an allowed_sources list for theme app extensions'},
 )
 
-const ThemeCapabilitiesSchema = CapabilitiesSchema.extend({
+const ThemeCapabilitiesSchema = zod.object({
   // A boolean `network_access` (used by UI extensions) never had an effect on theme app extensions. Keep ignoring it.
   network_access: zod.preprocess(
     (value) => (typeof value === 'boolean' ? undefined : value),