XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameter

Description Shopify allows developers to embed widgets (containing product info) on third-party websites via "widgets.shopifyapps.com". When the widget is rendered the `shop` attribute is not filtered allowing any website (not just Shopify shops) to be specified. By providing an attacker controlled …

Framework.Helpers.stripHTMLForObject = function(obj) {
  obj.stripping = true;
  var idx, val;
  for (idx in obj) {
    if (obj.hasOwnProperty(idx)) {
      var val = obj[inx]
      if("string" == typeof val) {
        obj[idx] = Framework.Helpers.stripHTML(val) 
      } else {
        if(null != …