# Improper deep link validation

Shopify Android app deep-link path-prefix check bypassed with ../ traversal, loading arbitrary URLs in a WebView with EASDK JS bridge, enabling local file access and JS execution.

- Payout: hidden
- Severity: low
- Program: Shopify
- Found by: fr4via
- Disclosed: 2022-07-11
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1087744
- Library page: https://bugbountylibrary.com/r/h1%3A1087744
- Tags: area:web3 domain:mobile impact:data-leak impact:integrity kind:bounty platform:hackerone sev:low tech:android technique:source-review vuln:auth-bypass vuln:path-traversal

**Target:** Shopify Android app deep link handler / WebView
**Root cause:** Deep link handler validates scheme/host and path prefix but does not normalize the URI, so appending ../ after an allowed /admin/... prefix escapes the prefix and routes to arbitrary paths/URLs.
**Steps:**
1. Craft intent: `am start -W -a android.intent.action.VIEW -d "https://TARGET.myshopify.com/admin/collections/../../"` to escape the /admin prefix and load the store root.
2. Create a partner account and a new app whose URL points to an attacker-controlled server.
3. In partner dashboard choose the target client store and copy the merchant install link.
4. Send intent: `am start -W -a android.intent.action.VIEW -d "https://TARGET.myshopify.com/admin/collections/.../oauth/install_custom_app?client_id=..."` to load the external URL in the WebView.
5. Use the EASDK JS bridge, e.g. `EASDK.redirect("file:///data/data/com.shopify.mobile/shared_prefs/notification_ids.xml")`, to read local files or execute JS.
**How found:** Reviewed the deep link activity's declared schemes and path prefixes (/admin subdirectories), hypothesized the prefix check was string-based without normalization, and tested appending ../ to escape it.
**Exploitation:** Attacker delivers a VIEW intent with a crafted https://*.myshopify.com URL containing ../ traversal past the /admin path prefix; the app routes it to the WebView activity, which loads attacker-controlled content that can invoke the EASDK JavaScript interface to redirect to file:// URIs and execute JS in the app context.
**Escalation:** Chained path traversal with the EASDK JS bridge to reach file:// local storage and arbitrary JS execution, beyond simple phishing.
**Insight:** When a deep link handler whitelists path prefixes, test ../ and encoded traversal after the allowed prefix; also check whether the resulting WebView exposes a JS bridge (EASDK) that turns URL loading into file:// access or JS execution.