From 1d93a8213a71a11b9451e0e7e5fd08806bc82622 Mon Sep 17 00:00:00 2001
From: Josh Larson <josh.larson@shopify.com>
Date: Fri, 16 Oct 2026 10:49:25 -0500
Subject: [PATCH 1/5] Exempt inert schema-typed Liquid settings from
 LIQUID_UNSAFE_RENDER

---
 .../checks/LIQUID_UNSAFE_RENDER.md            |  4 +-
 .../app-security-engine/checks/embedded.ts    |  2 +-
 .../app-security-engine/rules/liquid-rules.ts | 71 ++++++++++++++++++-
 .../app-security-engine/scanners/index.ts     |  2 +-
 .../tests/deterministic-rules.test.ts         | 36 ++++++++++
 5 files changed, 110 insertions(+), 5 deletions(-)

diff --git a/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md b/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
index a322754caea..d304e6765cc 100644
--- a/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
+++ b/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
@@ -1,6 +1,6 @@
 ---
 id: LIQUID_UNSAFE_RENDER
-version: 1
+version: 2
 severity: medium
 precedence: union
 ---
@@ -8,3 +8,5 @@ precedence: union
 # Liquid Unsafe Render
 
 Inspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.
+
+As of version 2, the deterministic rule exempts exact `block.settings.<id>` / `section.settings.<id>` output in HTML text and non-URL attribute contexts when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, or `=` characters). Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, JavaScript/executable contexts, and URL attributes remain flagged as before.
diff --git a/packages/app/src/cli/services/app-security-engine/checks/embedded.ts b/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
index 37cd0ff8d22..bfc4a0c906b 100644
--- a/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
+++ b/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
@@ -17,7 +17,7 @@ export const EMBEDDED_CHECK_SOURCES: ReadonlyArray<string> = [
   "---\nid: EOL_API_VERSION\nversion: 2\nseverity: low\nprecedence: prefer-agent\n---\n\n# Eol Api Version\n\nInspect the selected `shopify.app*.toml` plus React Router `app/shopify.server.*` declarations. Shopify publishes quarterly versions in January, April, July, and October and supports each stable version for 12 months; the app security check allows a documented 30-day extension grace period before reporting it as end-of-life. Cite the exact declaration. For malformed config, computed `ApiVersion` values, or a Shopify-announced exceptional extension, inspect the source and current lifecycle policy rather than inferring from unrelated constants.\n",
   "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 2\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
   "---\nid: INSECURE_WEBHOOK_URL\nversion: 2\nseverity: high\nprecedence: prefer-agent\n---\n\n# Insecure Configured Callback Url\n\nInspect webhook destinations and OAuth redirect URLs in the selected Shopify app configuration. Relative Shopify paths and valid pubsub/eventbridge webhook destinations are allowed. Report HTTP, malformed, credential-bearing, wildcard-host, wildcard-path, or otherwise unsafe configured callback URLs.\n",
-  "---\nid: LIQUID_UNSAFE_RENDER\nversion: 1\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n",
+  "---\nid: LIQUID_UNSAFE_RENDER\nversion: 2\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n\nAs of version 2, the deterministic rule exempts exact `block.settings.<id>` / `section.settings.<id>` output in HTML text and non-URL attribute contexts when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, or `=` characters). Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, JavaScript/executable contexts, and URL attributes remain flagged as before.\n",
   "---\nid: METAFIELD_OFFLINE_TOKEN\nversion: 2\nseverity: high\n---\n\n# Metafield Offline Token\n\nTrace metafield and metaobject writes and determine their token provenance. Report a write that runs in an offline Admin API context that no verified request for the same shop authorizes: for example `unauthenticated.admin(shop)` or a stored offline session reached from an unauthenticated route, an unverified webhook or app proxy request, or a job whose shop or values come from request-controlled input.\n\nAn offline session returned by `authenticate.admin(request)` (the React Router SDK default when `useOnlineTokens` isn't set) is a verified, shop-bound context: Shopify verified the session token and the staff member's access to the app. Don't report a write only because its token is offline or because an online token would add user attribution or expiry. Report it when:\n\n- the app defines its own per-user permission, for example an app-level role or allowlist check, and this write bypasses it. Name that permission.\n- request-controlled values reach an app-reserved (`$app`) metafield or metaobject that the app treats as trusted state and merchants can't edit themselves, for example a definition with `access.admin = \"merchant_read\"` or no merchant access, or billing, entitlement or feature-flag data. Writing to the `$app` namespace isn't safe by itself.\n\nConfirm token provenance and compensating authorization before reporting.\n",
   "---\nid: MISSING_AUTHORIZATION_CHECK\nversion: 3\nseverity: high\n---\n\nFind controller actions or route handlers that access resources without\nchecking whether the current user is authorized to access them, beyond\nauthentication. Authentication verifies WHO you are; authorization verifies\nWHAT you can do. An app can be authenticated but still access resources\nbelonging to another merchant if authorization checks are missing.\n\nThis is distinct from `MISSING_TENANT_ISOLATION` (database query\nscoping) — this check looks for missing policy/permission checks on\nactions, even when the data access is scoped. For example, an app might\nscope queries by shop but not check whether the merchant has the right to\ndelete a resource, or whether a staff member can access admin-only\nactions.\n\n## What to look for\n\n1. **Find authorization frameworks.** Check what the app uses:\n   - Rails: Pundit (`authorize`, `policy`, `Pundit`), CanCanCan\n     (`can?`, `ability`), action_access filters\n   - Remix/Express: middleware that checks roles/permissions\n   - Custom: `before_action :check_admin`, `if current_user.can?`\n\n2. **Find actions without authorization checks.** For each controller\n   action or route handler, determine:\n   - Is there a `before_action` that checks authorization (not just\n     authentication)?\n   - Is there a Pundit `authorize` call?\n   - Is there a CanCanCan `authorize!` or `can?` check?\n   - Is there a custom permission check?\n\n3. **Check for `skip_idor_protection` or equivalent opt-outs.** These\n   disable IDOR/authorization checks. For each, determine:\n   - Is the skip justified? (e.g., public endpoint, webhook, health check)\n   - Does the skip expose a state-changing action to unauthorised users?\n   - Is there a compensating control (HMAC, session token, etc.)?\n\n4. **Check for admin-only functionality reachable by merchants.** Look for:\n   - Controllers under `admin/` namespace that don't check staff vs merchant\n   - Actions that modify app configuration without checking the caller's role\n   - Staff-only operations accessible through the merchant-facing UI\n\n5. **Check for missing object-level authorization.** Even if the query\n   is scoped by shop, does the handler verify that the specific resource\n   belongs to the current merchant?\n   - `Order.find(params[:id])` scoped by shop — but does it check the\n     merchant can access this specific order?\n   - `Product.find(params[:id])` — is there a policy check, or just\n     tenant scoping?\n\n6. **Compare authorization across state transitions.** Do not stop at one\n   handler. Compare create/read/update/delete paths, replay after role or UI\n   changes, direct URLs that survive permission downgrades, and backend actions\n   that remain callable after a feature is hidden or disabled in the UI.\n\n## Shopify embedded apps (React Router)\n\n`authenticate.admin(request)` verifies the Shopify session token, so the caller is a staff member of that shop whom Shopify has granted access to this app. With offline tokens (the SDK default), Admin API calls use the app's granted scopes rather than the staff member's own permissions. That is Shopify's standard embedded app model, not a finding by itself. Report a handler only when it skips a concrete authorization boundary inside the app:\n\n- The app defines its own roles, owners, or allowlists (for example a check on `sessionToken.sub`, `onlineAccessInfo.associated_user`, `account_owner`, or an app database role), and a handler that performs the same or a more privileged operation doesn't apply it. Compare each route's loader and action, and sibling routes.\n- A request-supplied identifier selects an app-owned record that belongs to another user of the app.\n- The app uses online tokens to respect staff permissions on some paths, but a privileged path falls back to an offline session.\n\nIf none of these applies, record the check as executed with no finding.\n\n## What to report\n\nFor each action that exposes a concrete unauthorized operation beyond authentication:\n\n```json\n{\n  \"file\": \"app/controllers/orders_controller.rb\",\n  \"line\": 15,\n  \"message\": \"Destroy action has no authorization check beyond authentication\",\n  \"snippet\": \"def destroy\\n  Order.find(params[:id]).destroy\\nend\",\n  \"evidence\": [\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 15,\n      \"quote\": \"def destroy\"\n    },\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 5,\n      \"quote\": \"before_action :authenticate_user (no authorize check)\"\n    }\n  ],\n  \"confidence\": \"medium\",\n  \"reasoning\": \"The destroy action authenticates the user but does not call authorize or check a policy. Any authenticated merchant can delete any order within their shop, even if they shouldn't have delete permissions.\"\n}\n```\n\nOnly report when you can show an unauthorized operation is actually reachable;\ndifferent helper names or inconsistent UI affordances are not enough by themselves.\n\nDo not report:\n\n- Actions with explicit `authorize` / `can?` / policy checks\n- Actions protected by a `before_action` that checks authorization\n- Public endpoints (health checks, static content)\n- Webhook handlers (HMAC is the authorization)\n- Actions that only read data the merchant owns (scoped by session.shop\n  AND no object-level access control needed)\n- Internal/staff-only controllers (under `Internal::` namespace, behind\n  employee SSO like `EmployeeIdentity`, `IdentityClient`, etc.)\n- Test files (under test/ or \\*\\_test.rb)\n- Test controllers\n",
   "---\nid: MISSING_COMPLIANCE_WEBHOOKS\nversion: 1\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Missing Compliance Webhooks\n\nInspect the selected `shopify.app*.toml` file. If it could not be parsed, keep the check unresolved. Verify all three compliance topics (`shop/redact`, `customers/data_request`, `customers/redact`) are declared in that configuration. Report only a confirmed missing topic.\n",
diff --git a/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts b/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
index 1c9f1e4eb2c..b0dafdb2d6f 100644
--- a/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
+++ b/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
@@ -30,13 +30,69 @@ export function scanLiquidSecurity(files: SourceFile[]): LiquidScanResult {
       parserFailures.push(file.path)
       continue
     }
-    issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidUnsafeRenderVisitor(file)))
+    const schemaSettings = extractSchemaSettings(file.content)
+    issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidUnsafeRenderVisitor(file, schemaSettings)))
     issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidExecutableContextVisitor(file)))
   }
   return {issues, parserFailures}
 }
 
-function liquidUnsafeRenderVisitor(file: SourceFile) {
+interface SchemaSetting {
+  type?: unknown
+  options?: unknown
+}
+
+const URL_ATTRIBUTE_NAMES = new Set(['href', 'src', 'action', 'formaction', 'poster', 'cite', 'xlink:href'])
+const INERT_OPTION_VALUE = /^[A-Za-z0-9\-._~:/?#@!$()*+,;%]*$/
+
+// Extract id -> setting from the file's {% schema %} JSON. Returns undefined
+// (fail-closed: no exemption) when the schema is missing, duplicated,
+// unparseable, or has duplicate setting ids.
+function extractSchemaSettings(content: string): Map<string, SchemaSetting> | undefined {
+  const blocks = [...content.matchAll(/\{%-?\s*schema\s*-?%\}([\s\S]*?)\{%-?\s*endschema\s*-?%\}/g)]
+  if (blocks.length !== 1) return undefined
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(blocks[0]![1]!.trim())
+    // Unparseable schema fails closed: no exemption.
+    // eslint-disable-next-line no-catch-all/no-catch-all
+  } catch {
+    return undefined
+  }
+  if (!parsed || typeof parsed !== 'object') return undefined
+  const settings = (parsed as {settings?: unknown}).settings
+  if (!Array.isArray(settings)) return undefined
+  const byId = new Map<string, SchemaSetting>()
+  for (const setting of settings) {
+    if (!setting || typeof setting !== 'object') continue
+    const id = (setting as {id?: unknown}).id
+    if (typeof id !== 'string' || id === '') continue
+    if (byId.has(id)) return undefined
+    byId.set(id, setting as SchemaSetting)
+  }
+  return byId
+}
+
+function isSchemaExemptSetting(expression: string, schemaSettings: Map<string, SchemaSetting> | undefined): boolean {
+  if (!schemaSettings) return false
+  const baseExpression = expression.split('|')[0]!.trim()
+  const match = /^(?:block|section)\.settings\.([A-Za-z0-9_-]+)$/.exec(baseExpression)
+  if (!match) return false
+  const setting = schemaSettings.get(match[1]!)
+  if (!setting) return false
+  if (setting.type === 'checkbox' || setting.type === 'range') return true
+  if (setting.type === 'select' || setting.type === 'radio') {
+    if (!Array.isArray(setting.options) || setting.options.length === 0) return false
+    return setting.options.every((option) => {
+      if (!option || typeof option !== 'object') return false
+      const value = (option as {value?: unknown}).value
+      return typeof value === 'string' && INERT_OPTION_VALUE.test(value)
+    })
+  }
+  return false
+}
+
+function liquidUnsafeRenderVisitor(file: SourceFile, schemaSettings?: Map<string, SchemaSetting>) {
   return {
     LiquidVariableOutput(node: LiquidVariableOutput, ancestors: LiquidHtmlNode[]): Issue[] | undefined {
       const expression = outputSource(node)
@@ -44,6 +100,11 @@ function liquidUnsafeRenderVisitor(file: SourceFile) {
       const filters = filterNames(node)
       const context = liquidOutputContext(ancestors)
       if (isSafelyRendered(filters, context)) return undefined
+      if (
+        (context === 'html_text' || (context === 'html_attribute' && !isUrlAttributeContext(ancestors))) &&
+        isSchemaExemptSetting(expression, schemaSettings)
+      )
+        return undefined
       return [
         makeLiquidIssue(
           'LIQUID_UNSAFE_RENDER',
@@ -116,6 +177,12 @@ function liquidOutputContext(ancestors: LiquidHtmlNode[]): LiquidOutputContext {
   return 'html_attribute'
 }
 
+function isUrlAttributeContext(ancestors: LiquidHtmlNode[]): boolean {
+  const attribute = ancestors.find((ancestor): ancestor is AttributeNode => ancestor.type.startsWith('Attr'))
+  if (!attribute) return false
+  return URL_ATTRIBUTE_NAMES.has(attributeName(attribute).toLowerCase())
+}
+
 function attributeName(attribute: AttributeNode): string {
   if (!('name' in attribute) || !Array.isArray(attribute.name)) return ''
   return attribute.name.map((part) => ('value' in part && typeof part.value === 'string' ? part.value : '')).join('')
diff --git a/packages/app/src/cli/services/app-security-engine/scanners/index.ts b/packages/app/src/cli/services/app-security-engine/scanners/index.ts
index ddf02cb2ab1..4ad0b29775f 100644
--- a/packages/app/src/cli/services/app-security-engine/scanners/index.ts
+++ b/packages/app/src/cli/services/app-security-engine/scanners/index.ts
@@ -160,7 +160,7 @@ const DETERMINISTIC_CHECK_DEFINITIONS: ReadonlyArray<DeterministicCheckDefinitio
   jsCheck('CREDENTIAL_BROWSER_LEAKAGE', (context) => scanCredentialBrowserLeakage(context.sourceFiles), 'source', 2),
   {
     id: 'LIQUID_UNSAFE_RENDER',
-    version: 1,
+    version: 2,
     lifecycle: 'active',
     analysisMode: 'ast',
     target: 'theme',
diff --git a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
index 25ef65b94a2..f5dc6b50282 100644
--- a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
+++ b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
@@ -58,6 +58,7 @@ describe('deterministic rules product contract', () => {
     expect(DETERMINISTIC_CHECKS.get('CREDENTIAL_LOG_LEAKAGE')?.version).toBe(2)
     expect(DETERMINISTIC_CHECKS.get('CREDENTIAL_BROWSER_LEAKAGE')?.version).toBe(2)
     expect(DETERMINISTIC_CHECKS.get('UNSAFE_INNERHTML')?.version).toBe(3)
+    expect(DETERMINISTIC_CHECKS.get('LIQUID_UNSAFE_RENDER')?.version).toBe(2)
     expect(DETERMINISTIC_CHECKS.get('STATIC_FRAME_ANCESTORS')?.version).toBe(2)
     expect(DETERMINISTIC_CHECKS.get('MISSING_DEPENDENCY_SECURITY_AUTOMATION')?.version).toBe(2)
   })
@@ -333,4 +334,39 @@ describe('Liquid AST mode', () => {
       'extensions/theme/blocks/a.liquid',
     ])
   })
+
+  test('exempts schema-defined inert settings only in HTML text and non-URL attributes', () => {
+    const schema = (settings: string) => `{% schema %}{"settings":[${settings}]}{% endschema %}`
+    const select = schema('{"type":"select","id":"layout","options":[{"value":"left"},{"value":"right"}]}')
+    const liquid = (content: string) =>
+      scanLiquidSecurity([source(content, 'extensions/theme/blocks/a.liquid')]).issues.map((finding) => finding.id)
+    // Inert select clean in text and non-URL attribute; escaped variants stay clean.
+    expect(liquid(`{{ block.settings.layout }}${select}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div class="{{ block.settings.layout }}"></div>${select}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{{ block.settings.layout | escape }}${select}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    // Checkbox and range clean.
+    expect(liquid(`{{ block.settings.show }}${schema('{"type":"checkbox","id":"show"}')}`)).not.toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid(`{{ section.settings.size }}${schema('{"type":"range","id":"size"}')}`)).not.toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    // Bad option, free-text types, property access, JS/executable and URL contexts still flagged.
+    expect(
+      liquid(`{{ block.settings.layout }}${schema('{"type":"select","id":"layout","options":[{"value":"a<b"}]}')}`),
+    ).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{{ block.settings.title }}${schema('{"type":"text","id":"title"}')}`)).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid(`{{ block.settings.body }}${schema('{"type":"richtext","id":"body"}')}`)).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid(`{{ block.settings.layout.title }}${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<script>const v = {{ block.settings.layout }};</script>${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div onclick="{{ block.settings.layout }}"></div>${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<a href="{{ block.settings.layout }}">x</a>${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    // Missing or unparseable schema stays flagged.
+    expect(liquid('{{ block.settings.layout }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.layout }}{% schema %}not-json{% endschema %}')).toContain('LIQUID_UNSAFE_RENDER')
+  })
 })

From fb8c31f0bcf81bede1d964ca053eeb5d1cadebca Mon Sep 17 00:00:00 2001
From: Josh Larson <josh.larson@shopify.com>
Date: Tue, 20 Oct 2026 09:11:27 -0500
Subject: [PATCH 2/5] Limit LIQUID_UNSAFE_RENDER schema exemption to block
 settings with literal filter args

In an app block, section.settings refers to the host section, so it is no longer checked against the block schema. Filter arguments are rendered too, so a filter argument that references a setting or variable (for example default: block.settings.title) now disqualifies the exemption.
---
 .../checks/LIQUID_UNSAFE_RENDER.md            |  2 +-
 .../app-security-engine/checks/embedded.ts    |  2 +-
 .../app-security-engine/rules/liquid-rules.ts | 41 ++++++++++++----
 .../tests/deterministic-rules.test.ts         | 47 ++++++++++++++++++-
 4 files changed, 81 insertions(+), 11 deletions(-)

diff --git a/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md b/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
index d304e6765cc..5430040b329 100644
--- a/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
+++ b/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
@@ -9,4 +9,4 @@ precedence: union
 
 Inspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.
 
-As of version 2, the deterministic rule exempts exact `block.settings.<id>` / `section.settings.<id>` output in HTML text and non-URL attribute contexts when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, or `=` characters). Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, JavaScript/executable contexts, and URL attributes remain flagged as before.
+As of version 2, the deterministic rule exempts exact `block.settings.<id>` output in app block files (`blocks/`) in HTML text and non-URL attribute contexts when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, or `=` characters). Filters are allowed only when every argument is a string, number, or literal such as `nil` or `true`. `section.settings` in an app block refers to the host section and is not exempt. Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, filter arguments that reference settings or variables, JavaScript/executable contexts, and URL attributes remain flagged as before.
diff --git a/packages/app/src/cli/services/app-security-engine/checks/embedded.ts b/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
index bfc4a0c906b..1946bfeb182 100644
--- a/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
+++ b/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
@@ -17,7 +17,7 @@ export const EMBEDDED_CHECK_SOURCES: ReadonlyArray<string> = [
   "---\nid: EOL_API_VERSION\nversion: 2\nseverity: low\nprecedence: prefer-agent\n---\n\n# Eol Api Version\n\nInspect the selected `shopify.app*.toml` plus React Router `app/shopify.server.*` declarations. Shopify publishes quarterly versions in January, April, July, and October and supports each stable version for 12 months; the app security check allows a documented 30-day extension grace period before reporting it as end-of-life. Cite the exact declaration. For malformed config, computed `ApiVersion` values, or a Shopify-announced exceptional extension, inspect the source and current lifecycle policy rather than inferring from unrelated constants.\n",
   "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 2\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
   "---\nid: INSECURE_WEBHOOK_URL\nversion: 2\nseverity: high\nprecedence: prefer-agent\n---\n\n# Insecure Configured Callback Url\n\nInspect webhook destinations and OAuth redirect URLs in the selected Shopify app configuration. Relative Shopify paths and valid pubsub/eventbridge webhook destinations are allowed. Report HTTP, malformed, credential-bearing, wildcard-host, wildcard-path, or otherwise unsafe configured callback URLs.\n",
-  "---\nid: LIQUID_UNSAFE_RENDER\nversion: 2\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n\nAs of version 2, the deterministic rule exempts exact `block.settings.<id>` / `section.settings.<id>` output in HTML text and non-URL attribute contexts when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, or `=` characters). Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, JavaScript/executable contexts, and URL attributes remain flagged as before.\n",
+  "---\nid: LIQUID_UNSAFE_RENDER\nversion: 2\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n\nAs of version 2, the deterministic rule exempts exact `block.settings.<id>` output in app block files (`blocks/`) in HTML text and non-URL attribute contexts when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, or `=` characters). Filters are allowed only when every argument is a string, number, or literal such as `nil` or `true`. `section.settings` in an app block refers to the host section and is not exempt. Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, filter arguments that reference settings or variables, JavaScript/executable contexts, and URL attributes remain flagged as before.\n",
   "---\nid: METAFIELD_OFFLINE_TOKEN\nversion: 2\nseverity: high\n---\n\n# Metafield Offline Token\n\nTrace metafield and metaobject writes and determine their token provenance. Report a write that runs in an offline Admin API context that no verified request for the same shop authorizes: for example `unauthenticated.admin(shop)` or a stored offline session reached from an unauthenticated route, an unverified webhook or app proxy request, or a job whose shop or values come from request-controlled input.\n\nAn offline session returned by `authenticate.admin(request)` (the React Router SDK default when `useOnlineTokens` isn't set) is a verified, shop-bound context: Shopify verified the session token and the staff member's access to the app. Don't report a write only because its token is offline or because an online token would add user attribution or expiry. Report it when:\n\n- the app defines its own per-user permission, for example an app-level role or allowlist check, and this write bypasses it. Name that permission.\n- request-controlled values reach an app-reserved (`$app`) metafield or metaobject that the app treats as trusted state and merchants can't edit themselves, for example a definition with `access.admin = \"merchant_read\"` or no merchant access, or billing, entitlement or feature-flag data. Writing to the `$app` namespace isn't safe by itself.\n\nConfirm token provenance and compensating authorization before reporting.\n",
   "---\nid: MISSING_AUTHORIZATION_CHECK\nversion: 3\nseverity: high\n---\n\nFind controller actions or route handlers that access resources without\nchecking whether the current user is authorized to access them, beyond\nauthentication. Authentication verifies WHO you are; authorization verifies\nWHAT you can do. An app can be authenticated but still access resources\nbelonging to another merchant if authorization checks are missing.\n\nThis is distinct from `MISSING_TENANT_ISOLATION` (database query\nscoping) — this check looks for missing policy/permission checks on\nactions, even when the data access is scoped. For example, an app might\nscope queries by shop but not check whether the merchant has the right to\ndelete a resource, or whether a staff member can access admin-only\nactions.\n\n## What to look for\n\n1. **Find authorization frameworks.** Check what the app uses:\n   - Rails: Pundit (`authorize`, `policy`, `Pundit`), CanCanCan\n     (`can?`, `ability`), action_access filters\n   - Remix/Express: middleware that checks roles/permissions\n   - Custom: `before_action :check_admin`, `if current_user.can?`\n\n2. **Find actions without authorization checks.** For each controller\n   action or route handler, determine:\n   - Is there a `before_action` that checks authorization (not just\n     authentication)?\n   - Is there a Pundit `authorize` call?\n   - Is there a CanCanCan `authorize!` or `can?` check?\n   - Is there a custom permission check?\n\n3. **Check for `skip_idor_protection` or equivalent opt-outs.** These\n   disable IDOR/authorization checks. For each, determine:\n   - Is the skip justified? (e.g., public endpoint, webhook, health check)\n   - Does the skip expose a state-changing action to unauthorised users?\n   - Is there a compensating control (HMAC, session token, etc.)?\n\n4. **Check for admin-only functionality reachable by merchants.** Look for:\n   - Controllers under `admin/` namespace that don't check staff vs merchant\n   - Actions that modify app configuration without checking the caller's role\n   - Staff-only operations accessible through the merchant-facing UI\n\n5. **Check for missing object-level authorization.** Even if the query\n   is scoped by shop, does the handler verify that the specific resource\n   belongs to the current merchant?\n   - `Order.find(params[:id])` scoped by shop — but does it check the\n     merchant can access this specific order?\n   - `Product.find(params[:id])` — is there a policy check, or just\n     tenant scoping?\n\n6. **Compare authorization across state transitions.** Do not stop at one\n   handler. Compare create/read/update/delete paths, replay after role or UI\n   changes, direct URLs that survive permission downgrades, and backend actions\n   that remain callable after a feature is hidden or disabled in the UI.\n\n## Shopify embedded apps (React Router)\n\n`authenticate.admin(request)` verifies the Shopify session token, so the caller is a staff member of that shop whom Shopify has granted access to this app. With offline tokens (the SDK default), Admin API calls use the app's granted scopes rather than the staff member's own permissions. That is Shopify's standard embedded app model, not a finding by itself. Report a handler only when it skips a concrete authorization boundary inside the app:\n\n- The app defines its own roles, owners, or allowlists (for example a check on `sessionToken.sub`, `onlineAccessInfo.associated_user`, `account_owner`, or an app database role), and a handler that performs the same or a more privileged operation doesn't apply it. Compare each route's loader and action, and sibling routes.\n- A request-supplied identifier selects an app-owned record that belongs to another user of the app.\n- The app uses online tokens to respect staff permissions on some paths, but a privileged path falls back to an offline session.\n\nIf none of these applies, record the check as executed with no finding.\n\n## What to report\n\nFor each action that exposes a concrete unauthorized operation beyond authentication:\n\n```json\n{\n  \"file\": \"app/controllers/orders_controller.rb\",\n  \"line\": 15,\n  \"message\": \"Destroy action has no authorization check beyond authentication\",\n  \"snippet\": \"def destroy\\n  Order.find(params[:id]).destroy\\nend\",\n  \"evidence\": [\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 15,\n      \"quote\": \"def destroy\"\n    },\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 5,\n      \"quote\": \"before_action :authenticate_user (no authorize check)\"\n    }\n  ],\n  \"confidence\": \"medium\",\n  \"reasoning\": \"The destroy action authenticates the user but does not call authorize or check a policy. Any authenticated merchant can delete any order within their shop, even if they shouldn't have delete permissions.\"\n}\n```\n\nOnly report when you can show an unauthorized operation is actually reachable;\ndifferent helper names or inconsistent UI affordances are not enough by themselves.\n\nDo not report:\n\n- Actions with explicit `authorize` / `can?` / policy checks\n- Actions protected by a `before_action` that checks authorization\n- Public endpoints (health checks, static content)\n- Webhook handlers (HMAC is the authorization)\n- Actions that only read data the merchant owns (scoped by session.shop\n  AND no object-level access control needed)\n- Internal/staff-only controllers (under `Internal::` namespace, behind\n  employee SSO like `EmployeeIdentity`, `IdentityClient`, etc.)\n- Test files (under test/ or \\*\\_test.rb)\n- Test controllers\n",
   "---\nid: MISSING_COMPLIANCE_WEBHOOKS\nversion: 1\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Missing Compliance Webhooks\n\nInspect the selected `shopify.app*.toml` file. If it could not be parsed, keep the check unresolved. Verify all three compliance topics (`shop/redact`, `customers/data_request`, `customers/redact`) are declared in that configuration. Report only a confirmed missing topic.\n",
diff --git a/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts b/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
index b0dafdb2d6f..f74d7fecf92 100644
--- a/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
+++ b/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
@@ -5,6 +5,8 @@ import type {LiquidHtmlNode} from '@shopify/theme-check-node'
 
 type LiquidVariableOutput = Extract<LiquidHtmlNode, {type: 'LiquidVariableOutput'}>
 type AttributeNode = Extract<LiquidHtmlNode, {type: `Attr${string}`}>
+type LiquidVariableMarkup = Exclude<LiquidVariableOutput['markup'], string>
+type LiquidFilterArgument = LiquidVariableMarkup['filters'][number]['args'][number]
 
 interface LiquidScanResult {
   issues: Issue[]
@@ -30,7 +32,9 @@ export function scanLiquidSecurity(files: SourceFile[]): LiquidScanResult {
       parserFailures.push(file.path)
       continue
     }
-    const schemaSettings = extractSchemaSettings(file.content)
+    // In an app block, `block.settings` is described by the file's own schema, but `section.settings` belongs to
+    // the host theme section, so only app block files can exempt settings.
+    const schemaSettings = APP_BLOCK_FILE.test(file.path) ? extractSchemaSettings(file.content) : undefined
     issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidUnsafeRenderVisitor(file, schemaSettings)))
     issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidExecutableContextVisitor(file)))
   }
@@ -44,6 +48,7 @@ interface SchemaSetting {
 
 const URL_ATTRIBUTE_NAMES = new Set(['href', 'src', 'action', 'formaction', 'poster', 'cite', 'xlink:href'])
 const INERT_OPTION_VALUE = /^[A-Za-z0-9\-._~:/?#@!$()*+,;%]*$/
+const APP_BLOCK_FILE = /(?:^|[\\/])blocks[\\/][^\\/]+$/
 
 // Extract id -> setting from the file's {% schema %} JSON. Returns undefined
 // (fail-closed: no exemption) when the schema is missing, duplicated,
@@ -73,12 +78,17 @@ function extractSchemaSettings(content: string): Map<string, SchemaSetting> | un
   return byId
 }
 
-function isSchemaExemptSetting(expression: string, schemaSettings: Map<string, SchemaSetting> | undefined): boolean {
-  if (!schemaSettings) return false
-  const baseExpression = expression.split('|')[0]!.trim()
-  const match = /^(?:block|section)\.settings\.([A-Za-z0-9_-]+)$/.exec(baseExpression)
-  if (!match) return false
-  const setting = schemaSettings.get(match[1]!)
+function isSchemaExemptSetting(
+  node: LiquidVariableOutput,
+  schemaSettings: Map<string, SchemaSetting> | undefined,
+): boolean {
+  if (!schemaSettings || typeof node.markup === 'string') return false
+  const {expression, filters} = node.markup
+  // Filter arguments are rendered too (for example `default: block.settings.title`), so only literals are allowed.
+  if (!filters.every((filter) => filter.args.every(isLiteralFilterArgument))) return false
+  const settingId = blockSettingId(expression)
+  if (settingId === undefined) return false
+  const setting = schemaSettings.get(settingId)
   if (!setting) return false
   if (setting.type === 'checkbox' || setting.type === 'range') return true
   if (setting.type === 'select' || setting.type === 'radio') {
@@ -92,6 +102,21 @@ function isSchemaExemptSetting(expression: string, schemaSettings: Map<string, S
   return false
 }
 
+/** The `<id>` of an exact `block.settings.<id>` lookup, or undefined for any other expression. */
+function blockSettingId(expression: LiquidVariableMarkup['expression']): string | undefined {
+  if (expression.type !== 'VariableLookup' || expression.name !== 'block' || expression.lookups.length !== 2) {
+    return undefined
+  }
+  const [settings, id] = expression.lookups
+  if (settings?.type !== 'String' || settings.value !== 'settings' || id?.type !== 'String') return undefined
+  return id.value
+}
+
+function isLiteralFilterArgument(argument: LiquidFilterArgument): boolean {
+  const value = argument.type === 'NamedArgument' ? argument.value : argument
+  return value.type === 'String' || value.type === 'Number' || value.type === 'LiquidLiteral'
+}
+
 function liquidUnsafeRenderVisitor(file: SourceFile, schemaSettings?: Map<string, SchemaSetting>) {
   return {
     LiquidVariableOutput(node: LiquidVariableOutput, ancestors: LiquidHtmlNode[]): Issue[] | undefined {
@@ -102,7 +127,7 @@ function liquidUnsafeRenderVisitor(file: SourceFile, schemaSettings?: Map<string
       if (isSafelyRendered(filters, context)) return undefined
       if (
         (context === 'html_text' || (context === 'html_attribute' && !isUrlAttributeContext(ancestors))) &&
-        isSchemaExemptSetting(expression, schemaSettings)
+        isSchemaExemptSetting(node, schemaSettings)
       )
         return undefined
       return [
diff --git a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
index f5dc6b50282..6047b977f62 100644
--- a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
+++ b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
@@ -348,7 +348,7 @@ describe('Liquid AST mode', () => {
     expect(liquid(`{{ block.settings.show }}${schema('{"type":"checkbox","id":"show"}')}`)).not.toContain(
       'LIQUID_UNSAFE_RENDER',
     )
-    expect(liquid(`{{ section.settings.size }}${schema('{"type":"range","id":"size"}')}`)).not.toContain(
+    expect(liquid(`{{ block.settings.size }}${schema('{"type":"range","id":"size"}')}`)).not.toContain(
       'LIQUID_UNSAFE_RENDER',
     )
     // Bad option, free-text types, property access, JS/executable and URL contexts still flagged.
@@ -369,4 +369,49 @@ describe('Liquid AST mode', () => {
     expect(liquid('{{ block.settings.layout }}')).toContain('LIQUID_UNSAFE_RENDER')
     expect(liquid('{{ block.settings.layout }}{% schema %}not-json{% endschema %}')).toContain('LIQUID_UNSAFE_RENDER')
   })
+
+  test('exempts only block settings in app block files, never the host section settings', () => {
+    const schema = (settings: string) => `{% schema %}{"settings":[${settings}]}{% endschema %}`
+    const range = schema('{"type":"range","id":"size"}')
+    const select = schema('{"type":"select","id":"layout","options":[{"value":"left"},{"value":"right"}]}')
+    const liquid = (content: string, path = 'extensions/theme/blocks/a.liquid') =>
+      scanLiquidSecurity([source(content, path)]).issues.map((finding) => finding.id)
+
+    expect(liquid(`{{ block.settings.layout }}${select}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{{ block.settings.size }}${range}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    // `section.settings` in an app block is the host section's, which this file's schema doesn't describe.
+    expect(liquid(`{{ section.settings.size }}${range}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div class="{{ section.settings.layout }}"></div>${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    // Outside app blocks, no setting is exempt.
+    expect(liquid(`{{ block.settings.layout }}${select}`, 'extensions/theme/snippets/a.liquid')).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+  })
+
+  test('exempts filtered inert settings only when every filter argument is a literal', () => {
+    const schema = `{% schema %}{"settings":[{"type":"checkbox","id":"show"},{"type":"text","id":"title"}]}{% endschema %}`
+    const liquid = (output: string) =>
+      scanLiquidSecurity([source(`${output}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
+        (finding) => finding.id,
+      )
+
+    expect(liquid('{{ block.settings.show | downcase }}')).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | default: 'x' }}")).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | default: 'x', allow_false: true }}")).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | replace: 'true', 'on' | append: 1 | prepend: nil }}")).not.toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    // A setting or variable in any filter argument can render a free-text value.
+    expect(liquid('{{ block.settings.show | default: block.settings.title }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.show | append: block.settings.title }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.show | prepend: section.settings.title }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | replace: 'true', block.settings.title }}")).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid('{{ block.settings.show | default: product.metafields.app.title }}')).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    expect(liquid('{{ block.settings.show | downcase | append: title }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | default: 'x', allow_false: title }}")).toContain('LIQUID_UNSAFE_RENDER')
+  })
 })

From 0cd0c3ca191f5b9d15f381de72493b96e40ca318 Mon Sep 17 00:00:00 2001
From: Josh Larson <josh.larson@shopify.com>
Date: Tue, 20 Oct 2026 10:21:15 -0500
Subject: [PATCH 3/5] Tighten LIQUID_UNSAFE_RENDER schema exemption to inert
 positions and filters

The v2 exemption could still suppress findings for output that is not inert:

- Attribute contexts used a URL denylist that missed object data, srcset, and imagesrcset. Exempt attribute values are now an allowlist (class, id, title, alt, role, width, height, lang, dir, aria-*), and only in quoted values with a fully static attribute name.
- Liquid directly in an attribute list, in an attribute or tag name, in an unquoted value, or inside raw-text elements such as style is no longer exempt.
- Literal filter arguments did not prove inert output (url_decode, t, script_tag). Only argument-less case and whitespace filters, escape, and default with an inert literal fallback are allowed.
- A file that rebinds block (assign, capture, for, tablerow, increment, decrement) loses the exemption, since block.settings may no longer refer to the schema-owning block.

Co-authored-by: Qlaw <noreply@qlaw.quick.shopify.io>
---
 .../checks/LIQUID_UNSAFE_RENDER.md            |   2 +-
 .../app-security-engine/checks/embedded.ts    |   2 +-
 .../app-security-engine/rules/liquid-rules.ts | 124 ++++++++++++++++--
 .../tests/deterministic-rules.test.ts         | 120 ++++++++++++++++-
 4 files changed, 230 insertions(+), 18 deletions(-)

diff --git a/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md b/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
index 5430040b329..19bb9add4d3 100644
--- a/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
+++ b/packages/app/src/cli/services/app-security-engine/checks/LIQUID_UNSAFE_RENDER.md
@@ -9,4 +9,4 @@ precedence: union
 
 Inspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.
 
-As of version 2, the deterministic rule exempts exact `block.settings.<id>` output in app block files (`blocks/`) in HTML text and non-URL attribute contexts when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, or `=` characters). Filters are allowed only when every argument is a string, number, or literal such as `nil` or `true`. `section.settings` in an app block refers to the host section and is not exempt. Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, filter arguments that reference settings or variables, JavaScript/executable contexts, and URL attributes remain flagged as before.
+As of version 2, the deterministic rule exempts exact `block.settings.<id>` output in app block files (`blocks/`) when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, `&`, or `=` characters). The output must be element text content or a quoted value of a statically named `class`, `id`, `title`, `alt`, `role`, `width`, `height`, `lang`, `dir`, or `aria-*` attribute. Filters are allowed only from a small inert set (`downcase`, `upcase`, `capitalize`, `strip`, `lstrip`, `rstrip`, `strip_newlines`, `handleize`, `handle`, `escape`, `escape_once`, without arguments) or `default` with an inert string, number, or literal fallback. `section.settings` in an app block refers to the host section and is not exempt, and a file that rebinds `block` (`assign`, `capture`, `for`, `tablerow`, `increment`, or `decrement`) loses the exemption entirely. Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, other filters (including `url_decode`, `t`, and tag-producing filters such as `script_tag`), URL, style, `data-*`, or other attributes, Liquid that forms an attribute or tag name, unquoted attribute values, raw-text elements such as `<style>`, and JavaScript/executable contexts remain flagged as before.
diff --git a/packages/app/src/cli/services/app-security-engine/checks/embedded.ts b/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
index 1946bfeb182..d31aa7df8f7 100644
--- a/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
+++ b/packages/app/src/cli/services/app-security-engine/checks/embedded.ts
@@ -17,7 +17,7 @@ export const EMBEDDED_CHECK_SOURCES: ReadonlyArray<string> = [
   "---\nid: EOL_API_VERSION\nversion: 2\nseverity: low\nprecedence: prefer-agent\n---\n\n# Eol Api Version\n\nInspect the selected `shopify.app*.toml` plus React Router `app/shopify.server.*` declarations. Shopify publishes quarterly versions in January, April, July, and October and supports each stable version for 12 months; the app security check allows a documented 30-day extension grace period before reporting it as end-of-life. Cite the exact declaration. For malformed config, computed `ApiVersion` values, or a Shopify-announced exceptional extension, inspect the source and current lifecycle policy rather than inferring from unrelated constants.\n",
   "---\nid: EXPIRING_OFFLINE_TOKEN\nversion: 2\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Expiring Offline Token\n\nFor supported React Router apps, verify `expiringOfflineAccessTokens` is enabled and the selected session storage persists `expires`, `refreshToken`, and `refreshTokenExpires` metadata needed for refresh and rotation. `isOnline: false` selects an offline session; it does not disable token expiry and is not a finding. Report an explicit `expiringOfflineAccessTokens: false`. Treat absent or computed flags, custom storage, and ambiguous Prisma schemas as unresolved investigation: inspect storage adapters, migrations, and serialization before returning a clean result. Config-only and unsupported frameworks are handled by the runtime applicability boundary.\n",
   "---\nid: INSECURE_WEBHOOK_URL\nversion: 2\nseverity: high\nprecedence: prefer-agent\n---\n\n# Insecure Configured Callback Url\n\nInspect webhook destinations and OAuth redirect URLs in the selected Shopify app configuration. Relative Shopify paths and valid pubsub/eventbridge webhook destinations are allowed. Report HTTP, malformed, credential-bearing, wildcard-host, wildcard-path, or otherwise unsafe configured callback URLs.\n",
-  "---\nid: LIQUID_UNSAFE_RENDER\nversion: 2\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n\nAs of version 2, the deterministic rule exempts exact `block.settings.<id>` output in app block files (`blocks/`) in HTML text and non-URL attribute contexts when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, or `=` characters). Filters are allowed only when every argument is a string, number, or literal such as `nil` or `true`. `section.settings` in an app block refers to the host section and is not exempt. Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, filter arguments that reference settings or variables, JavaScript/executable contexts, and URL attributes remain flagged as before.\n",
+  "---\nid: LIQUID_UNSAFE_RENDER\nversion: 2\nseverity: medium\nprecedence: union\n---\n\n# Liquid Unsafe Render\n\nInspect only theme-extension Liquid/HTML files the parser could not analyze. Liquid output is not automatically HTML-escaped. Check the destination: use `escape`/`escape_once` for HTML text and ordinary attributes, `json` when embedding a value as JavaScript data, and `metafield_tag` only for supported rich metafield rendering in HTML content. HTML escaping is not sufficient for event handlers, `srcdoc`, or a `<script src>` URL; avoid merchant-controlled output there and validate any dynamic URL. An ordinary non-script `src` attribute is not itself an executable sink. `{% raw %}` suppresses Liquid parsing, so apparent output inside it is literal text. Follow rendered snippets and inspect ambiguous filters or parser failures before reporting.\n\nAs of version 2, the deterministic rule exempts exact `block.settings.<id>` output in app block files (`blocks/`) when the same file's `{% schema %}` defines the setting as `checkbox` or `range`, or as `select`/`radio` whose every option value is inert (no markup, quote, whitespace, `&`, or `=` characters). The output must be element text content or a quoted value of a statically named `class`, `id`, `title`, `alt`, `role`, `width`, `height`, `lang`, `dir`, or `aria-*` attribute. Filters are allowed only from a small inert set (`downcase`, `upcase`, `capitalize`, `strip`, `lstrip`, `rstrip`, `strip_newlines`, `handleize`, `handle`, `escape`, `escape_once`, without arguments) or `default` with an inert string, number, or literal fallback. `section.settings` in an app block refers to the host section and is not exempt, and a file that rebinds `block` (`assign`, `capture`, `for`, `tablerow`, `increment`, or `decrement`) loses the exemption entirely. Missing, unparseable, or duplicated schema, unsafe option values, other types, property access, other filters (including `url_decode`, `t`, and tag-producing filters such as `script_tag`), URL, style, `data-*`, or other attributes, Liquid that forms an attribute or tag name, unquoted attribute values, raw-text elements such as `<style>`, and JavaScript/executable contexts remain flagged as before.\n",
   "---\nid: METAFIELD_OFFLINE_TOKEN\nversion: 2\nseverity: high\n---\n\n# Metafield Offline Token\n\nTrace metafield and metaobject writes and determine their token provenance. Report a write that runs in an offline Admin API context that no verified request for the same shop authorizes: for example `unauthenticated.admin(shop)` or a stored offline session reached from an unauthenticated route, an unverified webhook or app proxy request, or a job whose shop or values come from request-controlled input.\n\nAn offline session returned by `authenticate.admin(request)` (the React Router SDK default when `useOnlineTokens` isn't set) is a verified, shop-bound context: Shopify verified the session token and the staff member's access to the app. Don't report a write only because its token is offline or because an online token would add user attribution or expiry. Report it when:\n\n- the app defines its own per-user permission, for example an app-level role or allowlist check, and this write bypasses it. Name that permission.\n- request-controlled values reach an app-reserved (`$app`) metafield or metaobject that the app treats as trusted state and merchants can't edit themselves, for example a definition with `access.admin = \"merchant_read\"` or no merchant access, or billing, entitlement or feature-flag data. Writing to the `$app` namespace isn't safe by itself.\n\nConfirm token provenance and compensating authorization before reporting.\n",
   "---\nid: MISSING_AUTHORIZATION_CHECK\nversion: 3\nseverity: high\n---\n\nFind controller actions or route handlers that access resources without\nchecking whether the current user is authorized to access them, beyond\nauthentication. Authentication verifies WHO you are; authorization verifies\nWHAT you can do. An app can be authenticated but still access resources\nbelonging to another merchant if authorization checks are missing.\n\nThis is distinct from `MISSING_TENANT_ISOLATION` (database query\nscoping) — this check looks for missing policy/permission checks on\nactions, even when the data access is scoped. For example, an app might\nscope queries by shop but not check whether the merchant has the right to\ndelete a resource, or whether a staff member can access admin-only\nactions.\n\n## What to look for\n\n1. **Find authorization frameworks.** Check what the app uses:\n   - Rails: Pundit (`authorize`, `policy`, `Pundit`), CanCanCan\n     (`can?`, `ability`), action_access filters\n   - Remix/Express: middleware that checks roles/permissions\n   - Custom: `before_action :check_admin`, `if current_user.can?`\n\n2. **Find actions without authorization checks.** For each controller\n   action or route handler, determine:\n   - Is there a `before_action` that checks authorization (not just\n     authentication)?\n   - Is there a Pundit `authorize` call?\n   - Is there a CanCanCan `authorize!` or `can?` check?\n   - Is there a custom permission check?\n\n3. **Check for `skip_idor_protection` or equivalent opt-outs.** These\n   disable IDOR/authorization checks. For each, determine:\n   - Is the skip justified? (e.g., public endpoint, webhook, health check)\n   - Does the skip expose a state-changing action to unauthorised users?\n   - Is there a compensating control (HMAC, session token, etc.)?\n\n4. **Check for admin-only functionality reachable by merchants.** Look for:\n   - Controllers under `admin/` namespace that don't check staff vs merchant\n   - Actions that modify app configuration without checking the caller's role\n   - Staff-only operations accessible through the merchant-facing UI\n\n5. **Check for missing object-level authorization.** Even if the query\n   is scoped by shop, does the handler verify that the specific resource\n   belongs to the current merchant?\n   - `Order.find(params[:id])` scoped by shop — but does it check the\n     merchant can access this specific order?\n   - `Product.find(params[:id])` — is there a policy check, or just\n     tenant scoping?\n\n6. **Compare authorization across state transitions.** Do not stop at one\n   handler. Compare create/read/update/delete paths, replay after role or UI\n   changes, direct URLs that survive permission downgrades, and backend actions\n   that remain callable after a feature is hidden or disabled in the UI.\n\n## Shopify embedded apps (React Router)\n\n`authenticate.admin(request)` verifies the Shopify session token, so the caller is a staff member of that shop whom Shopify has granted access to this app. With offline tokens (the SDK default), Admin API calls use the app's granted scopes rather than the staff member's own permissions. That is Shopify's standard embedded app model, not a finding by itself. Report a handler only when it skips a concrete authorization boundary inside the app:\n\n- The app defines its own roles, owners, or allowlists (for example a check on `sessionToken.sub`, `onlineAccessInfo.associated_user`, `account_owner`, or an app database role), and a handler that performs the same or a more privileged operation doesn't apply it. Compare each route's loader and action, and sibling routes.\n- A request-supplied identifier selects an app-owned record that belongs to another user of the app.\n- The app uses online tokens to respect staff permissions on some paths, but a privileged path falls back to an offline session.\n\nIf none of these applies, record the check as executed with no finding.\n\n## What to report\n\nFor each action that exposes a concrete unauthorized operation beyond authentication:\n\n```json\n{\n  \"file\": \"app/controllers/orders_controller.rb\",\n  \"line\": 15,\n  \"message\": \"Destroy action has no authorization check beyond authentication\",\n  \"snippet\": \"def destroy\\n  Order.find(params[:id]).destroy\\nend\",\n  \"evidence\": [\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 15,\n      \"quote\": \"def destroy\"\n    },\n    {\n      \"file\": \"app/controllers/orders_controller.rb\",\n      \"line\": 5,\n      \"quote\": \"before_action :authenticate_user (no authorize check)\"\n    }\n  ],\n  \"confidence\": \"medium\",\n  \"reasoning\": \"The destroy action authenticates the user but does not call authorize or check a policy. Any authenticated merchant can delete any order within their shop, even if they shouldn't have delete permissions.\"\n}\n```\n\nOnly report when you can show an unauthorized operation is actually reachable;\ndifferent helper names or inconsistent UI affordances are not enough by themselves.\n\nDo not report:\n\n- Actions with explicit `authorize` / `can?` / policy checks\n- Actions protected by a `before_action` that checks authorization\n- Public endpoints (health checks, static content)\n- Webhook handlers (HMAC is the authorization)\n- Actions that only read data the merchant owns (scoped by session.shop\n  AND no object-level access control needed)\n- Internal/staff-only controllers (under `Internal::` namespace, behind\n  employee SSO like `EmployeeIdentity`, `IdentityClient`, etc.)\n- Test files (under test/ or \\*\\_test.rb)\n- Test controllers\n",
   "---\nid: MISSING_COMPLIANCE_WEBHOOKS\nversion: 1\nseverity: medium\nprecedence: prefer-agent\n---\n\n# Missing Compliance Webhooks\n\nInspect the selected `shopify.app*.toml` file. If it could not be parsed, keep the check unresolved. Verify all three compliance topics (`shop/redact`, `customers/data_request`, `customers/redact`) are declared in that configuration. Report only a confirmed missing topic.\n",
diff --git a/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts b/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
index f74d7fecf92..c7f0669d80a 100644
--- a/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
+++ b/packages/app/src/cli/services/app-security-engine/rules/liquid-rules.ts
@@ -7,6 +7,8 @@ type LiquidVariableOutput = Extract<LiquidHtmlNode, {type: 'LiquidVariableOutput
 type AttributeNode = Extract<LiquidHtmlNode, {type: `Attr${string}`}>
 type LiquidVariableMarkup = Exclude<LiquidVariableOutput['markup'], string>
 type LiquidFilterArgument = LiquidVariableMarkup['filters'][number]['args'][number]
+type LiquidTag = Extract<LiquidHtmlNode, {type: 'LiquidTag'}>
+type LiquidAst = Exclude<ReturnType<typeof toLiquidHTMLAST>, Error>
 
 interface LiquidScanResult {
   issues: Issue[]
@@ -33,8 +35,10 @@ export function scanLiquidSecurity(files: SourceFile[]): LiquidScanResult {
       continue
     }
     // In an app block, `block.settings` is described by the file's own schema, but `section.settings` belongs to
-    // the host theme section, so only app block files can exempt settings.
-    const schemaSettings = APP_BLOCK_FILE.test(file.path) ? extractSchemaSettings(file.content) : undefined
+    // the host theme section, so only app block files can exempt settings. If the file rebinds `block`, a
+    // `block.settings` lookup may no longer refer to the schema-owning block, so the whole file loses the exemption.
+    const schemaSettings =
+      APP_BLOCK_FILE.test(file.path) && !rebindsBlock(ast) ? extractSchemaSettings(file.content) : undefined
     issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidUnsafeRenderVisitor(file, schemaSettings)))
     issues.push(...visit<SourceCodeType.LiquidHtml, Issue>(ast, liquidExecutableContextVisitor(file)))
   }
@@ -46,7 +50,30 @@ interface SchemaSetting {
   options?: unknown
 }
 
-const URL_ATTRIBUTE_NAMES = new Set(['href', 'src', 'action', 'formaction', 'poster', 'cite', 'xlink:href'])
+// Attributes whose value the browser treats as plain text. Every other attribute (URLs such as href, src, srcset,
+// object data, or formaction; event handlers; style; srcdoc; data-*; unknown names) keeps the finding, because an
+// inert-looking value can still be a URL or code there.
+const INERT_ATTRIBUTE_NAMES = new Set(['class', 'id', 'title', 'alt', 'role', 'width', 'height', 'lang', 'dir'])
+const INERT_ARIA_ATTRIBUTE = /^aria-[a-z]+$/
+// Argument-less filters whose output stays within INERT_OPTION_VALUE when their input does. Decoding, lookup, and
+// markup-producing filters (url_decode, t, script_tag, link_to, ...) are not listed, so they keep the finding.
+const INERT_FILTER_NAMES = new Set([
+  'downcase',
+  'upcase',
+  'capitalize',
+  'strip',
+  'lstrip',
+  'rstrip',
+  'strip_newlines',
+  'handleize',
+  'handle',
+  'escape',
+  'escape_once',
+])
+// Tags that bind a variable name in the current scope.
+const BINDING_TAG_NAMES = new Set(['assign', 'capture', 'for', 'tablerow', 'increment', 'decrement'])
+// No markup, quote, whitespace, `=`, or `&` characters. `%` is allowed: no exempt destination percent-decodes,
+// because URL attributes and decoding filters such as url_decode keep the finding.
 const INERT_OPTION_VALUE = /^[A-Za-z0-9\-._~:/?#@!$()*+,;%]*$/
 const APP_BLOCK_FILE = /(?:^|[\\/])blocks[\\/][^\\/]+$/
 
@@ -84,8 +111,9 @@ function isSchemaExemptSetting(
 ): boolean {
   if (!schemaSettings || typeof node.markup === 'string') return false
   const {expression, filters} = node.markup
-  // Filter arguments are rendered too (for example `default: block.settings.title`), so only literals are allowed.
-  if (!filters.every((filter) => filter.args.every(isLiteralFilterArgument))) return false
+  // A filter can turn an inert value into markup (`url_decode`, `script_tag`) or replace it (`t`), and its arguments
+  // are rendered too, so only filters that keep the output in the inert charset are allowed.
+  if (!filters.every(isInertFilter)) return false
   const settingId = blockSettingId(expression)
   if (settingId === undefined) return false
   const setting = schemaSettings.get(settingId)
@@ -112,9 +140,39 @@ function blockSettingId(expression: LiquidVariableMarkup['expression']): string
   return id.value
 }
 
-function isLiteralFilterArgument(argument: LiquidFilterArgument): boolean {
+function isInertFilter(filter: LiquidVariableMarkup['filters'][number]): boolean {
+  // `default` renders its fallback argument, so that argument must itself be an inert literal.
+  if (filter.name === 'default') return filter.args.every(isInertLiteralArgument)
+  return INERT_FILTER_NAMES.has(filter.name) && filter.args.length === 0
+}
+
+function isInertLiteralArgument(argument: LiquidFilterArgument): boolean {
   const value = argument.type === 'NamedArgument' ? argument.value : argument
-  return value.type === 'String' || value.type === 'Number' || value.type === 'LiquidLiteral'
+  if (value.type === 'String') return INERT_OPTION_VALUE.test(value.value)
+  return value.type === 'Number' || value.type === 'LiquidLiteral'
+}
+
+/** True when the file binds the name `block` itself with assign, capture, for, tablerow, increment, or decrement. */
+function rebindsBlock(ast: LiquidAst): boolean {
+  const bindings = visit<SourceCodeType.LiquidHtml, true>(ast, {
+    LiquidTag(node: LiquidTag): true[] | undefined {
+      return BINDING_TAG_NAMES.has(node.name) && bindsBlock(node.markup) ? [true] : undefined
+    },
+  })
+  return bindings.length > 0
+}
+
+function bindsBlock(markup: unknown): boolean {
+  // Unparsed tag markup fails closed on any mention of `block`.
+  if (typeof markup === 'string') return /\bblock\b/.test(markup)
+  if (!markup || typeof markup !== 'object') return false
+  const {type, name, value, variableName} = markup as {
+    type?: unknown
+    name?: unknown
+    value?: unknown
+    variableName?: unknown
+  }
+  return name === 'block' || variableName === 'block' || (type === 'String' && value === 'block')
 }
 
 function liquidUnsafeRenderVisitor(file: SourceFile, schemaSettings?: Map<string, SchemaSetting>) {
@@ -126,7 +184,8 @@ function liquidUnsafeRenderVisitor(file: SourceFile, schemaSettings?: Map<string
       const context = liquidOutputContext(ancestors)
       if (isSafelyRendered(filters, context)) return undefined
       if (
-        (context === 'html_text' || (context === 'html_attribute' && !isUrlAttributeContext(ancestors))) &&
+        (context === 'html_text' || context === 'html_attribute') &&
+        isInertOutputPosition(node, ancestors) &&
         isSchemaExemptSetting(node, schemaSettings)
       )
         return undefined
@@ -202,10 +261,51 @@ function liquidOutputContext(ancestors: LiquidHtmlNode[]): LiquidOutputContext {
   return 'html_attribute'
 }
 
-function isUrlAttributeContext(ancestors: LiquidHtmlNode[]): boolean {
-  const attribute = ancestors.find((ancestor): ancestor is AttributeNode => ancestor.type.startsWith('Attr'))
-  if (!attribute) return false
-  return URL_ATTRIBUTE_NAMES.has(attributeName(attribute).toLowerCase())
+/**
+ * True when the output lands in element text content or in a quoted value of a statically named inert attribute.
+ * Output in a tag name, directly in an attribute list (where it can supply an attribute name), in an unquoted or
+ * dynamically named attribute, or inside raw-text elements such as script or style is not inert.
+ */
+function isInertOutputPosition(node: LiquidVariableOutput, ancestors: LiquidHtmlNode[]): boolean {
+  const path: LiquidHtmlNode[] = [...ancestors, node]
+  let position: 'content' | 'attributes' | 'attribute_value' = 'content'
+  for (let index = 0; index < ancestors.length; index++) {
+    const parent = path[index]!
+    const child = path[index + 1]!
+    if (
+      parent.type === 'HtmlElement' ||
+      parent.type === 'HtmlVoidElement' ||
+      parent.type === 'HtmlSelfClosingElement'
+    ) {
+      if (staticName(parent.name) === undefined) return false
+      if ('children' in parent && contains(parent.children, child)) position = 'content'
+      else if (contains(parent.attributes, child)) position = 'attributes'
+      else return false
+    } else if (parent.type === 'AttrDoubleQuoted' || parent.type === 'AttrSingleQuoted') {
+      const name = staticName(parent.name)?.toLowerCase()
+      if (position !== 'attributes' || !contains(parent.value, child) || name === undefined) return false
+      if (!INERT_ATTRIBUTE_NAMES.has(name) && !INERT_ARIA_ATTRIBUTE.test(name)) return false
+      position = 'attribute_value'
+    } else if (parent.type.startsWith('Html') || parent.type.startsWith('Attr')) {
+      // Raw-text elements (script, style), unquoted attributes, and any other HTML node.
+      return false
+    }
+  }
+  return position !== 'attributes'
+}
+
+function contains(list: unknown, child: LiquidHtmlNode): boolean {
+  return Array.isArray(list) && list.includes(child)
+}
+
+/** The name made only of text parts, or undefined when any part is Liquid. */
+function staticName(name: unknown): string | undefined {
+  if (typeof name === 'string') return name
+  if (!Array.isArray(name) || name.length === 0) return undefined
+  const parts = name.map((part: {type?: unknown; value?: unknown}) =>
+    part.type === 'TextNode' && typeof part.value === 'string' ? part.value : undefined,
+  )
+  return parts.every((part) => part !== undefined) ? parts.join('') : undefined
 }
 
 function attributeName(attribute: AttributeNode): string {
diff --git a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
index 6047b977f62..c9b0850bada 100644
--- a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
+++ b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
@@ -388,7 +388,7 @@ describe('Liquid AST mode', () => {
     )
   })
 
-  test('exempts filtered inert settings only when every filter argument is a literal', () => {
+  test('exempts filtered inert settings only through inert filters with inert literal arguments', () => {
     const schema = `{% schema %}{"settings":[{"type":"checkbox","id":"show"},{"type":"text","id":"title"}]}{% endschema %}`
     const liquid = (output: string) =>
       scanLiquidSecurity([source(`${output}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
@@ -396,11 +396,31 @@ describe('Liquid AST mode', () => {
       )
 
     expect(liquid('{{ block.settings.show | downcase }}')).not.toContain('LIQUID_UNSAFE_RENDER')
-    expect(liquid("{{ block.settings.show | default: 'x' }}")).not.toContain('LIQUID_UNSAFE_RENDER')
-    expect(liquid("{{ block.settings.show | default: 'x', allow_false: true }}")).not.toContain('LIQUID_UNSAFE_RENDER')
-    expect(liquid("{{ block.settings.show | replace: 'true', 'on' | append: 1 | prepend: nil }}")).not.toContain(
+    expect(liquid('{{ block.settings.show | strip | upcase | handleize | capitalize }}')).not.toContain(
       'LIQUID_UNSAFE_RENDER',
     )
+    expect(liquid("{{ block.settings.show | default: 'x' }}")).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | default: 'x', allow_false: true }}")).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.show | default: 3 }}')).not.toContain('LIQUID_UNSAFE_RENDER')
+    // Filters that are not proven inert keep the finding, even with literal or no arguments.
+    for (const filter of [
+      'url_decode',
+      'base64_decode',
+      't',
+      'script_tag',
+      'stylesheet_tag',
+      'img_tag',
+      "link_to: 'x'",
+      "replace: 'true', 'on'",
+      "append: 'x'",
+      'prepend: nil',
+      "downcase: 'x'",
+    ]) {
+      expect(liquid(`{{ block.settings.show | ${filter} }}`)).toContain('LIQUID_UNSAFE_RENDER')
+    }
+    // A `default` fallback is rendered, so it must be an inert literal.
+    expect(liquid("{{ block.settings.show | default: '<b>' }}")).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid("{{ block.settings.show | default: 'a b' }}")).toContain('LIQUID_UNSAFE_RENDER')
     // A setting or variable in any filter argument can render a free-text value.
     expect(liquid('{{ block.settings.show | default: block.settings.title }}')).toContain('LIQUID_UNSAFE_RENDER')
     expect(liquid('{{ block.settings.show | append: block.settings.title }}')).toContain('LIQUID_UNSAFE_RENDER')
@@ -414,4 +434,96 @@ describe('Liquid AST mode', () => {
     expect(liquid('{{ block.settings.show | downcase | append: title }}')).toContain('LIQUID_UNSAFE_RENDER')
     expect(liquid("{{ block.settings.show | default: 'x', allow_false: title }}")).toContain('LIQUID_UNSAFE_RENDER')
   })
+
+  test('keeps decoding and markup filters flagged for percent-encoded select values', () => {
+    const schema = `{% schema %}{"settings":[{"type":"select","id":"layout","options":[{"value":"%3Cimg%20src%3Dx%20onerror%3Dalert(1)%3E"},{"value":"left"}]}]}{% endschema %}`
+    const liquid = (output: string) =>
+      scanLiquidSecurity([source(`${output}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
+        (finding) => finding.id,
+      )
+
+    // Percent-encoded text is inert until something decodes it.
+    expect(liquid('{{ block.settings.layout }}')).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.layout | url_decode }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.layout | t }}')).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid('{{ block.settings.layout | script_tag }}')).toContain('LIQUID_UNSAFE_RENDER')
+  })
+
+  test('exempts inert settings only in quoted values of statically named inert attributes', () => {
+    const schema =
+      '{% schema %}{"settings":[{"type":"select","id":"layout","options":[{"value":"left"},{"value":"onclick"}]}]}{% endschema %}'
+    const liquid = (content: string) =>
+      scanLiquidSecurity([source(`${content}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
+        (finding) => finding.id,
+      )
+    const output = '{{ block.settings.layout }}'
+
+    for (const attribute of ['class', 'id', 'title', 'alt', 'role', 'width', 'height', 'lang', 'dir', 'aria-label']) {
+      expect(liquid(`<div ${attribute}="${output}"></div>`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    }
+    expect(liquid(`<img alt='x ${output}'>`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<p>{% if true %}${output}{% endif %}</p>`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div {% if true %}class="${output}"{% endif %}></div>`)).not.toContain('LIQUID_UNSAFE_RENDER')
+
+    // URL, script, style, data-*, and unknown attributes keep the finding.
+    for (const markup of [
+      `<object data="${output}"></object>`,
+      `<img srcset="${output}">`,
+      `<link imagesrcset="${output}">`,
+      `<img src="${output}">`,
+      `<a href="${output}">x</a>`,
+      `<button formaction="${output}"></button>`,
+      `<form action="${output}"></form>`,
+      `<video poster="${output}"></video>`,
+      `<table background="${output}"></table>`,
+      `<a ping="${output}">x</a>`,
+      `<blockquote cite="${output}"></blockquote>`,
+      `<svg><a xlink:href="${output}"></a></svg>`,
+      `<object codebase="${output}"></object>`,
+      `<html manifest="${output}"></html>`,
+      `<iframe srcdoc="${output}"></iframe>`,
+      `<div style="${output}"></div>`,
+      `<div onclick="${output}"></div>`,
+      `<div data-layout="${output}"></div>`,
+      `<div x-layout="${output}"></div>`,
+    ]) {
+      expect(liquid(markup)).toContain('LIQUID_UNSAFE_RENDER')
+    }
+
+    // Output that can supply an attribute or tag name, unquoted values, and raw-text elements keep the finding.
+    expect(liquid(`<button ${output}="alert(1)"></button>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div ${output}></div>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div {% if true %}${output}{% endif %}></div>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div data-${output}="1"></div>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<div class=${output}></div>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<${output}>x</${output}>`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`<style>.a { color: ${output}; }</style>`)).toContain('LIQUID_UNSAFE_RENDER')
+  })
+
+  test('disables the exemption in files that rebind block', () => {
+    const schema = '{% schema %}{"settings":[{"type":"range","id":"size"}]}{% endschema %}'
+    const liquid = (content: string) =>
+      scanLiquidSecurity([source(`${content}${schema}`, 'extensions/theme/blocks/a.liquid')]).issues.map(
+        (finding) => finding.id,
+      )
+    const output = '{{ block.settings.size }}'
+
+    expect(liquid(`{% assign item = section %}${output}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{% for item in section.blocks %}{% endfor %}${output}`)).not.toContain('LIQUID_UNSAFE_RENDER')
+
+    for (const binding of [
+      '{% assign block = section %}',
+      '{% for block in section.blocks %}{% endfor %}',
+      '{% tablerow block in section.blocks %}{% endtablerow %}',
+      '{% capture block %}x{% endcapture %}',
+      '{% increment block %}',
+      '{% decrement block %}',
+      '{% liquid\n  assign block = section\n%}',
+    ]) {
+      expect(liquid(`${binding}${output}`)).toContain('LIQUID_UNSAFE_RENDER')
+      // The binding disables the exemption for the whole file, including output before it.
+      expect(liquid(`${output}${binding}`)).toContain('LIQUID_UNSAFE_RENDER')
+    }
+    expect(liquid(`{% for block in section.blocks %}${output}{% endfor %}`)).toContain('LIQUID_UNSAFE_RENDER')
+  })
 })

From 7a09d86d5a3ac2e4007bb2a9ce43a550f711c1cd Mon Sep 17 00:00:00 2001
From: Josh Larson <josh.larson@shopify.com>
Date: Tue, 20 Oct 2026 10:35:45 -0500
Subject: [PATCH 4/5] Cover LIQUID_UNSAFE_RENDER fail-closed schema guards

Add cases for duplicate schema blocks, duplicate setting ids, empty select options, and the inert radio exemption. Each fails when its guard is removed.

Co-authored-by: Qlaw <noreply@qlaw.quick.shopify.io>
---
 .../tests/deterministic-rules.test.ts              | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
index c9b0850bada..fa6d4de154c 100644
--- a/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
+++ b/packages/app/src/cli/services/app-security-engine/tests/deterministic-rules.test.ts
@@ -368,6 +368,20 @@ describe('Liquid AST mode', () => {
     // Missing or unparseable schema stays flagged.
     expect(liquid('{{ block.settings.layout }}')).toContain('LIQUID_UNSAFE_RENDER')
     expect(liquid('{{ block.settings.layout }}{% schema %}not-json{% endschema %}')).toContain('LIQUID_UNSAFE_RENDER')
+    // Duplicate schema blocks, duplicate setting ids, and empty options stay flagged.
+    expect(liquid(`{{ block.settings.layout }}${select}${select}`)).toContain('LIQUID_UNSAFE_RENDER')
+    expect(
+      liquid(`{{ block.settings.layout }}${schema('{"type":"text","id":"layout"},{"type":"checkbox","id":"layout"}')}`),
+    ).toContain('LIQUID_UNSAFE_RENDER')
+    expect(liquid(`{{ block.settings.layout }}${schema('{"type":"select","id":"layout","options":[]}')}`)).toContain(
+      'LIQUID_UNSAFE_RENDER',
+    )
+    // Inert radio is clean.
+    expect(
+      liquid(
+        `{{ block.settings.layout }}${schema('{"type":"radio","id":"layout","options":[{"value":"a"},{"value":"b"}]}')}`,
+      ),
+    ).not.toContain('LIQUID_UNSAFE_RENDER')
   })
 
   test('exempts only block settings in app block files, never the host section settings', () => {

From afa1bf9b5f45411dd175b8da3fecc8ca8cc2dc11 Mon Sep 17 00:00:00 2001
From: Josh Larson <jplhomer@gmail.com>
Date: Tue, 20 Oct 2026 13:37:12 -0500
Subject: [PATCH 5/5] Add patch changeset for LIQUID_UNSAFE_RENDER schema-typed
 exemption

---
 .changeset/liquid-unsafe-render-schema-types.md | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .changeset/liquid-unsafe-render-schema-types.md

diff --git a/.changeset/liquid-unsafe-render-schema-types.md b/.changeset/liquid-unsafe-render-schema-types.md
new file mode 100644
index 00000000000..23243add12d
--- /dev/null
+++ b/.changeset/liquid-unsafe-render-schema-types.md
@@ -0,0 +1,6 @@
+---
+'@shopify/app': patch
+'@shopify/cli': patch
+---
+
+Stop `shopify app security check` from flagging inert schema-typed app block settings (checkbox, range, and select/radio with safe option values) under LIQUID_UNSAFE_RENDER when they render as element text or safe quoted attributes