Encode device authorization request parameters

.changeset/encode-device-authorization-request.md

@@ -0,0 +1,5 @@
+---
+'@shopify/cli-kit': patch
+---
+
+Encode device authorization request parameters safely.

packages/cli-kit/src/private/node/session/device-authorization.test.ts

@@ -63,11 +63,48 @@ describe('requestDeviceAuthorization', () => {
     expect(shopifyFetch).toBeCalledWith('https://fqdn.com/oauth/device_authorization', {
       method: 'POST',
       headers: {'Content-type': 'application/x-www-form-urlencoded'},
-      body: 'client_id=clientId&scope=scope1 scope2',
+      body: new URLSearchParams({client_id: 'clientId', scope: 'scope1 scope2'}).toString(),
     })
     expect(got).toEqual(dataExpected)
   })
 
+  test('encodes special characters in authorization scopes', async () => {
+    // Given
+    const response = new Response(JSON.stringify(data))
+    vi.mocked(shopifyFetch).mockResolvedValue(response)
+    vi.mocked(identityFqdn).mockResolvedValue('fqdn.com')
+    vi.mocked(clientId).mockReturnValue('clientId')
+    const scopes = ['scope&name', 'scope=value', 'scope%value']
+
+    // When
+    await requestDeviceAuthorization(scopes)
+
+    // Then
+    expect(shopifyFetch).toHaveBeenCalledWith('https://fqdn.com/oauth/device_authorization', {
+      method: 'POST',
+      headers: {'Content-type': 'application/x-www-form-urlencoded'},
+      body: 'client_id=clientId&scope=scope%26name+scope%3Dvalue+scope%25value',
+    })
+  })
+
+  test('omits empty authorization scope values', async () => {
+    // Given
+    const response = new Response(JSON.stringify(data))
+    vi.mocked(shopifyFetch).mockResolvedValue(response)
+    vi.mocked(identityFqdn).mockResolvedValue('fqdn.com')
+    vi.mocked(clientId).mockReturnValue('clientId')
+
+    // When
+    await requestDeviceAuthorization([])
+
+    // Then
+    expect(shopifyFetch).toHaveBeenCalledWith('https://fqdn.com/oauth/device_authorization', {
+      method: 'POST',
+      headers: {'Content-type': 'application/x-www-form-urlencoded'},
+      body: 'client_id=clientId',
+    })
+  })
+
   test('opens the browser directly in an interactive terminal', async () => {
     // Given
     const outputInfo = vi.spyOn(output, 'outputInfo')

packages/cli-kit/src/private/node/session/device-authorization.ts

@@ -152,10 +152,8 @@ export async function pollForDeviceAuthorization(code: string, interval = 5): Pr
 }
 
 function convertRequestToParams(queryParams: {client_id: string; scope: string}): string {
-  return Object.entries(queryParams)
-    .map(([key, value]) => value && `${key}=${value}`)
-    .filter((hasValue) => Boolean(hasValue))
-    .join('&')
+  // URLSearchParams applies form encoding so scope values cannot change the request structure.
+  return new URLSearchParams(Object.entries(queryParams).filter(([, value]) => Boolean(value))).toString()
 }
 
 /**