braintree 4.39.0 → 4.41.0

data/spec/integration/braintree/samsung_pay_card_spec.rb

@@ -3,7 +3,7 @@ require File.expand_path(File.dirname(__FILE__) + "/client_api/spec_helper")
 
 # NEXT_MAJOR_VERSION remove these tests
 # SamsungPayCard has been deprecated
-xdescribe Braintree::SamsungPayCard do
+describe Braintree::SamsungPayCard do
   it "can create from payment method nonce" do
     customer = Braintree::Customer.create!
 

data/spec/integration/braintree/transaction_search_spec.rb

@@ -11,8 +11,7 @@ describe Braintree::Transaction, "search" do
       expect(collection.maximum_size).to eq(0)
     end
 
-    #Disabling test until we have more stable CI
-    xit "can search on text fields" do
+    it "can search on text fields" do
       first_name = "Tim_#{rand(10**10)}"
       token = "creditcard_#{rand(10**10)}"
       customer_id = "customer_#{rand(10**10)}"
@@ -132,8 +131,7 @@ describe Braintree::Transaction, "search" do
       expect(collection.first.id).to eq(transaction.id)
     end
 
-    #Disabling test until we have more stable CI
-    xit "searches on users" do
+    it "searches on users" do
       transaction = Braintree::Transaction.sale!(
         :amount => Braintree::Test::TransactionAmounts::Authorize,
         :payment_method_nonce => Braintree::Test::Nonce::PayPalBillingAgreement,
@@ -177,14 +175,15 @@ describe Braintree::Transaction, "search" do
       expect(collection.first.id).to eq(transaction_id)
     end
 
-    it "searches on reason_codes for 3 items" do
+    it "searches on reason_codes for 2 items" do
       reason_code = ["R01", "R02"]
 
       collection = Braintree::Transaction.search do |search|
+        search.ids.in ["ach_txn_ret1", "ach_txn_ret2"]
         search.reason_code.in reason_code
       end
 
-      expect(collection.maximum_size).to eq(3)
+      expect(collection.maximum_size).to eq(2)
     end
 
     it "searches on reason_code" do
@@ -192,6 +191,7 @@ describe Braintree::Transaction, "search" do
       reason_code = "R01"
 
       collection = Braintree::Transaction.search do |search|
+        search.ids.in [transaction_id]
         search.reason_code.in reason_code
       end
       item = collection.find { |t| t.id == transaction_id }
@@ -204,6 +204,7 @@ describe Braintree::Transaction, "search" do
       reason_code = "RJCT"
 
       collection = Braintree::Transaction.search do |search|
+        search.ids.in [transaction_id]
         search.reason_code.in reason_code
       end
       item = collection.find { |t| t.id == transaction_id }
@@ -217,10 +218,11 @@ describe Braintree::Transaction, "search" do
       reason_code = "any_reason_code"
 
       collection = Braintree::Transaction.search do |search|
+        search.ids.in ["ach_txn_ret1", "ach_txn_ret2", "ach_txn_ret3", "ach_txn_ret4"]
         search.reason_code.is reason_code
       end
 
-      expect(collection.maximum_size).to eq(6)
+      expect(collection.maximum_size).to eq(4)
     end
 
     context "multiple value fields" do
@@ -255,6 +257,93 @@ describe Braintree::Transaction, "search" do
         expect(collection.maximum_size).to eq(0)
       end
 
+      it "searches on ach_type" do
+        same_day_transaction = Braintree::Transaction.find("sameday_ach_sameday_requested")
+        standard_transaction = Braintree::Transaction.find("standard_ach_standard_requested")
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is same_day_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::SameDay
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(same_day_transaction.id)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is same_day_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::Standard
+        end
+
+        expect(collection.maximum_size).to eq(0)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is standard_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::Standard
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(standard_transaction.id)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is standard_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::SameDay
+        end
+
+        expect(collection.maximum_size).to eq(0)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is same_day_transaction.id
+          search.ach_type.in [
+            Braintree::Transaction::AchType::SameDay,
+            Braintree::Transaction::AchType::Standard
+          ]
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(same_day_transaction.id)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is standard_transaction.id
+          search.ach_type.in [
+            Braintree::Transaction::AchType::SameDay,
+            Braintree::Transaction::AchType::Standard
+          ]
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(standard_transaction.id)
+
+        divergent_transaction = Braintree::Transaction.find("standard_ach_sameday_requested")
+        expect(divergent_transaction.ach_type).to eq(Braintree::Transaction::AchType::Standard)
+        expect(divergent_transaction.requested_ach_type).to eq(Braintree::Transaction::AchType::SameDay)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is divergent_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::Standard
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(divergent_transaction.id)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is divergent_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::SameDay
+        end
+
+        expect(collection.maximum_size).to eq(0)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is divergent_transaction.id
+          search.ach_type.in [
+            Braintree::Transaction::AchType::SameDay,
+            Braintree::Transaction::AchType::Standard
+          ]
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(divergent_transaction.id)
+      end
+
       it "searches on credit_card_customer_location" do
         transaction = Braintree::Transaction.sale!(
           :amount => Braintree::Test::TransactionAmounts::Authorize,
@@ -512,6 +601,7 @@ describe Braintree::Transaction, "search" do
       end
 
       it "finds expired authorizations by status" do
+        skip "pending search fix"
         collection = Braintree::Transaction.search do |search|
           search.status.in Braintree::Transaction::Status::AuthorizationExpired
         end
@@ -614,7 +704,7 @@ describe Braintree::Transaction, "search" do
         expect(collection.first.id).to eq(transaction_id)
       end
 
-      xit "searches on debit_network" do
+      it "searches on debit_network" do
         transaction = Braintree::Transaction.sale!(
           :amount => Braintree::Test::TransactionAmounts::Authorize,
           :merchant_account_id => SpecHelper::PinlessDebitMerchantAccountId,
@@ -658,6 +748,14 @@ describe Braintree::Transaction, "search" do
           end
         end.to raise_error(ArgumentError)
       end
+
+      it "raises an exception on invalid ach_type" do
+        expect do
+          Braintree::Transaction.search do |search|
+            search.ach_type.is "invalid_ach_type"
+          end
+        end.to raise_error(ArgumentError)
+      end
     end
 
     context "range fields" do
@@ -854,6 +952,7 @@ describe Braintree::Transaction, "search" do
       context "ach return response created at" do
         it "it finds records within date range of the custom field" do
           date_search = Braintree::Transaction.search do |search|
+            search.ids.in ["ach_txn_ret1", "ach_txn_ret2", "ach_txn_ret3", "ach_txn_ret4"]
             search.ach_return_responses_created_at.between(DateTime.now - 1.0, DateTime.now + 1.0)
           end
 
@@ -862,6 +961,7 @@ describe Braintree::Transaction, "search" do
 
         it "it does not find records not within date range of the custom field" do
           neg_date_search = Braintree::Transaction.search do |search|
+           search.ids.in ["ach_txn_ret1", "ach_txn_ret2", "ach_txn_ret3", "ach_txn_ret4"]
            search.ach_return_responses_created_at.between(DateTime.now + 1.0, DateTime.now - 1.0)
           end
 
@@ -1006,7 +1106,7 @@ describe Braintree::Transaction, "search" do
           }
         end
 
-        xit "searches on dispute_date in UTC" do
+        it "searches on dispute_date in UTC" do
           collection = Braintree::Transaction.search do |search|
             search.id.is @disputed_transaction.id
             search.dispute_date.between(
@@ -1043,7 +1143,7 @@ describe Braintree::Transaction, "search" do
           expect(collection.first.id).to eq(@disputed_transaction.id)
         end
 
-        xit "searches on dispute_date in local time" do
+        it "searches on dispute_date in local time" do
           now = @disputed_time.localtime("-06:00")
 
           collection = Braintree::Transaction.search do |search|
@@ -1073,7 +1173,7 @@ describe Braintree::Transaction, "search" do
           expect(collection.maximum_size).to eq(1)
         end
 
-        xit "searches on dispute_date with date ranges" do
+        it "searches on dispute_date with date ranges" do
           collection = Braintree::Transaction.search do |search|
             search.id.is @disputed_transaction.id
             search.dispute_date.between(
@@ -1151,6 +1251,7 @@ describe Braintree::Transaction, "search" do
         end
 
         it "finds expired authorizations in a given range" do
+          skip "pending search fix"
           collection = Braintree::Transaction.search do |search|
             search.authorization_expired_at.between(
               Date.today - 2,
@@ -1379,8 +1480,7 @@ describe Braintree::Transaction, "search" do
       end
     end
 
-    #Disabling until we have a more stable CI
-    xit "returns multiple results" do
+    it "returns multiple results" do
       collection = Braintree::Transaction.search
       expect(collection.maximum_size).to be > 100
 

data/spec/integration/braintree/transaction_spec.rb

@@ -336,7 +336,7 @@ describe Braintree::Transaction do
 
     describe "sca_exemption" do
       context "with a valid request" do
-        xit "succeeds" do
+        it "succeeds with a valid sca_exemption request" do
           requested_exemption = "low_value"
           result = Braintree::Transaction.create(
             :type => "sale",
@@ -1370,7 +1370,7 @@ describe Braintree::Transaction do
         expect(result.transaction.gateway_rejection_reason).to eq(Braintree::Transaction::GatewayRejectionReason::TokenIssuance)
       end
 
-      xit "exposes the excessive_retry gateway rejection reason" do
+      it "exposes the excessive_retry gateway rejection reason" do
         with_duplicate_checking_merchant do
           result = nil
           counter = 0
@@ -1749,7 +1749,7 @@ describe Braintree::Transaction do
         expect(result.transaction.descriptor.url).to eq("ebay.com")
       end
 
-      it "has validation errors if format is invalid" do
+      it "has validation errors when the descriptor name is too long" do
         result = Braintree::Transaction.sale(
           :amount => Braintree::Test::TransactionAmounts::Authorize,
           :credit_card => {
@@ -1757,7 +1757,7 @@ describe Braintree::Transaction do
             :expiration_date => "05/2009"
           },
           :descriptor => {
-            :name => "badcompanyname12*badproduct12",
+            :name => "badcompanyname12*badproductdescription",
             :phone => "%bad4445555",
             :url => "12345678901234"
           },
@@ -2221,8 +2221,8 @@ describe Braintree::Transaction do
         expect(apple_pay_details).not_to be_nil
         expect(apple_pay_details.bin).not_to be_nil
         expect(apple_pay_details.card_type).to eq(Braintree::ApplePayCard::CardType::Visa)
-        expect(apple_pay_details.payment_instrument_name).to eq("Visa 8886")
-        expect(apple_pay_details.source_description).to eq("Visa 8886")
+        expect(apple_pay_details.payment_instrument_name).to match(/\AVisa \d{4}\z/)
+        expect(apple_pay_details.source_description).to match(/\AVisa \d{4}\z/)
         expect(apple_pay_details.expiration_month.to_i).to be > 0
         expect(apple_pay_details.expiration_year.to_i).to be > 0
         expect(apple_pay_details.cardholder_name).not_to be_nil
@@ -2250,8 +2250,8 @@ describe Braintree::Transaction do
         expect(apple_pay_details).not_to be_nil
         expect(apple_pay_details.bin).not_to be_nil
         expect(apple_pay_details.card_type).to eq(Braintree::ApplePayCard::CardType::Visa)
-        expect(apple_pay_details.payment_instrument_name).to eq("Visa 2006")
-        expect(apple_pay_details.source_description).to eq("Visa 2006")
+        expect(apple_pay_details.payment_instrument_name).to match(/\AVisa \d{4}\z/)
+        expect(apple_pay_details.source_description).to match(/\AVisa \d{4}\z/)
         expect(apple_pay_details.expiration_month.to_i).to be > 0
         expect(apple_pay_details.expiration_year.to_i).to be > 0
         expect(apple_pay_details.cardholder_name).not_to be_nil
@@ -2280,8 +2280,8 @@ describe Braintree::Transaction do
         apple_pay_details = result.transaction.apple_pay_details
         expect(apple_pay_details).not_to be_nil
         expect(apple_pay_details.card_type).to eq(Braintree::ApplePayCard::CardType::Visa)
-        expect(apple_pay_details.payment_instrument_name).to eq("Visa 8886")
-        expect(apple_pay_details.source_description).to eq("Visa 8886")
+        expect(apple_pay_details.payment_instrument_name).to match(/\AVisa \d{4}\z/)
+        expect(apple_pay_details.source_description).to match(/\AVisa \d{4}\z/)
         expect(apple_pay_details.expiration_month.to_i).to be > 0
         expect(apple_pay_details.expiration_year.to_i).to be > 0
         expect(apple_pay_details.cardholder_name).not_to be_nil
@@ -2905,6 +2905,106 @@ describe Braintree::Transaction do
         expect(result.transaction.status).to eq(Braintree::Transaction::Status::Authorized)
       end
 
+      it "can create a transaction with a three_d_secure_pass_thru network specified" do
+        result = Braintree::Transaction.create(
+          :type => "sale",
+          :amount => Braintree::Test::TransactionAmounts::Authorize,
+          :credit_card => {
+            :number => Braintree::Test::CreditCardNumbers::Visa,
+            :expiration_date => "05/2009",
+          },
+          :three_d_secure_pass_thru => {
+            :eci_flag => "05",
+            :cavv => "some_cavv",
+            :xid => "some_xid",
+            :three_d_secure_version => "2.2.0",
+            :authentication_response => "Y",
+            :directory_response => "Y",
+            :cavv_algorithm => "2",
+            :network => Braintree::ThreeDSecurePassThru::Network::Visa,
+          },
+        )
+
+        expect(result.success?).to eq(true)
+        expect(result.transaction.status).to eq(Braintree::Transaction::Status::Authorized)
+      end
+
+      it "returns an error for transaction with three_d_secure_pass_thru network when submit_for_settlement is false" do
+        result = Braintree::Transaction.create(
+          :type => "sale",
+          :amount => Braintree::Test::TransactionAmounts::Authorize,
+          :credit_card => {
+            :number => Braintree::Test::CreditCardNumbers::Visa,
+            :expiration_date => "05/2009",
+          },
+          :three_d_secure_pass_thru => {
+            :eci_flag => "05",
+            :cavv => "some_cavv",
+            :xid => "some_xid",
+            :three_d_secure_version => "2.2.0",
+            :authentication_response => "Y",
+            :directory_response => "Y",
+            :cavv_algorithm => "2",
+            :network => Braintree::ThreeDSecurePassThru::Network::Eftpos,
+          },
+          :options => {
+            :submit_for_settlement => false,
+          },
+        )
+
+        expect(result.success?).to eq(false)
+        expect(result.errors.for(:transaction).on(:base)[0].code).to eq(Braintree::ErrorCodes::Transaction::Options::SubmitForSettlementIsNotSupportedForNetwork)
+      end
+
+      it "returns an error for transaction when the three_d_secure_pass_thru network does not support the presentment currency" do
+        result = Braintree::Transaction.create(
+          :type => "sale",
+          :currency_iso_code => "USD",
+          :amount => Braintree::Test::TransactionAmounts::Authorize,
+          :credit_card => {
+            :number => Braintree::Test::CreditCardNumbers::Visa,
+            :expiration_date => "05/2009",
+          },
+          :three_d_secure_pass_thru => {
+            :eci_flag => "05",
+            :cavv => "some_cavv",
+            :xid => "some_xid",
+            :three_d_secure_version => "2.2.0",
+            :authentication_response => "Y",
+            :directory_response => "Y",
+            :cavv_algorithm => "2",
+            :network => Braintree::ThreeDSecurePassThru::Network::Eftpos,
+          },
+        )
+
+        expect(result.success?).to eq(false)
+        expect(result.errors.for(:transaction).for(:three_d_secure_pass_thru).on(:network)[0].code).to eq(Braintree::ErrorCodes::Transaction::ThreeDSecureNetworkDoesNotSupportCurrency)
+      end
+
+      it "returns an error for transaction when the three_d_secure_pass_thru network does not support the merchant account currency" do
+        result = Braintree::Transaction.create(
+          :type => "sale",
+          :amount => Braintree::Test::TransactionAmounts::Authorize,
+          :credit_card => {
+            :number => Braintree::Test::CreditCardNumbers::Visa,
+            :expiration_date => "05/2009",
+          },
+          :three_d_secure_pass_thru => {
+            :eci_flag => "05",
+            :cavv => "some_cavv",
+            :xid => "some_xid",
+            :three_d_secure_version => "2.2.0",
+            :authentication_response => "Y",
+            :directory_response => "Y",
+            :cavv_algorithm => "2",
+            :network => Braintree::ThreeDSecurePassThru::Network::Eftpos,
+          },
+        )
+
+        expect(result.success?).to eq(false)
+        expect(result.errors.for(:transaction).for(:three_d_secure_pass_thru).on(:network)[0].code).to eq(Braintree::ErrorCodes::Transaction::ThreeDSecureNetworkDoesNotSupportMerchantAccountCurrency)
+      end
+
       it "returns an error for transaction with three_d_secure_pass_thru when processor settings do not support 3DS for card type" do
         result = Braintree::Transaction.create(
           :merchant_account_id => "heartland_ma",
@@ -5133,6 +5233,28 @@ describe Braintree::Transaction do
         transaction = Braintree::Transaction.find(transaction.id)
         expect(transaction.refund_ids.sort).to eq([transaction_1.id, transaction_2.id].sort)
       end
+
+      it "allows partial refund with surcharge_amount" do
+        transaction = Braintree::Transaction.sale!(
+          :amount => Braintree::Test::TransactionAmounts::Authorize,
+          :surcharge_amount => "1.00",
+          :credit_card => {
+            :number => Braintree::Test::CreditCardNumbers::Visa,
+            :expiration_date => "05/2009"
+          },
+          :options => {
+            :submit_for_settlement => true
+          },
+        )
+        config = Braintree::Configuration.instantiate
+        config.http.put("#{config.base_merchant_path}/transactions/#{transaction.id}/settle")
+        transaction = Braintree::Transaction.find(transaction.id)
+
+        result = Braintree::Transaction.refund(transaction.id, :amount => transaction.amount / 2, :surcharge_amount => "0.50")
+        expect(result.success?).to eq(true)
+        expect(result.transaction.type).to eq("credit")
+        expect(result.transaction.surcharge_amount).to eq(BigDecimal("0.50"))
+      end
     end
 
     it "returns a successful result if successful" do
@@ -5172,6 +5294,28 @@ describe Braintree::Transaction do
       expect(result.success?).to eq(false)
       expect(result.errors.for(:transaction).on(:base)[0].code).to eq(Braintree::ErrorCodes::Transaction::CannotRefundUnlessSettled)
     end
+
+    it "accepts surcharge_amount field in refund" do
+      transaction = Braintree::Transaction.sale!(
+        :amount => Braintree::Test::TransactionAmounts::Authorize,
+        :surcharge_amount => "1.00",
+        :credit_card => {
+          :number => Braintree::Test::CreditCardNumbers::Visa,
+          :expiration_date => "05/2009"
+        },
+        :options => {
+          :submit_for_settlement => true
+        },
+      )
+      config = Braintree::Configuration.instantiate
+      config.http.put("#{config.base_merchant_path}/transactions/#{transaction.id}/settle")
+      transaction = Braintree::Transaction.find(transaction.id)
+
+      result = Braintree::Transaction.refund(transaction.id, :surcharge_amount => "1.00")
+      expect(result.success?).to eq(true)
+      expect(result.transaction.type).to eq("credit")
+      expect(result.transaction.surcharge_amount).to eq(BigDecimal("1.00"))
+    end
   end
 
   describe "self.refund!" do
@@ -5908,7 +6052,7 @@ describe Braintree::Transaction do
       end
     end
 
-    xit "Amex Pay with Points" do
+    it "Amex Pay with Points" do
       context "transaction creation" do
         it "succeeds when submit_for_settlement is true" do
           result = Braintree::Transaction.sale(
@@ -6055,7 +6199,7 @@ describe Braintree::Transaction do
     end
 
     context "Pinless debit transaction" do
-      xit "succesfully submits for settlement" do
+      it "successfully submits for settlement" do
         # Flaky test
         result = Braintree::Transaction.sale(
           :amount => Braintree::Test::TransactionAmounts::Authorize,
@@ -6367,7 +6511,7 @@ describe Braintree::Transaction do
       expect(leg_errors).to eq([Braintree::ErrorCodes::Transaction::Industry::Leg::TravelFlight::FareAmountCannotBeNegative])
     end
 
-    xit "succeeds when level 2 data is provided" do
+    it "succeeds when level 2 data is provided" do
       result = Braintree::Transaction.sale(
         :amount => Braintree::Test::TransactionAmounts::Authorize,
         :merchant_account_id => SpecHelper::FakeAmexDirectMerchantAccountId,
@@ -6391,7 +6535,7 @@ describe Braintree::Transaction do
       expect(result.transaction.status).to eq(Braintree::Transaction::Status::SubmittedForSettlement)
     end
 
-    xit "succeeds when level 3 data is provided" do
+    it "succeeds when level 3 data is provided" do
       result = Braintree::Transaction.sale(
         :amount => Braintree::Test::TransactionAmounts::Authorize,
         :merchant_account_id => SpecHelper::FakeAmexDirectMerchantAccountId,
@@ -6532,11 +6676,11 @@ describe Braintree::Transaction do
           expect(result.errors.for(:transaction).on(:amount)[0].code).to eq(Braintree::ErrorCodes::Transaction::SettlementAmountIsTooLarge)
         end
 
-        it "returns an error response when the descriptor is invalid" do
+        it "returns an error response when the descriptor name is too long" do
           result = Braintree::Transaction.update_details(transaction.id, {
             :amount => Braintree::Test::TransactionAmounts::Authorize.to_f - 1,
             :descriptor => {
-              :name => "invalid descriptor name",
+              :name => "invalid descriptor name that is way too long",
               :phone => "invalid phone",
               :url => "12345678901234"
             },
@@ -8079,7 +8223,7 @@ describe Braintree::Transaction do
   end
 
   context "Surcharge Amount" do
-    it "accepts surcharge_amount field" do
+    it "accepts surcharge_amount field for sale transactions" do
       result = Braintree::Transaction.create(
         :type => "sale",
         :amount => "10.00",
@@ -8093,5 +8237,41 @@ describe Braintree::Transaction do
       expect(result.success?).to eq(true)
       expect(result.transaction.surcharge_amount).to eq(BigDecimal("1.00"))
     end
+
+    it "accepts surcharge_amount field for blind credit" do
+      result = Braintree::Transaction.create(
+        :type => "credit",
+        :amount => "10.00",
+        :surcharge_amount => "1.00",
+        :credit_card => {
+          :number => Braintree::Test::CreditCardNumbers::Visa,
+          :expiration_date => "05/2029"
+        },
+      )
+
+      expect(result.success?).to eq(true)
+      expect(result.transaction.surcharge_amount).to eq(BigDecimal("1.00"))
+    end
+  end
+
+  describe "path traversal" do
+    it "self.void rejects a traversal transaction_id and does not void the victim transaction" do
+      victim_transaction = Braintree::Transaction.sale!(
+        :amount => Braintree::Test::TransactionAmounts::Authorize,
+        :credit_card => {
+          :number => Braintree::Test::CreditCardNumbers::Visa,
+          :expiration_date => "05/2009"
+        },
+        :options => {:submit_for_settlement => false},
+      )
+      traversal_id = "../transactions/#{victim_transaction.id}"
+
+      expect do
+        Braintree::Transaction.void(traversal_id)
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+
+      unaffected_transaction = Braintree::Transaction.find(victim_transaction.id)
+      expect(unaffected_transaction.status).to eq(Braintree::Transaction::Status::Authorized)
+    end
   end
 end

data/spec/unit/braintree/address_spec.rb

@@ -58,6 +58,20 @@ describe Braintree::Address do
         Braintree::Address.update("customer_id", "address_id", :street_address => "456 E Main", :invalid_key => "foo")
       end.to raise_error(ArgumentError, "invalid keys: invalid_key")
     end
+
+    it "raises an error if address_id contains invalid characters" do
+      expect do
+        Braintree::Address.update("customer_id", "../../foo", :street_address => "456 E Main")
+      end.to raise_error(ArgumentError, "address_id contains invalid characters")
+    end
+  end
+
+  describe "self.delete" do
+    it "raises an error if address_id contains invalid characters" do
+      expect do
+        Braintree::Address.delete("customer_id", "../../foo")
+      end.to raise_error(ArgumentError, "address_id contains invalid characters")
+    end
   end
 
   describe "self.find" do
@@ -85,6 +99,24 @@ describe Braintree::Address do
         Braintree::Address.find("customer_id", 8675309)
       end.to_not raise_error
     end
+
+    it "raises an error if address_id contains invalid characters" do
+      expect do
+        Braintree::Address.find("customer_id", "../../foo")
+      end.to raise_error(ArgumentError, "address_id contains invalid characters")
+    end
+
+    it "raises an error if address_id is a lone dot segment" do
+      expect do
+        Braintree::Address.find("customer_id", ".")
+      end.to raise_error(ArgumentError, "address_id contains invalid characters")
+    end
+
+    it "raises an error if address_id contains a dot" do
+      expect do
+        Braintree::Address.find("customer_id", "foo.bar")
+      end.to raise_error(ArgumentError, "address_id contains invalid characters")
+    end
   end
 
   describe "self.new" do