braintree 4.39.0 → 4.41.0

data/spec/unit/braintree/client_token_spec.rb

@@ -20,6 +20,78 @@ module Braintree
           )
         }.to raise_error(ArgumentError, /created_at, public_key/)
       end
+
+      context "with preferred_payment_method_token" do
+        let(:config) { SpecHelper::TestMerchantConfig }
+        let(:gateway) { Gateway.new(config) }
+        let(:http) { double(:http) }
+
+        before do
+          allow(config).to receive(:http).and_return(http)
+          allow(Configuration).to receive(:gateway).and_return(gateway)
+        end
+
+        def expect_client_token_post(options)
+          expect(http).to receive(:post).with(
+            "#{config.base_merchant_path}/client_token",
+            :client_token => options,
+          ).and_return(:client_token => {:value => "client-token"})
+        end
+
+        it "renames preferred_payment_method_token to payment_method_id" do
+          expect_client_token_post(
+            :payment_method_id => "a-pmt",
+            :version => ClientToken::DEFAULT_VERSION,
+          )
+
+          client_token = Braintree::ClientToken.generate(
+            :preferred_payment_method_token => "a-pmt",
+          )
+
+          expect(client_token).to eq("client-token")
+        end
+
+        it "renames string preferred_payment_method_token to payment_method_id" do
+          expect_client_token_post(
+            :payment_method_id => "a-pmt",
+            :version => ClientToken::DEFAULT_VERSION,
+          )
+
+          client_token = Braintree::ClientToken.generate(
+            "preferred_payment_method_token" => "a-pmt",
+          )
+
+          expect(client_token).to eq("client-token")
+        end
+
+        it "renames preferred_payment_method_token when the value is nil" do
+          expect_client_token_post(
+            :payment_method_id => nil,
+            :version => ClientToken::DEFAULT_VERSION,
+          )
+
+          client_token = Braintree::ClientToken.generate(
+            :preferred_payment_method_token => nil,
+          )
+
+          expect(client_token).to eq("client-token")
+        end
+
+        it "does not mutate the caller's options hash" do
+          options = {:preferred_payment_method_token => "a-pmt"}
+          expect(http).to receive(:post).twice.with(
+            "#{config.base_merchant_path}/client_token",
+            :client_token => {
+              :payment_method_id => "a-pmt",
+              :version => ClientToken::DEFAULT_VERSION,
+            },
+          ).and_return(:client_token => {:value => "client-token"})
+
+          expect(Braintree::ClientToken.generate(options)).to eq("client-token")
+          expect(Braintree::ClientToken.generate(options)).to eq("client-token")
+          expect(options).to eq(:preferred_payment_method_token => "a-pmt")
+        end
+      end
     end
 
     context "adding credit_card options with no customer ID" do

data/spec/unit/braintree/credit_card_spec.rb

@@ -51,6 +51,7 @@ describe Braintree::CreditCard do
           :directory_response,
           :cavv_algorithm,
           :ds_transaction_id,
+          :network,
         ]},
         :customer_id,
       ])
@@ -100,6 +101,7 @@ describe Braintree::CreditCard do
           :directory_response,
           :cavv_algorithm,
           :ds_transaction_id,
+          :network,
         ]},
       ])
     end
@@ -291,4 +293,30 @@ describe Braintree::CreditCard do
     card = Braintree::CreditCard._new(:gateway, {:purchase => "No"})
     expect(card.purchase).to eq("No")
   end
+
+  describe "path traversal" do
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.delete("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.find("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.from_nonce raises an exception if the nonce is a traversal segment" do
+      expect do
+        Braintree::CreditCard.from_nonce("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "nonce contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.update("../payment_methods/paypal_account/victim_token", :cvv => "123")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/credit_card_verification_spec.rb

@@ -183,4 +183,12 @@ describe Braintree::CreditCardVerification do
       expect(verification.credit_card[:payment_account_reference]).to eq("V0010013019339005665779448477")
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::CreditCardVerification.find("../verifications/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/customer_spec.rb

@@ -164,6 +164,7 @@ describe Braintree::Customer do
             :directory_response,
             :cavv_algorithm,
             :ds_transaction_id,
+            :network,
           ]},
         ]},
         {:paypal_account => [
@@ -307,6 +308,7 @@ describe Braintree::Customer do
             :directory_response,
             :cavv_algorithm,
             :ds_transaction_id,
+            :network,
           ]},
         ]},
         {:tax_identifiers => [
@@ -413,4 +415,30 @@ describe Braintree::Customer do
       end.to raise_error(NoMethodError, /protected method .new/)
     end
   end
+
+  describe "path traversal" do
+    it "self.delete raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.delete("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.update raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.update("../transactions/some_id/void", :first_name => "HackerOne")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.transactions raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.transactions("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/dispute_spec.rb

@@ -278,6 +278,44 @@ describe Braintree::Dispute do
     end
   end
 
+  describe "path traversal" do
+    [
+      :accept,
+      :finalize,
+      :find,
+    ].each do |method_name|
+      it "self.#{method_name} raises an exception if the dispute_id is a traversal segment" do
+        expect do
+          Braintree::Dispute.public_send(method_name, "../../foo")
+        end.to raise_error(ArgumentError, "dispute_id contains invalid characters")
+      end
+    end
+
+    it "self.add_file_evidence raises an exception if the dispute_id is a traversal segment" do
+      expect do
+        Braintree::Dispute.add_file_evidence("../../foo", "document_id")
+      end.to raise_error(ArgumentError, "dispute_id contains invalid characters")
+    end
+
+    it "self.add_text_evidence raises an exception if the dispute_id is a traversal segment" do
+      expect do
+        Braintree::Dispute.add_text_evidence("../../foo", "text evidence")
+      end.to raise_error(ArgumentError, "dispute_id contains invalid characters")
+    end
+
+    it "self.remove_evidence raises an exception if the dispute_id is a traversal segment" do
+      expect do
+        Braintree::Dispute.remove_evidence("../../foo", "evidence_id")
+      end.to raise_error(ArgumentError, "dispute_id contains invalid characters")
+    end
+
+    it "self.remove_evidence raises an exception if the evidence_id is a traversal segment" do
+      expect do
+        Braintree::Dispute.remove_evidence("dispute_id", "../../foo")
+      end.to raise_error(ArgumentError, "evidence_id contains invalid characters")
+    end
+  end
+
   describe "initialize" do
     it "converts string amount_dispute and amount_won" do
       dispute = Braintree::Dispute._new(attributes)

data/spec/unit/braintree/http_spec.rb

@@ -183,6 +183,50 @@ END
     end
   end
 
+  describe "#delete" do
+    it "appends the query string to the path when query_params are present" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Delete, "/customers?id=123").and_return(response)
+
+      http.delete("/customers", :id => 123)
+    end
+
+    it "does not append a query string when query_params are empty" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Delete, "/customers").and_return(response)
+
+      http.delete("/customers")
+    end
+  end
+
+  describe "#get" do
+    it "appends the query string to the path when query_params are present" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+      allow(http).to receive(:_body).with(response).and_return("")
+      allow(Braintree::Xml).to receive(:hash_from_xml).with("").and_return({})
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Get, "/customers?id=123").and_return(response)
+
+      http.get("/customers", :id => 123)
+    end
+
+    it "does not append a query string when query_params are empty" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+      allow(http).to receive(:_body).with(response).and_return("")
+      allow(Braintree::Xml).to receive(:hash_from_xml).with("").and_return({})
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Get, "/customers").and_return(response)
+
+      http.get("/customers")
+    end
+  end
+
   describe "_build_query_string" do
     it "returns an empty string for empty query params" do
       expect(Braintree::Http.new(:config)._build_query_string({})).to eq("")

data/spec/unit/braintree/merchant_account_spec.rb

@@ -0,0 +1,11 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::MerchantAccount do
+  describe "path traversal" do
+    it "self.find raises an exception if the merchant_account_id is a traversal segment" do
+      expect do
+        Braintree::MerchantAccount.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "merchant_account_id contains invalid characters")
+    end
+  end
+end

data/spec/unit/braintree/package_tracking_spec.rb

@@ -24,8 +24,8 @@ describe "Package Tracking Unit Tests" do
 
           it "raises an ArgumentError if transaction_id is an invalid format" do
             expect do
-              Braintree::Transaction.package_tracking("invalid-transaction-id", {})
-            end.to raise_error(ArgumentError, "transaction_id is invalid")
+              Braintree::Transaction.package_tracking("invalid/transaction/id", {})
+            end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
           end
 
           it "raises an exception if attributes contain an invalid key" do

data/spec/unit/braintree/payment_method_nonce_spec.rb

@@ -47,4 +47,18 @@ describe Braintree::PaymentMethodNonce do
       expect(payment_method_nonce.default?).to be true
     end
   end
+
+  describe "path traversal" do
+    it "self.create raises an exception if the payment_method_token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethodNonce.create("../payment_method_nonces/victim_nonce")
+      end.to raise_error(ArgumentError, "payment_method_token contains invalid characters")
+    end
+
+    it "self.find raises an exception if the payment_method_nonce is a traversal segment" do
+      expect do
+        Braintree::PaymentMethodNonce.find("../payment_method_nonces/victim_nonce")
+      end.to raise_error(ArgumentError, "payment_method_nonce contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/payment_method_spec.rb

@@ -144,4 +144,24 @@ describe Braintree::PaymentMethod do
       end.to_not raise_error
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.find("../customers/some_id/transaction_ids")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.update("../customers/some_id/transaction_ids", {})
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.delete("../customers/some_id/transaction_ids")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/paypal_account_spec.rb

@@ -50,4 +50,24 @@ describe Braintree::PayPalAccount do
       expect(paypal_account.edit_paypal_vault_id).to eq(mock_edit_paypal_vault_id)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.update("../payment_methods/credit_card/victim_token", {})
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.delete("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/plan_gateway_spec.rb

@@ -0,0 +1,30 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::PlanGateway do
+  let(:gateway) do
+    config = Braintree::Configuration.new(
+      :merchant_id => "merchant_id",
+      :public_key => "public_key",
+      :private_key => "private_key",
+    )
+    Braintree::Gateway.new(config)
+  end
+
+  describe "path traversal" do
+    it "find raises an exception if the id is a traversal segment" do
+      plan_gateway = Braintree::PlanGateway.new(gateway)
+
+      expect do
+        plan_gateway.find("../plans/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "update raises an exception if the plan_id is a traversal segment" do
+      plan_gateway = Braintree::PlanGateway.new(gateway)
+
+      expect do
+        plan_gateway.update("../plans/victim_id", {})
+      end.to raise_error(ArgumentError, "plan_id contains invalid characters")
+    end
+  end
+end

data/spec/unit/braintree/sepa_debit_account_spec.rb

@@ -83,4 +83,18 @@ describe Braintree::SepaDirectDebitAccount do
       it { is_expected.to be false }
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::SepaDirectDebitAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::SepaDirectDebitAccount.delete("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/subscription_spec.rb

@@ -77,4 +77,24 @@ describe Braintree::Subscription do
       expect(subscription).not_to eq("not a subscription")
     end
   end
+
+  describe "path traversal" do
+    it "self.cancel raises an exception if the subscription_id is a traversal segment" do
+      expect do
+        Braintree::Subscription.cancel("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "subscription_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::Subscription.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.update raises an exception if the subscription_id is a traversal segment" do
+      expect do
+        Braintree::Subscription.update("../transactions/some_id/void", {})
+      end.to raise_error(ArgumentError, "subscription_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/test_transaction_spec.rb

@@ -0,0 +1,18 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::TestTransaction do
+  describe "path traversal" do
+    [
+      :settle,
+      :settlement_confirm,
+      :settlement_decline,
+      :settlement_pending,
+    ].each do |method_name|
+      it "self.#{method_name} raises an exception if the transaction_id is a traversal segment" do
+        expect do
+          Braintree::TestTransaction.public_send(method_name, "../transactions/victim_id/void")
+        end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+      end
+    end
+  end
+end

data/spec/unit/braintree/transaction_gateway_spec.rb

@@ -128,6 +128,7 @@ describe Braintree::TransactionGateway do
             :directory_response,
             :cavv_algorithm,
             :ds_transaction_id,
+            :network,
           ]
         },
         {
@@ -199,5 +200,15 @@ describe Braintree::TransactionGateway do
     it "creates transaction gateway submit for partial settlement signature" do
        expect(Braintree::TransactionGateway._submit_for_partial_settlement_signature).to include(:final_capture)
     end
+
+    it "creates a transaction gateway refund signature" do
+      expect(Braintree::TransactionGateway._refund_signature).to match([
+        :amount,
+        :api_request_key,
+        :merchant_account_id,
+        :order_id,
+        :surcharge_amount,
+      ])
+    end
   end
 end

data/spec/unit/braintree/transaction_line_item_spec.rb

@@ -0,0 +1,11 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::TransactionLineItem do
+  describe "path traversal" do
+    it "self.find_all raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::TransactionLineItem.find_all("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+  end
+end

data/spec/unit/braintree/transaction_search_spec.rb

@@ -21,4 +21,29 @@ describe Braintree::TransactionSearch do
       search.billing_company "one"
     end.to raise_error(RuntimeError, "An operator is required")
   end
+
+  it "builds a hash for ach_type with a single value (same_day)" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.is Braintree::Transaction::AchType::SameDay
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::SameDay]})
+  end
+
+  it "builds a hash for ach_type with a single value (standard)" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.is Braintree::Transaction::AchType::Standard
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::Standard]})
+  end
+
+  it "builds a hash for ach_type with both values" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.in Braintree::Transaction::AchType::SameDay, Braintree::Transaction::AchType::Standard
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::SameDay, Braintree::Transaction::AchType::Standard]})
+  end
+
+  it "raises if ach_type is given a value outside the allow-list" do
+    search = Braintree::TransactionSearch.new
+    expect do
+      search.ach_type.is "invalid_ach_type"
+    end.to raise_error(ArgumentError, /Invalid argument\(s\) for ach_type: invalid_ach_type/)
+  end
 end

data/spec/unit/braintree/transaction_spec.rb

@@ -40,8 +40,8 @@ describe Braintree::Transaction do
   describe "self.submit_for_settlement" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.submit_for_settlement("invalid-transaction-id")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.submit_for_settlement("invalid/transaction/id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
 
     it "raises an ArgumentError if options hash includes an invalid key" do
@@ -54,16 +54,16 @@ describe Braintree::Transaction do
   describe "self.adjust_authorization" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.adjust_authorization("invalid-transaction-id", "10.00")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.adjust_authorization("invalid/transaction/id", "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
   end
 
   describe "self.update_details" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.update_details("invalid-transaction-id")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.update_details("invalid/transaction/id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
   end
 
@@ -604,4 +604,66 @@ describe Braintree::Transaction do
       expect(transaction.surcharge_amount).to be_nil
     end
   end
+
+  describe "path traversal" do
+    it "self.clone_transaction raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.clone_transaction("../customers/some_id", :amount => "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::Transaction.find("../customers/some_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.refund raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.refund("../customers/some_id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.void raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.void("../transactions/victim_id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.cancel_release raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.cancel_release("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.package_tracking raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.package_tracking("../transactions/victim_id/void", {})
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.submit_for_settlement raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.submit_for_settlement("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.adjust_authorization raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.adjust_authorization("../transactions/victim_id/void", "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.update_details raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.update_details("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.submit_for_partial_settlement raises an exception if the authorized_transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.submit_for_partial_settlement("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "authorized_transaction_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/us_bank_account_spec.rb

@@ -10,4 +10,12 @@ describe Braintree::UsBankAccount do
       expect(Braintree::UsBankAccount._new(:gateway, :default => false).default?).to eq(false)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::UsBankAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end