braintree 4.39.0 → 4.41.0

data/spec/unit/braintree/us_bank_account_verification_spec.rb

@@ -95,4 +95,18 @@ describe Braintree::UsBankAccountVerification do
       expect(verification).not_to eq(same_id_different_object)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::UsBankAccountVerification.find("../verifications/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.confirm_micro_transfer_amounts raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::UsBankAccountVerification.confirm_micro_transfer_amounts("../verifications/victim_id", ["0.01", "0.02"])
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/util_spec.rb

@@ -417,4 +417,41 @@ describe Braintree::Util do
       expect(Braintree::Util.url_decode("foo%3Fbar")).to eq("foo?bar")
     end
   end
+
+  describe "self.invalid_path_segment?" do
+    [
+      "customer123",
+      "CUSTOMER_123",
+      "a-b_c-D9",
+      "1234567890",
+      "a",
+      123,
+    ].each do |valid_segment|
+      it "returns false for a valid segment #{valid_segment.inspect}" do
+        expect(Braintree::Util.invalid_path_segment?(valid_segment)).to eq(false)
+      end
+    end
+
+    [
+      "",
+      "   ",
+      ".",
+      "..",
+      "foo/bar",
+      "foo\\bar",
+      "foo%bar",
+      "..%2f..%2fvictim",
+      "%2e%2e",
+      "../../victim_customer/addresses/victim_address",
+      "abc.def",
+      "abc def",
+      nil,
+      {},
+      [],
+    ].each do |invalid_segment|
+      it "returns true for an invalid segment #{invalid_segment.inspect}" do
+        expect(Braintree::Util.invalid_path_segment?(invalid_segment)).to eq(true)
+      end
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: braintree
 version: !ruby/object:Gem::Version
-  version: 4.39.0
+  version: 4.41.0
 platform: ruby
 authors:
 - Braintree
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-06-15 00:00:00.000000000 Z
+date: 2026-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: builder
@@ -195,6 +195,7 @@ files:
 - lib/braintree/test_transaction.rb
 - lib/braintree/testing_gateway.rb
 - lib/braintree/three_d_secure_info.rb
+- lib/braintree/three_d_secure_pass_thru.rb
 - lib/braintree/transaction.rb
 - lib/braintree/transaction/address_details.rb
 - lib/braintree/transaction/apple_pay_details.rb
@@ -355,6 +356,7 @@ files:
 - spec/unit/braintree/local_payment_context_spec.rb
 - spec/unit/braintree/local_payment_expired_spec.rb
 - spec/unit/braintree/local_payment_funded_spec.rb
+- spec/unit/braintree/merchant_account_spec.rb
 - spec/unit/braintree/meta_checkout_card_details_spec.rb
 - spec/unit/braintree/meta_checkout_card_spec.rb
 - spec/unit/braintree/meta_checkout_token_details_spec.rb
@@ -369,6 +371,7 @@ files:
 - spec/unit/braintree/payment_method_spec.rb
 - spec/unit/braintree/paypal_account_spec.rb
 - spec/unit/braintree/paypal_payment_resource_spec.rb
+- spec/unit/braintree/plan_gateway_spec.rb
 - spec/unit/braintree/resource_collection_spec.rb
 - spec/unit/braintree/risk_data/liability_shift.rb
 - spec/unit/braintree/risk_data_spec.rb
@@ -379,6 +382,7 @@ files:
 - spec/unit/braintree/subscription_search_spec.rb
 - spec/unit/braintree/subscription_spec.rb
 - spec/unit/braintree/successful_result_spec.rb
+- spec/unit/braintree/test_transaction_spec.rb
 - spec/unit/braintree/three_d_secure_info_spec.rb
 - spec/unit/braintree/transaction/apple_pay_details_spec.rb
 - spec/unit/braintree/transaction/credit_card_details_spec.rb
@@ -395,6 +399,7 @@ files:
 - spec/unit/braintree/transaction/visa_checkout_card_details_spec.rb
 - spec/unit/braintree/transaction_ach_mandate_spec.rb
 - spec/unit/braintree/transaction_gateway_spec.rb
+- spec/unit/braintree/transaction_line_item_spec.rb
 - spec/unit/braintree/transaction_search_spec.rb
 - spec/unit/braintree/transaction_spec.rb
 - spec/unit/braintree/unknown_payment_method_spec.rb
@@ -437,7 +442,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.15
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Braintree Ruby Server SDK