braintree 4.40.0 → 4.41.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a358a5cff7db74d5364a662ed1076dd786742d6d6f75b0f9c040fda06353a955
-  data.tar.gz: b78e2a6f20ab1207515ea76f3e7aaa6a367283b10821b026c9f89498e2e8f35c
+  metadata.gz: 874cd322dda721874dc4418b2f6ca24116b9395f7affc02d43fe056f43424b3a
+  data.tar.gz: 8c73ed2ec27ecf6b916474bc12dc14bde985c48107a53bdcea17a65a216cc3d5
 SHA512:
-  metadata.gz: 7fbb0b0ca10ec35cd3e8e6d34476eaada51e465caf4aa25a00e6d61fdbafea147a25579ed012717f2b2fec3da184d823dd0756add7738d8e4bcf1a8abea1dd2d
-  data.tar.gz: 7374cd696e006db551149f9363194c3a8ecafc7ec607b93b6a53f2eeb3eb2961e4b63bd68d20c2ea0f5262fab405597e924219b7e76fd514b0a398c367fa7403
+  metadata.gz: f8f4fa7af94d5b317dc5efa9aea66d1fbcf84f689e9cb19435f6899b8af8c39fb25063a8d0ff40e4025f42014e4c18555e9d4b2e779132b0fc73afc3f6204baa
+  data.tar.gz: 815d5927abfa22e7acbdf7fa4353d9408b0b0add7f66a5e1cbf43b2b2aaa03a5ac4f925eb25b69bcf1060ff04c01e9cdc9c908e560a4e6e7df9db14339ed886a

data/lib/braintree/client_token_gateway.rb

@@ -9,12 +9,21 @@ module Braintree
     end
 
     def generate(options={})
+      options = options.dup
+
       _validate_options(options)
 
       options[:version] ||= ClientToken::DEFAULT_VERSION
 
       Util.verify_keys(ClientTokenGateway._generate_signature, options)
 
+      if options.has_key?(:preferred_payment_method_token)
+        options[:payment_method_id] = options.delete(:preferred_payment_method_token)
+        options.delete("preferred_payment_method_token")
+      elsif options.has_key?("preferred_payment_method_token")
+        options[:payment_method_id] = options.delete("preferred_payment_method_token")
+      end
+
       params = {:client_token => options}
       result = @config.http.post("#{@config.base_merchant_path}/client_token", params)
 
@@ -27,7 +36,7 @@ module Braintree
 
     def self._generate_signature
       [
-        :address_id, :customer_id, :proxy_merchant_id, :merchant_account_id,
+        :address_id, :customer_id, :merchant_account_id, :preferred_payment_method_token, :proxy_merchant_id,
         :version,
         {:domains => [:_any_key_]},
         {:options => [:fail_on_duplicate_payment_method, :fail_on_duplicate_payment_method_for_customer, :make_default, :verify_card]}

data/lib/braintree/credit_card_gateway.rb

@@ -39,6 +39,8 @@ module Braintree
     end
 
     def delete(token)
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       @config.http.delete("#{@config.base_merchant_path}/payment_methods/credit_card/#{token}")
     end
 
@@ -55,7 +57,8 @@ module Braintree
     end
 
     def find(token)
-      raise ArgumentError if token.nil? || token.to_s.strip == ""
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       response = @config.http.get("#{@config.base_merchant_path}/payment_methods/credit_card/#{token}")
       CreditCard._new(@gateway, response[:credit_card])
     rescue NotFoundError
@@ -63,7 +66,8 @@ module Braintree
     end
 
     def from_nonce(nonce)
-      raise ArgumentError if nonce.nil? || nonce.to_s.strip == ""
+      raise ArgumentError, "nonce contains invalid characters" if Util.invalid_path_segment?(nonce)
+
       response = @config.http.get("#{@config.base_merchant_path}/payment_methods/from_nonce/#{nonce}")
       CreditCard._new(@gateway, response[:credit_card])
     rescue NotFoundError
@@ -71,6 +75,8 @@ module Braintree
     end
 
     def update(token, attributes)
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       # NEXT_MAJOR_VERSION remove this check
       if attributes.has_key?(:venmo_sdk_payment_method_code) || attributes.has_key?(:venmo_sdk_session)
         warn "[DEPRECATED] The Venmo SDK integration is Unsupported. Please update your integration to use Pay with Venmo instead."

data/lib/braintree/credit_card_verification_gateway.rb

@@ -8,6 +8,8 @@ module Braintree
 
     def find(id)
       raise ArgumentError if id.nil? || id.to_s.strip == ""
+      raise ArgumentError, "id contains invalid characters" if Util.invalid_path_segment?(id)
+
       response = @config.http.get("#{@config.base_merchant_path}/verifications/#{id}")
       CreditCardVerification._new(response[:verification])
     rescue NotFoundError

data/lib/braintree/customer_gateway.rb

@@ -23,15 +23,19 @@ module Braintree
     end
 
     def delete(customer_id)
+      raise ArgumentError, "customer_id contains invalid characters" if Util.invalid_path_segment?(customer_id)
+
       @config.http.delete("#{@config.base_merchant_path}/customers/#{customer_id}")
       SuccessfulResult.new
     end
 
     def find(customer_id, options = {})
-      raise ArgumentError, "customer_id contains invalid characters" unless customer_id.to_s =~ /\A[\w-]+\z/
-      raise ArgumentError, "customer_id cannot be blank" if customer_id.nil?|| customer_id.to_s.strip == ""
+      raise ArgumentError, "customer_id contains invalid characters" if Util.invalid_path_segment?(customer_id)
+
+      association_filter_id = options[:association_filter_id]
+      raise ArgumentError, "association_filter_id contains invalid characters" if association_filter_id && Util.invalid_path_segment?(association_filter_id)
 
-      query_params = options[:association_filter_id].nil? ? "" : "?association_filter_id=#{options[:association_filter_id]}"
+      query_params = association_filter_id.nil? ? "" : "?association_filter_id=#{association_filter_id}"
       response = @config.http.get("#{@config.base_merchant_path}/customers/#{customer_id}#{query_params}")
       Customer._new(@gateway, response[:customer])
     rescue NotFoundError
@@ -47,11 +51,15 @@ module Braintree
     end
 
     def transactions(customer_id, options = {})
+      raise ArgumentError, "customer_id contains invalid characters" if Util.invalid_path_segment?(customer_id)
+
       response = @config.http.post("#{@config.base_merchant_path}/customers/#{customer_id}/transaction_ids")
       ResourceCollection.new(response) { |ids| _fetch_transactions(customer_id, ids) }
     end
 
     def update(customer_id, attributes)
+      raise ArgumentError, "customer_id contains invalid characters" if Util.invalid_path_segment?(customer_id)
+
       Util.verify_keys(CustomerGateway._update_signature, attributes)
       _do_update(:put, "/customers/#{customer_id}", :customer => attributes)
     end

data/lib/braintree/http.rb

@@ -8,7 +8,8 @@ module Braintree
     end
 
     def delete(path, query_params = {})
-      response = _http_do Net::HTTP::Delete, path
+      full_path = path + _build_query_string(query_params)
+      response = _http_do Net::HTTP::Delete, full_path
       if response.code.to_i == 200 || response.code.to_i == 204
         true
       elsif response.code.to_i == 422
@@ -19,7 +20,8 @@ module Braintree
     end
 
     def get(path, query_params = {})
-      response = _http_do Net::HTTP::Get, path
+      full_path = path + _build_query_string(query_params)
+      response = _http_do Net::HTTP::Get, full_path
       if response.code.to_i == 200 || response.code.to_i == 422
         Xml.hash_from_xml(_body(response))
       else

data/lib/braintree/merchant_account_gateway.rb

@@ -22,6 +22,8 @@ module Braintree
 
     def find(merchant_account_id)
       raise ArgumentError if merchant_account_id.nil? || merchant_account_id.to_s.strip == ""
+      raise ArgumentError, "merchant_account_id contains invalid characters" if Util.invalid_path_segment?(merchant_account_id)
+
       response = @config.http.get("#{@config.base_merchant_path}/merchant_accounts/#{merchant_account_id}")
       MerchantAccount._new(@gateway, response[:merchant_account])
     rescue NotFoundError

data/lib/braintree/payment_method_gateway.rb

@@ -33,6 +33,8 @@ module Braintree
     end
 
     def delete(token, options = {})
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       Util.verify_keys(PaymentMethodGateway._delete_signature, options)
       query_param = "?" + Util.hash_to_query_string(options) if not options.empty?
       @config.http.delete("#{@config.base_merchant_path}/payment_methods/any/#{token}#{query_param}")
@@ -40,7 +42,8 @@ module Braintree
     end
 
     def find(token)
-      raise ArgumentError if token.nil? || token.to_s.strip == ""
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       response = @config.http.get("#{@config.base_merchant_path}/payment_methods/any/#{token}")
       if response.has_key?(:credit_card)
         CreditCard._new(@gateway, response[:credit_card])
@@ -64,6 +67,8 @@ module Braintree
     end
 
     def update(token, attributes)
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       # NEXT_MAJOR_VERSION remove this check
       if attributes.has_key?(:venmo_sdk_payment_method_code) || attributes.has_key?(:venmo_sdk_session)
         warn "[DEPRECATED] The Venmo SDK integration is Unsupported. Please update your integration to use Pay with Venmo instead."

data/lib/braintree/payment_method_nonce_gateway.rb

@@ -9,6 +9,8 @@ module Braintree
     end
 
     def create(payment_method_token, args = {payment_method_nonce: {}})
+      raise ArgumentError, "payment_method_token contains invalid characters" if Util.invalid_path_segment?(payment_method_token)
+
       Util.verify_keys(PaymentMethodNonceGateway._create_signature, args)
 
       response = @config.http.post("#{@config.base_merchant_path}/payment_methods/#{payment_method_token}/nonces", args)
@@ -30,6 +32,8 @@ module Braintree
     end
 
     def find(payment_method_nonce)
+      raise ArgumentError, "payment_method_nonce contains invalid characters" if Util.invalid_path_segment?(payment_method_nonce)
+
       response = @config.http.get("#{@config.base_merchant_path}/payment_method_nonces/#{payment_method_nonce}")
       payment_method_nonce = PaymentMethodNonce._new(@gateway, response.fetch(:payment_method_nonce))
       SuccessfulResult.new(:payment_method_nonce => payment_method_nonce)

data/lib/braintree/paypal_account_gateway.rb

@@ -7,7 +7,8 @@ module Braintree
     end
 
     def find(token)
-      raise ArgumentError if token.nil? || token.to_s.strip == ""
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       response = @config.http.get("#{@config.base_merchant_path}/payment_methods/paypal_account/#{token}")
       PayPalAccount._new(@gateway, response[:paypal_account])
     rescue NotFoundError
@@ -20,11 +21,15 @@ module Braintree
     end
 
     def update(token, attributes)
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       Util.verify_keys(PayPalAccountGateway._update_signature, attributes)
       _do_update(:put, "/payment_methods/paypal_account/#{token}", :paypal_account => attributes)
     end
 
     def delete(token)
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       @config.http.delete("#{@config.base_merchant_path}/payment_methods/paypal_account/#{token}")
     end
 

data/lib/braintree/plan_gateway.rb

@@ -27,6 +27,8 @@ module Braintree
 
     def find(id)
       raise ArgumentError if id.nil? || id.to_s.strip == ""
+      raise ArgumentError, "id contains invalid characters" if Util.invalid_path_segment?(id)
+
       response = @config.http.get("#{@config.base_merchant_path}/plans/#{id}")
       Plan._new(@gateway, response[:plan])
     rescue NotFoundError
@@ -34,6 +36,8 @@ module Braintree
     end
 
     def update(plan_id, attributes)
+      raise ArgumentError, "plan_id contains invalid characters" if Util.invalid_path_segment?(plan_id)
+
       Util.verify_keys(PlanGateway._update_signature, attributes)
       response = @config.http.put("#{@config.base_merchant_path}/plans/#{plan_id}", :plan => attributes)
       if response[:plan]

data/lib/braintree/sepa_direct_debit_account_gateway.rb

@@ -8,6 +8,8 @@ module Braintree
 
     def find(token)
       raise ArgumentError if token.nil? || token.to_s.strip == ""
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       response = @config.http.get("#{@config.base_merchant_path}/payment_methods/sepa_debit_account/#{token}")
       SepaDirectDebitAccount._new(@gateway, response[:sepa_debit_account])
     rescue NotFoundError
@@ -16,6 +18,8 @@ module Braintree
 
     def delete(token)
       raise ArgumentError if token.nil? || token.to_s.strip == ""
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       @config.http.delete("#{@config.base_merchant_path}/payment_methods/sepa_debit_account/#{token}")
       SuccessfulResult.new
     rescue NotFoundError

data/lib/braintree/subscription_gateway.rb

@@ -9,6 +9,8 @@ module Braintree
     end
 
     def cancel(subscription_id)
+      raise ArgumentError, "subscription_id contains invalid characters" if Util.invalid_path_segment?(subscription_id)
+
       response = @config.http.put("#{@config.base_merchant_path}/subscriptions/#{subscription_id}/cancel")
       if response[:subscription]
         SuccessfulResult.new(:subscription => Subscription._new(@gateway, response[:subscription]))
@@ -36,6 +38,8 @@ module Braintree
 
     def find(id)
       raise ArgumentError if id.nil? || id.to_s.strip == ""
+      raise ArgumentError, "id contains invalid characters" if Util.invalid_path_segment?(id)
+
       response = @config.http.get("#{@config.base_merchant_path}/subscriptions/#{id}")
       Subscription._new(@gateway, response[:subscription])
     rescue NotFoundError
@@ -55,6 +59,8 @@ module Braintree
     end
 
     def update(subscription_id, attributes)
+      raise ArgumentError, "subscription_id contains invalid characters" if Util.invalid_path_segment?(subscription_id)
+
       Util.verify_keys(SubscriptionGateway._update_signature, attributes)
       response = @config.http.put("#{@config.base_merchant_path}/subscriptions/#{subscription_id}", :subscription => attributes)
       if response[:subscription]

data/lib/braintree/testing_gateway.rb

@@ -10,6 +10,7 @@ module Braintree
 
     def settle(transaction_id)
       check_environment
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
 
       response = @config.http.put("#{@config.base_merchant_path}/transactions/#{transaction_id}/settle")
       @transaction_gateway._handle_transaction_response(response)
@@ -17,6 +18,7 @@ module Braintree
 
     def settlement_confirm(transaction_id)
       check_environment
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
 
       response = @config.http.put("#{@config.base_merchant_path}/transactions/#{transaction_id}/settlement_confirm")
       @transaction_gateway._handle_transaction_response(response)
@@ -24,6 +26,7 @@ module Braintree
 
     def settlement_decline(transaction_id)
       check_environment
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
 
       response = @config.http.put("#{@config.base_merchant_path}/transactions/#{transaction_id}/settlement_decline")
       @transaction_gateway._handle_transaction_response(response)
@@ -31,6 +34,7 @@ module Braintree
 
     def settlement_pending(transaction_id)
       check_environment
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
 
       response = @config.http.put("#{@config.base_merchant_path}/transactions/#{transaction_id}/settlement_pending")
       @transaction_gateway._handle_transaction_response(response)

data/lib/braintree/transaction.rb

@@ -3,6 +3,12 @@ module Braintree
     include BaseModule
     include Braintree::Util::IdEquality
 
+    module AchType
+      SameDay  = "same_day"
+      Standard = "standard"
+      All = constants.map { |c| const_get(c) }
+    end
+
     module CreatedUsing
       FullInformation = "full_information"
       Token = "token"

data/lib/braintree/transaction_gateway.rb

@@ -22,7 +22,7 @@ module Braintree
     end
 
     def cancel_release(transaction_id)
-      raise ArgumentError, "transaction_id is invalid" unless transaction_id =~ /\A[0-9a-z]+\z/
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
       response = @config.http.put("#{@config.base_merchant_path}/transactions/#{transaction_id}/cancel_release")
       _handle_transaction_response(response)
     end
@@ -42,6 +42,8 @@ module Braintree
     end
 
     def clone_transaction(transaction_id, attributes)
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
+
       Util.verify_keys(TransactionGateway._clone_signature, attributes)
       _do_create "/transactions/#{transaction_id}/clone", :transaction_clone => attributes
     end
@@ -59,7 +61,9 @@ module Braintree
     end
 
     def find(id)
-      raise ArgumentError, "id can not be empty" if id.nil? || id.strip.to_s == ""
+      raise ArgumentError, "id can not be empty" if id.nil? || id.to_s.strip == ""
+      raise ArgumentError, "id contains invalid characters" if Util.invalid_path_segment?(id)
+
       response = @config.http.get("#{@config.base_merchant_path}/transactions/#{id}")
       Transaction._new(@gateway, response[:transaction])
     rescue NotFoundError
@@ -67,6 +71,8 @@ module Braintree
     end
 
     def refund(transaction_id, amount_or_options = nil)
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
+
       options = if amount_or_options.is_a?(Hash)
                   amount_or_options
                 else
@@ -103,7 +109,7 @@ module Braintree
     end
 
     def package_tracking(transaction_id, package_tracking_request)
-      raise ArgumentError, "transaction_id is invalid" unless transaction_id =~ /\A[0-9a-z]+\z/
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
       Util.verify_keys(TransactionGateway._package_tracking_request_signature, package_tracking_request)
       _do_create "/transactions/#{transaction_id}/shipments", :shipment => package_tracking_request
     end
@@ -126,7 +132,7 @@ module Braintree
     end
 
     def submit_for_settlement(transaction_id, amount = nil, options = {})
-      raise ArgumentError, "transaction_id is invalid" unless transaction_id =~ /\A[0-9a-z]+\z/
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
       Util.verify_keys(TransactionGateway._submit_for_settlement_signature, options)
       transaction_params = {:amount => amount}.merge(options)
       response = @config.http.put("#{@config.base_merchant_path}/transactions/#{transaction_id}/submit_for_settlement", :transaction => transaction_params)
@@ -138,7 +144,7 @@ module Braintree
     end
 
     def adjust_authorization(transaction_id, amount)
-      raise ArgumentError, "transaction_id is invalid" unless transaction_id =~ /\A[0-9a-z]+\z/
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
       Util.verify_keys(TransactionGateway._adjust_authorization_signature, {})
       transaction_params = {:amount => amount}
       response = @config.http.put("#{@config.base_merchant_path}/transactions/#{transaction_id}/adjust_authorization", :transaction => transaction_params)
@@ -150,14 +156,14 @@ module Braintree
     end
 
     def update_details(transaction_id, options = {})
-      raise ArgumentError, "transaction_id is invalid" unless transaction_id =~ /\A[0-9a-z]+\z/
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
       Util.verify_keys(TransactionGateway._update_details_signature, options)
       response = @config.http.put("#{@config.base_merchant_path}/transactions/#{transaction_id}/update_details", :transaction => options)
       _handle_transaction_response(response)
     end
 
     def submit_for_partial_settlement(authorized_transaction_id, amount = nil, options = {})
-      raise ArgumentError, "authorized_transaction_id is invalid" unless authorized_transaction_id =~ /\A[0-9a-z]+\z/
+      raise ArgumentError, "authorized_transaction_id contains invalid characters" if Util.invalid_path_segment?(authorized_transaction_id)
       Util.verify_keys(TransactionGateway._submit_for_partial_settlement_signature, options)
       transaction_params = {:amount => amount}.merge(options)
       response = @config.http.post("#{@config.base_merchant_path}/transactions/#{authorized_transaction_id}/submit_for_partial_settlement", :transaction => transaction_params)
@@ -169,6 +175,8 @@ module Braintree
     end
 
     def void(transaction_id, options = {})
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
+
       transaction_params = options.empty? ? nil : options
       response = @config.http.put(
         "#{@config.base_merchant_path}/transactions/#{transaction_id}/void",
@@ -382,6 +390,7 @@ module Braintree
         :api_request_key,
         :merchant_account_id,
         :order_id,
+        :surcharge_amount,
       ]
     end
 

data/lib/braintree/transaction_line_item_gateway.rb

@@ -7,7 +7,9 @@ module Braintree
     end
 
     def find_all(transaction_id)
-      raise ArgumentError, "transaction_id cannot be blank" if transaction_id.nil? || transaction_id.strip.to_s == ""
+      raise ArgumentError, "transaction_id cannot be blank" if transaction_id.nil? || transaction_id.to_s.strip == ""
+      raise ArgumentError, "transaction_id contains invalid characters" if Util.invalid_path_segment?(transaction_id)
+
       response = @config.http.get("#{@config.base_merchant_path}/transactions/#{transaction_id}/line_items")
       response[:line_items].map do |line_item_params|
         TransactionLineItem._new(@gateway, line_item_params)

data/lib/braintree/transaction_search.rb

@@ -46,6 +46,7 @@ module Braintree
     equality_fields :credit_card_expiration_date
     partial_match_fields :credit_card_number
 
+    multiple_value_field :ach_type, :allows => Transaction::AchType::All
     multiple_value_field :created_using, :allows => [
       Transaction::CreatedUsing::FullInformation,
       Transaction::CreatedUsing::Token

data/lib/braintree/us_bank_account_gateway.rb

@@ -8,6 +8,8 @@ module Braintree
 
     def find(token)
       raise ArgumentError if token.nil? || token.to_s.strip == ""
+      raise ArgumentError, "token contains invalid characters" if Util.invalid_path_segment?(token)
+
       response = @config.http.get("#{@config.base_merchant_path}/payment_methods/us_bank_account/#{token}")
       UsBankAccount._new(@gateway, response[:us_bank_account])
     rescue NotFoundError

data/lib/braintree/us_bank_account_verification_gateway.rb

@@ -8,6 +8,8 @@ module Braintree
 
     def confirm_micro_transfer_amounts(id, deposit_amounts)
       raise ArgumentError if id.nil? || id.to_s.strip == "" || !deposit_amounts.kind_of?(Array)
+      raise ArgumentError, "id contains invalid characters" if Util.invalid_path_segment?(id)
+
       response = @config.http.put(
         "#{@config.base_merchant_path}/us_bank_account_verifications/#{id}/confirm_micro_transfer_amounts",
         :us_bank_account_verification => {
@@ -27,6 +29,8 @@ module Braintree
 
     def find(id)
       raise ArgumentError if id.nil? || id.to_s.strip == ""
+      raise ArgumentError, "id contains invalid characters" if Util.invalid_path_segment?(id)
+
       response = @config.http.get("#{@config.base_merchant_path}/us_bank_account_verifications/#{id}")
       UsBankAccountVerification._new(response[:us_bank_account_verification])
     rescue NotFoundError

data/lib/braintree/version.rb

@@ -1,7 +1,7 @@
 module Braintree
   module Version
     Major = 4
-    Minor = 40
+    Minor = 41
     Tiny = 0
 
     String = "#{Major}.#{Minor}.#{Tiny}"

data/spec/integration/braintree/client_api/client_token_spec.rb

@@ -378,6 +378,20 @@ describe Braintree::ClientToken do
       end
     end
 
+    it "can pass preferred_payment_method_token" do
+      result = Braintree::Customer.create
+      raw_client_token = Braintree::ClientToken.generate(
+        :customer_id => result.customer.id,
+        :preferred_payment_method_token => "a-pmt",
+      )
+      client_token = decode_client_token(raw_client_token)
+
+      expect(client_token["paymentMethodIdJwt"]).not_to be_nil
+      jwt_segment = client_token["paymentMethodIdJwt"].split(".")[1]
+      jwt_payload = JSON.parse(Base64.urlsafe_decode64(jwt_segment + "=" * ((4 - jwt_segment.length % 4) % 4)))
+      expect(jwt_payload["pmid"]).to eq("a-pmt")
+    end
+
     it "can pass merchant_account_id" do
       merchant_account_id = SpecHelper::NonDefaultMerchantAccountId
 

data/spec/integration/braintree/customer_spec.rb

@@ -2677,4 +2677,47 @@ describe Braintree::Customer do
     end
   end
 
+  describe "path traversal" do
+    it "self.update rejects a traversal customer_id and does not void the victim transaction" do
+      transaction = Braintree::Transaction.sale!(
+        :amount => Braintree::Test::TransactionAmounts::Authorize,
+        :credit_card => {
+          :number => Braintree::Test::CreditCardNumbers::Visa,
+          :expiration_date => "05/2009"
+        },
+        :options => {:submit_for_settlement => false},
+      )
+      traversal_id = "../transactions/#{transaction.id}/void"
+
+      expect do
+        Braintree::Customer.update(traversal_id, :first_name => "HackerOne")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+
+      unaffected_transaction = Braintree::Transaction.find(transaction.id)
+      expect(unaffected_transaction.status).to eq(Braintree::Transaction::Status::Authorized)
+    end
+
+    it "self.delete rejects a traversal customer_id and does not delete the victim payment method" do
+      create_result = Braintree::Customer.create(:first_name => "Victim")
+      expect(create_result.success?).to eq(true)
+      customer = create_result.customer
+
+      credit_card_result = Braintree::CreditCard.create(
+        :customer_id => customer.id,
+        :number => Braintree::Test::CreditCardNumbers::Visa,
+        :expiration_date => "05/2009",
+      )
+      expect(credit_card_result.success?).to eq(true)
+      token = credit_card_result.credit_card.token
+      traversal_id = "../payment_methods/any/#{token}"
+
+      expect do
+        Braintree::Customer.delete(traversal_id)
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+
+      unaffected_credit_card = Braintree::CreditCard.find(token)
+      expect(unaffected_credit_card.token).to eq(token)
+    end
+  end
+
 end