braintree 4.40.0 → 4.41.0

data/spec/integration/braintree/transaction_search_spec.rb

@@ -257,6 +257,93 @@ describe Braintree::Transaction, "search" do
         expect(collection.maximum_size).to eq(0)
       end
 
+      it "searches on ach_type" do
+        same_day_transaction = Braintree::Transaction.find("sameday_ach_sameday_requested")
+        standard_transaction = Braintree::Transaction.find("standard_ach_standard_requested")
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is same_day_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::SameDay
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(same_day_transaction.id)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is same_day_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::Standard
+        end
+
+        expect(collection.maximum_size).to eq(0)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is standard_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::Standard
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(standard_transaction.id)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is standard_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::SameDay
+        end
+
+        expect(collection.maximum_size).to eq(0)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is same_day_transaction.id
+          search.ach_type.in [
+            Braintree::Transaction::AchType::SameDay,
+            Braintree::Transaction::AchType::Standard
+          ]
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(same_day_transaction.id)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is standard_transaction.id
+          search.ach_type.in [
+            Braintree::Transaction::AchType::SameDay,
+            Braintree::Transaction::AchType::Standard
+          ]
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(standard_transaction.id)
+
+        divergent_transaction = Braintree::Transaction.find("standard_ach_sameday_requested")
+        expect(divergent_transaction.ach_type).to eq(Braintree::Transaction::AchType::Standard)
+        expect(divergent_transaction.requested_ach_type).to eq(Braintree::Transaction::AchType::SameDay)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is divergent_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::Standard
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(divergent_transaction.id)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is divergent_transaction.id
+          search.ach_type.is Braintree::Transaction::AchType::SameDay
+        end
+
+        expect(collection.maximum_size).to eq(0)
+
+        collection = Braintree::Transaction.search do |search|
+          search.id.is divergent_transaction.id
+          search.ach_type.in [
+            Braintree::Transaction::AchType::SameDay,
+            Braintree::Transaction::AchType::Standard
+          ]
+        end
+
+        expect(collection.maximum_size).to eq(1)
+        expect(collection.first.id).to eq(divergent_transaction.id)
+      end
+
       it "searches on credit_card_customer_location" do
         transaction = Braintree::Transaction.sale!(
           :amount => Braintree::Test::TransactionAmounts::Authorize,
@@ -661,6 +748,14 @@ describe Braintree::Transaction, "search" do
           end
         end.to raise_error(ArgumentError)
       end
+
+      it "raises an exception on invalid ach_type" do
+        expect do
+          Braintree::Transaction.search do |search|
+            search.ach_type.is "invalid_ach_type"
+          end
+        end.to raise_error(ArgumentError)
+      end
     end
 
     context "range fields" do

data/spec/integration/braintree/transaction_spec.rb

@@ -5233,6 +5233,28 @@ describe Braintree::Transaction do
         transaction = Braintree::Transaction.find(transaction.id)
         expect(transaction.refund_ids.sort).to eq([transaction_1.id, transaction_2.id].sort)
       end
+
+      it "allows partial refund with surcharge_amount" do
+        transaction = Braintree::Transaction.sale!(
+          :amount => Braintree::Test::TransactionAmounts::Authorize,
+          :surcharge_amount => "1.00",
+          :credit_card => {
+            :number => Braintree::Test::CreditCardNumbers::Visa,
+            :expiration_date => "05/2009"
+          },
+          :options => {
+            :submit_for_settlement => true
+          },
+        )
+        config = Braintree::Configuration.instantiate
+        config.http.put("#{config.base_merchant_path}/transactions/#{transaction.id}/settle")
+        transaction = Braintree::Transaction.find(transaction.id)
+
+        result = Braintree::Transaction.refund(transaction.id, :amount => transaction.amount / 2, :surcharge_amount => "0.50")
+        expect(result.success?).to eq(true)
+        expect(result.transaction.type).to eq("credit")
+        expect(result.transaction.surcharge_amount).to eq(BigDecimal("0.50"))
+      end
     end
 
     it "returns a successful result if successful" do
@@ -5272,6 +5294,28 @@ describe Braintree::Transaction do
       expect(result.success?).to eq(false)
       expect(result.errors.for(:transaction).on(:base)[0].code).to eq(Braintree::ErrorCodes::Transaction::CannotRefundUnlessSettled)
     end
+
+    it "accepts surcharge_amount field in refund" do
+      transaction = Braintree::Transaction.sale!(
+        :amount => Braintree::Test::TransactionAmounts::Authorize,
+        :surcharge_amount => "1.00",
+        :credit_card => {
+          :number => Braintree::Test::CreditCardNumbers::Visa,
+          :expiration_date => "05/2009"
+        },
+        :options => {
+          :submit_for_settlement => true
+        },
+      )
+      config = Braintree::Configuration.instantiate
+      config.http.put("#{config.base_merchant_path}/transactions/#{transaction.id}/settle")
+      transaction = Braintree::Transaction.find(transaction.id)
+
+      result = Braintree::Transaction.refund(transaction.id, :surcharge_amount => "1.00")
+      expect(result.success?).to eq(true)
+      expect(result.transaction.type).to eq("credit")
+      expect(result.transaction.surcharge_amount).to eq(BigDecimal("1.00"))
+    end
   end
 
   describe "self.refund!" do
@@ -8179,7 +8223,7 @@ describe Braintree::Transaction do
   end
 
   context "Surcharge Amount" do
-    it "accepts surcharge_amount field" do
+    it "accepts surcharge_amount field for sale transactions" do
       result = Braintree::Transaction.create(
         :type => "sale",
         :amount => "10.00",
@@ -8193,5 +8237,41 @@ describe Braintree::Transaction do
       expect(result.success?).to eq(true)
       expect(result.transaction.surcharge_amount).to eq(BigDecimal("1.00"))
     end
+
+    it "accepts surcharge_amount field for blind credit" do
+      result = Braintree::Transaction.create(
+        :type => "credit",
+        :amount => "10.00",
+        :surcharge_amount => "1.00",
+        :credit_card => {
+          :number => Braintree::Test::CreditCardNumbers::Visa,
+          :expiration_date => "05/2029"
+        },
+      )
+
+      expect(result.success?).to eq(true)
+      expect(result.transaction.surcharge_amount).to eq(BigDecimal("1.00"))
+    end
+  end
+
+  describe "path traversal" do
+    it "self.void rejects a traversal transaction_id and does not void the victim transaction" do
+      victim_transaction = Braintree::Transaction.sale!(
+        :amount => Braintree::Test::TransactionAmounts::Authorize,
+        :credit_card => {
+          :number => Braintree::Test::CreditCardNumbers::Visa,
+          :expiration_date => "05/2009"
+        },
+        :options => {:submit_for_settlement => false},
+      )
+      traversal_id = "../transactions/#{victim_transaction.id}"
+
+      expect do
+        Braintree::Transaction.void(traversal_id)
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+
+      unaffected_transaction = Braintree::Transaction.find(victim_transaction.id)
+      expect(unaffected_transaction.status).to eq(Braintree::Transaction::Status::Authorized)
+    end
   end
 end

data/spec/unit/braintree/client_token_spec.rb

@@ -20,6 +20,78 @@ module Braintree
           )
         }.to raise_error(ArgumentError, /created_at, public_key/)
       end
+
+      context "with preferred_payment_method_token" do
+        let(:config) { SpecHelper::TestMerchantConfig }
+        let(:gateway) { Gateway.new(config) }
+        let(:http) { double(:http) }
+
+        before do
+          allow(config).to receive(:http).and_return(http)
+          allow(Configuration).to receive(:gateway).and_return(gateway)
+        end
+
+        def expect_client_token_post(options)
+          expect(http).to receive(:post).with(
+            "#{config.base_merchant_path}/client_token",
+            :client_token => options,
+          ).and_return(:client_token => {:value => "client-token"})
+        end
+
+        it "renames preferred_payment_method_token to payment_method_id" do
+          expect_client_token_post(
+            :payment_method_id => "a-pmt",
+            :version => ClientToken::DEFAULT_VERSION,
+          )
+
+          client_token = Braintree::ClientToken.generate(
+            :preferred_payment_method_token => "a-pmt",
+          )
+
+          expect(client_token).to eq("client-token")
+        end
+
+        it "renames string preferred_payment_method_token to payment_method_id" do
+          expect_client_token_post(
+            :payment_method_id => "a-pmt",
+            :version => ClientToken::DEFAULT_VERSION,
+          )
+
+          client_token = Braintree::ClientToken.generate(
+            "preferred_payment_method_token" => "a-pmt",
+          )
+
+          expect(client_token).to eq("client-token")
+        end
+
+        it "renames preferred_payment_method_token when the value is nil" do
+          expect_client_token_post(
+            :payment_method_id => nil,
+            :version => ClientToken::DEFAULT_VERSION,
+          )
+
+          client_token = Braintree::ClientToken.generate(
+            :preferred_payment_method_token => nil,
+          )
+
+          expect(client_token).to eq("client-token")
+        end
+
+        it "does not mutate the caller's options hash" do
+          options = {:preferred_payment_method_token => "a-pmt"}
+          expect(http).to receive(:post).twice.with(
+            "#{config.base_merchant_path}/client_token",
+            :client_token => {
+              :payment_method_id => "a-pmt",
+              :version => ClientToken::DEFAULT_VERSION,
+            },
+          ).and_return(:client_token => {:value => "client-token"})
+
+          expect(Braintree::ClientToken.generate(options)).to eq("client-token")
+          expect(Braintree::ClientToken.generate(options)).to eq("client-token")
+          expect(options).to eq(:preferred_payment_method_token => "a-pmt")
+        end
+      end
     end
 
     context "adding credit_card options with no customer ID" do

data/spec/unit/braintree/credit_card_spec.rb

@@ -293,4 +293,30 @@ describe Braintree::CreditCard do
     card = Braintree::CreditCard._new(:gateway, {:purchase => "No"})
     expect(card.purchase).to eq("No")
   end
+
+  describe "path traversal" do
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.delete("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.find("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.from_nonce raises an exception if the nonce is a traversal segment" do
+      expect do
+        Braintree::CreditCard.from_nonce("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "nonce contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.update("../payment_methods/paypal_account/victim_token", :cvv => "123")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/credit_card_verification_spec.rb

@@ -183,4 +183,12 @@ describe Braintree::CreditCardVerification do
       expect(verification.credit_card[:payment_account_reference]).to eq("V0010013019339005665779448477")
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::CreditCardVerification.find("../verifications/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/customer_spec.rb

@@ -415,4 +415,30 @@ describe Braintree::Customer do
       end.to raise_error(NoMethodError, /protected method .new/)
     end
   end
+
+  describe "path traversal" do
+    it "self.delete raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.delete("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.update raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.update("../transactions/some_id/void", :first_name => "HackerOne")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.transactions raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.transactions("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/http_spec.rb

@@ -183,6 +183,50 @@ END
     end
   end
 
+  describe "#delete" do
+    it "appends the query string to the path when query_params are present" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Delete, "/customers?id=123").and_return(response)
+
+      http.delete("/customers", :id => 123)
+    end
+
+    it "does not append a query string when query_params are empty" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Delete, "/customers").and_return(response)
+
+      http.delete("/customers")
+    end
+  end
+
+  describe "#get" do
+    it "appends the query string to the path when query_params are present" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+      allow(http).to receive(:_body).with(response).and_return("")
+      allow(Braintree::Xml).to receive(:hash_from_xml).with("").and_return({})
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Get, "/customers?id=123").and_return(response)
+
+      http.get("/customers", :id => 123)
+    end
+
+    it "does not append a query string when query_params are empty" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+      allow(http).to receive(:_body).with(response).and_return("")
+      allow(Braintree::Xml).to receive(:hash_from_xml).with("").and_return({})
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Get, "/customers").and_return(response)
+
+      http.get("/customers")
+    end
+  end
+
   describe "_build_query_string" do
     it "returns an empty string for empty query params" do
       expect(Braintree::Http.new(:config)._build_query_string({})).to eq("")

data/spec/unit/braintree/merchant_account_spec.rb

@@ -0,0 +1,11 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::MerchantAccount do
+  describe "path traversal" do
+    it "self.find raises an exception if the merchant_account_id is a traversal segment" do
+      expect do
+        Braintree::MerchantAccount.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "merchant_account_id contains invalid characters")
+    end
+  end
+end

data/spec/unit/braintree/package_tracking_spec.rb

@@ -24,8 +24,8 @@ describe "Package Tracking Unit Tests" do
 
           it "raises an ArgumentError if transaction_id is an invalid format" do
             expect do
-              Braintree::Transaction.package_tracking("invalid-transaction-id", {})
-            end.to raise_error(ArgumentError, "transaction_id is invalid")
+              Braintree::Transaction.package_tracking("invalid/transaction/id", {})
+            end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
           end
 
           it "raises an exception if attributes contain an invalid key" do

data/spec/unit/braintree/payment_method_nonce_spec.rb

@@ -47,4 +47,18 @@ describe Braintree::PaymentMethodNonce do
       expect(payment_method_nonce.default?).to be true
     end
   end
+
+  describe "path traversal" do
+    it "self.create raises an exception if the payment_method_token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethodNonce.create("../payment_method_nonces/victim_nonce")
+      end.to raise_error(ArgumentError, "payment_method_token contains invalid characters")
+    end
+
+    it "self.find raises an exception if the payment_method_nonce is a traversal segment" do
+      expect do
+        Braintree::PaymentMethodNonce.find("../payment_method_nonces/victim_nonce")
+      end.to raise_error(ArgumentError, "payment_method_nonce contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/payment_method_spec.rb

@@ -144,4 +144,24 @@ describe Braintree::PaymentMethod do
       end.to_not raise_error
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.find("../customers/some_id/transaction_ids")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.update("../customers/some_id/transaction_ids", {})
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.delete("../customers/some_id/transaction_ids")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/paypal_account_spec.rb

@@ -50,4 +50,24 @@ describe Braintree::PayPalAccount do
       expect(paypal_account.edit_paypal_vault_id).to eq(mock_edit_paypal_vault_id)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.update("../payment_methods/credit_card/victim_token", {})
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.delete("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/plan_gateway_spec.rb

@@ -0,0 +1,30 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::PlanGateway do
+  let(:gateway) do
+    config = Braintree::Configuration.new(
+      :merchant_id => "merchant_id",
+      :public_key => "public_key",
+      :private_key => "private_key",
+    )
+    Braintree::Gateway.new(config)
+  end
+
+  describe "path traversal" do
+    it "find raises an exception if the id is a traversal segment" do
+      plan_gateway = Braintree::PlanGateway.new(gateway)
+
+      expect do
+        plan_gateway.find("../plans/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "update raises an exception if the plan_id is a traversal segment" do
+      plan_gateway = Braintree::PlanGateway.new(gateway)
+
+      expect do
+        plan_gateway.update("../plans/victim_id", {})
+      end.to raise_error(ArgumentError, "plan_id contains invalid characters")
+    end
+  end
+end

data/spec/unit/braintree/sepa_debit_account_spec.rb

@@ -83,4 +83,18 @@ describe Braintree::SepaDirectDebitAccount do
       it { is_expected.to be false }
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::SepaDirectDebitAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::SepaDirectDebitAccount.delete("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/subscription_spec.rb

@@ -77,4 +77,24 @@ describe Braintree::Subscription do
       expect(subscription).not_to eq("not a subscription")
     end
   end
+
+  describe "path traversal" do
+    it "self.cancel raises an exception if the subscription_id is a traversal segment" do
+      expect do
+        Braintree::Subscription.cancel("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "subscription_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::Subscription.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.update raises an exception if the subscription_id is a traversal segment" do
+      expect do
+        Braintree::Subscription.update("../transactions/some_id/void", {})
+      end.to raise_error(ArgumentError, "subscription_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/test_transaction_spec.rb

@@ -0,0 +1,18 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::TestTransaction do
+  describe "path traversal" do
+    [
+      :settle,
+      :settlement_confirm,
+      :settlement_decline,
+      :settlement_pending,
+    ].each do |method_name|
+      it "self.#{method_name} raises an exception if the transaction_id is a traversal segment" do
+        expect do
+          Braintree::TestTransaction.public_send(method_name, "../transactions/victim_id/void")
+        end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+      end
+    end
+  end
+end

data/spec/unit/braintree/transaction_gateway_spec.rb

@@ -200,5 +200,15 @@ describe Braintree::TransactionGateway do
     it "creates transaction gateway submit for partial settlement signature" do
        expect(Braintree::TransactionGateway._submit_for_partial_settlement_signature).to include(:final_capture)
     end
+
+    it "creates a transaction gateway refund signature" do
+      expect(Braintree::TransactionGateway._refund_signature).to match([
+        :amount,
+        :api_request_key,
+        :merchant_account_id,
+        :order_id,
+        :surcharge_amount,
+      ])
+    end
   end
 end

data/spec/unit/braintree/transaction_line_item_spec.rb

@@ -0,0 +1,11 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::TransactionLineItem do
+  describe "path traversal" do
+    it "self.find_all raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::TransactionLineItem.find_all("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+  end
+end