braintree 4.40.0 → 4.41.0

data/spec/unit/braintree/transaction_search_spec.rb

@@ -21,4 +21,29 @@ describe Braintree::TransactionSearch do
       search.billing_company "one"
     end.to raise_error(RuntimeError, "An operator is required")
   end
+
+  it "builds a hash for ach_type with a single value (same_day)" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.is Braintree::Transaction::AchType::SameDay
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::SameDay]})
+  end
+
+  it "builds a hash for ach_type with a single value (standard)" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.is Braintree::Transaction::AchType::Standard
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::Standard]})
+  end
+
+  it "builds a hash for ach_type with both values" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.in Braintree::Transaction::AchType::SameDay, Braintree::Transaction::AchType::Standard
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::SameDay, Braintree::Transaction::AchType::Standard]})
+  end
+
+  it "raises if ach_type is given a value outside the allow-list" do
+    search = Braintree::TransactionSearch.new
+    expect do
+      search.ach_type.is "invalid_ach_type"
+    end.to raise_error(ArgumentError, /Invalid argument\(s\) for ach_type: invalid_ach_type/)
+  end
 end

data/spec/unit/braintree/transaction_spec.rb

@@ -40,8 +40,8 @@ describe Braintree::Transaction do
   describe "self.submit_for_settlement" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.submit_for_settlement("invalid-transaction-id")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.submit_for_settlement("invalid/transaction/id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
 
     it "raises an ArgumentError if options hash includes an invalid key" do
@@ -54,16 +54,16 @@ describe Braintree::Transaction do
   describe "self.adjust_authorization" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.adjust_authorization("invalid-transaction-id", "10.00")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.adjust_authorization("invalid/transaction/id", "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
   end
 
   describe "self.update_details" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.update_details("invalid-transaction-id")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.update_details("invalid/transaction/id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
   end
 
@@ -604,4 +604,66 @@ describe Braintree::Transaction do
       expect(transaction.surcharge_amount).to be_nil
     end
   end
+
+  describe "path traversal" do
+    it "self.clone_transaction raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.clone_transaction("../customers/some_id", :amount => "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::Transaction.find("../customers/some_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.refund raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.refund("../customers/some_id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.void raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.void("../transactions/victim_id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.cancel_release raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.cancel_release("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.package_tracking raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.package_tracking("../transactions/victim_id/void", {})
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.submit_for_settlement raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.submit_for_settlement("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.adjust_authorization raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.adjust_authorization("../transactions/victim_id/void", "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.update_details raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.update_details("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.submit_for_partial_settlement raises an exception if the authorized_transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.submit_for_partial_settlement("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "authorized_transaction_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/us_bank_account_spec.rb

@@ -10,4 +10,12 @@ describe Braintree::UsBankAccount do
       expect(Braintree::UsBankAccount._new(:gateway, :default => false).default?).to eq(false)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::UsBankAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/us_bank_account_verification_spec.rb

@@ -95,4 +95,18 @@ describe Braintree::UsBankAccountVerification do
       expect(verification).not_to eq(same_id_different_object)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::UsBankAccountVerification.find("../verifications/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.confirm_micro_transfer_amounts raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::UsBankAccountVerification.confirm_micro_transfer_amounts("../verifications/victim_id", ["0.01", "0.02"])
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/util_spec.rb

@@ -417,4 +417,41 @@ describe Braintree::Util do
       expect(Braintree::Util.url_decode("foo%3Fbar")).to eq("foo?bar")
     end
   end
+
+  describe "self.invalid_path_segment?" do
+    [
+      "customer123",
+      "CUSTOMER_123",
+      "a-b_c-D9",
+      "1234567890",
+      "a",
+      123,
+    ].each do |valid_segment|
+      it "returns false for a valid segment #{valid_segment.inspect}" do
+        expect(Braintree::Util.invalid_path_segment?(valid_segment)).to eq(false)
+      end
+    end
+
+    [
+      "",
+      "   ",
+      ".",
+      "..",
+      "foo/bar",
+      "foo\\bar",
+      "foo%bar",
+      "..%2f..%2fvictim",
+      "%2e%2e",
+      "../../victim_customer/addresses/victim_address",
+      "abc.def",
+      "abc def",
+      nil,
+      {},
+      [],
+    ].each do |invalid_segment|
+      it "returns true for an invalid segment #{invalid_segment.inspect}" do
+        expect(Braintree::Util.invalid_path_segment?(invalid_segment)).to eq(true)
+      end
+    end
+  end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: braintree
 version: !ruby/object:Gem::Version
-  version: 4.40.0
+  version: 4.41.0
 platform: ruby
 authors:
 - Braintree
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-08-05 00:00:00.000000000 Z
+date: 2026-09-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: builder
@@ -356,6 +356,7 @@ files:
 - spec/unit/braintree/local_payment_context_spec.rb
 - spec/unit/braintree/local_payment_expired_spec.rb
 - spec/unit/braintree/local_payment_funded_spec.rb
+- spec/unit/braintree/merchant_account_spec.rb
 - spec/unit/braintree/meta_checkout_card_details_spec.rb
 - spec/unit/braintree/meta_checkout_card_spec.rb
 - spec/unit/braintree/meta_checkout_token_details_spec.rb
@@ -370,6 +371,7 @@ files:
 - spec/unit/braintree/payment_method_spec.rb
 - spec/unit/braintree/paypal_account_spec.rb
 - spec/unit/braintree/paypal_payment_resource_spec.rb
+- spec/unit/braintree/plan_gateway_spec.rb
 - spec/unit/braintree/resource_collection_spec.rb
 - spec/unit/braintree/risk_data/liability_shift.rb
 - spec/unit/braintree/risk_data_spec.rb
@@ -380,6 +382,7 @@ files:
 - spec/unit/braintree/subscription_search_spec.rb
 - spec/unit/braintree/subscription_spec.rb
 - spec/unit/braintree/successful_result_spec.rb
+- spec/unit/braintree/test_transaction_spec.rb
 - spec/unit/braintree/three_d_secure_info_spec.rb
 - spec/unit/braintree/transaction/apple_pay_details_spec.rb
 - spec/unit/braintree/transaction/credit_card_details_spec.rb
@@ -396,6 +399,7 @@ files:
 - spec/unit/braintree/transaction/visa_checkout_card_details_spec.rb
 - spec/unit/braintree/transaction_ach_mandate_spec.rb
 - spec/unit/braintree/transaction_gateway_spec.rb
+- spec/unit/braintree/transaction_line_item_spec.rb
 - spec/unit/braintree/transaction_search_spec.rb
 - spec/unit/braintree/transaction_spec.rb
 - spec/unit/braintree/unknown_payment_method_spec.rb
@@ -438,7 +442,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.15
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Braintree Ruby Server SDK