braintree 4.40.0 → 4.42.0

data/spec/unit/braintree/credit_card_spec.rb

@@ -23,7 +23,7 @@ describe Braintree::CreditCard do
         :venmo_sdk_payment_method_code, # NEXT_MAJOR_VERSION Remove this attribute
         :device_data,
         :payment_method_nonce,
-        {:external_vault=>[:network_transaction_id]},
+        {:external_vault=>[:network_transaction_id, :mastercard_transaction_link_id]},
         {:options => match_array([:make_default, :skip_advanced_fraud_checking, :verification_merchant_account_id, :verify_card, :verification_amount, :venmo_sdk_session, # NEXT_MAJOR_VERSION Remove this attribute
           :account_information_inquiry, :fail_on_duplicate_payment_method, :fail_on_duplicate_payment_method_for_customer, :verification_account_type, :verification_currency_iso_code])},
         {:billing_address => [
@@ -72,7 +72,7 @@ describe Braintree::CreditCard do
         :venmo_sdk_payment_method_code, # NEXT_MAJOR_VERSION Remove this attribute
         :device_data,
         :payment_method_nonce,
-        {:external_vault=>[:network_transaction_id]},
+        {:external_vault=>[:network_transaction_id, :mastercard_transaction_link_id]},
         {:options => match_array([:make_default, :skip_advanced_fraud_checking, :verification_merchant_account_id, :verify_card, :verification_amount, :venmo_sdk_session, # NEXT_MAJOR_VERSION Remove this attribute
           :account_information_inquiry, :fail_on_duplicate_payment_method, :fail_on_duplicate_payment_method_for_customer, :verification_account_type, :verification_currency_iso_code])},
         {:billing_address => [
@@ -293,4 +293,30 @@ describe Braintree::CreditCard do
     card = Braintree::CreditCard._new(:gateway, {:purchase => "No"})
     expect(card.purchase).to eq("No")
   end
+
+  describe "path traversal" do
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.delete("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.find("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.from_nonce raises an exception if the nonce is a traversal segment" do
+      expect do
+        Braintree::CreditCard.from_nonce("../payment_methods/paypal_account/victim_token")
+      end.to raise_error(ArgumentError, "nonce contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::CreditCard.update("../payment_methods/paypal_account/victim_token", :cvv => "123")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/credit_card_verification_gateway_spec.rb

@@ -31,6 +31,7 @@ describe Braintree::CreditCardVerificationGateway do
       expect(result.inspect).to include("number")
       expect(result.inspect).to include("external_vault")
       expect(result.inspect).to include("previous_network_transaction_id")
+      expect(result.inspect).to include("previous_mastercard_transaction_link_id")
       expect(result.inspect).to include("status")
       expect(result.inspect).to include("intended_transaction_source")
       expect(result.inspect).to include("options")

data/spec/unit/braintree/credit_card_verification_spec.rb

@@ -183,4 +183,12 @@ describe Braintree::CreditCardVerification do
       expect(verification.credit_card[:payment_account_reference]).to eq("V0010013019339005665779448477")
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::CreditCardVerification.find("../verifications/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/customer_spec.rb

@@ -136,7 +136,7 @@ describe Braintree::Customer do
           :venmo_sdk_payment_method_code, # NEXT_MAJOR_VERSION Remove this attribute
           :device_data,
           :payment_method_nonce,
-          {:external_vault=>[:network_transaction_id]},
+          {:external_vault=>[:network_transaction_id, :mastercard_transaction_link_id]},
           {:options => match_array([:make_default, :skip_advanced_fraud_checking, :verification_merchant_account_id, :verify_card, :verification_amount, :venmo_sdk_session, # NEXT_MAJOR_VERSION Remove this attribute
             :account_information_inquiry, :fail_on_duplicate_payment_method, :verification_account_type, :verification_currency_iso_code])},
           {:billing_address => [
@@ -267,7 +267,7 @@ describe Braintree::Customer do
           :venmo_sdk_payment_method_code, # NEXT_MAJOR_VERSION Remove this attribute
           :device_data,
           :payment_method_nonce,
-          {:external_vault=>[:network_transaction_id]},
+          {:external_vault=>[:network_transaction_id, :mastercard_transaction_link_id]},
           {:options => match_array([
             :account_information_inquiry,
             :make_default,
@@ -415,4 +415,30 @@ describe Braintree::Customer do
       end.to raise_error(NoMethodError, /protected method .new/)
     end
   end
+
+  describe "path traversal" do
+    it "self.delete raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.delete("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.update raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.update("../transactions/some_id/void", :first_name => "HackerOne")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+
+    it "self.transactions raises an exception if the customer_id is a traversal segment" do
+      expect do
+        Braintree::Customer.transactions("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "customer_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/http_spec.rb

@@ -183,6 +183,50 @@ END
     end
   end
 
+  describe "#delete" do
+    it "appends the query string to the path when query_params are present" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Delete, "/customers?id=123").and_return(response)
+
+      http.delete("/customers", :id => 123)
+    end
+
+    it "does not append a query string when query_params are empty" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Delete, "/customers").and_return(response)
+
+      http.delete("/customers")
+    end
+  end
+
+  describe "#get" do
+    it "appends the query string to the path when query_params are present" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+      allow(http).to receive(:_body).with(response).and_return("")
+      allow(Braintree::Xml).to receive(:hash_from_xml).with("").and_return({})
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Get, "/customers?id=123").and_return(response)
+
+      http.get("/customers", :id => 123)
+    end
+
+    it "does not append a query string when query_params are empty" do
+      http = Braintree::Http.new(Braintree::Configuration.new)
+      response = double("response", :code => "200")
+      allow(http).to receive(:_body).with(response).and_return("")
+      allow(Braintree::Xml).to receive(:hash_from_xml).with("").and_return({})
+
+      expect(http).to receive(:_http_do).with(Net::HTTP::Get, "/customers").and_return(response)
+
+      http.get("/customers")
+    end
+  end
+
   describe "_build_query_string" do
     it "returns an empty string for empty query params" do
       expect(Braintree::Http.new(:config)._build_query_string({})).to eq("")

data/spec/unit/braintree/merchant_account_spec.rb

@@ -0,0 +1,11 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::MerchantAccount do
+  describe "path traversal" do
+    it "self.find raises an exception if the merchant_account_id is a traversal segment" do
+      expect do
+        Braintree::MerchantAccount.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "merchant_account_id contains invalid characters")
+    end
+  end
+end

data/spec/unit/braintree/package_tracking_spec.rb

@@ -24,8 +24,8 @@ describe "Package Tracking Unit Tests" do
 
           it "raises an ArgumentError if transaction_id is an invalid format" do
             expect do
-              Braintree::Transaction.package_tracking("invalid-transaction-id", {})
-            end.to raise_error(ArgumentError, "transaction_id is invalid")
+              Braintree::Transaction.package_tracking("invalid/transaction/id", {})
+            end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
           end
 
           it "raises an exception if attributes contain an invalid key" do

data/spec/unit/braintree/payment_method_nonce_spec.rb

@@ -47,4 +47,18 @@ describe Braintree::PaymentMethodNonce do
       expect(payment_method_nonce.default?).to be true
     end
   end
+
+  describe "path traversal" do
+    it "self.create raises an exception if the payment_method_token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethodNonce.create("../payment_method_nonces/victim_nonce")
+      end.to raise_error(ArgumentError, "payment_method_token contains invalid characters")
+    end
+
+    it "self.find raises an exception if the payment_method_nonce is a traversal segment" do
+      expect do
+        Braintree::PaymentMethodNonce.find("../payment_method_nonces/victim_nonce")
+      end.to raise_error(ArgumentError, "payment_method_nonce contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/payment_method_spec.rb

@@ -144,4 +144,24 @@ describe Braintree::PaymentMethod do
       end.to_not raise_error
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.find("../customers/some_id/transaction_ids")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.update("../customers/some_id/transaction_ids", {})
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PaymentMethod.delete("../customers/some_id/transaction_ids")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/paypal_account_spec.rb

@@ -50,4 +50,24 @@ describe Braintree::PayPalAccount do
       expect(paypal_account.edit_paypal_vault_id).to eq(mock_edit_paypal_vault_id)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.update raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.update("../payment_methods/credit_card/victim_token", {})
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::PayPalAccount.delete("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/plan_gateway_spec.rb

@@ -0,0 +1,30 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::PlanGateway do
+  let(:gateway) do
+    config = Braintree::Configuration.new(
+      :merchant_id => "merchant_id",
+      :public_key => "public_key",
+      :private_key => "private_key",
+    )
+    Braintree::Gateway.new(config)
+  end
+
+  describe "path traversal" do
+    it "find raises an exception if the id is a traversal segment" do
+      plan_gateway = Braintree::PlanGateway.new(gateway)
+
+      expect do
+        plan_gateway.find("../plans/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "update raises an exception if the plan_id is a traversal segment" do
+      plan_gateway = Braintree::PlanGateway.new(gateway)
+
+      expect do
+        plan_gateway.update("../plans/victim_id", {})
+      end.to raise_error(ArgumentError, "plan_id contains invalid characters")
+    end
+  end
+end

data/spec/unit/braintree/sepa_debit_account_spec.rb

@@ -83,4 +83,18 @@ describe Braintree::SepaDirectDebitAccount do
       it { is_expected.to be false }
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::SepaDirectDebitAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+
+    it "self.delete raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::SepaDirectDebitAccount.delete("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/subscription_spec.rb

@@ -77,4 +77,24 @@ describe Braintree::Subscription do
       expect(subscription).not_to eq("not a subscription")
     end
   end
+
+  describe "path traversal" do
+    it "self.cancel raises an exception if the subscription_id is a traversal segment" do
+      expect do
+        Braintree::Subscription.cancel("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "subscription_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::Subscription.find("../transactions/some_id/void")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.update raises an exception if the subscription_id is a traversal segment" do
+      expect do
+        Braintree::Subscription.update("../transactions/some_id/void", {})
+      end.to raise_error(ArgumentError, "subscription_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/test_transaction_spec.rb

@@ -0,0 +1,18 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::TestTransaction do
+  describe "path traversal" do
+    [
+      :settle,
+      :settlement_confirm,
+      :settlement_decline,
+      :settlement_pending,
+    ].each do |method_name|
+      it "self.#{method_name} raises an exception if the transaction_id is a traversal segment" do
+        expect do
+          Braintree::TestTransaction.public_send(method_name, "../transactions/victim_id/void")
+        end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+      end
+    end
+  end
+end

data/spec/unit/braintree/transaction_gateway_spec.rb

@@ -53,6 +53,7 @@ describe Braintree::TransactionGateway do
         {:external_vault => [
           :status,
           :previous_network_transaction_id,
+          :previous_mastercard_transaction_link_id,
         ]},
         {:google_pay_card => [:number, :cryptogram, :google_transaction_id, :expiration_month, :expiration_year, :source_card_type, :source_card_last_four, :eci_indicator]},
         {:industry => [
@@ -200,5 +201,28 @@ describe Braintree::TransactionGateway do
     it "creates transaction gateway submit for partial settlement signature" do
        expect(Braintree::TransactionGateway._submit_for_partial_settlement_signature).to include(:final_capture)
     end
+
+    it "creates a transaction gateway refund signature" do
+      expect(Braintree::TransactionGateway._refund_signature).to match([
+        :amount,
+        :api_request_key,
+        :merchant_account_id,
+        :order_id,
+        :surcharge_amount,
+      ])
+    end
+
+    it "creates a transaction gateway reverse signature" do
+      expect(Braintree::TransactionGateway._reverse_signature).to match([
+        :api_request_key,
+      ])
+    end
+
+    it "rejects invalid transaction IDs when reversing" do
+      transaction = Braintree::TransactionGateway.new(gateway)
+
+      expect { transaction.reverse("../transactions/victim") }
+        .to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
   end
 end

data/spec/unit/braintree/transaction_line_item_spec.rb

@@ -0,0 +1,11 @@
+require File.expand_path(File.dirname(__FILE__) + "/../spec_helper")
+
+describe Braintree::TransactionLineItem do
+  describe "path traversal" do
+    it "self.find_all raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::TransactionLineItem.find_all("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+  end
+end

data/spec/unit/braintree/transaction_search_spec.rb

@@ -21,4 +21,29 @@ describe Braintree::TransactionSearch do
       search.billing_company "one"
     end.to raise_error(RuntimeError, "An operator is required")
   end
+
+  it "builds a hash for ach_type with a single value (same_day)" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.is Braintree::Transaction::AchType::SameDay
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::SameDay]})
+  end
+
+  it "builds a hash for ach_type with a single value (standard)" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.is Braintree::Transaction::AchType::Standard
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::Standard]})
+  end
+
+  it "builds a hash for ach_type with both values" do
+    search = Braintree::TransactionSearch.new
+    search.ach_type.in Braintree::Transaction::AchType::SameDay, Braintree::Transaction::AchType::Standard
+    expect(search.to_hash).to eq({:ach_type => [Braintree::Transaction::AchType::SameDay, Braintree::Transaction::AchType::Standard]})
+  end
+
+  it "raises if ach_type is given a value outside the allow-list" do
+    search = Braintree::TransactionSearch.new
+    expect do
+      search.ach_type.is "invalid_ach_type"
+    end.to raise_error(ArgumentError, /Invalid argument\(s\) for ach_type: invalid_ach_type/)
+  end
 end

data/spec/unit/braintree/transaction_spec.rb

@@ -40,8 +40,8 @@ describe Braintree::Transaction do
   describe "self.submit_for_settlement" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.submit_for_settlement("invalid-transaction-id")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.submit_for_settlement("invalid/transaction/id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
 
     it "raises an ArgumentError if options hash includes an invalid key" do
@@ -54,16 +54,16 @@ describe Braintree::Transaction do
   describe "self.adjust_authorization" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.adjust_authorization("invalid-transaction-id", "10.00")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.adjust_authorization("invalid/transaction/id", "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
   end
 
   describe "self.update_details" do
     it "raises an ArgumentError if transaction_id is an invalid format" do
       expect do
-        Braintree::Transaction.update_details("invalid-transaction-id")
-      end.to raise_error(ArgumentError, "transaction_id is invalid")
+        Braintree::Transaction.update_details("invalid/transaction/id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
     end
   end
 
@@ -604,4 +604,66 @@ describe Braintree::Transaction do
       expect(transaction.surcharge_amount).to be_nil
     end
   end
+
+  describe "path traversal" do
+    it "self.clone_transaction raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.clone_transaction("../customers/some_id", :amount => "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::Transaction.find("../customers/some_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.refund raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.refund("../customers/some_id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.void raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.void("../transactions/victim_id")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.cancel_release raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.cancel_release("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.package_tracking raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.package_tracking("../transactions/victim_id/void", {})
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.submit_for_settlement raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.submit_for_settlement("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.adjust_authorization raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.adjust_authorization("../transactions/victim_id/void", "10.00")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.update_details raises an exception if the transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.update_details("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "transaction_id contains invalid characters")
+    end
+
+    it "self.submit_for_partial_settlement raises an exception if the authorized_transaction_id is a traversal segment" do
+      expect do
+        Braintree::Transaction.submit_for_partial_settlement("../transactions/victim_id/void")
+      end.to raise_error(ArgumentError, "authorized_transaction_id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/us_bank_account_spec.rb

@@ -10,4 +10,12 @@ describe Braintree::UsBankAccount do
       expect(Braintree::UsBankAccount._new(:gateway, :default => false).default?).to eq(false)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the token is a traversal segment" do
+      expect do
+        Braintree::UsBankAccount.find("../payment_methods/credit_card/victim_token")
+      end.to raise_error(ArgumentError, "token contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/us_bank_account_verification_spec.rb

@@ -95,4 +95,18 @@ describe Braintree::UsBankAccountVerification do
       expect(verification).not_to eq(same_id_different_object)
     end
   end
+
+  describe "path traversal" do
+    it "self.find raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::UsBankAccountVerification.find("../verifications/victim_id")
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+
+    it "self.confirm_micro_transfer_amounts raises an exception if the id is a traversal segment" do
+      expect do
+        Braintree::UsBankAccountVerification.confirm_micro_transfer_amounts("../verifications/victim_id", ["0.01", "0.02"])
+      end.to raise_error(ArgumentError, "id contains invalid characters")
+    end
+  end
 end

data/spec/unit/braintree/util_spec.rb

@@ -417,4 +417,41 @@ describe Braintree::Util do
       expect(Braintree::Util.url_decode("foo%3Fbar")).to eq("foo?bar")
     end
   end
+
+  describe "self.invalid_path_segment?" do
+    [
+      "customer123",
+      "CUSTOMER_123",
+      "a-b_c-D9",
+      "1234567890",
+      "a",
+      123,
+    ].each do |valid_segment|
+      it "returns false for a valid segment #{valid_segment.inspect}" do
+        expect(Braintree::Util.invalid_path_segment?(valid_segment)).to eq(false)
+      end
+    end
+
+    [
+      "",
+      "   ",
+      ".",
+      "..",
+      "foo/bar",
+      "foo\\bar",
+      "foo%bar",
+      "..%2f..%2fvictim",
+      "%2e%2e",
+      "../../victim_customer/addresses/victim_address",
+      "abc.def",
+      "abc def",
+      nil,
+      {},
+      [],
+    ].each do |invalid_segment|
+      it "returns true for an invalid segment #{invalid_segment.inspect}" do
+        expect(Braintree::Util.invalid_path_segment?(invalid_segment)).to eq(true)
+      end
+    end
+  end
 end