braintree 2.13.3 → 2.13.4

data/lib/braintree/transparent_redirect_gateway.rb

@@ -40,7 +40,8 @@ module Braintree
     def parse_and_validate_query_string(query_string) # :nodoc:
       params = Util.symbolize_keys(Util.parse_query_string(query_string))
       query_string_without_hash = query_string.split("&").reject{|param| param =~ /\Ahash=/}.join("&")
-      query_string_without_hash = Util.url_decode(query_string_without_hash)
+      decoded_query_string_without_hash = Util.url_decode(query_string_without_hash)
+      encoded_query_string_without_hash = Util.url_encode(query_string_without_hash)
 
       if params[:http_status] == nil
         raise UnexpectedError, "expected query string to have an http_status param"
@@ -48,7 +49,9 @@ module Braintree
         Util.raise_exception_for_status_code(params[:http_status], params[:bt_message])
       end
 
-      if _hash(query_string_without_hash) == params[:hash]
+      query_strings_without_hash = [query_string_without_hash, encoded_query_string_without_hash, decoded_query_string_without_hash]
+
+      if query_strings_without_hash.any? { |query_string| _hash(query_string) == params[:hash] }
         params
       else
         raise ForgedQueryString

data/lib/braintree/version.rb

@@ -2,7 +2,7 @@ module Braintree
   module Version
     Major = 2
     Minor = 13
-    Tiny = 3
+    Tiny = 4
 
     String = "#{Major}.#{Minor}.#{Tiny}"
   end

data/spec/unit/braintree/transparent_redirect_spec.rb

@@ -65,8 +65,8 @@ describe Braintree::TransparentRedirect do
       end.to raise_error(Braintree::ForgedQueryString)
     end
 
-    it "does not raise ForgedQueryString if any parameter is url encoded" do
-      url_encoded_query_string_without_hash = "http_status=200&nested_param%5Bsub_param%5D=testing"
+    it "does not raise Braintree::ForgedQueryString if query string is url encoded" do
+      url_encoded_query_string_without_hash = "http_status%3D200%26nested_param%5Bsub_param%5D%3Dtesting"
       url_decoded_query_string_without_hash = Braintree::Util.url_decode(url_encoded_query_string_without_hash)
 
       hash = Braintree::Digest.hexdigest(Braintree::Configuration.private_key, url_decoded_query_string_without_hash)
@@ -78,6 +78,31 @@ describe Braintree::TransparentRedirect do
       end.to_not raise_error(Braintree::ForgedQueryString)
     end
 
+    it "does not raise Braintree::ForgedQueryString if query string is url decoded" do
+      url_decoded_query_string_without_hash = "http_status=200&nested_param[sub_param]=testing"
+      url_encoded_query_string_without_hash = Braintree::Util.url_encode(url_decoded_query_string_without_hash)
+
+      hash = Braintree::Digest.hexdigest(Braintree::Configuration.private_key, url_encoded_query_string_without_hash)
+
+      url_decoded_query_string = "#{url_decoded_query_string_without_hash}&hash=#{hash}"
+
+      expect do
+        Braintree::Configuration.gateway.transparent_redirect.parse_and_validate_query_string url_decoded_query_string
+      end.to_not raise_error(Braintree::ForgedQueryString)
+    end
+
+    it "does not raise Braintree::ForgedQueryString if the query string is partially encoded" do
+      url_partially_encoded_query_string_without_hash = "http_status=200&nested_param%5Bsub_param%5D=testing"
+
+      hash = Braintree::Digest.hexdigest(Braintree::Configuration.private_key, url_partially_encoded_query_string_without_hash)
+
+      url_partially_encoded_query_string = "#{url_partially_encoded_query_string_without_hash}&hash=#{hash}"
+
+      expect do
+        Braintree::Configuration.gateway.transparent_redirect.parse_and_validate_query_string url_partially_encoded_query_string
+      end.to_not raise_error(Braintree::ForgedQueryString)
+    end
+
     it "raises an AuthenticationError if authentication fails" do
       expect do
         Braintree::Configuration.gateway.transparent_redirect.parse_and_validate_query_string add_hash_to_query_string("http_status=401")

data/spec/unit/braintree/util_spec.rb

@@ -259,7 +259,7 @@ describe Braintree::Util do
   end
 
   describe "self.url_decode" do
-    it "url encodes the given text" do
+    it "url decodes the given text" do
       Braintree::Util.url_decode("foo%3Fbar").should == "foo?bar"
     end
   end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification 
 name: braintree
 version: !ruby/object:Gem::Version 
-  hash: 61
+  hash: 51
   prerelease: 
   segments: 
   - 2
   - 13
-  - 3
-  version: 2.13.3
+  - 4
+  version: 2.13.4
 platform: ruby
 authors: 
 - Braintree
@@ -15,7 +15,7 @@ autorequire:
 bindir: bin
 cert_chain: []
 
-date: 2012-02-01 00:00:00 -06:00
+date: 2012-02-07 00:00:00 -06:00
 default_executable: 
 dependencies: 
 - !ruby/object:Gem::Dependency 
@@ -185,7 +185,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 
 rubyforge_project: braintree
-rubygems_version: 1.6.2
+rubygems_version: 1.4.2
 signing_key: 
 specification_version: 3
 summary: Braintree Gateway Ruby Client Library