cybersource_rest_client 0.0.84 → 0.0.86

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bb5d050b359e9fefb56a6f04e11510cc45f1c1b6f033a621495b4f82ff2d8a64
-  data.tar.gz: b8e37d57a3d3ec9a63ce79cb5115df8c41bedaeef333d774673f4ae07aafecc4
+  metadata.gz: 9af058d680a440a0a1a370445b76946f5bb4403e321269c582e107a349a2ea68
+  data.tar.gz: 79825e1641bae4050d5138918a52d73fc38ad34232d9f0059dd734e12933f72c
 SHA512:
-  metadata.gz: f712d7cca99ab978f9115b6dea2849c27c65ed3d899d5614d5687426f8d6b90d5b123f12647e7e3356f09028264f6a2a25f5a0dbeb3992af776533448f754836
-  data.tar.gz: bf26f45d42ad16decfe75998c29b338e0a111d36290064a2ac625f14627c47927e8828ca32e991bd067b07fdf5f21740f03278948f202f5192a569068321ea4e
+  metadata.gz: '0980f14806cda11beaf1a7f5a9188285e3205aa348b9327b3ec51019358b99189730cab2675138e27385bcb8b7403dfa4bb6bd75c6fa134ca087771dbf084c8a'
+  data.tar.gz: 36453fb8c747e84c722787acf1998bd727cd39e720aa1584e68748c7dae2e8cefb3864505ffeabd8e010ae2c7f8b27879adf45aabc138314d5d72299560d81c7

data/lib/AuthenticationSDK/core/MerchantConfig.rb

@@ -590,19 +590,20 @@ public
 
     def logAllProperties(merchantPropertyObj)
       propertyObj = Marshal.load(Marshal.dump(merchantPropertyObj))
-      merchantConfig = ''
-      hiddenProperties = (Constants::HIDDEN_MERCHANT_PROPERTIES).split(',')
-      hiddenPropArray = Array.new
-      hiddenProperties.each do |value|
-        hiddenPropArray << value.strip
-      end
-      hiddenPropArray.each do |prop|
-        propertyObj.each do |key, value|
-          if key == prop
-            propertyObj.delete(key)
+      hiddenProperties = Constants::HIDDEN_MERCHANT_PROPERTIES.split(',').map(&:strip)
+      hiddenPropertiesLower = hiddenProperties.map(&:downcase)
+      sensitivePatterns = Constants::SENSITIVE_PROPERTY_PATTERNS
+
+      if propertyObj.respond_to?(:each_pair)
+        propertyObj.each_key do |key|
+          keyStr = key.to_s
+          keyLower = keyStr.downcase
+          if hiddenPropertiesLower.include?(keyLower) || sensitivePatterns.any? { |p| keyLower.include?(p) }
+            propertyObj[key] = Constants::REDACTED_VALUE
           end
         end
       end
+
       @log_obj.logger.info('Merchant Configuration :\n' + propertyObj.to_s)
     end
 

data/lib/AuthenticationSDK/logging/sensitive_logging.rb

@@ -1,118 +1,290 @@
 require 'logger'
 require 'json'
 
-class SensitiveTag
-    attr_accessor :tagName, :pattern, :replacement, :disableMask
-    def initialize(tagName, pattern, replacement, disableMask)
-        @tagName = tagName
-        @pattern = pattern
-        @replacement = replacement
-        @disableMask = disableMask
+class SensitiveDataFilter < Logger::Formatter
+    SENSITIVE_KEYS = %w[
+        securitycode number cardnumber expirationmonth expirationyear expiration
+        expirationdate account routingnumber email firstname lastname phonenumber
+        type token signature prefix suffix bin pan encryptedrequest encryptedresponse
+        password secret apikey accesstoken refreshtoken ssn creditcard debitcard cvv pin
+        cardholder nameoncard holdername track1 track2 trackdata
+        iban swift bic dateofbirth birthdate taxid
+        privatekey publickey authorization bearer
+        cavv xid pares micr jwt jwe
+        paymentinformation paymentinstrument card billto shipto
+        customer driverlicense
+    ].freeze
+
+    REDACTED_PAYLOAD = '[REDACTED]'.freeze
+    REDACTED_VALUE = ('X' * 10).freeze
+
+    def json_object?(str)
+        parsed = JSON.parse(str)
+        parsed.is_a?(Hash)
+    rescue JSON::ParserError, TypeError
+        false
     end
-end
 
-class SensitiveDataConfigType
-    attr_accessor :sensitiveTags, :sensitiveStringRegexes
-
-    def initialize
-    @sensitiveTags = Array.new([
-            SensitiveTag.new("securityCode", "[0-9]{3,4}", "XXX", false),
-            SensitiveTag.new("number", "(\\s*\\p{N}\\s*)+(\\p{N}{4})(\\s*)", "XXXX-\\2", false),
-            SensitiveTag.new("cardNumber", "(\\s*\\p{N}\\s*)+(\\p{N}{4})(\\s*)", "XXXX-\\2", false),
-            SensitiveTag.new("expirationMonth", "[0-1][0-9]", "XXXX", false),
-            SensitiveTag.new("expirationYear", "2[0-9][0-9][0-9]", "XXXX", false),
-            SensitiveTag.new("account", "(\\s*\\p{N}\\s*)+(\\p{N}{4})(\\s*)", "XXXX-\\2", false),
-            SensitiveTag.new("routingNumber", "[0-9]+", "XXXXX", false),
-            SensitiveTag.new("email", "[a-z0-9!#$%&'*+\/=?^_`{|}~-]+(?:.[a-z0-9!#$%&'*+\/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?", "XXXXX", false),
-            SensitiveTag.new("firstName", "([a-zA-Z]+( )?[a-zA-Z]*'?-?[a-zA-Z]*( )?([a-zA-Z]*)?)", "xxxxx", false),
-            SensitiveTag.new("lastName", "([a-zA-Z]+( )?[a-zA-Z]*'?-?[a-zA-Z]*( )?([a-zA-Z]*)?)", "xxxxx", false),
-            SensitiveTag.new("phoneNumber", "(\\+[0-9]{1,2} )?\\(?[0-9]{3}\\)?[ .-]?[0-9]{3}[ .-]?[0-9]{4}", "xxxxx", false),
-            SensitiveTag.new("type", "[-A-Za-z0-9 ]+", "xxxxx", false),
-            SensitiveTag.new("token", "[-.A-Za-z0-9 ]+", "xxxxx", false),
-            SensitiveTag.new("signature", "[-.A-Za-z0-9 ]+", "xxxxx", false),
-            SensitiveTag.new("prefix", "(\\p{N}{6})(\\p{N}*)", "\\2-XXXXX", false),
-            SensitiveTag.new("prefix", "(\\s*)(\\p{N}{4})(\\s*)(\\p{N}{2})(\\s*\\p{N}*\\s*)", "\\2-XXXX", false),
-            SensitiveTag.new("bin", "(\\s*)(\\p{N}{4})(\\s*)(\\p{N}{2})(\\s*\\p{N}*\\s*)", "\\2-XXXX", false)
-        ]).freeze
-
-    @sensitiveStringRegexes = [
-            "4\\p{N}{3}([\\ \\-]?)\\p{N}{4}\\1\\p{N}{4}\\1\\p{N}{4}",
-            "4\\p{N}{3}([\\ \\-]?)(?:\\p{N}{4}\\1){2}\\p{N}(?:\\p{N}{3})?",
-            "5[1-5]\\p{N}{2}([\\ \\-]?)\\p{N}{4}\\1\\p{N}{4}\\1\\p{N}{4}",
-            "6(?:011|22(?:1(?=[\\ \\-]?(?:2[6-9]|[3-9]))|[2-8]|9(?=[\\ \\-]?(?:[01]|2[0-5])))|4[4-9]\\p{N}|5\\p{N}\\p{N})([\\ \\-]?)\\p{N}{4}\\1\\p{N}{4}\\1\\p{N}{4}",
-            "35(?:2[89]|[3-8]\\p{N})([\\ \\-]?)\\p{N}{4}\\1\\p{N}{4}\\1\\p{N}{4}",
-            "3[47]\\p{N}\\p{N}([\\ \\-]?)\\p{N}{6}\\1\\p{N}{5}"
-        ].freeze
+    def maskSensitiveDataInJson(input)
+        str = input.to_s
+        parsed =
+            begin
+                JSON.parse(str)
+            rescue JSON::ParserError
+                # Fall back to Ruby Hash#inspect syntax (e.g. interpolated
+                # "#{hash}" in a log string produces {"k"=>"v"} or {:k=>"v"}).
+                # Convert heuristically to JSON without eval, then retry.
+                converted = rubyInspectToJson(str)
+                converted.nil? ? (raise) : JSON.parse(converted)
+            end
+        unless parsed.is_a?(Hash) || parsed.is_a?(Array)
+            return REDACTED_PAYLOAD
+        end
+        masked_data = maskJsonObject(parsed)
+        JSON.generate(masked_data)
+    rescue JSON::ParserError, TypeError, EncodingError
+        REDACTED_PAYLOAD
     end
-end
 
-class SensitiveDataFilter < Logger::Formatter
-    @@sensitiveTagConfig = nil
-    @@tagPatterns = nil
-    @@tagReplacements = nil
-    @@cardPatterns = nil
-
-    def initialize
-        @@sensitiveTagConfig = SensitiveDataConfigType.new
-        @@cardPatterns       = @@sensitiveTagConfig.sensitiveStringRegexes
-        @@tagPatterns        = Array.new(@@sensitiveTagConfig.sensitiveStringRegexes.length)
-        @@tagReplacements    = Array.new(@@sensitiveTagConfig.sensitiveTags.length)
-
-        @@sensitiveTagConfig.sensitiveTags.each_with_index do |sensitiveTag, index|
-            tagName = sensitiveTag.tagName
-            replacement = sensitiveTag.replacement
-
-            if sensitiveTag.pattern.nil? || sensitiveTag.pattern.empty?
-                pattern = "(.*)"
-            else
-            pattern = sensitiveTag.pattern
+    # Best-effort, eval-free conversion of Ruby Hash/Array#inspect output to
+    # JSON. Returns nil if the input cannot plausibly be Ruby inspect syntax
+    # (so the caller can fail closed). Handles:
+    #   :symbol => "v"     -> "symbol": "v"   (legacy inspect)
+    #   "k" => "v"         -> "k": "v"        (string-key inspect)
+    #   { bareword: "v" }  -> { "bareword": "v" }  (Ruby 3.4+ shorthand)
+    #   bare nil tokens    -> null
+    # Does NOT attempt to handle every Ruby literal (Procs, Time, custom
+    # #inspect, etc.); anything unrecognized will cause JSON.parse to fail
+    # downstream and the span will be redacted.
+    def rubyInspectToJson(str)
+        out = +''
+        i = 0
+        len = str.length
+        in_string = false
+        escape = false
+
+        while i < len
+            ch = str[i]
+            if in_string
+                out << ch
+                if escape
+                    escape = false
+                elsif ch == '\\'
+                    escape = true
+                elsif ch == '"'
+                    in_string = false
+                end
+                i += 1
+                next
             end
 
-            @@tagPatterns[index] = "\""+tagName+"\":\""+pattern+"\""
-            @@tagReplacements[index] = "\""+tagName+"\":\""+replacement+"\""
+            if ch == '"'
+                in_string = true
+                out << ch
+                i += 1
+                next
+            end
+
+            # :symbol_key (legacy inspect): preceded by { , [ or whitespace
+            if ch == ':' && i + 1 < len && str[i + 1] =~ /[A-Za-z_]/ &&
+               (out.empty? || out[-1] =~ /[\{\[,\s]/)
+                j = i + 1
+                j += 1 while j < len && str[j] =~ /[A-Za-z0-9_]/
+                sym = str[(i + 1)...j]
+                out << '"' << sym << '"'
+                i = j
+                next
+            end
+
+            # bareword: shorthand (Ruby 3.4+ inspect): preceded by { , or
+            # whitespace; followed by ':' then whitespace (so we don't
+            # confuse with the '::' constant-resolution operator).
+            if ch =~ /[A-Za-z_]/ &&
+               (out.empty? || out[-1] =~ /[\{\[,\s]/)
+                j = i
+                j += 1 while j < len && str[j] =~ /[A-Za-z0-9_]/
+                if j < len && str[j] == ':' && str[j + 1] != ':' &&
+                   (j + 1 >= len || str[j + 1] =~ /\s/)
+                    word = str[i...j]
+                    out << '"' << word << '":'
+                    i = j + 1
+                    next
+                end
+            end
+
+            # => operator
+            if ch == '=' && str[i + 1] == '>'
+                out << ':'
+                i += 2
+                next
+            end
+
+            # bare nil -> null
+            if ch == 'n' && str[i, 3] == 'nil' &&
+               (i.zero? || str[i - 1] =~ /[\s,\{\[:]/) &&
+               (i + 3 >= len || str[i + 3] =~ /[\s,\}\]]/)
+                out << 'null'
+                i += 3
+                next
+            end
+
+            out << ch
+            i += 1
         end
+
+        out
     end
 
-    def maskSensitiveDataInJson(input)
-        parts = input.split(":", 2)
-        json_data = JSON.parse(parts[1].strip)
-        encrypted_request = json_data["encryptedRequest"]
-        json_data["encryptedRequest"] = 'X' * encrypted_request.length
-        return parts[0] + ":" + JSON.generate(json_data)
+    def maskJsonObject(obj)
+        case obj
+        when Hash
+            obj.each_with_object({}) do |(key, value), result|
+                result[key] = if isSensitiveKey?(key)
+                              maskSensitiveValue(value)
+                            else
+                              maskJsonObject(value)
+                            end
+            end
+        when Array
+            obj.map { |item| maskJsonObject(item) }
+        else
+            obj
+        end
     end
 
-    def call(severity, time, progname, msg)
-        maskedMessage = maskSensitiveString(msg)
-        ccMasked = maskCreditCards(maskedMessage)
-        if ccMasked.include?("encryptedRequest")
-            mleMasked = maskSensitiveDataInJson(ccMasked)
-            return formatLogEntry(severity, time, progname, mleMasked)
+    def isSensitiveKey?(key)
+        normalized = key.to_s.downcase.gsub(/[^a-z0-9]/, '')
+        SENSITIVE_KEYS.any? { |sensitive| normalized.include?(sensitive) }
+    end
+
+    # When a sensitive key wraps a value, redact scalars directly. For nested
+    # Hash/Array containers, recurse via maskJsonObject so individual inner
+    # values are masked based on their own key names rather than blanket-
+    # redacting the entire container.
+    def maskSensitiveValue(value)
+        case value
+        when Hash, Array
+            maskJsonObject(value)
+        when String
+            REDACTED_VALUE
+        when Integer, Float
+            9_999
+        when TrueClass, FalseClass
+            false
         else
-            return formatLogEntry(severity, time, progname, ccMasked)
+            value
         end
     end
 
-    def maskCreditCards(input)
-        encoded_input = input #.force_encoding("UTF-8")
-        @@cardPatterns.each {|cardNumberRegex|
-            encoded_input = encoded_input.gsub(/#{cardNumberRegex}/, "XXX")
-        }
-        return encoded_input
+    def maskValue(value)
+        maskSensitiveValue(value)
     end
 
-    def maskSensitiveString(input)
-        encoded_input = input #.force_encoding("UTF-8")
-        @@tagPatterns.each_with_index do |item, index|
-            encoded_input = encoded_input.gsub(/#{item}/,@@tagReplacements[index])
+    # Central defense-in-depth entry point. Regardless of how the log message
+    # is shaped (Ruby Hash/Array, pure JSON string, "label: {json}",
+    # "prefix {json} suffix", or even multiple embedded JSON blobs), every
+    # JSON Object/Array substring is extracted, parsed, and masked in-place.
+    # Any JSON-shaped substring that fails to parse is replaced with
+    # REDACTED_PAYLOAD (fail-closed) so a partially-decrypted or truncated
+    # body cannot leak through the wrapper.
+    def call(severity, time, progname, msg)
+        maskedMessage =
+            case msg
+            when Hash, Array
+                # Ruby Hash/Array passed directly to logger.<level>(obj). Walk
+                # the structure with maskJsonObject so individual sensitive
+                # fields are masked; Hash#to_s produces "key=>value" syntax
+                # which is NOT valid JSON, so we must not route it through
+                # the string-based parser path.
+                JSON.generate(maskJsonObject(msg))
+            else
+                msg_str = msg.to_s
+                begin
+                    JSON.parse(msg_str)
+                    maskSensitiveDataInJson(msg_str)
+                rescue JSON::ParserError, TypeError
+                    maskEmbeddedJson(msg_str)
+                end
+            end
+        formatLogEntry(severity, time, progname, maskedMessage)
+    end
+
+    # Walk the string, extract every top-level balanced {...} or [...] span
+    # (respecting JSON string/escape rules), and mask each in place. If no
+    # JSON-shaped span is present, the original text is returned unchanged.
+    # If a span is found but cannot be parsed, the entire message is redacted.
+    def maskEmbeddedJson(msg_str)
+        return msg_str unless msg_str.include?('{') || msg_str.include?('[')
+
+        result = +''
+        i = 0
+        len = msg_str.length
+        found_any = false
+
+        while i < len
+            ch = msg_str[i]
+            if ch == '{' || ch == '['
+                span_end = find_balanced_json_end(msg_str, i)
+                if span_end.nil?
+                    # Unbalanced JSON-looking content remaining: fail closed.
+                    return REDACTED_PAYLOAD
+                end
+                candidate = msg_str[i..span_end]
+                masked = maskSensitiveDataInJson(candidate)
+                # maskSensitiveDataInJson returns REDACTED_PAYLOAD on parse failure,
+                # which is the safe outcome we want to propagate.
+                result << masked
+                i = span_end + 1
+                found_any = true
+            else
+                result << ch
+                i += 1
+            end
         end
-        return encoded_input
+
+        found_any ? result : msg_str
     end
 
-    def formatLogEntry(severity, time, progname, msg)
+    # Returns the index of the matching closing brace/bracket for the JSON
+    # span beginning at start_idx, honoring JSON string and escape rules.
+    # Returns nil if unbalanced.
+    def find_balanced_json_end(str, start_idx)
+        depth = 0
+        in_string = false
+        escape = false
+        i = start_idx
+        len = str.length
+
+        while i < len
+            ch = str[i]
+            if in_string
+                if escape
+                    escape = false
+                elsif ch == '\\'
+                    escape = true
+                elsif ch == '"'
+                    in_string = false
+                end
+            else
+                case ch
+                when '"'
+                    in_string = true
+                when '{', '['
+                    depth += 1
+                when '}', ']'
+                    depth -= 1
+                    return i if depth.zero?
+                    return nil if depth < 0
+                end
+            end
+            i += 1
+        end
+        nil
+    end
+
+    def formatLogEntry(severity, _time, progname, msg)
         datetime = DateTime.now
-        date_format = datetime.strftime("%Y-%m-%d %H:%M:%S")
-        log_message = "[#{date_format}] #{severity.ljust(10)} (#{progname}): #{msg}\n"
-        # $stdout.puts log_message
-        log_message
+        date_format = datetime.strftime('%Y-%m-%d %H:%M:%S')
+        "[#{date_format}] #{severity.ljust(10)} (#{progname}): #{msg}\n"
     end
-end
+end

data/lib/AuthenticationSDK/util/AuthJWEUtility.rb

@@ -1,19 +1,69 @@
 # frozen_string_literal: true
 
 require_relative './Cache'
+require_relative './Constants'
 require 'stringio'
 require 'jose'
+require 'json'
+require 'base64'
 
 public
+
 class AuthJWEUtility
   # <b>DEPRECATED:</b> This method has been marked as Deprecated and will be removed in coming releases. Use <tt>decrypt_jwe_using_private_key()</tt> instead.
   def self.decrypt_jwe_using_pem(merchant_config, encoded_response)
-    warn("[DEPRECATED] `decrypt_jwe_using_pem()` method is deprecated and will be removed in coming releases. Use `decrypt_jwe_using_private_key()` instead.")
+    warn('[DEPRECATED] `decrypt_jwe_using_pem()` method is deprecated and will be removed in coming releases. Use `decrypt_jwe_using_private_key()` instead.')
+    validate_jwe_algorithms(encoded_response)
     key = Cache.new.fetchPEMFileForNetworkTokenization(merchant_config.pemFileDirectory)
-    return JOSE::JWE.block_decrypt(key, encoded_response).first
+    JOSE::JWE.block_decrypt(key, encoded_response).first
   end
 
   def self.decrypt_jwe_using_private_key(private_key, encoded_response)
-    return JOSE::JWE.block_decrypt(private_key, encoded_response).first
+    validate_jwe_algorithms(encoded_response)
+    JOSE::JWE.block_decrypt(private_key, encoded_response).first
   end
+
+  # Validates the JWE header algorithms before decryption to prevent algorithm
+  # substitution attacks (e.g., Bleichenbacher padding oracle via RSA1_5,
+  # or chosen-plaintext via 'dir').
+  #
+  # Only algorithms supported by CGK are permitted:
+  #   alg: RSA-OAEP, RSA-OAEP-256
+  #   enc: A128GCM, A256GCM
+  def self.validate_jwe_algorithms(encoded_response)
+    if encoded_response.nil? || encoded_response.to_s.strip.empty?
+      raise StandardError, 'Encoded JWE response is nil or empty'
+    end
+
+    parts = encoded_response.to_s.split('.')
+    unless parts.length == 5
+      raise StandardError, "Invalid JWE compact serialization: expected 5 parts, got #{parts.length}"
+    end
+
+    # Base64url-decode the JOSE header (first segment); add padding as needed
+    header_b64 = parts[0]
+    # Add padding if needed for proper base64url decoding
+    header_b64 += '=' * (4 - header_b64.length % 4) if header_b64.length % 4 != 0
+    header_json = Base64.urlsafe_decode64(header_b64)
+    begin
+      header = JSON.parse(header_json)
+    rescue JSON::ParserError => e
+      raise StandardError, "Invalid JWE header: failed to parse JSON - #{e.message}"
+    end
+
+    alg = header['alg']
+    enc = header['enc']
+
+    unless Constants::ALLOWED_JWE_KEY_ENCRYPTION_ALGORITHMS.include?(alg)
+      raise StandardError, "Unsupported JWE key encryption algorithm '#{alg}'. " \
+        "Allowed: #{Constants::ALLOWED_JWE_KEY_ENCRYPTION_ALGORITHMS.join(', ')}"
+    end
+
+    unless Constants::ALLOWED_JWE_CONTENT_ENCRYPTION_ALGORITHMS.include?(enc)
+      raise StandardError, "Unsupported JWE content encryption algorithm '#{enc}'. " \
+        "Allowed: #{Constants::ALLOWED_JWE_CONTENT_ENCRYPTION_ALGORITHMS.join(', ')}"
+    end
+  end
+
+  private_class_method :validate_jwe_algorithms
 end

data/lib/AuthenticationSDK/util/Cache.rb

@@ -1,6 +1,5 @@
 require 'openssl'
 require 'base64'
-require 'active_support'
 require 'thread'
 require_relative 'CacheValue'
 require_relative 'CachedMLEKId'
@@ -9,6 +8,7 @@ require_relative 'Utility'
 require_relative '../util/Constants.rb'
 require_relative '../logging/log_factory.rb'
 require_relative '../logging/log_configuration.rb'
+require 'active_support'
 
 public
 # P12 file certificate Cache
@@ -21,7 +21,7 @@ public
       merchantId = merchantConfig.merchantId
       certificateFilePath = merchantConfig.p12KeyFilePath
 
-      cacheKey = merchantConfig.keyFilename + "_JWT"
+      cacheKey = File.expand_path(certificateFilePath) + "_JWT"
 
       @@mutex.synchronize do
         cachedCertificateInfo = @@cache_obj.read(cacheKey)
@@ -32,6 +32,9 @@ public
           cachedCertificateInfo = @@cache_obj.read(cacheKey)
         end
 
+        cachedCertificateInfo.private_key = OpenSSL::PKey::RSA.new(Base64.strict_decode64(cachedCertificateInfo.private_key))
+        cachedCertificateInfo.cert = OpenSSL::X509::Certificate.new(Base64.strict_decode64(cachedCertificateInfo.cert))
+
         return cachedCertificateInfo
       end
     end
@@ -60,7 +63,7 @@ public
             raise err
           end
 
-          cacheValue = CacheValue.new(mlePrivateKey, nil, fileModifiedTime)
+          cacheValue = CacheValue.new(Base64.strict_encode64(mlePrivateKey.to_pem), nil, fileModifiedTime)
 
           @@cache_obj.write(cacheKey, cacheValue)
         rescue StandardError => e
@@ -75,7 +78,7 @@ public
         privateKey, certificateList = Utility.getCertificateCollectionAndPrivateKeyFromP12(certificateFilePath, merchantConfig.keyPass)
         jwtCertificate = Utility.getCertificateBasedOnKeyAlias(certificateList, merchantConfig.keyAlias)
 
-        cacheValue = CacheValue.new(privateKey, jwtCertificate, fileModifiedTime)
+        cacheValue = CacheValue.new(Base64.strict_encode64(privateKey), Base64.strict_encode64(jwtCertificate), fileModifiedTime)
 
         @@cache_obj.write(cacheKey, cacheValue)
         return
@@ -105,7 +108,7 @@ public
           raise ArgumentError, "No certificate found for the specified mle_key_alias '#{merchantConfig.requestMleKeyAlias}' in file #{fileName}."
         end
 
-        cacheValue = CacheValue.new(privateKey, mleCertificate, fileModifiedTime)
+        cacheValue = CacheValue.new(Base64.strict_encode64(privateKey), Base64.strict_encode64(mleCertificate), fileModifiedTime)
 
         @@cache_obj.write(cacheKey, cacheValue)
         return
@@ -156,7 +159,7 @@ public
         end
       end
 
-      cachedCertificateInfo ? cachedCertificateInfo.cert : nil
+      cachedCertificateInfo ? OpenSSL::X509::Certificate.new(Base64.strict_decode64(cachedCertificateInfo.cert)) : nil
     end
 
     def getMLEResponsePrivateKeyFromFilePath(merchantConfig)
@@ -175,12 +178,12 @@ public
         end
       end
 
-      cachedCertificateInfo ? cachedCertificateInfo.private_key : nil
+      cachedCertificateInfo ? JOSE::JWK.from_pem(Base64.strict_decode64(cachedCertificateInfo.private_key)) : nil
     end
 
     def get_mle_kid_data_from_cache(merchant_config)
-      cache_key = merchant_config.responseMlePrivateKeyFilePath + Constants::RESPONSE_MLE_P12_PFX_CACHE_IDENTIFIER
       file_path = merchant_config.responseMlePrivateKeyFilePath
+      cache_key = File.expand_path(file_path) + Constants::RESPONSE_MLE_P12_PFX_CACHE_IDENTIFIER
 
       @@mutex.synchronize do
         if !@@cache_obj.exist?(cache_key)
@@ -216,7 +219,7 @@ public
         logger = @@logger.logger
 
         file_path = merchant_config.responseMlePrivateKeyFilePath
-        cache_key = merchant_config.responseMlePrivateKeyFilePath + Constants::RESPONSE_MLE_P12_PFX_CACHE_IDENTIFIER
+        cache_key = File.expand_path(file_path) + Constants::RESPONSE_MLE_P12_PFX_CACHE_IDENTIFIER
 
         # Get certificate from P12 file
         _, certificate_list = Utility.getCertificateCollectionAndPrivateKeyFromP12(
@@ -272,21 +275,26 @@ public
     def fetchPEMFileForNetworkTokenization(filePath)
       warn("[DEPRECATED] 'fetchPEMFileForNetworkTokenization' method is deprecated and will be removed in coming releases.")
 
+      # Use normalised filePath-scoped cache keys to prevent cross-tenant data leakage
+      normalised_path = File.expand_path(filePath)
+      pem_cache_key = "privateKeyFromPEMFile_#{normalised_path}"
+      pem_time_cache_key = "cachedLastModifiedTimeOfPEMFile_#{normalised_path}"
+
       # Thread-safe cache access for deprecated method
       @@mutex.synchronize do
-        pem_file_cache = @@cache_obj.read('privateKeyFromPEMFile')
-        cached_pem_file_last_updated_time = @@cache_obj.read('cachedLastModifiedTimeOfPEMFile')
+        pem_file_cache = @@cache_obj.read(pem_cache_key)
+        cached_pem_file_last_updated_time = @@cache_obj.read(pem_time_cache_key)
 
         if File.exist?(filePath)
           current_last_modified_time_of_PEM_file = File.mtime(filePath)
           if pem_file_cache.nil? || pem_file_cache.to_s.empty? || current_last_modified_time_of_PEM_file > cached_pem_file_last_updated_time
             private_key = JOSE::JWK.from_pem_file filePath
-            @@cache_obj.write('privateKeyFromPEMFile', private_key)
-            @@cache_obj.write('cachedLastModifiedTimeOfPEMFile', current_last_modified_time_of_PEM_file)
+            @@cache_obj.write(pem_cache_key, private_key)
+            @@cache_obj.write(pem_time_cache_key, current_last_modified_time_of_PEM_file)
           end
         end
 
-        return @@cache_obj.read('privateKeyFromPEMFile')
+        return @@cache_obj.read(pem_cache_key)
       end
     end