cybersource_rest_client 0.0.84 → 0.0.86

data/lib/AuthenticationSDK/util/Constants.rb

@@ -1,5 +1,4 @@
-  class Constants
-
+class Constants
       GET_REQUEST_TYPE_LOWER = 'get' unless const_defined?(:GET_REQUEST_TYPE_LOWER)
 
       POST_REQUEST_TYPE_LOWER = 'post' unless const_defined?(:POST_REQUEST_TYPE_LOWER)
@@ -42,7 +41,7 @@
 
       SIGNATURE_ALGORITHM = 'HmacSHA256' unless const_defined?(:SIGNATURE_ALGORITHM)
 
-      ALGORITHM = "algorithm=\"" unless const_defined?(:ALGORITHM)
+      ALGORITHM = 'algorithm="' unless const_defined?(:ALGORITHM)
 
       SHA256 = 'SHA-256=' unless const_defined?(:SHA256)
 
@@ -52,11 +51,11 @@
 
       USER_AGENT_VALUE = 'Mozilla/5.0' unless const_defined?(:USER_AGENT_VALUE)
 
-      KEY_ID = "keyid=\"" unless const_defined?(:KEY_ID)
+      KEY_ID = 'keyid="' unless const_defined?(:KEY_ID)
 
-      HEADERS_PARAM = "headers=\"" unless const_defined?(:HEADERS_PARAM)
+      HEADERS_PARAM = 'headers="' unless const_defined?(:HEADERS_PARAM)
 
-      SIGNATURE_PARAM = "signature=\"" unless const_defined?(:SIGNATURE_PARAM)
+      SIGNATURE_PARAM = 'signature="' unless const_defined?(:SIGNATURE_PARAM)
 
       AUTH_TYPE_HTTP = 'HTTP_SIGNATURE' unless const_defined?(:AUTH_TYPE_HTTP)
 
@@ -70,9 +69,12 @@
 
       JWT_KEY_TYPE_SHARED_SECRET = 'SHARED_SECRET' unless const_defined?(:JWT_KEY_TYPE_SHARED_SECRET)
 
-      INVALID_JWT_KEY_TYPE = "Invalid jwtKeyType. Must be 'P12' or 'SHARED_SECRET'." unless const_defined?(:INVALID_JWT_KEY_TYPE)
+      unless const_defined?(:INVALID_JWT_KEY_TYPE)
+        INVALID_JWT_KEY_TYPE = "Invalid jwtKeyType. Must be 'P12' or 'SHARED_SECRET'."
+      end
 
-      OLD_RUN_ENVIRONMENT_CONSTANTS = ['CYBERSOURCE.ENVIRONMENT.SANDBOX', 'CYBERSOURCE.ENVIRONMENT.PRODUCTION', 'CYBERSOURCE.IN.ENVIRONMENT.SANDBOX', 'CYBERSOURCE.IN.ENVIRONMENT.PRODUCTION', 'BANKOFAMERICA.ENVIRONMENT.SANDBOX', 'BANKOFAMERICA.ENVIRONMENT.PRODUCTION']
+      OLD_RUN_ENVIRONMENT_CONSTANTS = ['CYBERSOURCE.ENVIRONMENT.SANDBOX', 'CYBERSOURCE.ENVIRONMENT.PRODUCTION',
+                                       'CYBERSOURCE.IN.ENVIRONMENT.SANDBOX', 'CYBERSOURCE.IN.ENVIRONMENT.PRODUCTION', 'BANKOFAMERICA.ENVIRONMENT.SANDBOX', 'BANKOFAMERICA.ENVIRONMENT.PRODUCTION']
 
       # constants for fall back logic
 
@@ -90,7 +92,7 @@
 
       DEFAULT_LOG_LEVEL = 'debug' unless const_defined?(:DEFAULT_LOG_LEVEL)
 
-      LOG_LEVELS = ['UNKNOWN', 'FATAL', 'ERROR', 'WARN', 'INFO', 'DEBUG'] unless const_defined?(:LOG_LEVELS)
+      LOG_LEVELS = %w[UNKNOWN FATAL ERROR WARN INFO DEBUG] unless const_defined?(:LOG_LEVELS)
 
       # Constant for Fall back logic and Exception Handling
 
@@ -104,29 +106,43 @@
 
       INCORRECT_KEY_PASS = 'The keyPass Entered is Incorrect' unless const_defined?(:INCORRECT_KEY_PASS)
 
-      AUTH_TYPE_MANDATORY= 'AuthenticationType is Mandatory' unless const_defined?(:AUTH_TYPE_MANDATORY)
+      AUTH_TYPE_MANDATORY = 'AuthenticationType is Mandatory' unless const_defined?(:AUTH_TYPE_MANDATORY)
 
       MERCHANT_KEY_ID_MANDATORY = 'MerchantKeyId is Mandatory' unless const_defined?(:MERCHANT_KEY_ID_MANDATORY)
 
-      MERCHANT_SECRET_KEY_MANDATORY = 'MerchantSecretKey is Mandatory' unless const_defined?(:MERCHANT_SECRET_KEY_MANDATORY)
+      unless const_defined?(:MERCHANT_SECRET_KEY_MANDATORY)
+        MERCHANT_SECRET_KEY_MANDATORY = 'MerchantSecretKey is Mandatory'
+      end
 
       PORTFOLIO_ID_MANDATORY = 'PortfolioID is Mandatory' unless const_defined?(:PORTFOLIO_ID_MANDATORY)
 
       KEY_PASS_NULL = 'keyPass is empty, Assigining merchantID value' unless const_defined?(:KEY_PASS_NULL)
 
-      REQUEST_JSON_PATH_EMPTY = 'RequestJsonPath not provided. Using Default Value:'unless const_defined?(:REQUEST_JSON_PATH_EMPTY)
+      unless const_defined?(:REQUEST_JSON_PATH_EMPTY)
+        REQUEST_JSON_PATH_EMPTY = 'RequestJsonPath not provided. Using Default Value:'
+      end
 
       REQUEST_TYPE_EMPTY = 'RequestType Property of Merchant Config Not Set' unless const_defined?(:REQUEST_TYPE_EMPTY)
 
-      INVALID_REQUEST_TYPE_METHOD = 'Entered Request Type should be (GET/POST/PUT)' unless const_defined?(:INVALID_REQUEST_TYPE_METHOD)
+      unless const_defined?(:INVALID_REQUEST_TYPE_METHOD)
+        INVALID_REQUEST_TYPE_METHOD = 'Entered Request Type should be (GET/POST/PUT)'
+      end
 
-      INVALID_LOG_DIRECTORY = 'Entered LogDirectory is Missing/Incorrect. Using Default Path: ' unless const_defined?(:INVALID_LOG_DIRECTORY)
+      unless const_defined?(:INVALID_LOG_DIRECTORY)
+        INVALID_LOG_DIRECTORY = 'Entered LogDirectory is Missing/Incorrect. Using Default Path: '
+      end
 
-      INVALID_MAX_LOG_SIZE = 'Entered MaxLogSize is Missing/Incorrect. Using Default Value: ' unless const_defined?(:INVALID_MAX_LOG_SIZE)
+      unless const_defined?(:INVALID_MAX_LOG_SIZE)
+        INVALID_MAX_LOG_SIZE = 'Entered MaxLogSize is Missing/Incorrect. Using Default Value: '
+      end
 
-      INVALID_MAX_LOG_FILES = 'Entered MaxLogFiles is Missing/Incorrect. Using Default Value: ' unless const_defined?(:INVALID_MAX_LOG_FILES)
+      unless const_defined?(:INVALID_MAX_LOG_FILES)
+        INVALID_MAX_LOG_FILES = 'Entered MaxLogFiles is Missing/Incorrect. Using Default Value: '
+      end
 
-      INVALID_LOG_LEVEL = 'Entered LogLevel is Missing/Incorrect. Using Default Value: ' unless const_defined?(:INVALID_LOG_LEVEL)
+      unless const_defined?(:INVALID_LOG_LEVEL)
+        INVALID_LOG_LEVEL = 'Entered LogLevel is Missing/Incorrect. Using Default Value: '
+      end
 
       RUN_ENVIRONMENT_ERROR = 'Entered RunEnvironment is Incorrect.' unless const_defined?(:RUN_ENVIRONMENT_ERROR)
 
@@ -136,23 +152,50 @@
 
       WARNING_PREFIX = 'Warning: ' unless const_defined?(:WARNING_PREFIX)
 
-      HIDDEN_MERCHANT_PROPERTIES = 'merchantID,merchantKeyId,merchantsecretKey,keyAlias,keyPass' unless const_defined?(:HIDDEN_MERCHANT_PROPERTIES)
+      unless const_defined?(:HIDDEN_MERCHANT_PROPERTIES)
+        HIDDEN_MERCHANT_PROPERTIES = 'merchantID,merchantKeyId,merchantsecretKey,keyAlias,keyPass,'\
+          'keyPassword,sslKeyPassword,clientId,clientSecret,accessToken,refreshToken,'\
+          'privateKey,sslClientCert,responseMlePrivateKey,responseMlePrivateKeyPassword,'\
+          'responseMlePrivateKeyFilePassword,responseMlePrivateKeyFilePath,'\
+          'responseMlePrivateKeyFileName,mleForRequestPublicCertPath,pemFileDirectory,'\
+          'clientCertDirectory,keysDirectory,keyFilename'
+      end
+
+      unless const_defined?(:SENSITIVE_PROPERTY_PATTERNS)
+        # Substrings (case-insensitive) used to redact any configuration key whose name
+        # contains them. Provides defense-in-depth against new/unknown sensitive fields.
+        SENSITIVE_PROPERTY_PATTERNS = %w[secret password passwd pass token privatekey private_key apikey api_key credential cert].freeze
+      end
+
+      REDACTED_VALUE = '***REDACTED***' unless const_defined?(:REDACTED_VALUE)
 
       RUN_ENVIRONMENT = 'RunEnvironment is Mandatory' unless const_defined?(:RUN_ENVIRONMENT)
 
-      KEY_DIRECTORY_EMPTY = 'KeysDirectory not provided. Using Default Path:' unless const_defined?(:KEY_DIRECTORY_EMPTY)
+      unless const_defined?(:KEY_DIRECTORY_EMPTY)
+        KEY_DIRECTORY_EMPTY = 'KeysDirectory not provided. Using Default Path:'
+      end
 
-      FILE_NOT_FOUND = 'File not found, Re-Enter path/file name, Entered path/file name :: ' unless const_defined?(:FILE_NOT_FOUND)
+      unless const_defined?(:FILE_NOT_FOUND)
+        FILE_NOT_FOUND = 'File not found, Re-Enter path/file name, Entered path/file name :: '
+      end
 
       AUTH_ERROR = 'Check Authentication Type (HTTP_Signature/JWT) in cybs.yml.' unless const_defined?(:AUTH_ERROR)
 
-      KEY_FILE_NAME_NULL_EMPTY = 'KeyFilename Empty/Null. Assigining merchantID value' unless const_defined?(:KEY_FILE_NAME_NULL_EMPTY)
+      unless const_defined?(:KEY_FILE_NAME_NULL_EMPTY)
+        KEY_FILE_NAME_NULL_EMPTY = 'KeyFilename Empty/Null. Assigining merchantID value'
+      end
 
-      KEY_ALIAS_NULL_EMPTY = 'KeyAlias Empty/Null. Assigining merchantID value' unless const_defined?(:KEY_ALIAS_NULL_EMPTY)
+      unless const_defined?(:KEY_ALIAS_NULL_EMPTY)
+        KEY_ALIAS_NULL_EMPTY = 'KeyAlias Empty/Null. Assigining merchantID value'
+      end
 
-      INCORRECT_KEY_ALIAS = 'The Entered KeyAlias is Incorrect. Assigining merchantID value' unless const_defined?(:INCORRECT_KEY_ALIAS)
+      unless const_defined?(:INCORRECT_KEY_ALIAS)
+        INCORRECT_KEY_ALIAS = 'The Entered KeyAlias is Incorrect. Assigining merchantID value'
+      end
 
-      INCORRECT_KEY_ALIAS_USE_METAKEY = 'The Entered KeyAlias is Incorrect with useMetaKey set to true. Assigining portfolioID value' unless const_defined?(:INCORRECT_KEY_ALIAS_USE_METAKEY)
+      unless const_defined?(:INCORRECT_KEY_ALIAS_USE_METAKEY)
+        INCORRECT_KEY_ALIAS_USE_METAKEY = 'The Entered KeyAlias is Incorrect with useMetaKey set to true. Assigining portfolioID value'
+      end
 
       ENABLE_CLIENT_CERT_EMPTY = 'Enable Clientcert is Empty/Null.' unless const_defined?(:ENABLE_CLIENT_CERT_EMPTY)
 
@@ -178,15 +221,27 @@
 
       CERTIFICATE_EXPIRY_DATE_WARNING_DAYS = 90 unless const_defined?(:CERTIFICATE_EXPIRY_DATE_WARNING_DAYS)
 
-      MLE_CACHE_IDENTIFIER_FOR_CONFIG_CERT = "mleCertFromMerchantConfig"
+      MLE_CACHE_IDENTIFIER_FOR_CONFIG_CERT = 'mleCertFromMerchantConfig'
+
+      MLE_CACHE_IDENTIFIER_FOR_P12_CERT = 'mleCertFromP12'
+
+      DEFAULT_KEY_FILE_PATH = File.join(Dir.pwd, 'resources')
 
-      MLE_CACHE_IDENTIFIER_FOR_P12_CERT = "mleCertFromP12"
+      MLE_CACHE_KEY_IDENTIFIER_FOR_RESPONSE_PRIVATE_KEY = 'mleResponsePrivateKeyFromFile'
 
-      DEFAULT_KEY_FILE_PATH = File.join(Dir.pwd, "resources")
+      PUBLIC_KEY_CACHE_IDENTIFIER = 'FlexV2PublicKeys'
 
-      MLE_CACHE_KEY_IDENTIFIER_FOR_RESPONSE_PRIVATE_KEY = "mleResponsePrivateKeyFromFile"
+      RESPONSE_MLE_P12_PFX_CACHE_IDENTIFIER = '_responseMleP12Pfx'
 
-      PUBLIC_KEY_CACHE_IDENTIFIER = "FlexV2PublicKeys"
-      
-      RESPONSE_MLE_P12_PFX_CACHE_IDENTIFIER = "_responseMleP12Pfx"
-  end
+      # Allowed JWE algorithms for decryption (per CGK specification).
+      # Only strong key-encryption and content-encryption algorithms are permitted.
+      # Weak algorithms such as RSA1_5 (Bleichenbacher-vulnerable) and 'dir' are blocked.
+      unless const_defined?(:ALLOWED_JWE_KEY_ENCRYPTION_ALGORITHMS)
+        ALLOWED_JWE_KEY_ENCRYPTION_ALGORITHMS = %w[RSA-OAEP
+                                                   RSA-OAEP-256].freeze
+      end
+      unless const_defined?(:ALLOWED_JWE_CONTENT_ENCRYPTION_ALGORITHMS)
+        ALLOWED_JWE_CONTENT_ENCRYPTION_ALGORITHMS = %w[A128GCM
+                                                       A256GCM].freeze
+      end
+end

data/lib/AuthenticationSDK/util/MLEUtility.rb

@@ -1,4 +1,5 @@
 require_relative '../logging/log_factory.rb'
+require_relative '../logging/sensitive_logging.rb'
 require 'jose'
 require 'json'
 require_relative './Cache'
@@ -9,6 +10,28 @@ require_relative './AuthJWEUtility'
 public
   class MLEUtility
     @log_obj = nil
+
+    # Fail-safe gate for the decrypted-MLE-response diagnostic log lines.
+    # Default OFF: even at DEBUG, the decrypted/encrypted bodies are NOT emitted.
+    # Operators who need wire-level diagnostics must explicitly opt in by calling
+    # MLEUtility.enable_mle_plaintext_logging! in application bootstrap code; the
+    # toggle is process-local and not driven by config files or env vars so it
+    # cannot be flipped on accidentally by a deployment change.
+    @mle_plaintext_logging_enabled = false
+
+    class << self
+      def mle_plaintext_logging_enabled?
+        @mle_plaintext_logging_enabled == true
+      end
+
+      def enable_mle_plaintext_logging!
+        @mle_plaintext_logging_enabled = true
+      end
+
+      def disable_mle_plaintext_logging!
+        @mle_plaintext_logging_enabled = false
+      end
+    end
     def self.check_is_mle_for_API(merchant_config, inbound_mle_status, operation_ids)
       is_mle_for_api = false
 
@@ -148,11 +171,28 @@ public
       end
 
       begin
-        @log_obj.logger.info("LOG_NETWORK_RESPONSE_BEFORE_MLE_DECRYPTION: #{responseBody}")
+        # Fail-safe: only emit decrypted-MLE bodies when an operator has explicitly
+        # called MLEUtility.enable_mle_plaintext_logging! AND the logger is at
+        # DEBUG. Even then, route the payload through SensitiveDataFilter so
+        # PCI/PII fields (PAN, CVV, account, expiration, token, ...) are masked
+        # before reaching any appender.
+        plaintext_logging = MLEUtility.mle_plaintext_logging_enabled? && @log_obj.logger.debug?
+
+        if plaintext_logging
+          formatter = SensitiveDataFilter.new
+          @log_obj.logger.debug("LOG_NETWORK_RESPONSE_BEFORE_MLE_DECRYPTION: #{formatter.maskSensitiveDataInJson(responseBody)}")
+        else
+          @log_obj.logger.debug('LOG_NETWORK_RESPONSE_BEFORE_MLE_DECRYPTION: <encrypted payload omitted>')
+        end
 
         decryptedResponse = AuthJWEUtility.decrypt_jwe_using_private_key(mlePrivateKey, jweResponseToken)
 
-        @log_obj.logger.info("LOG_NETWORK_RESPONSE_AFTER_MLE_DECRYPTION: #{decryptedResponse}")
+        if plaintext_logging
+          formatter ||= SensitiveDataFilter.new
+          @log_obj.logger.debug("LOG_NETWORK_RESPONSE_AFTER_MLE_DECRYPTION: #{formatter.maskSensitiveDataInJson(decryptedResponse)}")
+        else
+          @log_obj.logger.debug('LOG_NETWORK_RESPONSE_AFTER_MLE_DECRYPTION: <decrypted payload not logged>')
+        end
 
         return decryptedResponse
       rescue => e

data/lib/AuthenticationSDK/util/Utility.rb

@@ -38,7 +38,19 @@ public
       return nil if certificateList.nil?
 
       certificateList.find do |cert|
-        cert.subject.to_a.any? { |_, value, _| value.include?(keyAlias) }
+        # Ensure cert is an OpenSSL::X509::Certificate, even if it's a PEM string
+        parsed = if cert.is_a?(String)
+          begin
+            OpenSSL::X509::Certificate.new(cert)
+          rescue OpenSSL::X509::CertificateError
+            next  # Skip invalid entries safely
+          end
+        else
+          cert
+        end
+
+        # Search all subject attributes for the keyAlias
+        parsed.subject.to_a.any? { |_, value, _| value.include?(keyAlias) }
       end
     end
 
@@ -46,14 +58,13 @@ public
       p12File = File.binread(certificateFilePath)
       p12Object = OpenSSL::PKCS12.new(p12File, keyPass)
 
-      privateKey = OpenSSL::PKey::RSA.new(p12Object.key)
+      privateKey = (OpenSSL::PKey::RSA.new(p12Object.key)).to_pem
 
-      primaryX5Certificate = p12Object.certificate
+      primaryX5Certificate = (p12Object.certificate).to_pem
       additionalX5Certificates = p12Object.ca_certs
 
       certificateList = [primaryX5Certificate]
-      certificateList.concat(additionalX5Certificates) if additionalX5Certificates
-
+      certificateList.concat(additionalX5Certificates.map(&:to_pem)) if additionalX5Certificates
       return [privateKey, certificateList]
     end