stripe 19.6.0 → 19.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 82286b48db91166e11aef358ae27fcffab4b855b9e9ae9f3b524e27745551ff0
-  data.tar.gz: f8f624933606ae7251b345d614bd61d7555bb4ccd4220c0fe738c00362ce487c
+  metadata.gz: 2658d175c0e9668ca5effb73396f22b9f19a3df059558de5ae56912db9e9547a
+  data.tar.gz: 29e5fb8e31fa57e3011a24117be58d99eb0f06d1385014ba135df1a936abe7db
 SHA512:
-  metadata.gz: 4241e97de04950962a14bbdb988c428148bca9abad2be29d0abc761673485b7c6e622b914cfe4cfb118ec6abb1ccaebb60ea2eec4705d06aa2099642008f23c4
-  data.tar.gz: a1565300b92248d840a3aeef3fefb399572de194e81fc2e4aebb66576cf9d64847ae0bd8dfa7fbc9774e80d570660573fdd88f247c654b2404b22e837b843e98
+  metadata.gz: 2a55bcb93a02feb6f0f766bf10ef9fde2a30be1535bead833583cbb24e49e9ca791ab0910a02d957f66bb2b1bec5e701ba8e330554a0a9536036cbed79e516e7
+  data.tar.gz: e992a203be967077d537facef9323182a643d6004197b7d563a93a98c79fb745283d6b8c23526fae44b0067f5f9f994e5e26e8ff17ac3228cd883a93393aedbf

data/lib/stripe/api_requestor.rb

@@ -462,13 +462,13 @@ module Stripe
     private def execute_request_internal(method, path,
                                          base_address, params, opts, usage,
                                          &read_body_chunk_block)
+      Util.validate_path!(path)
+
       api_mode = Util.get_api_mode(path)
       opts = RequestOptions.merge_config_and_opts(config, opts)
 
       raise ArgumentError, "method should be a symbol" \
       unless method.is_a?(Symbol)
-      raise ArgumentError, "path should be a string" \
-      unless path.is_a?(String)
 
       base_url ||= config.base_addresses[base_address]
 

data/lib/stripe/resources/v2/core/event_notification.rb

@@ -53,9 +53,12 @@ module Stripe
 
         # Retrieves the Event that generated this EventNotification.
         def fetch_event
-          resp = @client.raw_request(:get, "/v2/core/events/#{id}", opts: { stripe_context: context,
-                                                                            "Stripe-Request-Trigger" => "event=#{id}", },
-                                                                    usage: ["fetch_event"])
+          # `id` comes from the notification body, so escape it the way generated
+          # services do -- otherwise it can inject extra path or query segments.
+          path = "/v2/core/events/#{CGI.escape(id)}"
+          resp = @client.raw_request(:get, path, opts: { stripe_context: context,
+                                                         "Stripe-Request-Trigger" => "event=#{id}", },
+                                                 usage: ["fetch_event"])
           @client.deserialize(resp.http_body, api_mode: :v2)
         end
       end

data/lib/stripe/services/oauth_service.rb

@@ -11,7 +11,7 @@ module Stripe
 
       params[:client_id] = client_id(params)
 
-      params[:response_type] = "code" if params.include?(:response_type)
+      params[:response_type] ||= "code"
 
       query = Util.encode_parameters(params, :v1)
 

data/lib/stripe/util.rb

@@ -375,6 +375,38 @@ module Stripe
       res.zero?
     end
 
+    # Asserts that a request path is origin-relative: that it begins with a
+    # single "/" and carries no scheme, authority or userinfo.
+    #
+    # The absolute URL is built by concatenating a base address onto this path,
+    # and no base address ends in a slash. A path like "@evil.example/v1/x" or
+    # ".evil.example/v1/x" would modify the resulting host and direct the request
+    # (including the API key) to a non-Stripe host.
+    #
+    # Because some relative urls arrive from potentially untrusted sources (like
+    # webhook bodies), we have to be a little defensive.
+    #
+    # So, we require that a path starts with a leading slash and that URI.parse
+    # finds no scheme or authority in it.
+    def self.validate_path!(path)
+      unless path.is_a?(String) && path.start_with?("/") && !path.start_with?("//")
+        raise ArgumentError,
+              "path must be a string beginning with a single \"/\", got: #{path.inspect}"
+      end
+
+      uri =
+        begin
+          URI.parse(path)
+        rescue URI::InvalidURIError
+          raise ArgumentError, "path is not a valid URI: #{path.inspect}"
+        end
+
+      return if uri.scheme.nil? && uri.host.nil? && uri.userinfo.nil?
+
+      raise ArgumentError,
+            "path may not contain a scheme or authority, got: #{path.inspect}"
+    end
+
     # Returns either v1 or v2 as api_mode based on the given path
     def self.get_api_mode(path)
       if path.start_with?("/v2/")

data/lib/stripe/v2_list_object.rb

@@ -80,7 +80,8 @@ module Stripe
         _request(
           method: :get,
           path: next_page_url,
-          base_address: :api
+          base_address: :api,
+          opts: opts
         )
       end
     end

data/lib/stripe/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Stripe
-  VERSION = "19.6.0"
+  VERSION = "19.6.1"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stripe
 version: !ruby/object:Gem::Version
-  version: 19.6.0
+  version: 19.6.1
 platform: ruby
 authors:
 - Stripe
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-27 00:00:00.000000000 Z
+date: 2026-09-01 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bigdecimal