stripe 19.6.0 → 19.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 82286b48db91166e11aef358ae27fcffab4b855b9e9ae9f3b524e27745551ff0
-  data.tar.gz: f8f624933606ae7251b345d614bd61d7555bb4ccd4220c0fe738c00362ce487c
+  metadata.gz: 310e2209501ef945d302084ec788e94effc1d49d7b28ae696f96c72ba8b16352
+  data.tar.gz: 8b6c08b64f0f314f69a276b37c251079b19b17fff9b36e362751096a3896fac3
 SHA512:
-  metadata.gz: 4241e97de04950962a14bbdb988c428148bca9abad2be29d0abc761673485b7c6e622b914cfe4cfb118ec6abb1ccaebb60ea2eec4705d06aa2099642008f23c4
-  data.tar.gz: a1565300b92248d840a3aeef3fefb399572de194e81fc2e4aebb66576cf9d64847ae0bd8dfa7fbc9774e80d570660573fdd88f247c654b2404b22e837b843e98
+  metadata.gz: 5fa01da68c76512fb633bd82c8c36010cfd5b6d85ea38d1ba71acc6464859c5093514d9b8bb3c68b71616dfbdc238f286f436a2726d887066f173e1363b899c4
+  data.tar.gz: 79467cd47cd0712f1c95605a89ac2790b06c865c47d8dc438031479a1d5d72713bce5872fa9c38fc5d110b73adacb5457074fd3e92f7769858fc2d9a405dcb4e

data/lib/stripe/api_requestor.rb

@@ -462,13 +462,13 @@ module Stripe
     private def execute_request_internal(method, path,
                                          base_address, params, opts, usage,
                                          &read_body_chunk_block)
+      Util.validate_path!(path)
+
       api_mode = Util.get_api_mode(path)
       opts = RequestOptions.merge_config_and_opts(config, opts)
 
       raise ArgumentError, "method should be a symbol" \
       unless method.is_a?(Symbol)
-      raise ArgumentError, "path should be a string" \
-      unless path.is_a?(String)
 
       base_url ||= config.base_addresses[base_address]
 

data/lib/stripe/resources/v2/core/event_notification.rb

@@ -53,9 +53,12 @@ module Stripe
 
         # Retrieves the Event that generated this EventNotification.
         def fetch_event
-          resp = @client.raw_request(:get, "/v2/core/events/#{id}", opts: { stripe_context: context,
-                                                                            "Stripe-Request-Trigger" => "event=#{id}", },
-                                                                    usage: ["fetch_event"])
+          # `id` comes from the notification body, so escape it the way generated
+          # services do -- otherwise it can inject extra path or query segments.
+          path = "/v2/core/events/#{CGI.escape(id)}"
+          resp = @client.raw_request(:get, path, opts: { stripe_context: context,
+                                                         "Stripe-Request-Trigger" => "event=#{id}", },
+                                                 usage: ["fetch_event"])
           @client.deserialize(resp.http_body, api_mode: :v2)
         end
       end

data/lib/stripe/services/oauth_service.rb

@@ -11,7 +11,7 @@ module Stripe
 
       params[:client_id] = client_id(params)
 
-      params[:response_type] = "code" if params.include?(:response_type)
+      params[:response_type] ||= "code"
 
       query = Util.encode_parameters(params, :v1)
 

data/lib/stripe/stripe_context.rb

@@ -13,7 +13,7 @@ module Stripe
 
     # Creates a new StripeContext with the given segments.
     def initialize(segments = nil)
-      @segments = (segments || []).map(&:to_s).freeze
+      @segments = (segments || []).map { |segment| (segment.is_a?(String) ? segment.dup : segment.to_s).freeze }.freeze
     end
 
     # Parses a context string into a StripeContext instance.
@@ -54,6 +54,12 @@ module Stripe
     # Alias for == to support eql? method
     alias eql? ==
 
+    # As with equality in #== and #eql?, contexts with equivalent segments
+    # hash to the same value.
+    def hash
+      @segments.hash
+    end
+
     # Returns a human-readable representation for debugging.
     def inspect
       "#<#{self.class}:0x#{object_id.to_s(16)} segments=#{@segments.inspect}>"

data/lib/stripe/util.rb

@@ -375,6 +375,38 @@ module Stripe
       res.zero?
     end
 
+    # Asserts that a request path is origin-relative: that it begins with a
+    # single "/" and carries no scheme, authority or userinfo.
+    #
+    # The absolute URL is built by concatenating a base address onto this path,
+    # and no base address ends in a slash. A path like "@evil.example/v1/x" or
+    # ".evil.example/v1/x" would modify the resulting host and direct the request
+    # (including the API key) to a non-Stripe host.
+    #
+    # Because some relative urls arrive from potentially untrusted sources (like
+    # webhook bodies), we have to be a little defensive.
+    #
+    # So, we require that a path starts with a leading slash and that URI.parse
+    # finds no scheme or authority in it.
+    def self.validate_path!(path)
+      unless path.is_a?(String) && path.start_with?("/") && !path.start_with?("//")
+        raise ArgumentError,
+              "path must be a string beginning with a single \"/\", got: #{path.inspect}"
+      end
+
+      uri =
+        begin
+          URI.parse(path)
+        rescue URI::InvalidURIError
+          raise ArgumentError, "path is not a valid URI: #{path.inspect}"
+        end
+
+      return if uri.scheme.nil? && uri.host.nil? && uri.userinfo.nil?
+
+      raise ArgumentError,
+            "path may not contain a scheme or authority, got: #{path.inspect}"
+    end
+
     # Returns either v1 or v2 as api_mode based on the given path
     def self.get_api_mode(path)
       if path.start_with?("/v2/")

data/lib/stripe/v2_list_object.rb

@@ -80,7 +80,8 @@ module Stripe
         _request(
           method: :get,
           path: next_page_url,
-          base_address: :api
+          base_address: :api,
+          opts: opts
         )
       end
     end

data/lib/stripe/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Stripe
-  VERSION = "19.6.0"
+  VERSION = "19.6.2"
 end

data/lib/stripe/webhook.rb

@@ -135,6 +135,14 @@ module Stripe
           )
         end
 
+        if secret.nil? || secret.empty?
+          raise SignatureVerificationError.new(
+            "No webhook secret value was provided. It should start with " \
+            "`whsec_`",
+            header, http_body: payload
+          )
+        end
+
         expected_sig = compute_signature(timestamp, payload, secret)
         unless signatures.any? { |s| Util.secure_compare(expected_sig, s) }
           raise SignatureVerificationError.new(

data/rbi/stripe/stripe_client.rbi

@@ -16,7 +16,7 @@ module Stripe
       )
         .returns(::Stripe::V2::Core::EventNotification)
     end
-    def parse_event_notification(payload, sig_header, secret, tolerance: Webhook::DEFAULT_TOLERANCE); end
+    def parse_event_notification(payload, sig_header, secret, tolerance: ::Stripe::Webhook::DEFAULT_TOLERANCE); end
 
     # Constructs a [thin event notification](https://docs.stripe.com/event-destinations#thin-payload) from
     # an incoming webhook without first verifying its authenticity. Should be used after calling

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: stripe
 version: !ruby/object:Gem::Version
-  version: 19.6.0
+  version: 19.6.2
 platform: ruby
 authors:
 - Stripe
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-08-27 00:00:00.000000000 Z
+date: 2026-09-09 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bigdecimal