raggedstaff/openfoodnetwork
1
0
Fork 0
mirror of https://github.com/openfoodfoundation/openfoodnetwork synced 2026-03-18 04:39:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Per review, check the URL is from a stripe subdomain

Browse Source
This commit is contained in:
Gaetan Craig-Riou
2025-09-08 11:00:11 +10:00
parent 118e18a78e
commit 1f15f094ce
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/stripe/authorize_response_patcher.rb
View File

@@ -27,9 +27,9 @@ module Stripe
next_action_type = next_action["type"]
return unless %w(authorize_with_url redirect_to_url).include?(next_action_type)
url = next_action[next_action_type]["url"]
host = URI(url).host
url if url.match(%r{https?://\S+}) && host.match?(/\S?stripe.com\Z/)
url = URI(next_action[next_action_type]["url"])
# Check the URL is from a stripe subdomain
url.to_s if url.is_a?(URI::HTTPS) && url.host.match?(/\.stripe.com\Z/)
end
# This field is used because the Spree code recognizes and stores it

2
spec/lib/stripe/authorize_response_patcher_spec.rb
View File

@@ -37,7 +37,7 @@ RSpec.describe Stripe::AuthorizeResponsePatcher do
"status" => "requires_source_action",
"next_source_action" => {
"type" => "authorize_with_url",
"authorize_with_url" => { "url" => "https://www.stripe.com.malicious.org/authorize" }
"authorize_with_url" => { "url" => "https://www.evil-stripe.com.malicious.org/authorize" }
}
}
}