Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Redsys: Properly escape special characters in 3DS requests #3537

Conversation

britth
Copy link
Contributor

@britth britth commented Feb 20, 2020

In some Redsys 3DS requests, the API will return SIS0042, which
signifies an error calculating the signature. After some testing,
this appears to be caused by special characters in various fields
of the request (in particular the DS_MERCHANT_TITULAR field).
Non-3DS requests escape the entire xml_request_from response, but
after testing the same approach for 3DS, that doesn't quite work
(you'll still end up with an encoding error after the first round of
3ds-related api requests). This PR updates to escape the cardholder
name when the transaction calls for 3DS to prevent such errors. It
also does the same thing for the description field as that seemed
like the most likely other place where a special character could
end up. I feel like there's probably a better way to do this, so if
you have another idea, please feel free to suggest!

If you'd like to manually test, try issuing a 3ds purchase request
against this branch, using a name or description that includes a
special character - the transaction should succeed. Then try issuing
a request using a special character against the active merchant master
branch, and it should fail.

Unit:
38 tests, 122 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
100% passed

Remote:
22 tests, 70 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
100% passed

@britth britth requested a review from a team February 20, 2020 22:03
Copy link
Contributor

@chinhle23-zz chinhle23-zz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Confirmed through external testing that SIS0042 ERROR is returned when there is a special character in the cardholder's name with 3DS requests on master. This branch fixes this error and 3DS transactions are successful with special characters in the cardholder's name. Other than the rubocop errors, LGTM 👍

@britth britth force-pushed the ecs-1030-redsys-properly-escape-special-characters-for-3ds branch 2 times, most recently from f5136d6 to b967dc7 Compare February 24, 2020 16:21
In some Redsys 3DS requests, the API will return SIS0042, which
signifies an error calculating the signature. After some testing,
this appears to be caused by special characters in various fields
of the request (in particular the `DS_MERCHANT_TITULAR` field).
Non-3DS requests escape the entire xml_request_from response, but
after testing the same approach for 3DS, that doesn't quite work
(you'll still end up with an encoding error after the first round of
3ds-related api requests). This PR updates to escape the cardholder
name when the transaction calls for 3DS to prevent such errors. It
also does the same thing for the description field as that seemed
like the most likely other place where a special character could
end up. I feel like there's probably a better way to do this, so if
you have another idea, please feel free to suggest!

If you'd like to manually test, try issuing a 3ds purchase request
against this branch, using a name or description that includes a
special character - the transaction should succeed. Then try issuing
a request using a special character against the active merchant master
branch, and it should fail.

Unit:
38 tests, 122 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
100% passed

Remote:
22 tests, 70 assertions, 0 failures, 0 errors, 0 pendings, 0 omissions, 0 notifications
100% passed
@britth britth force-pushed the ecs-1030-redsys-properly-escape-special-characters-for-3ds branch from b967dc7 to 926c2fe Compare February 24, 2020 16:37
@britth britth merged commit 926c2fe into activemerchant:master Feb 24, 2020
@britth britth deleted the ecs-1030-redsys-properly-escape-special-characters-for-3ds branch February 24, 2020 21:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants