Skip to content

Commit 4f7fe0e

Browse files
gnongsiegnongsie
authored
Merge pull request #112 from CyberSource/security-fix-Feb-2025
Fixes for security findings
2 parents f7cce9e + 3469c5c commit 4f7fe0e

File tree

65 files changed

+1762
-1721
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

65 files changed

+1762
-1721
lines changed

‎cybersource-rest-auth-netstandard/AuthenticationSdk/AuthenticationSdk/AuthenticationSdk.csproj‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636

3737
<ItemGroup>
3838
<PackageReference Include="jose-jwt" Version="4.1.0" />
39+
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
3940
<PackageReference Include="NLog" Version="5.0.0" />
4041
<PackageReference Include="Portable.BouncyCastle" Version="1.9.0" />
4142
<PackageReference Include="System.Configuration.ConfigurationManager" Version="6.0.0" />

‎cybersource-rest-auth-netstandard/AuthenticationSdk/AuthenticationSdk/core/Authorize.cs‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -63,12 +63,12 @@ public HttpToken GetSignature()
6363
_logger.Debug($"Date: {signatureObj.GmtDateTime}");
6464
_logger.Debug($"Host: {signatureObj.HostName}");
6565

66-
if (_merchantConfig.IsPostRequest || _merchantConfig.IsPutRequest || _merchantConfig.IsPatchRequest)
67-
{
68-
_logger.Debug($"digest: {signatureObj.Digest}");
69-
}
66+
//if (_merchantConfig.IsPostRequest || _merchantConfig.IsPutRequest || _merchantConfig.IsPatchRequest)
67+
//{
68+
// _logger.Debug($"digest: {signatureObj.Digest}");
69+
//}
7070

71-
logUtility.LogDebugMessage( _logger, $"Signature : {signatureObj.SignatureParam}");
71+
//logUtility.LogDebugMessage( _logger, $"Signature : {signatureObj.SignatureParam}");
7272

7373
return signatureObj;
7474
}
@@ -112,7 +112,7 @@ public JwtToken GetToken()
112112
_logger.Debug("Content-Type: application/hal+json");
113113
}
114114

115-
logUtility.LogDebugMessage(_logger, $"Authorization : Bearer {tokenObj.BearerToken}");
115+
//logUtility.LogDebugMessage(_logger, $"Authorization : Bearer {tokenObj.BearerToken}");
116116

117117
return tokenObj;
118118
}
@@ -156,7 +156,7 @@ public OAuthToken GetOAuthToken()
156156
_logger.Debug("Content-Type: application/hal+json");
157157
}
158158

159-
logUtility.LogDebugMessage(_logger, $"Authorization : Bearer {tokenObj.AccessToken}");
159+
//logUtility.LogDebugMessage(_logger, $"Authorization : Bearer {tokenObj.AccessToken}");
160160

161161
return tokenObj;
162162
}

‎cybersource-rest-auth-netstandard/AuthenticationSdk/AuthenticationSdk/util/LogUtility.cs‎

Lines changed: 50 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
using NLog;
1+
using Newtonsoft.Json.Linq;
2+
using NLog;
23
using System;
34
using System.Collections.Generic;
45
using System.Text;
@@ -9,6 +10,7 @@ namespace AuthenticationSdk.util
910
public class LogUtility
1011
{
1112
private static Dictionary<string, string> sensitiveTags = new Dictionary<string, string>();
13+
private static List<string> sensitiveTagsList = new List<string>();
1214
private static Dictionary<string, string> authenticationTags = new Dictionary<string, string>();
1315

1416
public LogUtility()
@@ -34,9 +36,11 @@ private void LoadSensitiveDataConfiguration()
3436
lock(mutex)
3537
{
3638
sensitiveTags.Clear();
39+
sensitiveTagsList.Clear();
3740
authenticationTags.Clear();
3841

3942
sensitiveTags = SensitiveTags.getSensitiveTags();
43+
sensitiveTagsList = SensitiveTags.getSensitiveTagsList();
4044
authenticationTags = AuthenticationTags.getAuthenticationTags();
4145

4246
loaded = true;
@@ -45,54 +49,67 @@ private void LoadSensitiveDataConfiguration()
4549

4650
public string MaskSensitiveData(string str)
4751
{
52+
bool isJsonString;
4853
try
4954
{
50-
foreach (KeyValuePair<string, string> tag in sensitiveTags)
51-
{
52-
//removing the space and hypen from PAN details before masking
53-
if (tag.Key.StartsWith("\\\"number\\\"") || tag.Key.StartsWith("\\\"cardNumber\\\"") || tag.Key.StartsWith("\\\"account\\\"")
54-
|| tag.Key.StartsWith("\\\"prefix\\\"") || tag.Key.StartsWith("\\\"bin\\\""))
55-
{
56-
string[] splittedStr = tag.Key.Split(':');
57-
string tagName = splittedStr[0];
58-
string specialPatternForPAN = "(((\\s*[s/-]*\\s*)+)\\p{N}((\\s*[s/-]*\\s*)+))+";
55+
JObject jsonObject = JObject.Parse(str);
56+
isJsonString = true;
5957

60-
// match the patters for PAN number
61-
MatchCollection matches = Regex.Matches(str, $"{tagName}:\\\"{specialPatternForPAN}\\\"");
58+
MaskSensitiveData(jsonObject);
6259

63-
//remove space and dash from the all matched pattern
64-
foreach (Match match in matches)
65-
{
66-
String strr = match.ToString();
67-
strr = strr.Replace(" ", "");
68-
strr = strr.Replace("-", "");
69-
//replace original value in str with match
70-
str = str.Replace(match.ToString(), strr);
71-
}
72-
}
73-
str = Regex.Replace(str, tag.Key, tag.Value);
74-
}
60+
return jsonObject.ToString();
7561
}
76-
catch (Exception e)
62+
catch (Exception)
7763
{
78-
throw e;
64+
isJsonString = false;
7965
}
8066

81-
try
67+
if (!isJsonString)
8268
{
83-
foreach (KeyValuePair<string, string> tag in authenticationTags)
69+
try
8470
{
85-
str = Regex.Replace(str, tag.Key, tag.Value);
71+
foreach (KeyValuePair<string, string> tag in authenticationTags)
72+
{
73+
str = Regex.Replace(str, tag.Key, tag.Value);
74+
}
8675
}
87-
}
88-
catch (Exception e)
89-
{
90-
throw e;
76+
catch (Exception e)
77+
{
78+
throw e;
79+
}
9180
}
9281

9382
return str;
9483
}
9584

85+
public void MaskSensitiveData(JObject jsonMsg)
86+
{
87+
foreach (var prop in jsonMsg.Properties())
88+
{
89+
bool isFieldSensitive = sensitiveTagsList.Contains(prop.Name);
90+
if (isFieldSensitive)
91+
{
92+
if (prop.Value != null && prop.Value.Type != JTokenType.Null)
93+
{
94+
if (prop.Value.Type == JTokenType.String)
95+
{
96+
string originalValue = prop.Value.ToString();
97+
prop.Value = new string('X', originalValue.Length);
98+
}
99+
else if (prop.Value.Type == JTokenType.Object)
100+
{
101+
MaskSensitiveData((JObject)prop.Value);
102+
}
103+
}
104+
}
105+
else if (prop.Value.Type == JTokenType.Object)
106+
{
107+
MaskSensitiveData((JObject)prop.Value);
108+
}
109+
}
110+
}
111+
112+
96113
public void LogDebugMessage(Logger logger, String debugMessage)
97114
{
98115
if (IsMaskingEnabled(logger))

‎cybersource-rest-auth-netstandard/AuthenticationSdk/AuthenticationSdk/util/SensitiveDataConfigurationType.cs‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -5,22 +5,22 @@ public class SensitiveDataConfigurationType
55
{
66
public static SensitiveTag[] sensitiveTags = new SensitiveTag[]
77
{
8-
new SensitiveTag("securityCode", "[0-9]{3,4}", "xxxxx", false),
9-
new SensitiveTag("number", "(\\s*\\p{N}\\s*)+(\\p{N}{4})(\\s*)", "xxxxx$2", false),
10-
new SensitiveTag("cardNumber", "(\\s*\\p{N}\\s*)+(\\p{N}{4})(\\s*)", "xxxxx$2", false),
11-
new SensitiveTag("expirationMonth", "[0-1][0-9]", "xxxx", false),
12-
new SensitiveTag("expirationYear", "2[0-9][0-9][0-9]", "xxxx", false),
13-
new SensitiveTag("account", "(\\s*\\p{N}\\s*)+(\\p{N}{4})(\\s*)", "xxxxx$2", false),
14-
new SensitiveTag("routingNumber", "[0-9]+", "xxxxx", false),
15-
new SensitiveTag("email", "[a-z0-9!#$%&'*+\\/=?^_`{|}~-]+(?:.[a-z0-9!#$%&'*+\\/=?^_`{|}~-]+)*@(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?.)+[a-z0-9](?:[a-z0-9-]*[a-z0-9])?", "xxxxx", false),
16-
new SensitiveTag("firstName", "([a-zA-Z]+( )?[a-zA-Z]*'?-?[a-zA-Z]*( )?([a-zA-Z]*)?)", "xxxxx", false),
17-
new SensitiveTag("lastName", "([a-zA-Z]+( )?[a-zA-Z]*'?-?[a-zA-Z]*( )?([a-zA-Z]*)?)", "xxxxx", false),
18-
new SensitiveTag("phoneNumber", "(\\+[0-9]{1,2} )?\\(?[0-9]{3}\\)?[ .-]?[0-9]{3}[ .-]?[0-9]{4}", "xxxxx", false),
19-
new SensitiveTag("type", "[-A-Za-z0-9 ]+", "xxxxx", false),
20-
new SensitiveTag("token", "[-.A-Za-z0-9 ]+", "xxxxx", false),
21-
new SensitiveTag("signature", "[-.A-Za-z0-9 ]+", "xxxxx", false),
22-
new SensitiveTag("prefix", "(\\s*)(\\p{N}{4})(\\s*)(\\p{N}{2})(\\s*\\p{N}*\\s*)", "$2$4xxxxx", false),
23-
new SensitiveTag("bin", "(\\s*)(\\p{N}{4})(\\s*)(\\p{N}{2})(\\s*\\p{N}*\\s*)", "$2$4xxxxx", false)
8+
new SensitiveTag("securityCode", "", "", false),
9+
new SensitiveTag("number", "", "", false),
10+
new SensitiveTag("cardNumber", "", "", false),
11+
new SensitiveTag("expirationMonth", "", "", false),
12+
new SensitiveTag("expirationYear", "", "", false),
13+
new SensitiveTag("account", "", "", false),
14+
new SensitiveTag("routingNumber", "", "", false),
15+
new SensitiveTag("email", "", "", false),
16+
new SensitiveTag("firstName", "", "", false),
17+
new SensitiveTag("lastName", "", "", false),
18+
new SensitiveTag("phoneNumber", "", "", false),
19+
new SensitiveTag("type", "", "", false),
20+
new SensitiveTag("token", "", "", false),
21+
new SensitiveTag("signature", "", "", false),
22+
new SensitiveTag("prefix", "", "", false),
23+
new SensitiveTag("bin", "", "", false)
2424
};
2525

2626
public static AuthenticationSchemeTag[] authenticationTags = new AuthenticationSchemeTag[]

‎cybersource-rest-auth-netstandard/AuthenticationSdk/AuthenticationSdk/util/SensitiveTags.cs‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,10 @@ namespace AuthenticationSdk.util
55
public class SensitiveTags
66
{
77
private static Dictionary<string, string> sensitiveTags = new Dictionary<string, string>();
8+
private static List<string> sensitiveTagsList = new List<string>();
89
private static bool isLoaded = false;
9-
10+
private static bool isTagsListLoaded = false;
11+
1012
public static Dictionary<string, string> getSensitiveTags()
1113
{
1214
if (isLoaded)
@@ -40,5 +42,26 @@ public static Dictionary<string, string> getSensitiveTags()
4042

4143
return sensitiveTags;
4244
}
45+
46+
public static List<string> getSensitiveTagsList()
47+
{
48+
if (isTagsListLoaded)
49+
{
50+
return sensitiveTagsList;
51+
}
52+
53+
int sensitiveTagsCount = SensitiveDataConfigurationType.sensitiveTags.Length;
54+
55+
for (int i = 0; i < sensitiveTagsCount; i++)
56+
{
57+
string tagName = SensitiveDataConfigurationType.sensitiveTags[i].tagName;
58+
59+
sensitiveTagsList.Add(tagName);
60+
}
61+
62+
isTagsListLoaded = true;
63+
64+
return sensitiveTagsList;
65+
}
4366
}
4467
}

‎cybersource-rest-client-netstandard/cybersource-rest-client-netstandard/Api/BatchesApi.cs‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -410,7 +410,7 @@ public ApiResponse< InlineResponse2007 > GetBatchReportWithHttpInfo (string batc
410410
{
411411
localVarPathParams.Add("batchId", Configuration.ApiClient.ParameterToString(batchId)); // path parameter
412412
}
413-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarPathParams)}");
413+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarPathParams)}");
414414
if (Method.Get == Method.Post)
415415
{
416416
localVarPostBody = "{}";
@@ -505,7 +505,7 @@ public async System.Threading.Tasks.Task<ApiResponse<InlineResponse2007>> GetBat
505505
{
506506
localVarPathParams.Add("batchId", Configuration.ApiClient.ParameterToString(batchId)); // path parameter
507507
}
508-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarPathParams)}");
508+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarPathParams)}");
509509
if (Method.Get == Method.Post)
510510
{
511511
localVarPostBody = "{}";
@@ -598,7 +598,7 @@ public ApiResponse< InlineResponse2006 > GetBatchStatusWithHttpInfo (string batc
598598
{
599599
localVarPathParams.Add("batchId", Configuration.ApiClient.ParameterToString(batchId)); // path parameter
600600
}
601-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarPathParams)}");
601+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarPathParams)}");
602602
if (Method.Get == Method.Post)
603603
{
604604
localVarPostBody = "{}";
@@ -693,7 +693,7 @@ public async System.Threading.Tasks.Task<ApiResponse<InlineResponse2006>> GetBat
693693
{
694694
localVarPathParams.Add("batchId", Configuration.ApiClient.ParameterToString(batchId)); // path parameter
695695
}
696-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarPathParams)}");
696+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarPathParams)}");
697697
if (Method.Get == Method.Post)
698698
{
699699
localVarPostBody = "{}";
@@ -798,10 +798,10 @@ public ApiResponse< InlineResponse2005 > GetBatchesListWithHttpInfo (long? offse
798798
{
799799
localVarQueryParams.Add("toDate", Configuration.ApiClient.ParameterToString(toDate)); // query parameter
800800
}
801-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
802-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
803-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
804-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
801+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
802+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
803+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
804+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
805805
if (Method.Get == Method.Post)
806806
{
807807
localVarPostBody = "{}";
@@ -908,10 +908,10 @@ public async System.Threading.Tasks.Task<ApiResponse<InlineResponse2005>> GetBat
908908
{
909909
localVarQueryParams.Add("toDate", Configuration.ApiClient.ParameterToString(toDate)); // query parameter
910910
}
911-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
912-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
913-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
914-
logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
911+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
912+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
913+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
914+
//logger.Debug($"HTTP Request Body :\n{logUtility.ConvertDictionaryToString(localVarQueryParams)}");
915915
if (Method.Get == Method.Post)
916916
{
917917
localVarPostBody = "{}";
@@ -1011,14 +1011,14 @@ public ApiResponse< InlineResponse202 > PostBatchWithHttpInfo (Body body)
10111011
localVarPostBody = body; // byte array
10121012
}
10131013

1014-
if (logUtility.IsMaskingEnabled(logger))
1015-
{
1016-
logger.Debug($"HTTP Request Body :\n{logUtility.MaskSensitiveData(localVarPostBody.ToString())}");
1017-
}
1018-
else
1019-
{
1020-
logger.Debug($"HTTP Request Body :\n{localVarPostBody}");
1021-
}
1014+
//if (logUtility.IsMaskingEnabled(logger))
1015+
//{
1016+
// logger.Debug($"HTTP Request Body :\n{logUtility.MaskSensitiveData(localVarPostBody.ToString())}");
1017+
//}
1018+
//else
1019+
//{
1020+
// logger.Debug($"HTTP Request Body :\n{localVarPostBody}");
1021+
//}
10221022

10231023

10241024
// make the HTTP request
@@ -1112,14 +1112,14 @@ public async System.Threading.Tasks.Task<ApiResponse<InlineResponse202>> PostBat
11121112
localVarPostBody = body; // byte array
11131113
}
11141114

1115-
if (logUtility.IsMaskingEnabled(logger))
1116-
{
1117-
logger.Debug($"HTTP Request Body :\n{logUtility.MaskSensitiveData(localVarPostBody.ToString())}");
1118-
}
1119-
else
1120-
{
1121-
logger.Debug($"HTTP Request Body :\n{localVarPostBody}");
1122-
}
1115+
//if (logUtility.IsMaskingEnabled(logger))
1116+
//{
1117+
// logger.Debug($"HTTP Request Body :\n{logUtility.MaskSensitiveData(localVarPostBody.ToString())}");
1118+
//}
1119+
//else
1120+
//{
1121+
// logger.Debug($"HTTP Request Body :\n{localVarPostBody}");
1122+
//}
11231123

11241124

11251125
// make the HTTP request

0 commit comments

Comments
 (0)