Skip to content

Commit 60edf10

Browse files
shamirwasiashamirwasia
authored
Merge pull request #42 from CyberSource/future
Future
2 parents 3f4116a + a18c6c7 commit 60edf10

29 files changed

+1361
-236
lines changed

‎CyberSource/Client/CustomTextMessageEncoder.cs‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,9 +61,15 @@ public override Message ReadMessage(Stream stream, int maxSizeOfHeaders, string
6161
{
6262
var sr = new StreamReader(stream);
6363
var wireResponse = sr.ReadToEnd();
64-
64+
65+
// Fix for Xml external entity injection violation in fortify report
66+
XmlReaderSettings settings = new XmlReaderSettings();
67+
settings.DtdProcessing = DtdProcessing.Prohibit;
68+
settings.XmlResolver = null;
69+
6570
XmlDocument doc = new XmlDocument();
66-
doc.LoadXml(wireResponse);
71+
XmlReader reader = XmlReader.Create(new StringReader(wireResponse), settings);
72+
doc.Load(reader);
6773
//We need to get rid of the security header because it is not signed by the web service.
6874
//The whole reason for the custom Encoder is to do this. the client rejected the unsigned header.
6975
//Our WCF client is set up to allow the absence of a security header but if the header exists then it must be signed.
@@ -73,7 +79,7 @@ public override Message ReadMessage(Stream stream, int maxSizeOfHeaders, string
7379
{
7480
n.DeleteSelf();
7581
}
76-
XmlReader reader = XmlReader.Create(new StringReader(doc.InnerXml));
82+
reader = XmlReader.Create(new StringReader(doc.InnerXml), settings);
7783
return Message.CreateMessage(reader, maxSizeOfHeaders, MessageVersion.Soap11);
7884
}
7985

‎CyberSource/Client/NVPClient.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -80,13 +80,13 @@ public static Hashtable RunTransaction(
8080

8181

8282
string keyFilePath = Path.Combine(config.KeysDirectory, config.EffectiveKeyFilename);
83-
proc.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(keyFilePath, config.EffectivePassword, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
83+
proc.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(keyFilePath, config.EffectivePassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
8484

8585
proc.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;
8686

8787
// Changes for SHA2 certificates support
8888
X509Certificate2Collection collection = new X509Certificate2Collection();
89-
collection.Import(keyFilePath, config.EffectivePassword, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
89+
collection.Import(keyFilePath, config.EffectivePassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
9090

9191
foreach (X509Certificate2 cert1 in collection)
9292
{

‎CyberSource/Client/SoapClient.cs‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,13 +80,13 @@ public static ReplyMessage RunTransaction(
8080

8181
//add certificate credentials
8282
string keyFilePath = Path.Combine(config.KeysDirectory,config.EffectiveKeyFilename);
83-
proc.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(keyFilePath,config.EffectivePassword, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
83+
proc.ClientCredentials.ClientCertificate.Certificate = new X509Certificate2(keyFilePath,config.EffectivePassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
8484

8585
proc.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = System.ServiceModel.Security.X509CertificateValidationMode.None;
8686

8787
// Changes for SHA2 certificates support
8888
X509Certificate2Collection collection = new X509Certificate2Collection();
89-
collection.Import(keyFilePath, config.EffectivePassword, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
89+
collection.Import(keyFilePath, config.EffectivePassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
9090

9191
foreach (X509Certificate2 cert1 in collection)
9292
{
@@ -174,7 +174,14 @@ private static XmlNode SerializeObjectToXmlNode(Object obj)
174174
}
175175
memoryStream.Position = 0;
176176
XmlDocument doc = new XmlDocument();
177-
doc.Load(memoryStream);
177+
178+
// Fix for Xml external entity injection violation in fortify report
179+
XmlReaderSettings settings = new XmlReaderSettings();
180+
settings.DtdProcessing = DtdProcessing.Prohibit;
181+
settings.XmlResolver = null;
182+
XmlReader reader = XmlReader.Create(memoryStream, settings);
183+
doc.Load(reader);
184+
178185
resultNode = doc.DocumentElement;
179186
}
180187

‎CyberSource/Client/XmlClient.cs‎

Lines changed: 40 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,15 @@ public class XmlClient : BaseClient
2727
static XmlClient()
2828
{
2929
// load the SOAP envelope document.
30-
mSoapEnvelope = new XmlDocument();
31-
32-
33-
34-
mSoapEnvelope.LoadXml(SOAP_ENVELOPE);
30+
mSoapEnvelope = new XmlDocument();
31+
32+
// Fix for Xml external entity injection violation in fortify report
33+
XmlReaderSettings settings = new XmlReaderSettings();
34+
settings.DtdProcessing = DtdProcessing.Prohibit;
35+
settings.XmlResolver = null;
36+
XmlReader reader = XmlReader.Create(new StringReader(SOAP_ENVELOPE), settings);
37+
38+
mSoapEnvelope.Load(reader);
3539
}
3640

3741
private XmlClient() { }
@@ -90,7 +94,7 @@ public static XmlDocument RunTransaction(
9094
X509Certificate2 cybsCert = null;
9195

9296
X509Certificate2Collection collection = new X509Certificate2Collection();
93-
collection.Import(keyFilePath, config.EffectivePassword, X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
97+
collection.Import(keyFilePath, config.EffectivePassword, X509KeyStorageFlags.MachineKeySet | X509KeyStorageFlags.Exportable | X509KeyStorageFlags.PersistKeySet);
9498

9599
foreach (X509Certificate2 cert1 in collection)
96100
{
@@ -262,9 +266,18 @@ private static void SignDocument(X509Certificate2 cert, XmlDocument doc)
262266

263267
doc.DocumentElement.FirstChild.FirstChild.AppendChild(doc.ImportNode(xmlDigitalSignature, true));
264268

265-
// Add KeyInfo Node with reference to the X509 cert
269+
// Add KeyInfo Node with reference to the X509 cert
270+
string keyInfoTags = "<root xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" ><ds:KeyInfo><SecurityTokenReference xmlns=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"><wsse:Reference URI=\"#X509Token\" ValueType=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3\"/></SecurityTokenReference></ds:KeyInfo></root>";
266271
XmlDocument keyInfo = new XmlDocument();
267-
keyInfo.LoadXml("<root xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" ><ds:KeyInfo><SecurityTokenReference xmlns=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"><wsse:Reference URI=\"#X509Token\" ValueType=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3\"/></SecurityTokenReference></ds:KeyInfo></root>");
272+
273+
// Fix for Xml external entity injection violation in fortify report
274+
XmlReaderSettings settings = new XmlReaderSettings();
275+
settings.DtdProcessing = DtdProcessing.Prohibit;
276+
settings.XmlResolver = null;
277+
XmlReader reader = XmlReader.Create(new StringReader(keyInfoTags), settings);
278+
279+
//keyInfo.LoadXml("<root xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\" xmlns:wsse=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\" ><ds:KeyInfo><SecurityTokenReference xmlns=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd\"><wsse:Reference URI=\"#X509Token\" ValueType=\"http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3\"/></SecurityTokenReference></ds:KeyInfo></root>");
280+
keyInfo.Load(reader);
268281
doc.DocumentElement.FirstChild.FirstChild.LastChild.AppendChild(doc.ImportNode(keyInfo.FirstChild.FirstChild, true));
269282

270283
//Add The Base64 representation of the X509 cert to BinarySecurityToken Node
@@ -283,7 +296,14 @@ private static void encryptDocument(X509Certificate2 cert, XmlDocument doc)
283296
"<xenc:ReferenceList><xenc:DataReference URI=\"#Body\"></xenc:DataReference></xenc:ReferenceList></xenc:EncryptedKey></root>";
284297

285298
XmlDocument encryptedDataTags = new XmlDocument();
286-
encryptedDataTags.LoadXml(encData);
299+
300+
// Fix for Xml external entity injection violation in fortify report
301+
XmlReaderSettings settings = new XmlReaderSettings();
302+
settings.DtdProcessing = DtdProcessing.Prohibit;
303+
settings.XmlResolver = null;
304+
XmlReader reader = XmlReader.Create(new StringReader(encData), settings);
305+
306+
encryptedDataTags.Load(reader);
287307
doc.DocumentElement.FirstChild.FirstChild.PrependChild(doc.ImportNode(encryptedDataTags.FirstChild.FirstChild, true));
288308

289309
XmlElement elementToEncrypt = doc.GetElementsByTagName(REQUEST_MESSAGE)[0] as XmlElement;
@@ -403,11 +423,17 @@ private static XmlDocument ReadXml(WebResponse webResponse)
403423
{
404424
Stream stream = null;
405425
try
406-
{
407-
XmlDocument xmlDoc = new XmlDocument();
408-
xmlDoc.PreserveWhitespace = true;
409-
stream = webResponse.GetResponseStream();
410-
xmlDoc.Load(stream);
426+
{
427+
XmlDocument xmlDoc = new XmlDocument();
428+
xmlDoc.PreserveWhitespace = true;
429+
stream = webResponse.GetResponseStream();
430+
431+
// Fix for Xml external entity injection violation in fortify report
432+
XmlReaderSettings settings = new XmlReaderSettings();
433+
settings.DtdProcessing = DtdProcessing.Prohibit;
434+
settings.XmlResolver = null;
435+
XmlReader reader = XmlReader.Create(stream, settings);
436+
xmlDoc.Load(reader);
411437
return (xmlDoc);
412438
}
413439
finally

‎CyberSourceSamples/src/nvp/nvpSamples/androidPayAuth.csv‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
"merchantID","your_merchant_id"
2+
"merchantReferenceCode","your_merchant_reference_code"
3+
"billTo_firstName","John"
4+
"billTo_lastName","Doe"
5+
"billTo_street1","1295CharlestonRoad"
6+
"billTo_city","MountainView"
7+
"billTo_postalCode","94043"
8+
"billTo_state","CA"
9+
"billTo_country","US"
10+
"billTo_email","[email protected]"
11+
"billTo_ipAddress","10.7.111.111"
12+
"purchaseTotals_currency","USD"
13+
"item_0_unitPrice","12.34"
14+
"item_1_unitPrice","56.78"
15+
"card_accountNumber","4111111111111111"
16+
"card_expirationMonth","12"
17+
"card_expirationYear","2020"
18+
"ccAuthService_run","true"
19+
"ccAuthService_cavv","ABCDEFabcdefABCDEFabcdef0987654321234567"
20+
"ccAuthService_commerceIndicator","internet"
21+
"ccAuthService_xid","ABCDEFabcdefABCDEFabcdef0987654321234567"
22+
"paymentNetworkToken_transactionType","1"
23+
"paymentSolution","006"

‎CyberSourceSamples/src/nvp/nvpSamples/applePayAuth.csv‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
"merchantID","your_merchant_id"
2+
"merchantReferenceCode","your_merchant_reference_code"
3+
"billTo_firstName","John"
4+
"billTo_lastName","Doe"
5+
"billTo_street1","1295CharlestonRoad"
6+
"billTo_city","MountainView"
7+
"billTo_postalCode","94043"
8+
"billTo_state","CA"
9+
"billTo_country","US"
10+
"billTo_email","[email protected]"
11+
"billTo_ipAddress","10.7.111.111"
12+
"purchaseTotals_currency","USD"
13+
"item_0_unitPrice","12.34"
14+
"item_1_unitPrice","56.78"
15+
"card_accountNumber","4111111111111111"
16+
"card_expirationMonth","12"
17+
"card_expirationYear","2020"
18+
"ccAuthService_run","true"
19+
"ccAuthService_cavv","ABCDEFabcdefABCDEFabcdef0987654321234567"
20+
"ccAuthService_commerceIndicator","internet"
21+
"ccAuthService_xid","ABCDEFabcdefABCDEFabcdef0987654321234567"
22+
"paymentNetworkToken_transactionType","1"
23+
"paymentSolution","001"

‎CyberSourceSamples/src/nvp/nvpSamples/auth.csv‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
"merchantID","your_merchant_id"
2+
"merchantReferenceCode","your_merchant_reference_code"
3+
"billTo_firstName","John"
4+
"billTo_lastName","Doe"
5+
"billTo_street1","1295CharlestonRoad"
6+
"billTo_city","MountainView"
7+
"billTo_postalCode","94043"
8+
"billTo_state","CA"
9+
"billTo_country","US"
10+
"billTo_email","[email protected]"
11+
"billTo_ipAddress","10.7.111.111"
12+
"purchaseTotals_currency","USD"
13+
"item_0_unitPrice","12.34"
14+
"item_1_unitPrice","56.78"
15+
"card_accountNumber","4111111111111111"
16+
"card_expirationMonth","12"
17+
"card_expirationYear","2020"
18+
"ccAuthService_run","true"

‎CyberSourceSamples/src/nvp/nvpSamples/authrev.csv‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
"merchantReferenceCode","your_merchant_reference_code"
2+
"purchaseTotals_currency","USD"
3+
"item_0_unitPrice","12.34"
4+
"item_1_unitPrice","56.78"
5+
"ccAuthReversalService_run","true"
6+
"ccAuthReversalService_authRequestID","authreqId"

‎CyberSourceSamples/src/nvp/nvpSamples/capture.csv‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
"merchantID","your_merchant_id"
2+
"merchantReferenceCode","your_merchant_reference_code"
3+
"item_0_unitPrice","12.34"
4+
"item_1_unitPrice","56.78"
5+
"purchaseTotals_currency","USD"
6+
"ccCaptureService_run",true"
7+
"ccCaptureService_authRequestID","4803123601076369401011"

‎CyberSourceSamples/src/nvp/nvpSamples/credit.csv‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
"merchantID","your_merchant_id"
2+
"merchantReferenceCode","your_merchant_reference_code"
3+
"purchaseTotals_currency","USD"
4+
"item_0_unitPrice","12.34"
5+
"item_1_unitPrice","56.78"
6+
"ccCreditService_run","true"
7+
"ccCreditService_captureRequestID","4803124484286005701019"

0 commit comments

Comments
 (0)