From cba46a9614e428e5d4024c139fd7dc56c7d348a7 Mon Sep 17 00:00:00 2001 From: satheeshsubramanivisa Date: Tue, 26 May 2026 11:52:27 -0500 Subject: [PATCH 1/2] Security finding, Checkmarx fix --- .env | 1 + docs/Commercetools-Setup.md | 1 - docs/PayPal-setup.md | 16 +- docs/Process-a-Payment-ClicktoPay.md | 83 + docs/Process-a-Payment-MOTO.md | 14 +- docs/Visa-ClicktoPay-Setup.md | 37 + package.json | 4 +- src/apiController.ts | 110 +- src/constants/customMessages.ts | 4 + src/constants/paymentConstants.ts | 4 +- src/index.ts | 40 +- .../payment-methods/PayPalPaymentMethod.ts | 136 +- src/requestBuilder/LineItemMapper.ts | 20 +- src/requestBuilder/PrepareFields.ts | 11 +- .../ProcessingInformationMapper.ts | 12 +- src/resources/isv_payment_data_type.json | 11 - .../payment/CreateWebhookSubscription.ts | 2 +- .../DeleteWebhookSubscriptionService.ts | 2 +- .../payment/GetWebhookSubscriptionDetails.ts | 2 +- src/types/Types.ts | 1 - src/unit-tests/const/CybersourceApiConst.ts | 10 +- src/unit-tests/const/LineItemMapperConst.ts | 1344 ++++++++--------- src/unit-tests/const/PayerAuthHelperConst.ts | 20 +- src/unit-tests/const/SyncHelperConst.ts | 26 +- .../RequestBuilder/LineItemMapper.spec.ts | 84 +- .../OrderInformationMapper.spec.ts | 384 ++--- .../RequestBuilder/PaymentInformation.spec.ts | 348 ++--- .../ProcessingInformationMapper.spec.ts | 390 ++--- .../unit/utils/PaymentActions.spec.ts | 590 ++++---- .../unit/utils/api/CommercetoolsApi.spec.ts | 836 ++++++++++ src/unit-tests/unit/utils/api/IsvApi.spec.ts | 36 + .../unit/utils/config/CustomExtension.spec.ts | 38 + .../unit/utils/config/CustomTypes.spec.ts | 26 + .../unit/utils/config/MultiMid.spec.ts | 49 + .../utils/helpers/PayerAuthHelper.spec.ts | 368 ++--- .../unit/utils/helpers/SyncHelper.spec.ts | 958 ++++++------ .../unit/utils/helpers/TokenHelper.spec.ts | 1210 +++++++-------- .../unit/utils/helpers/WebhookHelper.spec.ts | 310 ++-- src/utils/PaymentActions.ts | 2 + src/utils/PaymentHandler.ts | 71 +- src/utils/PaymentUtils.ts | 40 +- src/utils/api/CommercetoolsApi.ts | 27 +- src/utils/helpers/AuthenticationHelper.ts | 4 +- src/utils/helpers/OrderManagementHelper.ts | 12 +- src/utils/helpers/SyncHelper.ts | 4 +- src/views/javascript/paymentDetails.js | 16 +- src/views/orders.html | 52 +- src/views/paymentDetails.html | 52 +- 48 files changed, 4636 insertions(+), 3182 deletions(-) create mode 100644 docs/Process-a-Payment-ClicktoPay.md create mode 100644 docs/Visa-ClicktoPay-Setup.md create mode 100644 src/unit-tests/unit/utils/api/CommercetoolsApi.spec.ts create mode 100644 src/unit-tests/unit/utils/api/IsvApi.spec.ts create mode 100644 src/unit-tests/unit/utils/config/CustomExtension.spec.ts create mode 100644 src/unit-tests/unit/utils/config/CustomTypes.spec.ts create mode 100644 src/unit-tests/unit/utils/config/MultiMid.spec.ts diff --git a/.env b/.env index 2d777494..d40080e3 100644 --- a/.env +++ b/.env @@ -28,6 +28,7 @@ PAYMENT_GATEWAY_SAVED_CARD_LIMIT_FRAME = PAYMENT_GATEWAY_DECISION_SYNC = PAYMENT_GATEWAY_DECISION_MANAGER = +PAYMENT_GATEWAY_ENABLE_MOTO = PAYMENT_GATEWAY_RUN_SYNC = PAYMENT_GATEWAY_DECISION_SYNC_MULTI_MID = PAYMENT_GATEWAY_NETWORK_TOKEN_MULTI_MID = diff --git a/docs/Commercetools-Setup.md b/docs/Commercetools-Setup.md index 84972543..6bdc084d 100644 --- a/docs/Commercetools-Setup.md +++ b/docs/Commercetools-Setup.md @@ -142,7 +142,6 @@ Fields | isv_payerEnrollStatus | String | false || | isv_payerEnrollHttpCode | Number | false || | isv_saleEnabled | Boolean | false || -| isv_enabledMoto | Boolean | false || | isv_walletType | String | false || | isv_accountNumber | String | false || | isv_accountType | String | false || diff --git a/docs/PayPal-setup.md b/docs/PayPal-setup.md index 510fa7f9..4c759c1f 100644 --- a/docs/PayPal-setup.md +++ b/docs/PayPal-setup.md @@ -18,6 +18,20 @@ merchant account with your Cybersource merchant account: - Save the account facilitator email address, the client ID, and the secret key for future reference. + For example: + + ◦ Account facilitator email address: + + merchantuser-facilitator@merchant.com + + ◦ Client ID: + + AahnQzKLL2vvG_UI6YQy9xcyt5joMLVoPHW-1Bv8gCvPkTiNwQSRCvKIKXy8UZZguijbwJTTs_Cjhdz + + ◦ Secret key: + + EOE3eqqeIBy4q8LhsON0-wp2zPb_0SOqPH3sopx_uwuIMkCug7zw3aKDunstrXmcrGecmpeUJgsqTGO + - Contact Cybersourcemerchant support and provide your PayPal credentials: ◦ Account facilitator email address @@ -33,4 +47,4 @@ Once your merchant Id is configured with Cybersource, you can integrate PayPal a - Display PayPal as a payment option during the checkout process.You can get the PayPal payment Logo from [PayPal Logo Centre](https://www.paypal.com/in/webapps/mpp/logo-center) -After selecting PayPal as the payment method, you can continue to the [Process a Payment (PayPal)](Process-a-Payment-PayPal.md) process. +After selecting PayPal as the payment method, you can continue to the [Process a Payment (PayPal)](Process-a-Payment-PayPal.md) process. \ No newline at end of file diff --git a/docs/Process-a-Payment-ClicktoPay.md b/docs/Process-a-Payment-ClicktoPay.md new file mode 100644 index 00000000..751f9063 --- /dev/null +++ b/docs/Process-a-Payment-ClicktoPay.md @@ -0,0 +1,83 @@ +# Process a Payment (Visa Click to Pay) + +## Visa Click to Pay Processing Sequence Diagram + +![Visa Click to Pay Processing flow](images/Flow-Diagram-ClicktoPay.svg) + +## Process + +⚠️ **Shipping Address** : +The shipping address should be acquired from Visa Click to Pay. This can be set via the `init` javascript: + + V.init({ + apikey: "...", + paymentRequest: { + currencyCode: "GBP", + subtotal: "..." + }, + settings: { + shipping: { + collectShipping: "true", + acceptedRegions: ["GB"] + } + } + }); + +**If this method of collecting the shipping address is not used,a shipping address should be set on the cart before payment processing.** + +1. Create / prepare your cart + + a. Ensure your cart locale is set + + > **_NOTE:_** : If the cart has multiple shipping methods, the shipping address of the first available shipping method applied to the cart will be used to process the payment + +2. Create a Commercetools payment (https://docs.commercetools.com/api/projects/payments) and + populate the following + + | Property | Value | Required | Notes | + | ------------------------------------- | ----------------------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | + | customer | Reference to Commercetools customer | See notes | Required for non-guest checkout. If using MyPayments API this will automatically be set to the logged in customer. One of customer or anonymousId must be populated | + | anonymousId | Id for tracking guest checkout | See notes | Required for guest checkout. If using MyPayments API this will automatically be set. One of customer or anonymousId must be populated | + | paymentMethodInfo.paymentInterface | Cybersource | Yes | | + | paymentMethodInfo.method | visaCheckout | Yes | | + | amountPlanned | Amount to be processed | Yes | Should match cart gross total, unless split payments are being used | + | custom.type.key | isv_payment_data | Yes | | + | custom.fields.isv_token | Visa Click to Pay call Id | Yes | Obtain from the `callid` field on a successful Visa Click to Pay response | + | custom.fields.isv_deviceFingerprintId | Customer device fingerprint Id | Yes | Refer [Device Fingerprinting](./Decision-Manager.md#device-fingerprinting) to generate this value | + | custom.fields.isv_customerIpAddress | Customer IP address | Yes | Populated from client-side libraries | + | custom.fields.isv_saleEnabled | false | Yes | Set the value to true if sale is enabled | + | custom.fields.isv_walletType | Wallet type | No | This value is required if walletType is to be passed in authorization. Refer [Cybersource Processing a Payment](https://developer.cybersource.com/api-reference-assets/index.html#payments_payments_process-a-payment) for more information about the wallet type value to be passed. It is supported only for ApplePay, ClicktoPay and GooglePay payment methods| + | custom.fields.isv_merchantId | Merchant Id used for the transaction | No | Required when you want to support Multi-Mid functionality. Populate this field with the value of merchant Id in which the transaction should happen. When this field is empty, default mid configuration will be considered for the transaction. The same mid will be used for the follow-on transactions. | + | custom.fields.isv_shippingMethod | Shipping method for the order | No | Possible values: