It's possible to put whitespace into the Stripe keys, and then the only thing that happens is you get a JS console error and lots of misbehavior. Trim whitespace from the keys before saving.

Edit: Also validate the key format to be exactly what it should be.

CommentFileSizeAuthor
#4 uc_stripe.validate_keys_2605838_04.patch7.59 KBrfay

Comments

rfay created an issue. See original summary.

ayesh’s picture

ayesh commented

Could you look into https://security.drupal.org/node/156634 please?

I think that issue and this one can be done in a single shot.

rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented
Title: Trim whitespace from keys » Trim whitespace from keys and validate key format
Issue summary: View changes
rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented
Status: Active » Needs review
StatusFileSize
new uc_stripe.validate_keys_2605838_04.patch7.59 KB

This patch does 4 things that were recently discovered as necessary:

1. Catches exception thrown by Stripe.js if a key is invalid (or perhaps as-yet undiscovered exceptions)
2. Trims whitespace of entered keys in the Stripe settings form and applies check_plain()
3. Validates keys against a regex that excludes all but alphanumeric and underscore
4. Runs check_plain against any key retrieved from variable_get().

  • rfay committed ba81f78 on 7.x-2.x 
    Issue #2605838 by rfay: Trim whitespace from keys and validate key...
rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented
Status: Needs review » Fixed

Fixed in ba81f78 for 7.x-2.x, now reworking for 6.x-2.x

  • rfay committed b73b342 on 6.x-2.x 
    Issue #2605838 by rfay: Trim whitespace from keys and validate key...
rfay’s picture

rfay
he,him
Primary language English
Location Palisade, CO, USA
commented

Fixed in b73b342 for 6.x-2.x-dev

Although there were no reviews of these patches, reviews are still welcome if you see any issues.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.