Merge pull request #5 from CyberSource/v25.1.0

jbransvisa · web-flow · commit e2c7b84c293d · 2025-01-10T11:34:48.000-06:00
Fixed GitHub security scan issues
diff --git a/documentation/CJL/CJL.md b/documentation/CJL/CJL.md
diff --git a/documentation/sap-commerce.md b/documentation/sap-commerce.md
diff --git a/hybris/bin/b2b/isvb2bpaymentaddon/resources/isvb2bpaymentaddon.build.number b/hybris/bin/b2b/isvb2bpaymentaddon/resources/isvb2bpaymentaddon.build.number
@@ -5,5 +5,5 @@ name=isvb2bpaymentaddon
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
diff --git a/hybris/bin/b2b/isvfulfilmentprocess/resources/isvfulfilmentprocess.build.number b/hybris/bin/b2b/isvfulfilmentprocess/resources/isvfulfilmentprocess.build.number
@@ -5,5 +5,5 @@ name=isvfulfilmentprocess
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
diff --git a/hybris/bin/b2b/isvpayment/external-dependencies.xml b/hybris/bin/b2b/isvpayment/external-dependencies.xml
@@ -153,7 +153,7 @@
         <dependency>
             <groupId>com.nimbusds</groupId>
             <artifactId>nimbus-jose-jwt</artifactId>
-            <version>9.4.1</version>
+            <version>9.37.2</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okio</groupId>
diff --git a/hybris/bin/b2b/isvpayment/resources/isvpayment.build.number b/hybris/bin/b2b/isvpayment/resources/isvpayment.build.number
@@ -5,5 +5,5 @@ name=isvpayment
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
diff --git a/hybris/bin/b2b/isvpaymentsampledata/resources/isvpaymentsampledata.build.number b/hybris/bin/b2b/isvpaymentsampledata/resources/isvpaymentsampledata.build.number
@@ -5,5 +5,5 @@ name=isvpaymentsampledata
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
diff --git a/hybris/bin/b2c/isvb2cpaymentaddon/acceleratoraddon/web/webroot/_ui/responsive/common/js/isvb2cpaymentaddon.js b/hybris/bin/b2c/isvb2cpaymentaddon/acceleratoraddon/web/webroot/_ui/responsive/common/js/isvb2cpaymentaddon.js
diff --git a/hybris/bin/b2c/isvb2cpaymentaddon/resources/isvb2cpaymentaddon.build.number b/hybris/bin/b2c/isvb2cpaymentaddon/resources/isvb2cpaymentaddon.build.number
@@ -5,5 +5,5 @@ name=isvb2cpaymentaddon
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
diff --git a/hybris/bin/b2c/isvfulfilmentprocess/resources/isvfulfilmentprocess.build.number b/hybris/bin/b2c/isvfulfilmentprocess/resources/isvfulfilmentprocess.build.number
@@ -5,5 +5,5 @@ name=isvfulfilmentprocess
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
diff --git a/hybris/bin/b2c/isvpayment/external-dependencies.xml b/hybris/bin/b2c/isvpayment/external-dependencies.xml
@@ -153,7 +153,7 @@
         <dependency>
             <groupId>com.nimbusds</groupId>
             <artifactId>nimbus-jose-jwt</artifactId>
-            <version>9.4.1</version>
+            <version>9.37.2</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okio</groupId>
diff --git a/hybris/bin/b2c/isvpayment/resources/isvpayment.build.number b/hybris/bin/b2c/isvpayment/resources/isvpayment.build.number
@@ -5,5 +5,5 @@ name=isvpayment
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
diff --git a/hybris/bin/b2c/isvpaymentaddon/acceleratoraddon/web/webroot/WEB-INF/views/responsive/pages/checkout/alipay/alipay_simulator.jsp b/hybris/bin/b2c/isvpaymentaddon/acceleratoraddon/web/webroot/WEB-INF/views/responsive/pages/checkout/alipay/alipay_simulator.jsp
@@ -1,29 +1,68 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/
-xhtml1/DTD/xhtml1-transitional.dtd">
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/ xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
-<head>
+  <head>
     <title>This is an AliPay Simulator. No action is required.</title>
     <script type="text/javascript">
-        // Parse GET parameters
-        window.params = function()
-        {
-            var parameters = {};
-            var urlData = window.location.href.split('?')[1].split('&');
-            for(var i in urlData)
-            {
-                x = urlData[i].split('=');
+      // All functions need to be defined before they're used
+      // Parse GET parameters safely
+      window.params = (function () {
+        var parameters = {};
+        try {
+          if (window.location.href.indexOf("?") > -1) {
+            var urlData = window.location.href.split("?")[1].split("&");
+            for (var i in urlData) {
+              var x = urlData[i].split("=");
+              if (x[0] && x[1]) {
                 parameters[x[0]] = x[1];
+              }
             }
-            return parameters;
-        }();
-        // Redirect to HTTP GET "return_url" value
-        function Redirect()
-        {
-            window.location = decodeURIComponent((window.params.return_url).replace(/\+/g, '%20'))
+          }
+        } catch (e) {
+          console.error("Error parsing URL parameters");
         }
+        return parameters;
+      })();
+      // Simple URL validation - define this BEFORE Redirect function
+      function isValidUrl(url) {
+        try {
+          // If ACC.config is not available, fall back to basic validation
+          if (
+            typeof ACC !== "undefined" &&
+            ACC.config &&
+            ACC.config.contextPath
+          ) {
+            return url.indexOf(ACC.config.contextPath) === 0;
+          }
+          // Fallback: check if URL starts with / or current origin
+          return (
+            url.indexOf("/") === 0 || url.indexOf(window.location.origin) === 0
+          );
+        } catch (e) {
+          console.error("URL validation error:", e);
+          return false;
+        }
+      }
+      // Safer redirect function
+      function Redirect() {
+        try {
+          var returnUrl = window.params.return_url;
+          if (returnUrl) {
+            var decodedUrl = decodeURIComponent(
+              returnUrl.replace(/\+/g, "%20")
+            );
+            if (isValidUrl(decodedUrl)) {
+              window.location = decodedUrl;
+            } else {
+              console.error("Invalid redirect URL");
+            }
+          }
+        } catch (e) {
+          console.error("Redirect error:", e);
+        }
+      }
     </script>
-</head>
-<body onLoad="setTimeout('Redirect()', 3000)">
-<p>This is an AliPay Simulator. No action is required.</p>
-</body>
-</html>
+  </head>
+  <body onLoad="setTimeout('Redirect()', 3000)">
+    <p>This is an AliPay Simulator. No action is required.</p>
+  </body>
+</html>
diff --git a/hybris/bin/b2c/isvpaymentaddon/resources/isvpaymentaddon.build.number b/hybris/bin/b2c/isvpaymentaddon/resources/isvpaymentaddon.build.number
@@ -5,5 +5,5 @@ name=isvpaymentaddon
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
diff --git a/hybris/bin/b2c/isvpaymentsampledata/resources/isvpaymentsampledata.build.number b/hybris/bin/b2c/isvpaymentsampledata/resources/isvpaymentsampledata.build.number
@@ -5,5 +5,5 @@ name=isvpaymentsampledata
 builddate=20210318 1419
 releasedate=20210318 1509
 vendor=isv.sap
-version=24.1.0
+version=25.1.0
 version.api=2011
