Skip to content

Commit 5352e7f

Browse files
bprokopcbprokopc
committed
Spring boot examples update
1 parent 56eb168 commit 5352e7f

4 files changed

Lines changed: 46 additions & 9 deletions

File tree

‎java8/flex-sdk-spring-boot/src/main/java/com/cybersource/flex/application/CheckoutController.java‎

Lines changed: 23 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,14 @@
77
import com.cybersource.flex.sdk.FlexService;
88
import com.cybersource.flex.sdk.exception.FlexException;
99
import com.cybersource.flex.sdk.model.FlexPublicKey;
10+
import java.util.HashMap;
1011
import java.util.Map;
12+
import javax.servlet.http.HttpServletResponse;
1113
import javax.servlet.http.HttpSession;
1214
import org.springframework.beans.factory.annotation.Autowired;
1315
import org.springframework.stereotype.Controller;
1416
import org.springframework.ui.Model;
17+
import org.springframework.web.bind.annotation.ModelAttribute;
1518
import org.springframework.web.bind.annotation.RequestMapping;
1619
import org.springframework.web.bind.annotation.RequestMethod;
1720
import org.springframework.web.bind.annotation.RequestParam;
@@ -22,8 +25,14 @@ public class CheckoutController {
2225
@Autowired
2326
private FlexService flexService;
2427

28+
@ModelAttribute
29+
public void setFramingResponseHeader(HttpServletResponse response) {
30+
response.setHeader("X-Frame-Options", "DENY");
31+
}
32+
2533
@RequestMapping("/")
26-
String redirect() {
34+
String redirect(final HttpSession session) {
35+
session.invalidate();
2736
return "redirect:checkout";
2837
}
2938

@@ -39,7 +48,9 @@ String checkout(final HttpSession session, final Model model) throws FlexExcepti
3948
}
4049

4150
@RequestMapping(value = "/receipt", method = RequestMethod.POST)
42-
String receipt(@RequestParam final Map<String, Object> postParams, final HttpSession session, final Model model) throws FlexException {
51+
String receipt(@RequestParam Map<String, Object> postParams, final HttpSession session, final Model model) throws FlexException {
52+
postParams = validateUntrustedParameters(postParams);
53+
4354
// Read in the public key to be used and remove it from the session
4455
final FlexPublicKey key = (FlexPublicKey) session.getAttribute("flexPublicKey");
4556
session.removeAttribute("flexPublicKey"); // no longer needed
@@ -59,4 +70,14 @@ String receipt(@RequestParam final Map<String, Object> postParams, final HttpSes
5970
return "receipt";
6071
}
6172

73+
private Map<String, Object> validateUntrustedParameters(Map<String, Object> parameters) {
74+
Map<String, Object> retVal = new HashMap<>();
75+
// Each parameter must undergo proper validation / sanitization.
76+
// The type of validation to be implemented will vary between individual
77+
// Flex API integrations. It is merchant's responsibility to implement adequate
78+
// parameter validation for production deployments.
79+
parameters.forEach((k, v) -> retVal.put(k, v));
80+
return retVal;
81+
}
82+
6283
}

‎java8/flex-sdk-spring-boot/src/main/resources/templates/checkout.html‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,6 @@
5555
</div>
5656
<div class="col-xs-6">
5757
<select class="form-control" name="expiryYear" id="expiryYear">
58-
<option>2018</option>
5958
<option>2019</option>
6059
<option>2020</option>
6160
<option>2021</option>

‎java8/spring-boot/src/main/java/com/cybersource/flex/application/CheckoutController.java‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,16 @@
99
import com.cybersource.flex.models.KeyResult;
1010
import com.cybersource.flex.vdp.VDPEnpoints;
1111
import java.security.PublicKey;
12+
import java.util.HashMap;
1213
import java.util.Map;
1314
import javax.annotation.PostConstruct;
15+
import javax.servlet.http.HttpServletResponse;
1416
import javax.servlet.http.HttpSession;
1517
import org.springframework.beans.factory.annotation.Autowired;
1618
import org.springframework.beans.factory.annotation.Value;
1719
import org.springframework.stereotype.Controller;
1820
import org.springframework.ui.Model;
21+
import org.springframework.web.bind.annotation.ModelAttribute;
1922
import org.springframework.web.bind.annotation.RequestMapping;
2023
import org.springframework.web.bind.annotation.RequestMethod;
2124
import org.springframework.web.bind.annotation.RequestParam;
@@ -42,8 +45,14 @@ private void postConstruct() {
4245
restTemplate.getMessageConverters().add(0, new KeyParametersMessageConverter(apiKey, sharedSecret));
4346
}
4447

48+
@ModelAttribute
49+
public void setFramingResponseHeader(HttpServletResponse response) {
50+
response.setHeader("X-Frame-Options", "DENY");
51+
}
52+
4553
@RequestMapping("/")
46-
String redirect() {
54+
String redirect(final HttpSession session) {
55+
session.invalidate();
4756
return "redirect:checkout";
4857
}
4958

@@ -63,7 +72,9 @@ String checkout(final HttpSession session, final Model model) {
6372
}
6473

6574
@RequestMapping(value = "/receipt", method = RequestMethod.POST)
66-
String receipt(@RequestParam final Map<String, Object> postParams, final HttpSession session, final Model model) {
75+
String receipt(@RequestParam Map<String, Object> postParams, final HttpSession session, final Model model) {
76+
postParams = validateUntrustedParameters(postParams);
77+
6778
// Read in the public key to use and remove it from the session
6879
PublicKey flexPublicKey = (PublicKey) session.getAttribute("flexPublicKey");
6980
session.removeAttribute("flexPublicKey"); // no longer needed
@@ -89,9 +100,18 @@ String receipt(@RequestParam final Map<String, Object> postParams, final HttpSes
89100
* For demonstration purposes, all post parameters are added to the view
90101
* model to display data received from cardholder's browser.
91102
*/
92-
93103
model.addAttribute("postParams", postParams);
94104
return "receipt";
95105
}
96106

107+
private Map<String, Object> validateUntrustedParameters(Map<String, Object> parameters) {
108+
Map<String, Object> retVal = new HashMap<>();
109+
// Each parameter must undergo proper validation / sanitization.
110+
// The type of validation to be implemented will vary between individual
111+
// Flex API integrations. It is merchant's responsibility to implement adequate
112+
// parameter validation for production deployments.
113+
parameters.forEach((k, v) -> retVal.put(k, v));
114+
return retVal;
115+
}
116+
97117
}

‎java8/spring-boot/src/main/resources/templates/checkout.html‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -56,9 +56,6 @@
5656
</div>
5757
<div class="col-xs-6">
5858
<select class="form-control" name="cardExpirationYear" id="cardExpirationYear">
59-
<option>2016</option>
60-
<option>2017</option>
61-
<option>2018</option>
6259
<option>2019</option>
6360
<option>2020</option>
6461
<option>2021</option>

0 commit comments

Comments
 (0)