search

kfrancis / chargify-dot-net

MIT License
20 stars 49 forks source link

ChargifyException Message may contain sensitive information #65

Closed rdsimes closed 5 years ago

rdsimes commented 5 years ago

We have noticed that some ChargifyException Message values contain sensitive information, namely the request body that was posted to chargify. Here is an abridged sample (bogus credit card number used)

[ChargifyException: The server returned 'Unprocessable Entity' with the status code 422 (422) when posting '<?xml version="1.0" encoding="UTF-8"?><subscription><credit_card_attributes><full_number>4111111111111119</full_number><expiration_month>10</expiration_month><expiration_year>2019</expiration_year><cvv>000</cvv><billing_country>NZ</billing_country></credit_card_attributes></subscription>'.]

Some request body values may be acceptable to include in the message but probably not any containing a cc number etc

Happy to have a crack at resolving this issue

kfrancis commented 5 years ago

Ok, I'll get that cleaned up: the full number is likely the only field that might be problematic.

kfrancis commented 5 years ago

This will be released in the next version.