search

lyang / braintree-rails

MIT License
65 stars 22 forks source link

Improve security of regexes to satisfy Rails 4. #2

Closed brandon-beacher closed 11 years ago

brandon-beacher commented 11 years ago

Rails 4 was failing with this message:

"The provided regular expression is using multiline anchors (^ or $), which may present a security risk. Did you mean to use \A and \z, or forgot to add the :multiline => true option?

lyang commented 11 years ago

Thank you very much for the fixes :thumbsup:

brandon-beacher commented 11 years ago

You're welcome - very nice code! I'm working with it now and may have more for you.

Have you considered adding transparent redirect support?

https://www.braintreepayments.com/docs/ruby/customers/create_tr

lyang commented 11 years ago

This gem should work with TR out of the box.

The only thing you will lose are the client side validations.

I have TR example at https://github.com/lyang/braintree-rails-example/tree/transparent_redirect

Thanks