Giter Club home page Giter Club logo

payment-gateway's Introduction

Payment Gateway

Build e2e tests Code Coverage

Running the app

In visual studio:

  • Right click on PaymentGateway.WebApi
  • Select Set as StartUp project
  • Select PaymentGateway.WebApi
    running in Visual Studio

In VSCode:

  • Go to Run and Debug
  • Select .NET Core Launch (web) from the drop-down at the top
  • Press the debug button
    running in VSCode

Testing

Test Credit card numbers that will pass validation.

See e2e\readme.md for more information on running the Cypress tests.

Assumptions

  • Format of the Merchant ID
  • Format of the Terminal ID
  • Only handling card payments. Other payment methods are "phase 2" of the project
  • If a payment fails, the payment needs to be submitted again, with a new Transaction Date

Decisions

I decided to test the API using Cypress because it's quick to configure and easy to use. Another benefit is that testing an API in 2 languages can highlight issues in the usage of the RESTful API (unit tests in c# and e2e in Javascript). If I used C# all the way through, I wouldn't see the pain of the different date formats as easily, because I would likely be using strongly-typed properties all the way through. Likely the payment gateway would be consumed by multiple different tech-stacks if is used widely enough.

I used fluent validation because it has some useful inbuilt validators such as the card number validator. I could have also used value types for each of the fields in the request to ensure they are valid values.

I used the MediatR library because I think that the mediator pattern helps create a clean architecture within the app.

I have tried to optimise for readibility of the code, and tried to not prematurely refactor. As such decisions like splitting the logic into multiple projects, or splitting a function out into another class have been deferred until there's more information eg way more logic, way more objects.

I didn't unit test the MakeAPaymentRequestHandler class because each branch in the logic is tested by the Cypress tests. Given more time I might consider useful tests for this class.

What I would do differently

  • Instead of relying on datetime, I might use a library such as noda time for more reliable dates.
  • I would containerise this API. My PC is "Windows 10 Home" so it's a bit of a pain to install docker on.
  • I may get rid of the magic strings in the validation logic. I held off for the time being because I think that some of the messages needed to be customised according to which validation rule triggered the error.
  • If I were working with others to get this project completed, I would most likely use short-lived branches and create PRs for review. In this case it seemed overkill to branch and merge all the time.
  • I might implement the decorator pattern for logging and other things such as telemetry and caching.
  • I would implement persistent storage. ATM I'm storing in memory, but lots of storage options would be easier to implement with an instance already up-and running or docker instaled on my PC. I would likely keep the in memory implementation for local testing.

payment-gateway's People

Contributors

eloisetaylor5693 avatar mend-bolt-for-github[bot] avatar

Stargazers

 avatar

Watchers

 avatar

payment-gateway's Issues

CVE-2022-3517 (High) detected in minimatch-3.0.4.tgz

CVE-2022-3517 - High Severity Vulnerability

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /e2e/package.json

Path to vulnerable library: /e2e/node_modules/minimatch/package.json

Dependency Hierarchy:

  • cypress-7.3.0.tgz (Root Library)
    • tmp-0.2.1.tgz
      • rimraf-3.0.2.tgz
        • glob-7.1.7.tgz
          • minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: aaf881ee764b9b2848e6889e183423b62e2b0f12

Found in base branch: main

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5


Step up your Open Source Security Game with Mend here

CVE-2019-0820 (High) detected in system.text.regularexpressions.4.3.0.nupkg, system.text.regularexpressions.4.1.0.nupkg

CVE-2019-0820 - High Severity Vulnerability

Vulnerable Libraries - system.text.regularexpressions.4.3.0.nupkg, system.text.regularexpressions.4.1.0.nupkg

system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /src/PaymentGateway.UnitTests/PaymentGateway.UnitTests.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • nunit3testadapter.3.17.0.nupkg (Root Library)
    • system.xml.xmldocument.4.3.0.nupkg
      • system.xml.readerwriter.4.3.0.nupkg
        • system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)
system.text.regularexpressions.4.1.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.1.0.nupkg

Path to dependency file: /src/PaymentGateway.WebApi/PaymentGateway.WebApi.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.regularexpressions/4.1.0/system.text.regularexpressions.4.1.0.nupkg

Dependency Hierarchy:

  • serilog.aspnetcore.4.1.0.nupkg (Root Library)
    • serilog.settings.configuration.3.1.0.nupkg
      • microsoft.extensions.dependencymodel.2.0.4.nupkg
        • newtonsoft.json.9.0.1.nupkg
          • system.text.regularexpressions.4.1.0.nupkg (Vulnerable Library)

Found in HEAD commit: aaf881ee764b9b2848e6889e183423b62e2b0f12

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1


Step up your Open Source Security Game with Mend here

CVE-2021-43138 (High) detected in async-3.2.0.tgz

CVE-2021-43138 - High Severity Vulnerability

Vulnerable Library - async-3.2.0.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-3.2.0.tgz

Path to dependency file: /e2e/package.json

Path to vulnerable library: /e2e/node_modules/async/package.json

Dependency Hierarchy:

  • cypress-7.3.0.tgz (Root Library)
    • getos-3.2.1.tgz
      • async-3.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 3.2.2

Direct dependency fix Resolution (cypress): 7.4.0


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.