Pull in security updates from main fork

CHANGELOG.md

@@ -1,3 +1,9 @@
+## 2.0.1
+* Fix form encoded by replacing CGI.escape with URI parser.
+
+## 2.0.0
+* Change URI.escape to CGI.escape which changes form encoding for spaces from "%20" to "+".
+
 ## 1.0.1
 * Fix Case Sensitivity of Content Type for deserialization process
 

README.md

@@ -1,6 +1,9 @@
+# Deprecation Notice:
+This SDK is deprecated; you can continue to use it, but no new features or support requests will be accepted. An integration with [the new Server SDK](https://github.com/paypal/PayPal-Server-SDKs) is recommended. Review the [docs](https://developer.paypal.com/serversdk/http/getting-started/how-to-get-started/) for details.
+
 ## Paypal HttpClient
 
-PaypasHttp is a generic HTTP Client.
+PaypalHttp is a generic HTTP Client.
 
 In it's simplest form, an [`HttpClient`](./lib/paypalhttp/http_client.rb) exposes an `#execute` method which takes an HTTP request, executes it against the domain described in an `Environment`, and returns an HTTP response.
 

lib/paypalhttp/serializers/form_encoded.rb

@@ -2,10 +2,14 @@
 
 module PayPalHttp
   class FormEncoded
+    def initialize
+      @parser = URI::Parser.new()
+    end
+
     def encode(request)
       encoded_params = []
       request.body.each do |k, v|
-        encoded_params.push("#{URI.escape(k.to_s)}=#{URI.escape(v.to_s)}")
+        encoded_params.push("#{@parser.escape(k.to_s)}=#{@parser.escape(v.to_s)}")
       end
 
       encoded_params.join("&")

lib/paypalhttp/version.rb

@@ -1 +1 @@
-VERSION = "1.0.1"
+VERSION = "2.0.1"

spec/paypalhttp/encoder_spec.rb

@@ -108,6 +108,39 @@
       expect(serialized).to eq("key=value%20with%20a%20space&another_key=1013")
     end
 
+    it 'encodes different special/unsafe characters when using a URI parser' do
+      req = OpenStruct.new({
+        :verb => "POST",
+        :path => "/v1/api",
+        :headers => {
+          "content-type" => "application/x-www-form-urlencoded; charset=utf8"
+        },
+        :body => {
+          :key => " ..<..>..%..{..}..|..^..`..!",
+          :another_key => 1013,
+        }
+      })
+      serialized = Encoder.new.serialize_request(req)
+
+      expect(serialized).to eq("key=%20..%3C..%3E..%25..%7B..%7D..%7C..%5E..%60..!&another_key=1013")
+    end
+
+    it 'does not encode links given certain special characters' do
+      req = OpenStruct.new({
+        :verb => "POST",
+        :path => "/v1/api",
+        :headers => {
+          "content-type" => "application/x-www-form-urlencoded; charset=utf8"
+        },
+        :body => {
+          :key => "https://localhost:3001/"
+        }
+      })
+      serialized = Encoder.new.serialize_request(req)
+
+      expect(serialized).to eq("key=https://localhost:3001/")
+    end
+
     it 'throws when content-type is unsupported' do
       req = OpenStruct.new({
         :headers  => {