Skip to content
This repository has been archived by the owner on Mar 12, 2021. It is now read-only.

Very malformed credit card numbers may result in spurious success #14

Open
DavidJProkopetz opened this issue Sep 5, 2018 · 0 comments

Comments

@DavidJProkopetz
Copy link

I've just run across a very strange edge case: in the event that a very malformed credit card number is passed, Moneris may return a null response code. Based on their documentation, this is presumably because it thinks it's received invalid XML. However, this library only seems to register an error if the response code is greater than or equal to 50, and a null response code evaluates to zero, causing the was_successful() function to spuriously return true.

I haven't fully determined the extent of the card number mangling that can cause Moneris to return a null response code, but passing a credit card number with fewer than 13 digits seems to trigger it reliably; this scenario can be encountered in practice if a user inadvertently omits a digit group when entering their credit card number, resulting in a 12-digit number.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant