URL-encode untrusted data in URLs

[awush-stripe]

Summary

Doyensec identified API injection vulnerabilities.

Motivation

https://jira.corp.stripe.com/browse/SAF-22964

Testing

• Added tests
• Modified tests
• Manually verified

Changelog

• [SECURITY]5798 URL-encode IDs used in URLs to prevent injection attacks.

[github-actions]

Diffuse output:

OLD: paymentsheet-example-release-master.apk (signature: none)
NEW: paymentsheet-example-release-pr.apk (signature: none)

          │          compressed          │         uncompressed          
          ├──────────┬──────────┬────────┼───────────┬───────────┬───────
 APK      │ old      │ new      │ diff   │ old       │ new       │ diff  
──────────┼──────────┼──────────┼────────┼───────────┼───────────┼───────
      dex │  5.4 MiB │  5.4 MiB │ +406 B │    14 MiB │    14 MiB │ +80 B 
     arsc │  1.9 MiB │  1.9 MiB │    0 B │   1.9 MiB │   1.9 MiB │   0 B 
 manifest │  4.3 KiB │  4.3 KiB │    0 B │  19.9 KiB │  19.9 KiB │   0 B 
      res │    1 MiB │    1 MiB │    0 B │   1.8 MiB │   1.8 MiB │   0 B 
   native │  2.6 MiB │  2.6 MiB │    0 B │     6 MiB │     6 MiB │   0 B 
    asset │    3 MiB │    3 MiB │  +17 B │     3 MiB │     3 MiB │ +17 B 
    other │ 83.1 KiB │ 83.1 KiB │    0 B │ 158.3 KiB │ 158.3 KiB │   0 B 
──────────┼──────────┼──────────┼────────┼───────────┼───────────┼───────
    total │   14 MiB │   14 MiB │ +423 B │  26.9 MiB │  26.9 MiB │ +97 B 

         │          raw           │             unique             
         ├────────┬────────┬──────┼────────┬────────┬──────────────
 DEX     │ old    │ new    │ diff │ old    │ new    │ diff         
─────────┼────────┼────────┼──────┼────────┼────────┼──────────────
   files │      2 │      2 │    0 │        │        │              
 strings │  87233 │  87238 │   +5 │  72823 │  72824 │ +1 (+4 -3)   
   types │  22757 │  22757 │    0 │  20489 │  20489 │  0 (+2 -2)   
 classes │  18393 │  18393 │    0 │  18393 │  18393 │  0 (+2 -2)   
 methods │  97719 │  97723 │   +4 │  93518 │  93517 │ -1 (+11 -12) 
  fields │ 104446 │ 104445 │   -1 │ 103162 │ 103162 │  0 (+2 -2)   

 ARSC    │ old  │ new  │ diff 
─────────┼──────┼──────┼──────
 configs │  334 │  334 │  0   
 entries │ 6294 │ 6294 │  0

APK

    compressed    │    uncompressed    │                               
─────────┬────────┼─────────┬──────────┤                               
 size    │ diff   │ size    │ diff     │ path                          
─────────┼────────┼─────────┼──────────┼───────────────────────────────
 3.3 MiB │ +878 B │ 8.2 MiB │ +1.4 KiB │ ∆ classes.dex                 
 2.1 MiB │ -472 B │ 5.8 MiB │ -1.3 KiB │ ∆ classes2.dex                
 8.1 KiB │  +17 B │ 7.9 KiB │    +17 B │ ∆ assets/dexopt/baseline.prof 
─────────┼────────┼─────────┼──────────┼───────────────────────────────
 5.4 MiB │ +423 B │  14 MiB │    +97 B │ (total)

DEX

STRINGS:

   old   │ new   │ diff       
  ───────┼───────┼────────────
   72823 │ 72824 │ +1 (+4 -3) 
  + Lcom/stripe/android/core/utils/EncodeKt_json_1;
  + Lcom/stripe/android/core/utils/EncodeKt;
  + encode(value, Charsets.UTF_8.name())
  + ~~R8{backend:dex,compilation-mode:release,has-checksums:false,min-api:21,pg-map-id:bcc2e25,r8-mode:compatibility,version:3.3.83}
  
  - ~~R8{backend:dex,compilation-mode:release,has-checksums:false,min-api:21,pg-map-id:ea64ee2,r8-mode:compatibility,version:3.3.83}
  - Lcom/stripe/android/stripecardscan/framework/util/EncodeKt_json_1;
  - Lcom/stripe/android/stripecardscan/framework/util/EncodeKt;
  

TYPES:

   old   │ new   │ diff      
  ───────┼───────┼───────────
   20489 │ 20489 │ 0 (+2 -2) 
  + Lcom/stripe/android/core/utils/EncodeKt_json_1;
  + Lcom/stripe/android/core/utils/EncodeKt;
  
  - Lcom/stripe/android/stripecardscan/framework/util/EncodeKt_json_1;
  - Lcom/stripe/android/stripecardscan/framework/util/EncodeKt;
  

METHODS:

   old   │ new   │ diff         
  ───────┼───────┼──────────────
   93518 │ 93517 │ -1 (+11 -12) 
  + com.stripe.android.core.utils.EncodeKt_json_1 <clinit>()
  + com.stripe.android.core.utils.EncodeKt_json_1 <init>()
  + com.stripe.android.core.utils.EncodeKt_json_1 invoke(Object) → Object
  + com.stripe.android.core.utils.EncodeKt_json_1 invoke(d)
  + com.stripe.android.core.utils.EncodeKt <clinit>()
  + com.stripe.android.core.utils.EncodeKt b64Encode(String) → String
  + com.stripe.android.core.utils.EncodeKt b64Encode(byte[]) → String
  + com.stripe.android.core.utils.EncodeKt decodeFromJson(a, String) → Object
  + com.stripe.android.core.utils.EncodeKt encodeToJson(k, Object) → String
  + com.stripe.android.core.utils.EncodeKt encodeToXWWWFormUrl(k, Object) → String
  + com.stripe.android.core.utils.EncodeKt urlEncode(String) → String
  
  - com.stripe.android.core.storage.SharedPreferencesStorage_Companion getLogTag() → String
  - com.stripe.android.core.storage.SharedPreferencesStorage access_getLogTag_cp() → String
  - com.stripe.android.stripecardscan.framework.util.EncodeKt_json_1 <clinit>()
  - com.stripe.android.stripecardscan.framework.util.EncodeKt_json_1 <init>()
  - com.stripe.android.stripecardscan.framework.util.EncodeKt_json_1 invoke(Object) → Object
  - com.stripe.android.stripecardscan.framework.util.EncodeKt_json_1 invoke(d)
  - com.stripe.android.stripecardscan.framework.util.EncodeKt <clinit>()
  - com.stripe.android.stripecardscan.framework.util.EncodeKt b64Encode(String) → String
  - com.stripe.android.stripecardscan.framework.util.EncodeKt b64Encode(byte[]) → String
  - com.stripe.android.stripecardscan.framework.util.EncodeKt decodeFromJson(a, String) → Object
  - com.stripe.android.stripecardscan.framework.util.EncodeKt encodeToJson(k, Object) → String
  - com.stripe.android.stripecardscan.framework.util.EncodeKt encodeToXWWWFormUrl(k, Object) → String
  

FIELDS:

   old    │ new    │ diff      
  ────────┼────────┼───────────
   103162 │ 103162 │ 0 (+2 -2) 
  + com.stripe.android.core.utils.EncodeKt_json_1 INSTANCE: EncodeKt_json_1
  + com.stripe.android.core.utils.EncodeKt json: a
  
  - com.stripe.android.stripecardscan.framework.util.EncodeKt_json_1 INSTANCE: EncodeKt_json_1
  - com.stripe.android.stripecardscan.framework.util.EncodeKt json: a