Decode the sdk meta if url encoded meta is passed (#165)

* Decode the sdk meta if url encoded meta is passed * decode inline for null safety * fix flow error * remove type conversion
paypal · Sep 18, 2023 · 6e1ad20 · 6e1ad20
1 parent a102dd6
commit 6e1ad20
Show file tree

Hide file tree

Showing 4 changed files with 28 additions and 3 deletions.
diff --git a/server/meta.jsx b/server/meta.jsx
@@ -261,7 +261,9 @@ function sanitizeSDKUrl(sdkUrl: string): string {
 
 export function unpackSDKMeta(sdkMeta?: string): SDKMeta {
   const { url, attrs } = sdkMeta
-    ? JSON.parse(Buffer.from(sdkMeta, "base64").toString("utf8"))
+    ? JSON.parse(
+        Buffer.from(decodeURIComponent(sdkMeta), "base64").toString("utf8")
+      )
     : DEFAULT_SDK_META;
 
   if (url) {

diff --git a/src/experiment.js b/src/experiment.js
@@ -34,8 +34,10 @@ export function createExperiment(
 
     logCheckpoint({ treatment, checkpoint, payload }) {
       if (treatment.indexOf(name) !== -1) {
+        // $FlowFixMe
         log.info(`${treatment}_${checkpoint}`, payload);
       } else {
+        // $FlowFixMe
         log.info(`${name}_${treatment}_${checkpoint}`, payload);
       }
 

diff --git a/src/tracking.js b/src/tracking.js
@@ -113,8 +113,7 @@ export function setupLogger() {
     // https://www.paypal.com/buttons/smart
     // https://www.paypal.com/us/gifts/
     const isLoadedInFrame = isPayPalDomain() && window.xprops;
-    const sdkLoadTime =
-      typeof loadTime === "number" ? loadTime.toString() : undefined;
+    const sdkLoadTime = typeof loadTime === "number" ? loadTime : undefined;
 
     logger
       .info(`setup_${getEnv()}`)

diff --git a/test/server/meta.test.js b/test/server/meta.test.js
@@ -71,6 +71,28 @@ test("should construct a valid script url with paypalobjects", () => {
   }
 });
 
+test("should construct a valid script url with url encoded sdkMeta and trailing ? in checkout.js", () => {
+  const sdkUrl = "https://www.paypalobjects.com/api/checkout.js?";
+
+  const { getSDKLoader } = unpackSDKMeta(
+    encodeURIComponent(
+      Buffer.from(
+        JSON.stringify({
+          url: sdkUrl,
+        })
+      ).toString("base64")
+    )
+  );
+
+  const $ = cheerio.load(getSDKLoader());
+  const script = $("script[data-paypal-checkout]");
+  const src = script.attr("src");
+
+  if (src !== "https://www.paypalobjects.com/api/checkout.js") {
+    throw new Error(`unexpected script url ${src}`);
+  }
+});
+
 test("should construct a valid script url with checkout.js using the qa cdn", () => {
   const sdkUrl =
     "https://uideploy--staticcontent--7482d416a81b5--ghe.preview.dev.paypalinc.com/api/checkout.js";