amzn / amazon-pay-sdk-java Goto Github PK

The [pom.xml] file was removed from this project on December 8th.

Please restore [pom.xml]

In Util:114 the line

in = new BufferedReader(new InputStreamReader(con.getErrorStream()));

does not take into account that con.getErrorStream() may return null, in such case a NPE will be thrown.

See https://docs.oracle.com/javase/7/docs/api/java/net/HttpURLConnection.html#getErrorStream()

Hi, I have an application that uses the SDK to retrieve shipping address details from amazon.co.jp accounts.
Everything was working fine when launching from Eclipse, but text returned garbled on our development server.
I found the likely cause is that "UTF-8" is not specified when the InputStreamReader is created here.

As a quick workaround we can specify -Dfile.encoding=UTF-8 when launching the application to force UTF-8 to be used, but it would be preferable if you can fix the SDK to specify "UTF-8" (or the handy StandardCharsets.UTF_8 from JDK7+) directly in the code.

Thanks.

edit: Our development server itself is set to UTF-8, but the docker container the application is launched in apparently is not. Either way, it would be best if the SDK doesn't rely on environment settings.

OSGi bundle description is missing inside MANIFEST.MF

Issue opened in the wrong project

EventType element of "Message" object is important to know what kind of Billing Notification came and use it accordingly.
Currently it is not part of "IPNMessageMetaData" object causing problem to parse manually rather than using the sdk.

Hello,
I see here: https://github.com/amzn/amazon-pay-sdk-java/releases
that 3.3.0 has been released, but the source code (pom.xml is still 3.1.0 ...)

Hi, I am using AmazonPay sdk for the payment in my app but sometimes i am getting crashes
"SourceFile line 12 in amazonpay.silentpay.n.a". I don't know why it is happening or how can i fix it.

We're experiencing an issue where requests made through the client have all headers removed, including a trace ID header we use to associate requests in our logs. We see in the code where the headers are being removed. Ideally, we would like to have the client keep all headers by default, or at least be able to specify certain headers (like the trace ID) that the client will keep on requests.

See the follwing sections

Making a createCheckoutSession request

JSONObject payload = new JSONObject();
JSONObject webCheckoutDetail = new JSONObject();
webCheckoutDetail.put("checkoutReviewReturnUrl", "https://localhost/store/checkout_review");
payload.put("webCheckoutDetail", webCheckoutDetail);

### Making an updateCheckoutSession request


AmazonPayResponse response = null;
JSONObject payload = new JSONObject();
JSONObject updateWebCheckoutDetail = new JSONObject();
updateWebCheckoutDetail.put("checkoutResultReturnUrl", "https://localhost/store/checkout_return");
payload.put("webCheckoutDetail", updateWebCheckoutDetail);

These should be changed to

Making a createCheckoutSession request

JSONObject payload = new JSONObject();
JSONObject webCheckoutDetails = new JSONObject();
webCheckoutDetails.put("checkoutReviewReturnUrl", "https://localhost/store/checkout_review");
payload.put("webCheckoutDetails", webCheckoutDetails);

### Making an updateCheckoutSession request

```java

AmazonPayResponse response = null;
JSONObject payload = new JSONObject();
JSONObject updateWebCheckoutDetails = new JSONObject();
updateWebCheckoutDetails.put("checkoutResultReturnUrl", "https://localhost/store/checkout_return");
payload.put("webCheckoutDetails", updateWebCheckoutDetails);

generateErrorException(ResponseData rawResponse) uses this:

    final XMLInputFactory xmlInputFactory = XMLInputFactory.newFactory();

public static T marshalXML(Class clazz, ResponseData rawResponse) uses this:

final XMLInputFactory xmlInputFactory = XMLInputFactory.newInstance();

For my environment, I changed them both to use newInstance(), as the jars that already in use on my site do not have the newFactory() method.

I only reported this because it seems inconsistent.

BTW, Thanks so much for all the work that has been put into this.

Hello,
i'm trying to integrate AmazonPay in our self developed shop system.
We've tried to set the proxy settings with
Config configkey = new PayConfig()
{snip}
.withProxyHost(OUR_PROXY)
.withProxyPort(PROXY_PORT)
.withProxyUsername("")
.withProxyPassword("");

Client client = new PayClient(configkey);

With this configuration we get an Connection refused exception. If we use a VPN to for example a private computer the connection will be correctly established.

Kind regards,
Daniel

Amazon Pay Java SDK version: 3.5.1

Looking at Util.java - line 186 we can see that the JVM property http.proxyPort is set everytime a) httpSendRequest(String method, ....., PayConfig config) is called and b) config.getProxyHost() on line 182 returns a reference to an object.

Let's take a closer look at line 186:

1. config.getProxyPort() returns the port number as a value of the primitive type int.
2. systemSettings.put() is called for setting the property http.proxyPort.
   According to the Oracle Java 8 Docs doing so "is strongly discouraged as they allow the caller to insert entries whose keys or values are not Strings. The setProperty method should be used instead."

The undesired consequences of using put() in combination with non-String values become clearly visible if we have a look at an actual implementation of Java's Properties.getProperty() method (e.g. the OpenJDK 8 implementation). We can see on line 970 that every property value that is not a String instance will become null. On line 971 we see that a default value might be returned instead of null in case defaults provides one.

Its obvious now that Properties.getProperty("http.proxyPort") for the whole JVM will return an undesired value of null (or some default value) if we set the proxy port number as an int value instead of a String.

Quick (but dirty) fix proposal

As a quick workaround we rewrote Util.java - line 186 to the following: systemSettings.put("http.proxyPort", Integer.valueOf(config.getProxyPort()).toString());

The benefit of this fix is that it introduces no API changes.
The downside of this fix is that we still don't comply with Oracle's recommendation regarding setting properties.

Other fix proposals

• Consider using System.setProperty("http.proxyPort", Integer.valueOf(config.getProxyPort()).toString())) to comply with Oracle's recommendation.
• Change the field PayConfig.proxyPort from int to String. Downside: API change.

I am having trouble with the latest version of the SDK:

java.lang.NoSuchMethodError: com.amazon.pay.impl.Util.getServiceURLEndpoint(Lcom/amazon/pay/Config;)Ljava/lang/String;
at com.amazon.pay.impl.PayClient.postRequest(PayClient.java:1182)
at com.amazon.pay.impl.PayClient.sendRequest(PayClient.java:1154)
at com.amazon.pay.impl.PayClient.setOrderReferenceDetails(PayClient.java:300)

3.4.0 is not in maven central. Do you plan to add it?
https://mvnrepository.com/artifact/com.amazon.pay/amazon-pay-java-sdk

When parsing the xml string (parameter data), the xml external entity is not disabled, and the attacker may control the data to perform the xml external entity injection attack.

Trying to parse the IPN Message using NotificationFactory.parseNotification(headerMap, bodyJson); results in a empty AuthorizationDetails. Debugging into the issue i found that the unmarshal of "NotificationData" is not successful and throws a Runtime Exception.

Exception in thread "main" java.lang.RuntimeException: unexpected element (uri:"", local:"AmazonAuthorizationId"). Expected elements are <{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}AuthorizationStatus>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}AuthorizationAmount>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}AddressVerificationCode>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}SoftDecline>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}AmazonAuthorizationId>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}CreationTimestamp>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}ExpirationTimestamp>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}CaptureNow>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}OrderItemCategories>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}AuthorizationFee>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}SellerAuthorizationNote>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}AuthorizationReferenceId>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}AuthorizationBillingAddress>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}IdList>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}SoftDescriptor>,<{http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01}CapturedAmount>

Also, noticed that the IPN Test cases does not check if the message is parsed correctly. So this will not be identified in JUnit tests.

I'm Attaching the json that i used and the java file that can be used for checking.
NOTE: Rename AuthorizationNotification3.txt -> AuthorizationNotification3.json and Test.txt -> Test.json

AuthorizationNotification3.txt
Test.txt

call the API get this error from amazon

Encountered marshalling error while marshalling data
ErrorResponse xmlns：http://mws.amazonservices.com/schema/OffAmazonPayments/2013-01-01
type: Sender
code:InvalidOrderReferenceId
message:The OrderReferenceId S03-2715707-3xxxxx is invalid
RequestId: d64cde91-53b3-4252-a6eb-f90984xxxxxxxx

what i did

①At order floor use the javascript from sandbox
(https://static-fe.payments-amazon.com/OffAmazonPayments/jp/sandbox/lpa/js/Widgets.js)

②use the OrderReferenceId to request
onOrderReferenceCreate: function(orderReference) {
orderReference.getAmazonOrderReferenceId(); //use this to request
}

③building Client
Config config = new PayConfig()
.withSellerId("xxxxxxxxxxxx")
.withAccessKey("XXXXXXXXXXXXXXXXXXXX")
.withSecretKey("XXXXXXXXXXXXXXXXXXXX")
.withCurrencyCode(CurrencyCode.JPY)
.withRegion(Region.JP)
.withSandboxMode(true)//because its test so sandboxMode use true

Client client = new PayClient(config);

④call api
GetOrderReferenceDetailsRequest req = new GetOrderReferenceDetailsRequest(amazonPayOrderReferenceId);
//optional parameters
req.setSellerId(config.getSellerId());
req.setAddressConsentToken(amazonPayToken);
//call api
GetOrderReferenceDetailsResponseData response = client.getOrderReferenceDetails(req);

Hi!

After the last commit on src/com/amazon/pay/impl/PayLogUtil.java (Line 128)

it generates a IllegalArgumentException calling the com.amazon.pay.response.parser.Parser methods, probably because there the accessExternalDTD has been set as not supported:

Stacktrace:

java.lang.IllegalArgumentException: Not supported: http://javax.xml.XMLConstants/property/accessExternalDTD at org.apache.xalan.processor.TransformerFactoryImpl.setAttribute(TransformerFactoryImpl.java:571) at com.amazon.pay.impl.PayLogUtil.getSanitizedData(PayLogUtil.java:126) at com.amazon.pay.impl.PayLogUtil.sanitizeString(PayLogUtil.java:75) at com.amazon.pay.response.parser.ResponseData.<init>(ResponseData.java:36) at com.amazon.pay.response.parser.GetOrderReferenceDetailsResponseData.<init>(GetOrderReferenceDetailsResponseData.java:30) at com.amazon.pay.response.parser.Parser.getOrderReferenceDetails(Parser.java:61)

The following line should be removed:

because it's a duplicate of line 1068.

Converting a byte array into a String may lead to data loss.

it is possible also to send money from merchant to a customer ? (opposite direction)

The IPN parser does not parse the SellerId and other attributes for IPNs such as Capture notification.
INotification only provides the notification type and no other common information.
We would like to obtain the SellerId and use it to verify that some random other seller did not set our URL for the IPNs.
Since we pass in the OffAmazonPaymentsServiceConfig when creating the NotificationParserFactory, I thought maybe the SDK was checking the sellerId internally, but this does not seem to be the case. As it is, we would have to parse the message again separately just to get the sellerId....

The IpnHandler.java example does not work with gson-2.x.x installed. It works fine with gson-1.7.1 and older versions. However, when the latest gson-2.3.1 is installed, a call to:

INotificationParser::parseRawMessage (HttpServletRequest req)

causes the following exception:

com.amazonservices.mws.offamazonpaymentsipn.NotificationsException: Error with message - content is not in json format
at com.amazonservices.mws.offamazonpaymentsipn.parsers.Message.
at com.amazonservices.mws.offamazonpaymentsipn.parsers.SnsNotificationParser.parseNotification
at com.amazonservices.mws.offamazonpaymentsipn.NotificationParser.parseRawMessage
at com.amazonservices.mws.offamazonpaymentsipn.NotificationParser.parseRawMessage

We are trying to retrieve the status of a merchant account like so:

Config conf = new PayConfig()
                .withAccessKey(AMAZONPAYACCESSKEY)
                .withSecretKey(AMAZONPAYSECRETKEY)
                .withCurrencyCode(CurrencyCode.USD)
                .withSandboxMode(false)
                .withRegion(Region.US);

		Client client = new PayClient(conf);
		
		final GetMerchantAccountStatusRequest request = new GetMerchantAccountStatusRequest();
		request.setSellerId("XXXX");
		request.setMWSAuthToken("XXXXXXX");
		
		final GetMerchantAccountStatusResponseData resp = client.getMerchantAccountStatus(request);

Please let us know how to resolve this.