juspay / juspay/hyperswitch

[BUG] : The request schema needs validation over card details

Open
#701 1 comment 0 reactions 0 assignees View on GitHub
A-payment-methods C-bug
Dominant language
Rust
Stars
43.6k
Forks
5.1k
Avg merge
2d 21h
Merged PRs (30d)
210

Description

### Bug Description

Currently the card details are being passed as string, and it is failing at connector call.

There is no check what values are being passed in `card_expiry_month`, `card_expiry_year` or `card_cvc`.

Anybody can pass random string, without conveying the liability of the wrong input

### Expected Behavior

While parsing the request, there should be a validation check over the fields to include what values are expected out of them so that it need not be applied at individual connectors.

### Actual Behavior

Currently all strings are accepted.

### Steps To Reproduce

- Create a Payments Request Call
- Put any string in `card_month` like `"card": {
"card_number": "4035 5010 0000 0008",
"card_exp_month": "av",
"card_exp_year": "cadge",
"card_holder_name": "john Doe",
"card_cvc": "bug"
}`

### Context For The Bug

_No response_

### Environment

Are you using hyperswitch hosted version? Yes/No
If yes, please provide the value of the `x-request-id` response header for helping us debug your issue.

If not (or if building/running locally), please provide the following details:
1. Operating System or Linux distribution:
2. Rust version (output of `rustc --version`): ``
3. App version (output of `cargo r -- --version`): ``

### Have you spent some time to check if this bug has been raised before?

- [X] I checked and didn't find similar issue

### Have you read the Contributing Guidelines?

- [X] I have read the [Contributing Guidelines](https://github.com/juspay/hyperswitch/blob/main/docs/CONTRIBUTING.md)

### Are you willing to submit a PR?

No, but I'm happy to collaborate on a PR with someone else

Contributor guide

Open the contributing guide

Research direction

Start at the request-parsing path for card_exp_month, card_exp_year, and card_cvc, then trace how those values reach connector calls. Define the accepted values from the request schema requirements and verify that invalid strings are rejected before connector invocation; the payload names no specific files or tests.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
api, payments
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.