paytm/paytm_python_checksum

Checksum - Python Language

• More Details: https://developer.paytm.com/docs/checksum/#python

paytm_python_checksum's Issues

Error in getStringByParams method

I am trying to integrate my web application with Paytm gateway.

I get the following error when I try to verify checksum received from initiate-transaction API:

env/lib/python3.7/site-packages/paytmchecksum/PaytmChecksum.py:49: in verifySignature
    params = getStringByParams(params)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

params = {'authenticated': False, 'isPromoCodeValid': False, 'resultInfo': {'resultCode': '0000', 'resultMsg': 'Success', 'resultStatus': 'S'}, 'txnToken': 'dc844fa9d0014e649f214f20d97a032d1596632160847'}

    def getStringByParams(params):
        params_string = []
        for key in sorted(params.keys()):
>           value = params[key] if params[key] is not None and params[key].lower() != "null" else ""
E           AttributeError: 'bool' object has no attribute 'lower'

env/lib/python3.7/site-packages/paytmchecksum/PaytmChecksum.py:68: AttributeError

I think, the error is because we are trying to do lower() on a non-string object.

Insecure secret generation.

• This lib uses random to generate salts instead of secrets as recommended by the python docs.
• Is that an acceptable risk that is handled upstream at the API level or should I patch this lib to use secrets internally?

argument of type 'int' is not iterable

In get_param_string
if("|" in params[key] or (escape_refund == True and "REFUND" in params[key])):
TypeError: argument of type 'int' is not iterable

Add SECURITY.md

Hello 👋

I run a security community that finds and fixes vulnerabilities in OSS. A researcher (@justmorpheus) has found a potential issue, which I would be eager to share with you.

Could you add a SECURITY.md file with an e-mail address for me to send further details to? GitHub recommends a security policy to ensure issues are responsibly disclosed, and it would help direct researchers in the future.

Looking forward to hearing from you 👍

(cc @huntr-helper)

String case error

I am getting "No module named 'PaytmChecksum'" error as its "paytmchecksum" (installed through pip) and in your PaytmChecksum.py
from Crypto.Cipher import AES
also throws a ModuleNotFound error

ModuleNotFoundError: No module named 'Crypto'

env details:
Py Interpreter: Python 3.9.6
OS:

• Darwin LM0002232 20.6.0 Darwin Kernel Version 20.6.0: Wed Jun 23 00:26:31 PDT 2021; root:xnu-7195.141.2~5/RELEASE_X86_64 x86_64 Big-Sur
  &
• Windows 10

Problem:

Traceback (most recent call last): File "/pyprojects/py_env3.9/paytm_enquiry/enquire_paytm.py", line 6, in <module> from paytmchecksum import PaytmChecksum File "/pyprojects/py_env3.9/lib/python3.9/site-packages/paytmchecksum/__init__.py", line 1, in <module> from .PaytmChecksum import generateSignature, verifySignature, encrypt, decrypt File "/pyprojects/py_env3.9/lib/python3.9/site-packages/paytmchecksum/PaytmChecksum.py", line 7, in <module> from Crypto.Cipher import AES ModuleNotFoundError: No module named 'Crypto'

pip freeze:
certifi==2021.10.8 charset-normalizer==2.0.7 crypto==1.4.1 idna==3.2 Naked==0.1.31 path==16.2.0 paytmchecksum==1.7.0 pycryptodome==3.11.0 PyYAML==5.4.1 requests==2.26.0 shellescape==3.8.1

even if we install pycrypto, it still gives below error:

`
File "/projects/backend/pyprojects/py_env3.9/lib/python3.9/site-packages/crypto/Cipher/init.py", line 27, in
from Crypto.Cipher._mode_ecb import _create_ecb_cipher
ModuleNotFoundError: No module named 'Crypto'

`

Solution:

• either create a softlink for Cryptodome -> Crypto
• or we can submit a merge request to change line in https://github.com/paytm/Paytm_Python_Checksum/blob/master/paytmchecksum/PaytmChecksum.py#L7

change:
from Crypto.Cipher import AES
to
from Cryptodome.Cipher import AES

add description in pypi

verifySignature method fails for string params

Hello all,

I think there is an error in the following line:

https://github.com/paytm/Paytm_Python_Checksum/blob/master/paytmchecksum/PaytmChecksum.py#L46

del params["CHECKSUMHASH"]

The verifySignature method accepts params argument of both dict and string types. But this operation - ["CHECKSUMHASH"] can not be done on string types. We'll get the following error if we do so:

TypeError: string indices must be integers