AC-8119: Fedex Shipping Method Configuration Fix

Author: pawan-adobe-security

app/code/Magento/Fedex/Model/Config/Backend/FedexUrl.php

@@ -0,0 +1,74 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\Fedex\Model\Config\Backend;
+
+use Magento\Framework\App\Cache\TypeListInterface;
+use Magento\Framework\App\Config\ScopeConfigInterface;
+use Magento\Framework\App\Config\Value;
+use Magento\Framework\Data\Collection\AbstractDb;
+use Magento\Framework\Exception\ValidatorException;
+use Magento\Framework\Model\Context;
+use Magento\Framework\Model\ResourceModel\AbstractResource;
+use Magento\Framework\Registry;
+use Magento\Framework\Validator\Url;
+use Magento\Framework\Model\AbstractModel;
+
+/**
+ * Represents a config URL that may point to a Fedex endpoint
+ */
+class FedexUrl extends Value
+{
+    /**
+     * @var Url
+     */
+    private Url $url;
+
+    /**
+     * @param Context $context
+     * @param Registry $registry
+     * @param ScopeConfigInterface $config
+     * @param TypeListInterface $cacheTypeList
+     * @param AbstractResource|null $resource
+     * @param AbstractDb|null $resourceCollection
+     * @param Url $url
+     * @param array $data
+     */
+    public function __construct(
+        Context $context,
+        Registry $registry,
+        ScopeConfigInterface $config,
+        TypeListInterface $cacheTypeList,
+        AbstractResource $resource = null,
+        AbstractDb $resourceCollection = null,
+        Url $url,
+        array $data = []
+    ) {
+        $this->url = $url;
+        parent::__construct($context, $registry, $config, $cacheTypeList, $resource, $resourceCollection, $data);
+    }
+
+    /**
+     * @inheritdoc
+     * @throws ValidatorException
+     */
+    public function beforeSave(): AbstractModel
+    {
+        $isValid = $this->url->isValid($this->getValue());
+        if ($isValid) {
+            // phpcs:ignore Magento2.Functions.DiscouragedFunction
+            $host = parse_url((string)$this->getValue(), \PHP_URL_HOST);
+
+            if (!empty($host) && !preg_match('/(?:.+\.|^)fedex\.com$/i', $host)) {
+                throw new ValidatorException(__('Fedex API endpoint URL\'s must use fedex.com'));
+            }
+        }
+
+        return parent::beforeSave();
+    }
+}

app/code/Magento/Fedex/Test/Unit/Model/Config/Backend/FedexUrlTest.php

@@ -0,0 +1,88 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+declare(strict_types=1);
+
+namespace Magento\Fedex\Test\Unit\Model\Config\Backend;
+
+use Magento\Fedex\Model\Config\Backend\FedexUrl;
+use Magento\Framework\Exception\ValidatorException;
+use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * Verify behavior of FedexUrl backend type
+ */
+class FedexUrlTest extends TestCase
+{
+
+    /**
+     * @var FedexUrl
+     */
+    private $config;
+
+    protected function setUp(): void
+    {
+        $objectManager = new ObjectManager($this);
+        /** @var FedexUrl $fedexUrl */
+        $this->config = $objectManager->getObject(FedexUrl::class);
+    }
+
+    /**
+     * @dataProvider validDataProvider
+     * @param string|null $data The valid data
+     * @throws ValidatorException
+     */
+    public function testBeforeSave(string $data = null)
+    {
+        $this->config->setValue($data);
+        $this->config->beforeSave();
+    }
+
+    /**
+     * @dataProvider invalidDataProvider
+     * @param string $data The invalid data
+     */
+    public function testBeforeSaveErrors(string $data)
+    {
+        $this->expectException('Magento\Framework\Exception\ValidatorException');
+        $this->expectExceptionMessage('Fedex API endpoint URL\'s must use fedex.com');
+        $this->config->setValue($data);
+        $this->config->beforeSave();
+    }
+
+    /**
+     * Validator Data Provider
+     *
+     * @return array
+     */
+    public function validDataProvider(): array
+    {
+        return [
+            [],
+            [null],
+            [''],
+            ['http://fedex.com'],
+            ['https://foo.fedex.com'],
+            ['http://foo.fedex.com/foo/bar?baz=bash&fizz=buzz'],
+        ];
+    }
+
+    /**
+     * @return \string[][]
+     */
+    public function invalidDataProvider(): array
+    {
+        return [
+            ['http://fedexfoo.com'],
+            ['https://foofedex.com'],
+            ['https://fedex.com.fake.com'],
+            ['https://fedex.info'],
+            ['http://fedex.com.foo.com/foo/bar?baz=bash&fizz=buzz'],
+            ['http://foofedex.com/foo/bar?baz=bash&fizz=buzz'],
+        ];
+    }
+}

app/code/Magento/Fedex/etc/adminhtml/system.xml

@@ -40,12 +40,14 @@
                 </field>
                 <field id="production_webservices_url" translate="label" type="text" sortOrder="90" showInDefault="1" showInWebsite="1" canRestore="1">
                     <label>Web-Services URL (Production)</label>
+                    <backend_model>Magento\Fedex\Model\Config\Backend\FedexUrl</backend_model>
                     <depends>
                         <field id="sandbox_mode">0</field>
                     </depends>
                 </field>
                 <field id="sandbox_webservices_url" translate="label" type="text" sortOrder="100" showInDefault="1" showInWebsite="1" canRestore="1">
                     <label>Web-Services URL (Sandbox)</label>
+                    <backend_model>Magento\Fedex\Model\Config\Backend\FedexUrl</backend_model>
                     <depends>
                         <field id="sandbox_mode">1</field>
                     </depends>

app/code/Magento/Fedex/i18n/en_US.csv

@@ -78,3 +78,4 @@ Debug,Debug
 "Show Method if Not Applicable","Show Method if Not Applicable"
 "Sort Order","Sort Order"
 "Can't convert a shipping cost from ""%1-%2"" for FedEx carrier.","Can't convert a shipping cost from ""%1-%2"" for FedEx carrier."
+"Fedex API endpoint URL\'s must use fedex.com","Fedex API endpoint URL\'s must use fedex.com"