Skip to content

fix(billing): replace text/template with strings.Replace in checkout URL templating#1619

Open
rohilsurana wants to merge 2 commits into
mainfrom
fix/billing-checkout-url-template-injection
Open

fix(billing): replace text/template with strings.Replace in checkout URL templating#1619
rohilsurana wants to merge 2 commits into
mainfrom
fix/billing-checkout-url-template-injection

Conversation

@rohilsurana
Copy link
Copy Markdown
Member

Summary

  • templatizeUrls used Go's text/template to process user-supplied SuccessUrl and CancelUrl, which supports arbitrary function calls and complex expressions beyond simple variable interpolation
  • Replaced with strings.Replace since the only placeholder is {{.CheckoutID}}
  • Removes text/template and bytes imports, adds strings
  • Simplifies function signature by removing the error return (string replacement cannot fail)

Test plan

  • go build and go vet pass
  • Verify checkout flow still substitutes {{.CheckoutID}} correctly in success/cancel URLs

@vercel
Copy link
Copy Markdown

vercel Bot commented May 15, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
frontier Ready Ready Preview, Comment May 15, 2026 0:54am

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai Bot commented May 15, 2026

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: d243bc67-f2ab-46f5-9da1-5ae3f79d1dcb

📥 Commits

Reviewing files that changed from the base of the PR and between 97028bf and 091670f.

📒 Files selected for processing (1)
  • billing/checkout/service.go
🚧 Files skipped from review as they are similar to previous changes (1)
  • billing/checkout/service.go

📝 Walkthrough

Summary by CodeRabbit

  • Refactor
    • Simplified internal checkout URL handling to reduce complexity and streamline session creation, improving reliability and maintainability without changing user-facing behavior.

Walkthrough

billing/checkout/service.go simplifies URL templating by replacing Go's text/template parsing with direct string replacement. The templatizeUrls helper now performs simple {{.CheckoutID}} placeholder substitution and returns only a Checkout, eliminating error handling. The Create and CreateSessionForPaymentMethod methods remove their error checks for this helper.

Changes

URL templating simplification

Layer / File(s) Summary
Simplify templatizeUrls to string replacement
billing/checkout/service.go
templatizeUrls is rewritten from text/template parsing/execution to direct strings.Replace placeholder substitution and returns only Checkout without error. Imports are updated to remove bytes and text/template while keeping strings.
Update call sites to remove error handling
billing/checkout/service.go
Create and CreateSessionForPaymentMethod no longer check for errors from templatizeUrls and assign the templated checkout directly.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Suggested reviewers

  • whoAbhishekSah
🚥 Pre-merge checks | ✅ 2
✅ Passed checks (2 passed)
Check name Status Explanation
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

  • Generate code and open pull requests
  • Plan features and break down work
  • Investigate incidents and troubleshoot customer tickets together
  • Automate recurring tasks and respond to alerts with triggers
  • Summarize progress and report instantly

Built for teams:

  • Shared memory across your entire org—no repeating context
  • Per-thread sandboxes to safely plan and execute work
  • Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
billing/checkout/service.go (1)

488-493: ⚡ Quick win

Consider using strings.ReplaceAll for better readability.

The implementation correctly replaces the checkout ID placeholder. For improved code clarity, consider using strings.ReplaceAll (available since Go 1.12) instead of strings.Replace with -1:

✨ Proposed refactor
 func (s *Service) templatizeUrls(ch Checkout, checkoutID string) Checkout {
-	ch.SuccessUrl = strings.Replace(ch.SuccessUrl, "{{.CheckoutID}}", checkoutID, -1)
-	ch.CancelUrl = strings.Replace(ch.CancelUrl, "{{.CheckoutID}}", checkoutID, -1)
+	ch.SuccessUrl = strings.ReplaceAll(ch.SuccessUrl, "{{.CheckoutID}}", checkoutID)
+	ch.CancelUrl = strings.ReplaceAll(ch.CancelUrl, "{{.CheckoutID}}", checkoutID)
 	return ch
 }

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 958b8017-818d-4798-9243-affca3811f58

📥 Commits

Reviewing files that changed from the base of the PR and between c922ba4 and 97028bf.

📒 Files selected for processing (1)
  • billing/checkout/service.go

@coveralls
Copy link
Copy Markdown

coveralls commented May 15, 2026

Coverage Report for CI Build 25918869693

Coverage increased (+0.03%) to 42.339%

Details

  • Coverage increased (+0.03%) from the base build.
  • Patch coverage: 6 uncovered changes across 1 file (0 of 6 lines covered, 0.0%).
  • 2 coverage regressions across 1 file.

Uncovered Changes

File Changed Covered %
billing/checkout/service.go 6 0 0.0%

Coverage Regressions

2 previously-covered lines in 1 file lost coverage.

File Lines Losing Coverage Coverage
billing/checkout/service.go 2 0.0%

Coverage Stats

Coverage Status
Relevant Lines: 37712
Covered Lines: 15967
Line Coverage: 42.34%
Coverage Strength: 11.87 hits per line

💛 - Coveralls

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants