Language: Python
Label: safe
CWE: CWE-203 \u2014 Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.

Code:
def handle_authorization(notification: Dict[str, Any], gateway_config: GatewayConfig):
    mark_capture = gateway_config.auto_capture
    if mark_capture:
        # If we mark order as a capture by default we don't need to handle auth actions
        return
    payment = get_payment(notification.get("merchantReference"))
    if not payment:
        # We don't know anything about that payment
        return

    transaction_id = notification.get("pspReference")
    transaction = get_transaction(payment, transaction_id, TransactionKind.AUTH)
    if transaction:
        # We already marked it as Auth
        return

    transaction = create_new_transaction(notification, payment, TransactionKind.AUTH)

    success_msg = "Adyen: The payment request was successful."
    failed_msg = "Adyen: The payment request failed."
    create_payment_notification_for_order(
        payment, success_msg, failed_msg, transaction.is_success
    )