CVE-2017-0907 (published 2017-11-13T17:29Z)

The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-918
cwe_name: Server-Side Request Forgery (SSRF)
description: The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
extended_description: By providing URLs to unexpected hosts or ports, attackers can make it appear that the server is sending the request, possibly bypassing access controls such as firewalls that prevent the attackers from accessing the URLs directly. The server can be used as a proxy to conduct port scanning of hosts in internal networks, use other URLs such as that can access documents on the system (using file://), or use other protocols such as gopher:// or tftp://, which may provide greater control over the contents of requests.
         

Fix information:
repo_url: https://github.com/recurly/recurly-client-net
commit_details: repo_url: https://github.com/recurly/recurly-client-net
author: benjamin eckel
author_date: 2017-11-08 14:35:49-08:00
msg: SSRF fix: replace EscapeUriString with EscapeDataString
repository: repo_url: https://github.com/recurly/recurly-client-net
repo_name: recurly/recurly-client-dotnet
description: A .NET API wrapper for Recurly.
repo_language: C#
owner: recurly
file_changes: filename: Account.cs
change_type: ModificationType.MODIFY
diff: @@ -145,7 +145,7 @@ namespace Recurly
         public void DeleteBillingInfo()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete,
-                UrlPrefix + Uri.EscapeUriString(AccountCode) + "/billing_info");
+                UrlPrefix + Uri.EscapeDataString(AccountCode) + "/billing_info");
             _billingInfo = null;
         }
 
@@ -165,7 +165,7 @@ namespace Recurly
         {
             // PUT /accounts/<account code>
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(AccountCode),
+                UrlPrefix + Uri.EscapeDataString(AccountCode),
                 WriteXml);
         }
 
@@ -199,7 +199,7 @@ namespace Recurly
         {
             var i = invoice ?? new Invoice();
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-                UrlPrefix + Uri.EscapeUriString(AccountCode) + "/invoices",
+                UrlPrefix + Uri.EscapeDataString(AccountCode) + "/invoices",
                 i.WriteXml,
                 i.ReadXml);
 
@@ -213,7 +213,7 @@ namespace Recurly
         {
             var i = invoice ?? new Invoice();
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-                UrlPrefix + Uri.EscapeUriString(AccountCode) + "/invoices/preview",
+                UrlPrefix + Uri.EscapeDataString(AccountCode) + "/invoices/preview",
                 i.WriteXml,
                 i.ReadXml);
 
@@ -231,7 +231,7 @@ namespace Recurly
         {
             var adjustments = new AdjustmentList();
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                UrlPrefix + Uri.EscapeUriString(AccountCode) + "/adjustments/"
+                UrlPrefix + Uri.EscapeDataString(AccountCode) + "/adjustments/"
                 + Build.QueryStringWith(Adjustment.AdjustmentState.Any == state ? "" : "state=" + state.ToString().EnumNameToTransportCase())
                 .AndWith(Adjustment.AdjustmentType.All == type ? "" : "type=" + type.ToString().EnumNameToTransportCase())
                 , adjustments.ReadXmlList);
@@ -247,7 +247,7 @@ namespace Recurly
         {
             var shippingAddresses = new ShippingAddressList(this);
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                UrlPrefix + Uri.EscapeUriString(AccountCode) + "/shipping_addresses/",
+                UrlPrefix + Uri.EscapeDataString(AccountCode) + "/shipping_addresses/",
                 shippingAddresses.ReadXmlList);
 
             return statusCode == HttpStatusCode.NotFound ? null : shippingAddresses;
@@ -269,7 +269,7 @@ namespace Recurly
         /// <returns></returns>
         public RecurlyList<Subscription> GetSubscriptions(Subscription.SubscriptionState state = Subscription.SubscriptionState.All)
         {
-            return new SubscriptionList(UrlPrefix + Uri.EscapeUriString(AccountCode) + "/subscriptions/"
+            return new SubscriptionList(UrlPrefix + Uri.EscapeDataString(AccountCode) + "/subscriptions/"
                 + Build.QueryStringWith(state.Equals(Subscription.SubscriptionState.All) ? "" : "state=" + state.ToString().EnumNameToTransportCase()));
         }
 
@@ -282,14 +282,14 @@ namespace Recurly
         public RecurlyList<Transaction> GetTransactions(TransactionList.TransactionState state = TransactionList.TransactionState.All,
             TransactionList.TransactionType type = TransactionList.TransactionType.All)
         {
-            return new TransactionList(UrlPrefix + Uri.EscapeUriString(AccountCode) + "/transactions/"
+            return new TransactionList(UrlPrefix + Uri.EscapeDataString(AccountCode) + "/transactions/"
                  + Build.QueryStringWith(state != TransactionList.TransactionState.All ? "state=" + state.ToString().EnumNameToTransportCase() : "")
                    .AndWith(type != TransactionList.TransactionType.All ? "type=" + type.ToString().EnumNameToTransportCase() : ""));
         }
 
         public RecurlyList<Note> GetNotes()
         {
-            return new NoteList(UrlPrefix + Uri.EscapeUriString(AccountCode) + "/notes/");
+            return new NoteList(UrlPrefix + Uri.EscapeDataString(AccountCode) + "/notes/");
         }
 
         /// <summary>
@@ -328,7 +328,7 @@ namespace Recurly
             var redemptions = new CouponRedemptionList();
 
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                UrlPrefix + Uri.EscapeUriString(AccountCode) + "/redemptions",
+                UrlPrefix + Uri.EscapeDataString(AccountCode) + "/redemptions",
                 redemptions.ReadXmlList);
 
             return statusCode == HttpStatusCode.NotFound ? null : redemptions;
@@ -560,7 +560,7 @@ namespace Recurly
             var account = new Account();
             // GET /accounts/<account code>
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                UrlPrefix + Uri.EscapeUriString(accountCode),
+                UrlPrefix + Uri.EscapeDataString(accountCode),
                 account.ReadXml);
 
             return statusCode == HttpStatusCode.NotFound ? null : account;
@@ -575,7 +575,7 @@ namespace Recurly
         {
             // DELETE /accounts/<account code>
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete,
-                Account.UrlPrefix + Uri.EscapeUriString(accountCode));
+                Account.UrlPrefix + Uri.EscapeDataString(accountCode));
         }
 
         /// <summary>
@@ -586,7 +586,7 @@ namespace Recurly
         {
             // PUT /accounts/<account code>/reopen
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                Account.UrlPrefix + Uri.EscapeUriString(accountCode) + "/reopen");
+                Account.UrlPrefix + Uri.EscapeDataString(accountCode) + "/reopen");
         }
 
         /// <summary>

programming_language: C#
filename: AccountBalance.cs
change_type: ModificationType.MODIFY
diff: @@ -19,7 +19,7 @@ namespace Recurly
             var accountBalance = new AccountBalance();
 
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                UrlPrefix + Uri.EscapeUriString(accountCode) + "/balance", accountBalance.ReadXml);
+                UrlPrefix + Uri.EscapeDataString(accountCode) + "/balance", accountBalance.ReadXml);
 
             return statusCode == HttpStatusCode.NotFound ? null : accountBalance;
         }

programming_language: C#
filename: AddOn.cs
change_type: ModificationType.MODIFY
diff: @@ -64,7 +64,7 @@ namespace Recurly
         public void Create()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-                UrlPrefix + Uri.EscapeUriString(PlanCode) + UrlPostfix,
+                UrlPrefix + Uri.EscapeDataString(PlanCode) + UrlPostfix,
                 WriteXml,
                 ReadXml);
         }
@@ -75,7 +75,7 @@ namespace Recurly
         public void Update()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(PlanCode) + UrlPostfix + Uri.EscapeUriString(AddOnCode),
+                UrlPrefix + Uri.EscapeDataString(PlanCode) + UrlPostfix + Uri.EscapeDataString(AddOnCode),
                 WriteXml,
                 ReadXml);
         }
@@ -86,7 +86,7 @@ namespace Recurly
         public void Delete()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete,
-                UrlPrefix + Uri.EscapeUriString(PlanCode) + UrlPostfix + Uri.EscapeUriString(AddOnCode));
+                UrlPrefix + Uri.EscapeDataString(PlanCode) + UrlPostfix + Uri.EscapeDataString(AddOnCode));
         }
 
 

programming_language: C#
filename: Adjustment.cs
change_type: ModificationType.MODIFY
diff: @@ -115,7 +115,7 @@ namespace Recurly
         {
             // POST /accounts/<account code>/adjustments
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-                UrlPrefix + Uri.EscapeUriString(AccountCode) + UrlPostfix,
+                UrlPrefix + Uri.EscapeDataString(AccountCode) + UrlPostfix,
                 WriteXml,
                 ReadXml);
         }
@@ -129,7 +129,7 @@ namespace Recurly
         {
             // DELETE /adjustments/<uuid>
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete,
-                UrlPostfix + Uri.EscapeUriString(Uuid));
+                UrlPostfix + Uri.EscapeDataString(Uuid));
         }
 
 
@@ -284,7 +284,7 @@ namespace Recurly
         {
             var adjustment = new Adjustment();
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                "/adjustments/" + Uri.EscapeUriString(uuid),
+                "/adjustments/" + Uri.EscapeDataString(uuid),
                 adjustment.ReadXml);
             return adjustment;
         }

programming_language: C#
filename: BillingInfo.cs
change_type: ModificationType.MODIFY
diff: @@ -186,7 +186,7 @@ namespace Recurly
 
         private static string BillingInfoUrl(string accountCode)
         {
-            return UrlPrefix + Uri.EscapeUriString(accountCode) + UrlPostfix;
+            return UrlPrefix + Uri.EscapeDataString(accountCode) + UrlPostfix;
         }
 
         internal override void ReadXml(XmlTextReader reader)

programming_language: C#
filename: Coupon.cs
change_type: ModificationType.MODIFY
diff: @@ -175,14 +175,14 @@ namespace Recurly
         public void Update()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(CouponCode),
+                UrlPrefix + Uri.EscapeDataString(CouponCode),
                 WriteXmlUpdate);
         }
 
         public void Restore()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(CouponCode) + "/restore",
+                UrlPrefix + Uri.EscapeDataString(CouponCode) + "/restore",
                 WriteXmlUpdate);
         }
 
@@ -192,7 +192,7 @@ namespace Recurly
         public void Deactivate()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete,
-                UrlPrefix + Uri.EscapeUriString(CouponCode));
+                UrlPrefix + Uri.EscapeDataString(CouponCode));
         }
 
         public RecurlyList<Coupon> GetUniqueCouponCodes()
@@ -535,7 +535,7 @@ namespace Recurly
             var coupon = new Coupon();
 
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                Coupon.UrlPrefix + Uri.EscapeUriString(couponCode),
+                Coupon.UrlPrefix + Uri.EscapeDataString(couponCode),
                 coupon.ReadXml);
 
             return statusCode == HttpStatusCode.NotFound ? null : coupon;

programming_language: C#
filename: CouponRedemption.cs
change_type: ModificationType.MODIFY
diff: @@ -46,7 +46,7 @@ namespace Recurly
             var cr = new CouponRedemption {AccountCode = accountCode, Currency = currency, SubscriptionUuid = subscriptionUuid};
 
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-               "/coupons/" + Uri.EscapeUriString(couponCode) + "/redeem",
+               "/coupons/" + Uri.EscapeDataString(couponCode) + "/redeem",
                cr.WriteXml,
                cr.ReadXml);
 
@@ -60,8 +60,8 @@ namespace Recurly
         public void Delete()
         {
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete,
-                "/accounts/" + Uri.EscapeUriString(AccountCode) +
-                "/redemptions/" + Uri.EscapeUriString(Uuid));
+                "/accounts/" + Uri.EscapeDataString(AccountCode) +
+                "/redemptions/" + Uri.EscapeDataString(Uuid));
             AccountCode = null;
             CouponCode = null;
             Currency = null;

programming_language: C#
filename: Export.cs
change_type: ModificationType.MODIFY
diff: @@ -111,7 +111,7 @@ namespace Recurly
         {
             var exportFile = new ExportFile();
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                string.Format(ExportFile.FileUrlPrefix, date.ToString("yyyy-MM-dd"), Uri.EscapeUriString(fileName)),
+                string.Format(ExportFile.FileUrlPrefix, date.ToString("yyyy-MM-dd"), Uri.EscapeDataString(fileName)),
                 exportFile.ReadXml);
 
             return statusCode != HttpStatusCode.NotFound ? exportFile : null;

programming_language: C#
filename: GiftCard.cs
change_type: ModificationType.MODIFY
diff: @@ -324,7 +324,7 @@ namespace Recurly
             var giftCard = new GiftCard();
             // GET /gift_cards/<id>
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                UrlPrefix + Uri.EscapeUriString(id.ToString()),
+                UrlPrefix + Uri.EscapeDataString(id.ToString()),
                 giftCard.ReadXml);
 
             return statusCode == HttpStatusCode.NotFound ? null : giftCard;

programming_language: C#
filename: Invoice.cs
change_type: ModificationType.MODIFY
diff: @@ -121,7 +121,7 @@ namespace Recurly
         public void Create(string accountCode)
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-                "/accounts/" + Uri.EscapeUriString(accountCode) + Invoice.UrlPrefix,
+                "/accounts/" + Uri.EscapeDataString(accountCode) + Invoice.UrlPrefix,
                 WriteXml,
                 ReadXml);
         }
@@ -132,7 +132,7 @@ namespace Recurly
         public void Preview(string accountCode)
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-                "/accounts/" + Uri.EscapeUriString(accountCode) + Invoice.UrlPrefix + "preview",
+                "/accounts/" + Uri.EscapeDataString(accountCode) + Invoice.UrlPrefix + "preview",
                 WriteXml,
                 ReadXml);
         }
@@ -453,7 +453,7 @@ namespace Recurly
     {
         public static RecurlyList<Invoice> List(string accountCode)
         {
-            return new InvoiceList("/accounts/" + Uri.EscapeUriString(accountCode) + "/invoices");
+            return new InvoiceList("/accounts/" + Uri.EscapeDataString(accountCode) + "/invoices");
         }
 
         public static RecurlyList<Invoice> List()
@@ -504,7 +504,7 @@ namespace Recurly
             var invoice = new Invoice();
 
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-                "/accounts/" + Uri.EscapeUriString(accountCode) + Invoice.UrlPrefix,
+                "/accounts/" + Uri.EscapeDataString(accountCode) + Invoice.UrlPrefix,
                 invoice.ReadXml);
 
             return (int)statusCode == ValidationException.HttpStatusCode ? null : invoice;

programming_language: C#
filename: MeasuredUnit.cs
change_type: ModificationType.MODIFY
diff: @@ -56,7 +56,7 @@ namespace Recurly
         public void Update()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(Id.ToString()),
+                UrlPrefix + Uri.EscapeDataString(Id.ToString()),
                 WriteXml);
         }
 
@@ -66,7 +66,7 @@ namespace Recurly
         public void Delete()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete,
-                UrlPrefix + Uri.EscapeUriString(Id.ToString()));
+                UrlPrefix + Uri.EscapeDataString(Id.ToString()));
         }
 
         #region Read and Write XML documents

programming_language: C#
filename: Plan.cs
change_type: ModificationType.MODIFY
diff: @@ -58,7 +58,7 @@ namespace Recurly
             {
                 if (_addOns == null)
                 {
-                    var url = UrlPrefix + Uri.EscapeUriString(PlanCode) + "/add_ons/";
+                    var url = UrlPrefix + Uri.EscapeDataString(PlanCode) + "/add_ons/";
                     _addOns = new AddOnList(url);
                 }
                 return _addOns;
@@ -120,7 +120,7 @@ namespace Recurly
         public void Update()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(PlanCode),
+                UrlPrefix + Uri.EscapeDataString(PlanCode),
                 WriteXml);
         }
 
@@ -129,7 +129,7 @@ namespace Recurly
         /// </summary>
         public void Deactivate()
         {
-            Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete, UrlPrefix + Uri.EscapeUriString(PlanCode));
+            Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete, UrlPrefix + Uri.EscapeDataString(PlanCode));
         }
 
         /// <summary>
@@ -149,7 +149,7 @@ namespace Recurly
             var addOn = new AddOn();
 
             var status = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                UrlPrefix + Uri.EscapeUriString(PlanCode) + "/add_ons/" + Uri.EscapeUriString(addOnCode),
+                UrlPrefix + Uri.EscapeDataString(PlanCode) + "/add_ons/" + Uri.EscapeDataString(addOnCode),
                 addOn.ReadXml);
 
             if (status != HttpStatusCode.OK) return null;
@@ -445,7 +445,7 @@ namespace Recurly
             var plan = new Plan();
 
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                Plan.UrlPrefix + Uri.EscapeUriString(planCode),
+                Plan.UrlPrefix + Uri.EscapeDataString(planCode),
                 plan.ReadXml);
 
             return statusCode == HttpStatusCode.NotFound ? null : plan;

programming_language: C#
filename: Subscription.cs
change_type: ModificationType.MODIFY
diff: @@ -372,7 +372,7 @@ namespace Recurly
                 writeXmlDelegate = WriteChangeSubscriptionNowXml;
 
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(Uuid),
+                UrlPrefix + Uri.EscapeDataString(Uuid),
                 writeXmlDelegate,
                 ReadXml);
         }
@@ -389,7 +389,7 @@ namespace Recurly
         public void Cancel()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(Uuid) + "/cancel",
+                UrlPrefix + Uri.EscapeDataString(Uuid) + "/cancel",
                 ReadXml);
         }
 
@@ -399,7 +399,7 @@ namespace Recurly
         public void Reactivate()
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(Uuid) + "/reactivate",
+                UrlPrefix + Uri.EscapeDataString(Uuid) + "/reactivate",
                 ReadXml);
         }
 
@@ -410,7 +410,7 @@ namespace Recurly
         public void Terminate(RefundType refund)
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(Uuid) + "/terminate?refund=" + refund.ToString().EnumNameToTransportCase(),
+                UrlPrefix + Uri.EscapeDataString(Uuid) + "/terminate?refund=" + refund.ToString().EnumNameToTransportCase(),
                 ReadXml);
         }
 
@@ -460,7 +460,7 @@ namespace Recurly
             var previewSubscription = new Subscription();
 
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Post,
-                UrlPrefix + Uri.EscapeUriString(Uuid) + "/preview",
+                UrlPrefix + Uri.EscapeDataString(Uuid) + "/preview",
                 writeXmlDelegate,
                 previewSubscription.ReadPreviewXml);
 
@@ -480,14 +480,14 @@ namespace Recurly
         public void Postpone(DateTime nextRenewalDate, bool bulk = false)
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(Uuid) + "/postpone?next_renewal_date=" + nextRenewalDate.ToString("s") + "&bulk=" + bulk.ToString().ToLower(),
+                UrlPrefix + Uri.EscapeDataString(Uuid) + "/postpone?next_renewal_date=" + nextRenewalDate.ToString("s") + "&bulk=" + bulk.ToString().ToLower(),
                 ReadXml);
         }
 
         public bool UpdateNotes(Dictionary<string, string> notes)
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Put,
-                UrlPrefix + Uri.EscapeUriString(Uuid) + "/notes",
+                UrlPrefix + Uri.EscapeDataString(Uuid) + "/notes",
                 WriteSubscriptionNotesXml(notes),
                 ReadXml);
 
@@ -502,7 +502,7 @@ namespace Recurly
         {
             var coupons = new CouponRedemptionList();
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                UrlPrefix + Uri.EscapeUriString(Uuid) + "/redemptions/",
+                UrlPrefix + Uri.EscapeDataString(Uuid) + "/redemptions/",
                 coupons.ReadXmlList);
 
             return statusCode == HttpStatusCode.NotFound ? null : coupons;
@@ -968,7 +968,7 @@ namespace Recurly
         {
             var s = new Subscription();
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                Subscription.UrlPrefix + Uri.EscapeUriString(uuid),
+                Subscription.UrlPrefix + Uri.EscapeDataString(uuid),
                 s.ReadXml);
 
             return statusCode == HttpStatusCode.NotFound ? null : s;

programming_language: C#
filename: Transaction.cs
change_type: ModificationType.MODIFY
diff: @@ -146,7 +146,7 @@ namespace Recurly
         public void Refund(int? refund = null)
         {
             Client.Instance.PerformRequest(Client.HttpRequestMethod.Delete,
-                UrlPrefix + Uri.EscapeUriString(Uuid) + (refund.HasValue ? "?amount_in_cents=" + refund.Value : ""),
+                UrlPrefix + Uri.EscapeDataString(Uuid) + (refund.HasValue ? "?amount_in_cents=" + refund.Value : ""),
                 ReadXml);
         }
 
@@ -399,7 +399,7 @@ namespace Recurly
             var transaction = new Transaction();
 
             var statusCode = Client.Instance.PerformRequest(Client.HttpRequestMethod.Get,
-                Transaction.UrlPrefix + Uri.EscapeUriString(transactionId),
+                Transaction.UrlPrefix + Uri.EscapeDataString(transactionId),
                 transaction.ReadXml);
 
             return statusCode == HttpStatusCode.NotFound ? null : transaction;

programming_language: C#