Harden API requestor code against malicious URLs

[xavdid]

Why?

If an attacker got access to a user's webhook secret (or the user wasn't validating incoming webhook signatures) and a user was calling the built-in event_notification.fetch_related_object() method, a malicious webhook payload could cause a user integration to make an authenticated request to an attacker-controlled domain (leaking the secret key)

To solve, we're being more careful during url construction to ensure user input can't be used to send requests to non-stripe.com domains (on a per-request basis).

What?

• add path validation method and call it before the final URL is built
• Encode the event.id path param in fetch_event() to match the sanitation in the rest of the generated endpoints
• protect against treating malicious payloads as v2 iterables
• add tests

See Also

• RUN_DEVSDK-2808