A Tiny Regex Bug in Adyen's Java Library, and How My Fix Shipped in SDK v42.0.0

Description and use

A small regex bug in Adyen’s Java SDK caused test URLs to be incorrectly replaced with live URLs. The fix swapped replaceFirst for replace, added a regression test, and the PR was merged into SDK v42.0.0.

Problem

A regex misuse in Adyen's Java API Library caused test URLs to be incorrectly replaced with live URLs, risking misdirected payment calls.

Outcome

The regex bug was fixed by switching to literal string replacement, a new test was added to guard against regressions, and the change was merged and released in SDK v42.0.0.

Workflow

• Identify the bug in Service.java’s createBaseURL method.
• Replace replaceFirst calls with replace for literal dot matching.
• Add a test testLivePalUrlOnlyMatchesLiteralDots() to verify non-dot URLs are untouched.
• Run mvn spotless:apply to satisfy formatting checks.
• Run tests to confirm failure before fix and success after.
• Submit PR #1952 to Adyen/adyen-java-api-library.
• Merge and ship the change in SDK v42.0.0.

Evidence

The method createBaseURL in Service.java swaps test URLs for live URLs. It used String.replaceFirst() to do that.

Source

replaceFirst() takes a regex, not a plain string. In regex, a dot . means "any character".

Source

I replaced the affected replaceFirst() calls with String.replace(), which matches plain text with no regex at all.

Source

I also added a test, testLivePalUrlOnlyMatchesLiteralDots(), using a URL shaped like pal-testXadyenYcom.

Source

The PR was approved and merged, and the change shipped in SDK v42.0.0.

Source