A Tiny Regex Bug in Adyen's Java Library, and How My Fix Shipped in SDK v42.0.0

说明与用途

Adyen Java SDK 中的一个小正则表达式错误导致测试 URL 被错误地替换为生产 URL。通过将 replaceFirst 替换为 replace 并添加回归测试，问题得到修复，PR 合并并发布到 SDK v42.0.0。

问题

A regex misuse in Adyen's Java API Library caused test URLs to be incorrectly replaced with live URLs, risking misdirected payment calls.

结果

The regex bug was fixed by switching to literal string replacement, a new test was added to guard against regressions, and the change was merged and released in SDK v42.0.0.

工作流

• Identify the bug in Service.java’s createBaseURL method.
• Replace replaceFirst calls with replace for literal dot matching.
• Add a test testLivePalUrlOnlyMatchesLiteralDots() to verify non-dot URLs are untouched.
• Run mvn spotless:apply to satisfy formatting checks.
• Run tests to confirm failure before fix and success after.
• Submit PR #1952 to Adyen/adyen-java-api-library.
• Merge and ship the change in SDK v42.0.0.

证据

The method createBaseURL in Service.java swaps test URLs for live URLs. It used String.replaceFirst() to do that.

来源

replaceFirst() takes a regex, not a plain string. In regex, a dot . means "any character".

来源

I replaced the affected replaceFirst() calls with String.replace(), which matches plain text with no regex at all.

来源

I also added a test, testLivePalUrlOnlyMatchesLiteralDots(), using a URL shaped like pal-testXadyenYcom.

来源

The PR was approved and merged, and the change shipped in SDK v42.0.0.

来源