From 39396f3750d5f6c5c6f5edaf6e3e3e903aa36d77 Mon Sep 17 00:00:00 2001
From: Vinayak_Gote <vinayakgote44@gmail.com>
Date: Wed, 22 Apr 2026 19:20:21 +0530
Subject: [PATCH 1/2] fix: use String.replace() instead of replaceFirst() in
 createBaseURL

---
 src/main/java/com/adyen/Service.java     | 10 +++++-----
 src/test/java/com/adyen/ServiceTest.java | 13 +++++++++++++
 2 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/src/main/java/com/adyen/Service.java b/src/main/java/com/adyen/Service.java
index a9cc0df60..c885b430a 100644
--- a/src/main/java/com/adyen/Service.java
+++ b/src/main/java/com/adyen/Service.java
@@ -99,7 +99,7 @@ protected String createBaseURL(String url) {
         throw new IllegalArgumentException("please provide a live url prefix in the client");
       }
       url =
-          url.replaceFirst(
+          url.replace(
               "https://pal-test.adyen.com/pal/servlet/",
               "https://"
                   + config.getLiveEndpointUrlPrefix()
@@ -113,14 +113,14 @@ protected String createBaseURL(String url) {
       if (url.contains("/possdk/")) {
         // Custom handling of POS Mobile API url
         url =
-            url.replaceFirst(
+            url.replace(
                 "https://checkout-test.adyen.com/",
                 "https://"
                     + config.getLiveEndpointUrlPrefix()
                     + "-checkout-live.adyenpayments.com/");
       } else {
         url =
-            url.replaceFirst(
+            url.replace(
                 "https://checkout-test.adyen.com/",
                 "https://"
                     + config.getLiveEndpointUrlPrefix()
@@ -132,11 +132,11 @@ protected String createBaseURL(String url) {
       if (config.getTerminalApiRegion() == null
           || config.getTerminalApiRegion().equals(Region.EU)) {
         url =
-            url.replaceFirst(
+            url.replace(
                 "https://device-api-test.adyen.com", "https://device-api-live.adyen.com");
       } else {
         url =
-            url.replaceFirst(
+            url.replace(
                 "https://device-api-test.adyen.com",
                 String.format(
                     "https://device-api-live-%s.adyen.com",
diff --git a/src/test/java/com/adyen/ServiceTest.java b/src/test/java/com/adyen/ServiceTest.java
index c80e75529..0b330187d 100644
--- a/src/test/java/com/adyen/ServiceTest.java
+++ b/src/test/java/com/adyen/ServiceTest.java
@@ -58,6 +58,19 @@ public void testLivePalUrlWithPrefix() {
     assertEquals(expectedUrl, actualUrl);
   }
 
+  @Test
+  public void testLivePalUrlOnlyMatchesLiteralDots() {
+    config.setLiveEndpointUrlPrefix("123456789-company");
+    // A URL where dots are replaced with other characters should NOT be transformed
+    // by the pal- block. String.replace() does exact literal matching, so a URL that
+    // looks like a pal URL but has non-dot separators passes through untouched.
+    String urlWithNonDots = "https://pal-devXadyenYcom/pal/servlet/v52/initiate";
+
+    String actualUrl = service.createBaseURL(urlWithNonDots);
+
+    assertEquals(urlWithNonDots, actualUrl);
+  }
+
   @Test
   public void testLivePalUrlWithoutPrefix() {
     String testUrl = "https://pal-test.adyen.com/pal/servlet/v52/initiate";

From 500f7a21ddc4986d862fe9af3d0ebbce01d20392 Mon Sep 17 00:00:00 2001
From: Vinayak_Gote <vinayakgote44@gmail.com>
Date: Thu, 23 Apr 2026 07:22:53 +0530
Subject: [PATCH 2/2] fix: also replace replaceFirst in authe block, improve
 test assertion

---
 src/main/java/com/adyen/Service.java     |  2 +-
 src/test/java/com/adyen/ServiceTest.java | 12 +++++++-----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/main/java/com/adyen/Service.java b/src/main/java/com/adyen/Service.java
index c885b430a..11aff39a0 100644
--- a/src/main/java/com/adyen/Service.java
+++ b/src/main/java/com/adyen/Service.java
@@ -91,7 +91,7 @@ protected String createBaseURL(String url) {
     }
 
     if (url.contains("/authe/")) {
-      return url.replaceFirst("https://test.adyen.com/", "https://authe-live.adyen.com/");
+      return url.replace("https://test.adyen.com/", "https://authe-live.adyen.com/");
     }
 
     if (url.contains("pal-")) {
diff --git a/src/test/java/com/adyen/ServiceTest.java b/src/test/java/com/adyen/ServiceTest.java
index 0b330187d..ec8e97b0f 100644
--- a/src/test/java/com/adyen/ServiceTest.java
+++ b/src/test/java/com/adyen/ServiceTest.java
@@ -61,14 +61,16 @@ public void testLivePalUrlWithPrefix() {
   @Test
   public void testLivePalUrlOnlyMatchesLiteralDots() {
     config.setLiveEndpointUrlPrefix("123456789-company");
-    // A URL where dots are replaced with other characters should NOT be transformed
-    // by the pal- block. String.replace() does exact literal matching, so a URL that
-    // looks like a pal URL but has non-dot separators passes through untouched.
-    String urlWithNonDots = "https://pal-devXadyenYcom/pal/servlet/v52/initiate";
+    // This URL matches pal-test.adyen.com structurally but has non-dot separators.
+    // The old replaceFirst() would have incorrectly matched it (dots as wildcards).
+    // String.replace() does exact literal matching so the pal- block leaves it unchanged.
+    // The final fallback still converts -test to -live as expected.
+    String urlWithNonDots = "https://pal-testXadyenYcom/pal/servlet/v52/initiate";
+    String expectedUrl = "https://pal-liveXadyenYcom/pal/servlet/v52/initiate";
 
     String actualUrl = service.createBaseURL(urlWithNonDots);
 
-    assertEquals(urlWithNonDots, actualUrl);
+    assertEquals(expectedUrl, actualUrl);
   }
 
   @Test