Update generated code for beta

.github/workflows/ci.yml

@@ -6,6 +6,7 @@ on:
     branches:
       - master
       - beta
+      - private-preview
       - sdk-release/**
       - feature/**
     tags:
@@ -125,6 +126,9 @@ jobs:
           echo "JAVA_TEST_HOME=$JAVA_TEST_HOME"
 
       - uses: stripe/openapi/actions/stripe-mock@master
+        with:
+          # Used to determine if stripe-mock runs in beta mode
+          base: ${{ github.base_ref == 'private-preview' && 'beta' || github.ref_name == 'private-preview' && 'beta' || contains(github.ref_name, '-alpha.') && 'beta' || github.base_ref || github.ref_name }}
       - name: Run test suite
         run: just test
 

CHANGELOG.md

@@ -24,6 +24,9 @@ This release changes the pinned API version to 2026-08-26.preview.
   * Add support for event notification `V2SignalsAccountEvaluationCompleteEvent` with related object `v2.signals.AccountEvaluation`
 * [#2267](https://github.com/stripe/stripe-java/pull/2267) Add non-verified methods to managed handlers
 
+## 33.4.1 - 2026-09-01
+* [#2284](https://github.com/stripe/stripe-java/pull/2284) Harden API requestor code against malicious URLs
+
 ## 33.4.0 - 2026-08-26
 This release changes the pinned API version to 2026-08-26.dahlia.
 

CODEGEN_VERSION

@@ -1 +1 @@
-baff58c9d515cdd5f5c3231d101989d588788c6f
+e2d3e8255ba431b6d05e4a423941a157e947e763

OPENAPI_VERSION

@@ -1 +1 @@
-v2442
+v2459

src/main/java/com/stripe/model/v2/core/EventNotification.java

@@ -144,9 +144,14 @@ private RawRequestOptions getRequestOptions() {
 
   /* retrieves the full payload for an event. Protected because individual push classes use it, but type it correctly */
   protected Event fetchEvent() throws StripeException {
+    // `id` comes from the notification body, so encode it the way the generated
+    // services do -- otherwise it can inject extra path or query segments.
     StripeResponse response =
         client.rawRequest(
-            RequestMethod.GET, String.format("/v2/core/events/%s", id), null, getRequestOptions());
+            RequestMethod.GET,
+            String.format("/v2/core/events/%s", ApiResource.urlEncodeId(id)),
+            null,
+            getRequestOptions());
 
     return (Event) client.deserialize(response.body(), ApiMode.V2);
   }

src/main/java/com/stripe/net/LiveStripeResponseGetter.java

@@ -475,6 +475,27 @@ public void validateRequestOptions(RequestOptions options) {
     }
   }
 
+  /**
+   * Asserts that a request path is origin-relative: that it begins with a single {@code "/"}.
+   *
+   * <p>The absolute URL is built by concatenating a base URL onto this path, and no base URL ends
+   * in a slash. A path like {@code "@evil.example/v1/x"} or {@code ".evil.example/v1/x"} would
+   * modify the resulting host and direct the request (including the API key) to a non-Stripe host.
+   *
+   * <p>Because some relative urls arrive from potentially untrusted sources (like webhook bodies),
+   * we have to be a little defensive.
+   *
+   * <p>So, we require that a path starts with a leading slash. Deliberately not using {@link
+   * java.net.URI} to parse -- it enforces RFC 2396 strictly and would reject paths containing
+   * characters that callers have always been able to send.
+   */
+  static void validatePath(String path) {
+    if (path == null || !path.startsWith("/") || path.startsWith("//")) {
+      throw new IllegalArgumentException(
+          "Request path must begin with a single \"/\", got: " + path);
+    }
+  }
+
   private String fullUrl(BaseApiRequest apiRequest) {
     BaseAddress baseAddress = apiRequest.getBaseAddress();
     RequestOptions options = apiRequest.getOptions();
@@ -499,6 +520,7 @@ private String fullUrl(BaseApiRequest apiRequest) {
     if (options != null && options.getBaseUrl() != null) {
       baseUrl = options.getBaseUrl();
     }
+    validatePath(relativeUrl);
     return String.format("%s%s", baseUrl, relativeUrl);
   }
 }