Skip to content

[configurationwebhooks] Code generation: update services and models#1991

Open
AdyenAutomationBot wants to merge 1 commit into
mainfrom
sdk-automation/configurationwebhooks
Open

[configurationwebhooks] Code generation: update services and models#1991
AdyenAutomationBot wants to merge 1 commit into
mainfrom
sdk-automation/configurationwebhooks

Conversation

@AdyenAutomationBot

Copy link
Copy Markdown
Collaborator

This PR contains the automated changes for the configurationwebhooks service.

The commit history of this PR reflects the adyen-openapi commits that have been applied.

@AdyenAutomationBot AdyenAutomationBot requested a review from a team as a code owner June 17, 2026 09:05

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request updates the SDK generation metadata and registers discriminator mappings for MandateBankAccountAccountIdentification and PaymentInstrumentAdditionalBankAccountIdentificationsInner. The review feedback points out redundant self-mappings in the discriminator maps that should be removed to keep the code clean. Additionally, it highlights a potential concurrency vulnerability in the underlying JSON registration utility, recommending the use of ConcurrentHashMap to ensure thread safety during class loading.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

Comment on lines +155 to +161
// Initialize and register the discriminator mappings.
Map<String, Class<?>> mappings = new HashMap<>();
mappings.put("ukLocal", UKLocalMandateAccountIdentification.class);
mappings.put("UKLocalMandateAccountIdentification", UKLocalMandateAccountIdentification.class);
mappings.put(
"MandateBankAccount_accountIdentification", MandateBankAccountAccountIdentification.class);
JSON.registerDiscriminator(MandateBankAccountAccountIdentification.class, "type", mappings);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

1. Redundant Self-Mapping in Discriminator (Medium)

The mapping mappings.put("MandateBankAccount_accountIdentification", MandateBankAccountAccountIdentification.class); maps the parent/composed class to itself. A discriminator should only map to concrete subtype classes (like UKLocalMandateAccountIdentification). If this mapping is ever matched, the custom deserializer MandateBankAccountAccountIdentificationDeserializer will fail anyway because "MandateBankAccount_accountIdentification" is not a valid enum value for any of the subtypes. Removing this self-mapping keeps the code clean and avoids confusion.

2. Concurrency Vulnerability in JSON.registerDiscriminator (High)

The static block calls JSON.registerDiscriminator(...). Under the hood, JSON.java stores these mappings in a plain HashMap (modelDiscriminators). Since different model classes can be loaded concurrently on different threads (especially in a multi-threaded webhook processing environment), concurrent writes to this HashMap can cause race conditions, data corruption, or infinite loops.

Recommendation:
Although JSON.java is not modified in this PR, it should be updated to use ConcurrentHashMap for both modelDiscriminators and modelDescendants to ensure thread safety during class loading:

private static final Map<Class<?>, ClassDiscriminatorMapping> modelDiscriminators =
    new ConcurrentHashMap<>();
private static final Map<Class<?>, Map<String, GenericType>> modelDescendants =
    new ConcurrentHashMap<>();
    // Initialize and register the discriminator mappings.
    Map<String, Class<?>> mappings = new HashMap<>();
    mappings.put("ukLocal", UKLocalMandateAccountIdentification.class);
    mappings.put("UKLocalMandateAccountIdentification", UKLocalMandateAccountIdentification.class);
    JSON.registerDiscriminator(MandateBankAccountAccountIdentification.class, "type", mappings);

Comment on lines +154 to +162
// Initialize and register the discriminator mappings.
Map<String, Class<?>> mappings = new HashMap<>();
mappings.put("iban", IbanAccountIdentification.class);
mappings.put("IbanAccountIdentification", IbanAccountIdentification.class);
mappings.put(
"PaymentInstrument_additionalBankAccountIdentifications_inner",
PaymentInstrumentAdditionalBankAccountIdentificationsInner.class);
JSON.registerDiscriminator(
PaymentInstrumentAdditionalBankAccountIdentificationsInner.class, "type", mappings);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

1. Redundant Self-Mapping in Discriminator (Medium)

The mapping mappings.put("PaymentInstrument_additionalBankAccountIdentifications_inner", PaymentInstrumentAdditionalBankAccountIdentificationsInner.class); maps the parent/composed class to itself. A discriminator should only map to concrete subtype classes (like IbanAccountIdentification). If this mapping is ever matched, the custom deserializer PaymentInstrumentAdditionalBankAccountIdentificationsInnerDeserializer will fail anyway because "PaymentInstrument_additionalBankAccountIdentifications_inner" is not a valid enum value for any of the subtypes. Removing this self-mapping keeps the code clean and avoids confusion.

2. Concurrency Vulnerability in JSON.registerDiscriminator (High)

The static block calls JSON.registerDiscriminator(...). Under the hood, JSON.java stores these mappings in a plain HashMap (modelDiscriminators). Since different model classes can be loaded concurrently on different threads (especially in a multi-threaded webhook processing environment), concurrent writes to this HashMap can cause race conditions, data corruption, or infinite loops.

Recommendation:
Although JSON.java is not modified in this PR, it should be updated to use ConcurrentHashMap for both modelDiscriminators and modelDescendants to ensure thread safety during class loading:

private static final Map<Class<?>, ClassDiscriminatorMapping> modelDiscriminators =
    new ConcurrentHashMap<>();
private static final Map<Class<?>, Map<String, GenericType>> modelDescendants =
    new ConcurrentHashMap<>();
    // Initialize and register the discriminator mappings.
    Map<String, Class<?>> mappings = new HashMap<>();
    mappings.put("iban", IbanAccountIdentification.class);
    mappings.put("IbanAccountIdentification", IbanAccountIdentification.class);
    JSON.registerDiscriminator(
        PaymentInstrumentAdditionalBankAccountIdentificationsInner.class, "type", mappings);

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant