[Bug]: Reject untrusted 307 redirect locations in the HTTP client #2098

Description

AdyenCustomRedirectStrategy validates a redirect location only when the response status is 308. A 307 Temporary Redirect is also automatically handled by Apache HttpClient, but its destination is not checked by this library. A 307 redirect preserves the original HTTP method and request body. For an authenticated payment request, an unsafe redirect could therefore resend the request body and X-API-Key header to a non-Adyen host.

Steps to reproduce

1. Create an AdyenCustomRedirectStrategy.

2. Provide an HTTP response with:

   HTTP/1.1 307 Temporary Redirect
   Location: https://attacker.example/payments

3. Call getLocationURI(...) with that request, response, and context.

4. Run the focused test:

   mvn test "-Dcheckstyle.skip=true" "-Dtest=AdyenCustomRedirectStrategyTest"

The regression test is testGetLocationURI307InvalidDomainThrowsException in AdyenCustomRedirectStrategyTest.

Actual behavior

No HttpException is thrown for the 307 redirect location. The current implementation performs the Adyen-host validation only inside this condition:

if (statusCode == 308) {
  // validate redirect location
}

As a result, https://attacker.example/payments is accepted for a 307 redirect even though it is not an approved Adyen domain.

Expected behavior

Every redirect that the SDK automatically follows should be rejected unless its target is an HTTPS URL on an approved Adyen domain.

For the example above, the SDK should throw an HttpException instead of accepting the redirect.

Code snippet or screenshots (if applicable)

buildRunBeforeAnyChanges

TestRunWthoutNewBugs

TestRunWithNewBugs

buildRunAfterNewBugFix

TestRunAfterNewBugFix

Adyen Java API Library version

43.1.0

Java version

21.0.12

Operating System

Windows

Additional context

No response