davsclaus opened a new pull request, #24857: URL: https://github.com/apache/camel/pull/24857
## Summary Fixes 11 medium-severity bugs found during the July 2026 deep code review of camel-salesforce ([CAMEL-24161](https://issues.apache.org/jira/browse/CAMEL-24161)). Companion to #24848 which fixed the high-severity findings. **Auth / session / HTTP client:** - Mask `refreshToken` in `SalesforceLoginConfig.toString()` — was printed in clear text while all other secrets were masked (since CAMEL-15425) - Check `body.rewind()` return value in `SalesforceSecurityHandler` — multipart uploads silently sent empty body on 401 retry - Detect Jetty failure chunks in `AbstractClientBase` replay-buffering loop — mid-read I/O error produced silently truncated requests - Use `put()` instead of `add()` in `DefaultRawClient.setAccessToken()` — auth retry produced duplicate `X-SFDC-Session`/`Authorization` headers - Coordinate re-logins via `session.login()` on worker pool in `SalesforceSecurityHandler` — N concurrent 401s now share one login instead of each firing its own **Streaming / Pub/Sub:** - Use `getOrDefault()` in `SubscriptionHelper` connect listener and clean up `channelsToSubscribe` on unsubscribe — prevents NPE and silent channel loss on concurrent unsubscribe - Invoke `consumer.getExceptionHandler()` on per-event decode failures in `PubSubApiClient` — events were silently lost (log only, replay ID advanced past them) - Stop infinite retry on corrupted replay ID when `fallbackToLatestReplayId=false` in `PubSubApiClient`, and make replay preset state per-observer instead of shared — prevents infinite loop and cross-consumer preset overwrite **REST / Bulk / Composite:** - Clean up `RESPONSE_CLASS_DEFERRED`/`RESPONSE_CLASS_PREFIX` exchange properties in `JsonRestProcessor.processResponse()` — leaked into subsequent producers on the same exchange - Preserve exception when Salesforce returns both error body and exception in `CompositeApiProcessor` — HTTP failures were silently reported as success in raw/batch/composite modes - Fix `deleteSObjectWithId` in `AbstractRestProcessor` to restore DTO fields *before* completing the exchange (matching all sibling operations), and null-check external-id field value to prevent NPE ## Test plan - [x] All existing camel-salesforce-component tests pass (190 run, 0 failures) - [x] Updated `PubSubApiTest.testInvokesExceptionHandlerWhenReplayIdIsCorruptedAndFallbackToLatestReplayIdIsDisabled` to verify fixed behavior (stops after one attempt instead of infinite retry) - [ ] CI green _Claude Code on behalf of davsclaus_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.6 <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
