davsclaus opened a new pull request, #28940: URL: https://github.com/apache/camel/pull/28940
Fixes [CAMEL-26164](https://issues.apache.org/jira/browse/CAMEL-26164). All changes are in `WhatsAppWebhookProcessor`. ### 1. Empty query value gave ArrayIndexOutOfBoundsException `parseQueryParam` split each pair on `=` and read `keyValuePair[1]` without a check. A query such as `?hub.challenge=` (or a pair with no `=`) failed with `ArrayIndexOutOfBoundsException` and a 500 response. Splitting on `=` also cut a value that contains `=`. Now each pair is split at the first `=`. A missing or empty value becomes `""`. Empty pairs (`&&`) are skipped. ### 2. Query values were not URL-decoded Raw values were stored, so an encoded `hub.verify_token` did not match the configured token, and an encoded `hub.challenge` was echoed back encoded. Now keys and values are URL-decoded once (UTF-8). The processor reads `CamelHttpRawQuery` when it is set and falls back to `CamelHttpQuery`. This matters because netty-http puts the already decoded query in `CamelHttpQuery` (`URI.getQuery()`), so decoding that would decode twice, and an encoded `&` would split a value. servlet, undertow and platform-http (Vert.x) set the raw query in `CamelHttpQuery` and do not set `CamelHttpRawQuery`. A query with an invalid encoding (e.g. `%zz`) is rejected with 400 instead of failing with an exception. I did not use `URISupport.parseQuery`: it treats `RAW(...)` values specially, returns a `List` for a repeated key, and throws on a trailing `&`. That is endpoint URI syntax, not what an HTTP client sends. ### 3. Missing CamelHttpMethod header gave NullPointerException `process` called `getHeader(Exchange.HTTP_METHOD).toString()`. It now reads the header as a `String`, so a missing method is handled as an event (POST), as proposed in the issue. In the same block, an event with no body failed with a `NullPointerException` on `body.readAllBytes()`. It is now read as an empty body. ### Tests - New `WhatsAppWebhookProcessorTest` (8 tests) calls the processor directly. It covers: an empty value and a pair without `=`, a verified request with an empty challenge, an encoded token and challenge (`+`, `%20`, `%26`, `%3D`), raw query preferred over the decoded one, a wrong token (403), an invalid encoding (400), a missing HTTP method, and an event without a body. - New `WhatsAppWebhookTest.testWebhookRegistrationEncodedQuery` runs over netty-http end to end: `empty=` plus `hub.challenge=a%26b` must echo `a&b`. - All 9 new tests fail without the fix. The module suite passes: 20 tests, 0 failures, with `-Psourcecheck`. ### Not changed - No docs, options, headers or generated files change. - No upgrade-guide entry. Meta sends the verify token URL-encoded, so a configured token now matches what was sent. Only a token with a literal `+` or `%` that a client sent unencoded would stop matching, and that is not a valid query string. _Claude Code on behalf of Claus Ibsen (davsclaus)_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
