gnodet-bot commented on code in PR #29859:
URL: https://github.com/apache/camel/pull/29859#discussion_r4566260312
##########
components/camel-clickup/src/main/java/org/apache/camel/component/clickup/service/ClickUpWebhookService.java:
##########
@@ -80,30 +82,39 @@ public void validateMessageSignature(Message message,
String sharedSecret) {
throw new RuntimeException("The webhook HTTP request doesn't
contain the 'x-signature' header.");
}
- String messageBody;
+ byte[] messageBytes;
try (InputStream body = message.getBody(InputStream.class)) {
- messageBody = new String(body.readAllBytes());
+ // the signature covers the bytes as they arrived: decoding and
re-encoding them first would turn a
+ // malformed sequence into U+FFFD and change what is hashed
+ messageBytes = body.readAllBytes();
- LOG.debug("Message body {} to be validated against the given
signature {}", messageBody, signature);
+ // the signature authenticates the event, so it stays out of the
log
+ LOG.debug("Message body {} to be validated against the given
signature",
+ new String(messageBytes, StandardCharsets.UTF_8));
body.reset();
Review Comment:
🧹 **Dead code (and fragile):** After `readAllBytes()`, the stream is
exhausted and `messageBytes` holds all the data. No code after this point reads
from `body` again — `reset()` is a no-op. It's also fragile:
`InputStream.reset()` throws `IOException` on streams where `markSupported()`
returns `false` (which is the common case), and that exception would abort
signature validation.
```suggestion
```
Simply remove this line.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
