davsclaus commented on code in PR #29859:
URL: https://github.com/apache/camel/pull/29859#discussion_r4567773110
##########
components/camel-clickup/src/main/java/org/apache/camel/component/clickup/service/ClickUpWebhookService.java:
##########
@@ -80,30 +82,39 @@ public void validateMessageSignature(Message message,
String sharedSecret) {
throw new RuntimeException("The webhook HTTP request doesn't
contain the 'x-signature' header.");
}
- String messageBody;
+ byte[] messageBytes;
try (InputStream body = message.getBody(InputStream.class)) {
- messageBody = new String(body.readAllBytes());
+ // the signature covers the bytes as they arrived: decoding and
re-encoding them first would turn a
+ // malformed sequence into U+FFFD and change what is hashed
+ messageBytes = body.readAllBytes();
- LOG.debug("Message body {} to be validated against the given
signature {}", messageBody, signature);
+ // the signature authenticates the event, so it stays out of the
log
+ LOG.debug("Message body {} to be validated against the given
signature",
+ new String(messageBytes, StandardCharsets.UTF_8));
body.reset();
Review Comment:
Keeping it: the body is read a second time after the check.
`ClickUpWebhookProcessor` calls `validateMessageSignature(...)` and then parses
the event from `exchange.getIn().getBody(InputStream.class)` (line 66), so
`reset()` rewinds the cached stream for that second read. The line predates
#29696 and is the same on `main`. This PR is a straight cherry-pick of #29696
and #29809, so it stays identical to `main`.
_Claude Code on behalf of davsclaus_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
