[
https://issues.apache.org/jira/browse/CAMEL-24161?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18097123#comment-18097123
]
Claus Ibsen commented on CAMEL-24161:
-------------------------------------
Fixed via https://github.com/apache/camel/pull/24857
> camel-salesforce - Umbrella: medium-severity findings from July 2026 review
> ---------------------------------------------------------------------------
>
> Key: CAMEL-24161
> URL: https://issues.apache.org/jira/browse/CAMEL-24161
> Project: Camel
> Issue Type: Bug
> Components: camel-salesforce
> Reporter: Federico Mariani
> Assignee: Claus Ibsen
> Priority: Minor
> Labels: review-2026-07
> Fix For: 4.22.0
>
> Attachments: camel-salesforce-review-2026-07.md
>
>
> Umbrella for the medium-severity findings of the July 2026 review of
> camel-salesforce-component on main (4.22.0-SNAPSHOT). Full findings document
> attached to the high-severity umbrella; low-severity findings are listed in
> the document only.
> *Auth / session / HTTP client*
> # {{SalesforceLoginConfig:271-275}} — refresh token printed in clear text by
> toString() (other secrets are masked) and logged at DEBUG by
> SalesforceComponent.doStart.
> # {{SalesforceSecurityHandler:256-260}} — multipart create/update cannot be
> replayed after 401 re-login: {{body.rewind()}} result ignored and Jetty's
> MultiPartFormData.ContentSource does not support rewind -> retry sends an
> empty multipart POST.
> # {{AbstractClientBase:190-199}} — replay-buffering loop treats Jetty
> *failure* chunks (isLast()==true) as normal EOF; a body InputStream failing
> mid-read results in a silently truncated request with no local exception.
> # {{DefaultRawClient:49-53}} — auth retry produces duplicate X-SFDC-Session
> headers (add instead of put; Jetty copyRequest keeps custom headers), stale
> token first.
> # {{SalesforceSecurityHandler:239-246}} — handler-driven re-logins are
> uncoordinated: N concurrent 401'd conversations fire N token requests (no
> single-flight like SalesforceSession.login(oldToken)).
> *Streaming / Pub/Sub*
> # {{SubscriptionHelper:203-209}} — connect-listener NPE when a channel was
> unsubscribed concurrently (unsubscribe never removes from
> channelsToSubscribe); remaining channels silently never resubscribed after
> the snapshot was cleared (same class as CAMEL-20834).
> # {{PubSubApiClient:314-321}} — per-event decode failures are swallowed (log
> only, exception handler never invoked) while the stored replayId advances
> past the lost events; reconnects permanently skip them.
> # {{PubSubApiClient:353-369,388-397}} — corrupted replay id with
> fallbackToLatestReplayId=false retries the same corrupt id forever; the
> user's original replay preset is overwritten on every resubscribe.
> # {{PubSubApiClient:382-384}} — reconnect delay grows unboundedly; the
> configured maxBackoff is only applied to the login loop.
> *REST / Bulk / Composite*
> # {{JsonRestProcessor:221-224}} —
> RESPONSE_CLASS_DEFERRED/RESPONSE_CLASS_PREFIX exchange properties are not
> cleaned up (unlike processStreamResultResponse) and leak into subsequent
> producers on the same exchange.
> # {{CompositeApiProcessor:125-144}} — composite rawPayload mode discards the
> exception whenever Salesforce returned an error body (virtually always); HTTP
> failures reported as success.
> # {{AbstractRestProcessor:545-552}} — deleteSObjectWithId restores DTO fields
> *after* completing the exchange (all sibling operations restore before);
> related: {{AbstractRestProcessor:480-539}} NPEs (instead of falling back to
> the sObjectIdValue header) when the DTO's external-id field is unset.
> _This issue was researched and filed by Claude Code (AI) on behalf of
> Federico Mariani (fmariani). Full findings document from the review is
> attached to the umbrella issues._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
