Claus Ibsen created CAMEL-26028:
-----------------------------------
Summary: camel-support - the error of a failed API component call
shows the values of the endpoint options, passwords and tokens too
Key: CAMEL-26028
URL: https://issues.apache.org/jira/browse/CAMEL-26028
Project: Camel
Issue Type: Bug
Components: camel-support
Affects Versions: 4.18.0, 4.22.0, 4.23.0
Reporter: Claus Ibsen
Fix For: 4.24.0, 4.22.3, 4.18.6
When the method of an API component fails, {{ApiMethodHelper.invokeMethod}}
throws "Error invoking <method> with <arguments>: <message>"
({{ApiMethodHelper}}, main 07d2e7a987bc, lines 533 and 537), with the map of
all the arguments of the call. That map holds the options of the endpoint as
well, so the message, and the log of the error handler, show their values, such
as a password, an access token or a client secret. This applies to all API
components: as2, box, braintree, dhis2, fhir, google-calendar, google-drive,
google-mail, google-sheets, olingo2, olingo4, twilio and zendesk.
Checked on 4.24.0-SNAPSHOT with {{camel run}}: a fhir producer with the
{{username}} and {{password}} options, calling a server that does not answer,
failed with a message that holds the password.
*Proposed change*: mask the values of the sensitive options in the message, as
Camel masks them in endpoint URIs.
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
