Claus Ibsen created CAMEL-26036:
-----------------------------------
Summary: camel-aws-secrets-manager - binaryPayload stores the
Base64 text of the value, binary and string secrets, and no operation
Key: CAMEL-26036
URL: https://issues.apache.org/jira/browse/CAMEL-26036
Project: Camel
Issue Type: Bug
Components: camel-aws2
Affects Versions: 4.18.0, 4.22.0, 4.23.0
Reporter: Claus Ibsen
Fix For: 4.24.0
Found while adding the catalog body types of aws-secrets-manager (CAMEL-24961).
h4. 1. binaryPayload=true stores the Base64 text of the value
With {{binaryPayload=true}} createSecret, updateSecret and putSecretValue read
the body as text and store {{SdkBytes.fromUtf8String(Base64(text))}} as the
binary of the secret ({{SecretsManagerProducer}}, main 07d2e7a987bc, line 171,
and lines 330 and 478). The AWS SDK sends a binary as Base64 itself, so the
binary stored is the Base64 text of the value, not its bytes: another client
reads the Base64 text, and getSecret of this component decodes it once more. A
byte[] body is also turned into text first, so bytes that are not text in the
charset change. The docs say the value "is stored as binary".
Checked on 4.24.0-SNAPSHOT with {{camel run}} against the AWS emulator of
{{camel infra run aws}}: the binary of a secret made with the value
test-value-4 was the bytes of {{dGVzdC12YWx1ZS00}}; getSecret with
binaryPayload=true gave test-value-4 back.
*Proposed change*: store the bytes of the body as the binary, and give the
bytes back for getSecret; note it in the upgrade guide.
h4. 2. getSecret and batchGetSecret with binary and string secrets
* getSecret with {{binaryPayload=true}} of a string secret fails with a
{{NullPointerException}} ({{secretBinary()}} is null; line 211);
* getSecret without it of a binary secret gives no body, with no hint (line
213);
* batchGetSecret gives null for a binary secret (line 446), fails for a string
secret with binaryPayload=true (line 438), drops the errors of the response, so
the List can be shorter than the ids asked for, and skips empty version ids, so
{{CamelAwsSecretsManagerSecretVersionIds}} may not line up with the body.
Checked on 4.24.0-SNAPSHOT with {{camel run}} against the AWS emulator of
{{camel infra run aws}}: the NullPointerException, the null body, and {{[value,
null]}} for a string and a binary secret.
*Proposed change*: give the binary or the string, whichever the secret has;
fail for the errors of batchGetSecret or put them in a header.
h4. 3. No operation fails with a NullPointerException
Without the operation option and the {{CamelAwsSecretsManagerOperation}} header
the producer fails with {{NullPointerException: Cannot invoke
"...SecretsManagerOperations.ordinal()"}} (line 61). Checked on 4.24.0-SNAPSHOT
with {{camel run}} against the AWS emulator of {{camel infra run aws}}.
*Proposed change*: fail with a message that says the operation is missing, as
aws2-kms and aws2-iam do.
h4. Also read in the code, not run
* {{CamelAwsSecretsManagerSecretVersionIds}} is a List, but the catalog says
String ({{SecretsManagerConstants}}, lines 41-42); checked at runtime.
* updateSecret always sets the value from the body: no body fails, and the
description cannot be updated alone.
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
