Claus Ibsen created CAMEL-26276:
-----------------------------------
Summary: camel-clickup - compare the webhook signature in constant
time, and do not log it
Key: CAMEL-26276
URL: https://issues.apache.org/jira/browse/CAMEL-26276
Project: Camel
Issue Type: Improvement
Components: camel-clickup
Reporter: Claus Ibsen
Fix For: 4.24.0
Found while adding the catalog body types of clickup (CAMEL-24961, PR #28410).
{{ClickUpWebhookService.validateMessageSignature}} (main 2a465aa4814c, line 99)
compares the HMAC it computes with the signature of the request with
{{String.equals}}, and logs the body, the signature and the computed signature
at DEBUG (lines 87, 101 and 106). camel-whatsapp does the same check with
{{MessageDigest.isEqual}}.
Proposed: compare with {{MessageDigest.isEqual}}, and do not log the signatures
(or the body).
_Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
