[
https://issues.apache.org/jira/browse/CAMEL-26276?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18144316#comment-18144316
]
Claus Ibsen commented on CAMEL-26276:
-------------------------------------
The constant-time compare was done by
https://github.com/apache/camel/pull/29696 (merged on main, with UTF-8 hashing
of the raw body). https://github.com/apache/camel/pull/29809 does the rest: the
check no longer logs the signatures, the exception of a failed check no longer
carries the calculated signature, and toString() of the configuration and the
webhook masks the credentials. Both go to camel-4.22.x and camel-4.18.x
together once #29809 is merged, so I added 4.22.3 and 4.18.6 to the fix
versions. CAMEL-26917 was a duplicate of this issue.
@acosentino this ticket is assigned to you: I hope it is OK that #29809
completes it.
_Claude Code on behalf of davsclaus_
> camel-clickup - compare the webhook signature in constant time, and do not
> log it
> ---------------------------------------------------------------------------------
>
> Key: CAMEL-26276
> URL: https://issues.apache.org/jira/browse/CAMEL-26276
> Project: Camel
> Issue Type: Improvement
> Components: camel-clickup
> Reporter: Claus Ibsen
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> Found while adding the catalog body types of clickup (CAMEL-24961, PR #28410).
> {{ClickUpWebhookService.validateMessageSignature}} (main 2a465aa4814c, line
> 99) compares the HMAC it computes with the signature of the request with
> {{String.equals}}, and logs the body, the signature and the computed
> signature at DEBUG (lines 87, 101 and 106). camel-whatsapp does the same
> check with {{MessageDigest.isEqual}}.
> Proposed: compare with {{MessageDigest.isEqual}}, and do not log the
> signatures (or the body).
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
