davsclaus opened a new pull request, #28945: URL: https://github.com/apache/camel/pull/28945
Fixes [CAMEL-26169](https://issues.apache.org/jira/browse/CAMEL-26169). `NetWeaverProducer.doStart` built the uri of the inner http endpoint as `url + "?authUsername=" + username + "&authPassword=" + password + "&authMethod=Basic"`. ### 1. A url that already has a query string gets a second `?` **What was wrong:** with a url such as `http://host/odata?sap-client=100`, the http endpoint got `...?sap-client=100?authUsername=...`. The credentials became part of the `sap-client` value, so the request went out as `/odata/Flights?sap-client=100%3FauthUsername%3Dcamel` without authentication and the server answered 401. **What changed:** the auth parameters are appended with `&` when the url already contains `?`. Note: a query string written in the `sap-netweaver:` endpoint uri itself is parsed as endpoint options, so this case happens when the url is set on the endpoint directly (`NetWeaverEndpoint#setUrl`, bean configuration). ### 2. A password with `&` or `+` fails **What was wrong:** the username and password were put into the uri as is. With `password=RAW(a&b=c+d)` the password sent was `a`, and `b=c+d` went into the request query. A `+` became a space. **What changed:** the username and password are wrapped in `RAW()`. ### Tests New `NetWeaverProducerTest` runs the producer against a local httpcore5 server that asks for Basic auth. It checks the query string, the path, the Basic credentials and the JSON-to-Map result. Both tests fail without the fix (401 for the first; `b=c+d` in the query for the second) and pass with it. The module's surefire config only ran `*UriConfigurationTest` (the other tests need a real SAP account), so the new test is added to the includes, and `assertj-core` is added as a test dependency. `mvn clean install -Psourcecheck` in the module passes. ### Not changed - No option, header or doc change, so no generated files and no upgrade guide entry. - I did not switch to `URISupport.appendParametersToURI`: it normalizes and re-encodes the existing query of the url, and non-RAW values are decoded twice by the endpoint parser. _Claude Code on behalf of Claus Ibsen (davsclaus)_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
