Dhairya-007 commented on PR #29711:
URL: https://github.com/apache/camel/pull/29711#issuecomment-6825141056
Thanks — the leak is real and it is on the exact line I was rewriting, so it
belongs here. Fixed, and I took your *alternative* rather than the `finally`
version, because it removes the failure mode instead of handling it:
```java
String encoded = StringHelper.after(auth, " ");
byte[] credentials;
try {
// the value is base64 encoded, so we need to decode that
credentials = Base64.getDecoder().decode(encoded.trim());
} catch (IllegalArgumentException e) {
// a client sent something that is not base64 at all: no principal, so
the request is
// answered with 401 rather than an error
LOG.debug("Cannot decode the Basic Auth header, it is not valid base64");
return null;
}
String userAndPw = new String(credentials, StandardCharsets.UTF_8);
```
With `java.util.Base64` there is no `ByteBuf` on this path at all, so there
is nothing to release and no ordering to get wrong — and returning `null` on a
malformed header is what the method already does for every other unparseable
case, so the client gets a 401 instead of an exception out of the handler.
`io.netty.handler.codec.base64.Base64` is no longer imported; `ByteBuf` and
`NettyConverter` stay, they are still used by `writeResponse`.
**Added the malformed test**, and verifying it caught a mistake worth
mentioning: my first version also asserted that `Basic c2NvdHQ6dGlnZX` is
rejected. It is not — the JDK decoder does not require the trailing padding, so
that value decodes happily to `scott:tige`. The test now uses `Basic %%%` and
`Basic not base64!`, both of which really do throw, and says so in a comment.
**On @oscerd's upgrade-guide point:** #29694 concluded no note was needed,
since main requires Java 21 where the default charset is already UTF-8 and only
a deployment overriding `file.encoding` sees a change. The same reasoning
covers the server side, so I have left the guide alone — say the word if you
would rather have a sentence covering both halves and I will add it to one of
the two PRs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
