[
https://issues.apache.org/jira/browse/CAMEL-26164?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen reassigned CAMEL-26164:
-----------------------------------
Assignee: Claus Ibsen
> camel-whatsapp - the webhook fails with ArrayIndexOutOfBoundsException on an
> empty query value and does not URL-decode query values
> -----------------------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-26164
> URL: https://issues.apache.org/jira/browse/CAMEL-26164
> Project: Camel
> Issue Type: Bug
> Reporter: Claus Ibsen
> Assignee: Claus Ibsen
> Priority: Minor
> Fix For: 4.24.0
>
>
> Found while adding the catalog body types of whatsapp (CAMEL-24961, PR
> #28410).
> h4. 1. A query parameter with an empty value fails with
> ArrayIndexOutOfBoundsException
> {{WhatsAppWebhookProcessor.parseQueryParam}} (main 2a465aa4814c, lines
> 140-142) splits each pair on {{=}} and reads {{keyValuePair[1]}} without a
> check. A parameter with an empty value or no {{=}}, e.g. {{?hub.challenge=}},
> throws {{ArrayIndexOutOfBoundsException}} and the verification request fails
> with 500. Checked on 4.24.0-SNAPSHOT with the webhook on netty-http.
> Proposed: parse the query with {{URISupport.parseQuery}} (or check the length
> and use an empty value).
> h4. 2. Query values are not URL-decoded
> The same {{parseQueryParam}} (line 142) stores the raw values, so an encoded
> {{hub.verify_token}} does not match the configured token and an encoded
> {{hub.challenge}} is echoed back encoded. Checked on 4.24.0-SNAPSHOT with the
> webhook on netty-http.
> Proposed: URL-decode the keys and values (also done by
> {{URISupport.parseQuery}}).
> h4. 3. A missing CamelHttpMethod header gives a NullPointerException
> {{WhatsAppWebhookProcessor.process}} (main 2a465aa4814c, line 61) calls
> {{getHeader(Exchange.HTTP_METHOD).toString()}}, so a webhook request without
> the {{CamelHttpMethod}} header fails with a {{NullPointerException}}. Checked
> on 4.24.0-SNAPSHOT.
> Proposed: read the header as {{getHeader(Exchange.HTTP_METHOD,
> String.class)}} and treat a missing method as a POST (an event).
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
