[
https://issues.apache.org/jira/browse/CAMEL-26276?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-26276 started by Andrea Cosentino.
------------------------------------------------
> camel-clickup - compare the webhook signature in constant time, and do not
> log it
> ---------------------------------------------------------------------------------
>
> Key: CAMEL-26276
> URL: https://issues.apache.org/jira/browse/CAMEL-26276
> Project: Camel
> Issue Type: Improvement
> Components: camel-clickup
> Reporter: Claus Ibsen
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.24.0
>
>
> Found while adding the catalog body types of clickup (CAMEL-24961, PR #28410).
> {{ClickUpWebhookService.validateMessageSignature}} (main 2a465aa4814c, line
> 99) compares the HMAC it computes with the signature of the request with
> {{String.equals}}, and logs the body, the signature and the computed
> signature at DEBUG (lines 87, 101 and 106). camel-whatsapp does the same
> check with {{MessageDigest.isEqual}}.
> Proposed: compare with {{MessageDigest.isEqual}}, and do not log the
> signatures (or the body).
> _Claude Code on behalf of davsclaus_
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
