[jira] [Assigned] (CAMEL-26028) camel-support - the error of a failed API component call shows the values of the endpoint options, passwords and tokens too

["Claus Ibsen (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-26028?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Claus Ibsen reassigned CAMEL-26028:
-----------------------------------

    Assignee: Claus Ibsen

> camel-support - the error of a failed API component call shows the values of the endpoint options, passwords and tokens too
> ---------------------------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-26028
>                 URL: https://issues.apache.org/jira/browse/CAMEL-26028
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-support
>    Affects Versions: 4.18.0, 4.22.0, 4.23.0
>            Reporter: Claus Ibsen
>            Assignee: Claus Ibsen
>            Priority: Major
>             Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> When the method of an API component fails, {{ApiMethodHelper.invokeMethod}} throws "Error invoking <method> with <arguments>: <message>" ({{ApiMethodHelper}}, main 07d2e7a987bc, lines 533 and 537), with the map of all the arguments of the call. That map holds the options of the endpoint as well, so the message, and the log of the error handler, show their values, such as a password, an access token or a client secret. This applies to all API components: as2, box, braintree, dhis2, fhir, google-calendar, google-drive, google-mail, google-sheets, olingo2, olingo4, twilio and zendesk.
> Checked on 4.24.0-SNAPSHOT with {{camel run}}: a fhir producer with the {{username}} and {{password}} options, calling a server that does not answer, failed with a message that holds the password.
> *Proposed change*: mask the values of the sensitive options in the message, as Camel masks them in endpoint URIs.
> _Claude Code on behalf of davsclaus_



--
This message was sent by Atlassian Jira
(v10.3.26#10030026)