Encode HTTP Basic credentials as UTF-8, not in the platform default charset

components/camel-as2/camel-as2-api/src/main/java/org/apache/camel/component/as2/api/util/AS2HeaderUtils.java

@@ -16,6 +16,7 @@
  */
 package org.apache.camel.component.as2.api.util;
 
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Base64;
 import java.util.List;
@@ -167,7 +168,8 @@ public static String getParameterValue(Header[] headers, String headerName, Stri
     public static void addAuthorizationHeader(HttpMessage message, String userName, String password, String accessToken) {
         if (userName != null && password != null) {
             message.addHeader(AS2Header.AUTHORIZATION,
-                    ("Basic " + Base64.getEncoder().encodeToString((userName + ":" + password).getBytes())));
+                    ("Basic " + Base64.getEncoder()
+                            .encodeToString((userName + ":" + password).getBytes(StandardCharsets.UTF_8))));
         } else if (accessToken != null) {
             message.addHeader(AS2Header.AUTHORIZATION, "Bearer " + accessToken);
         }

components/camel-as2/camel-as2-api/src/test/java/org/apache/camel/component/as2/api/util/AS2HeaderUtilsTest.java

@@ -16,13 +16,20 @@
  */
 package org.apache.camel.component.as2.api.util;
 
+import java.util.Base64;
+
+import org.apache.camel.component.as2.api.AS2Header;
 import org.apache.camel.component.as2.api.util.AS2HeaderUtils.Parameter;
+import org.apache.hc.core5.http.HttpMessage;
+import org.apache.hc.core5.http.message.BasicHttpRequest;
 import org.apache.hc.core5.http.message.ParserCursor;
 import org.apache.hc.core5.util.CharArrayBuffer;
 import org.junit.jupiter.api.Test;
 
+import static java.nio.charset.StandardCharsets.ISO_8859_1;
 import static org.junit.jupiter.api.Assertions.assertArrayEquals;
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 
 public class AS2HeaderUtilsTest {
 
@@ -55,4 +62,20 @@ public void parseNameValuePairTest() {
         assertArrayEquals(SIGNED_RECEIPT_MICALG_VALUES, parameter.getValues(), "Unexpected value for parameter values");
     }
 
+    @Test
+    public void addAuthorizationHeaderEncodesCredentialsAsUtf8() {
+        // a password outside US-ASCII: "pa(diaeresis)ssword"
+        final String password = "p\u00e4ssword";
+        final HttpMessage message = new BasicHttpRequest("POST", "/");
+
+        AS2HeaderUtils.addAuthorizationHeader(message, "user", password, null);
+
+        // the expected value is written out rather than recomputed the way the code does it, so the assertion says
+        // what has to go on the wire whatever the JVM's default charset is: RFC 7617 asks for UTF-8
+        assertEquals("Basic dXNlcjpww6Rzc3dvcmQ=", message.getFirstHeader(AS2Header.AUTHORIZATION).getValue());
+
+        // what the default charset would have produced instead, had it not been UTF-8
+        assertNotEquals("Basic " + Base64.getEncoder().encodeToString(("user:" + password).getBytes(ISO_8859_1)),
+                message.getFirstHeader(AS2Header.AUTHORIZATION).getValue());
+    }
 }

components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/KeycloakProducer.java

@@ -18,6 +18,7 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Base64;
@@ -1414,7 +1415,7 @@ private void revokeToken(Exchange exchange, String defaultTypeHint) throws Excep
 
             // Add Basic authentication header
             String auth = clientId + ":" + clientSecret;
-            String encodedAuth = Base64.getEncoder().encodeToString(auth.getBytes());
+            String encodedAuth = Base64.getEncoder().encodeToString(auth.getBytes(StandardCharsets.UTF_8));
             request.setHeader("Authorization", "Basic " + encodedAuth);
             request.setHeader("Content-Type", "application/x-www-form-urlencoded");
 

components/camel-keycloak/src/main/java/org/apache/camel/component/keycloak/security/KeycloakTokenIntrospector.java

@@ -17,6 +17,7 @@
 package org.apache.camel.component.keycloak.security;
 
 import java.io.IOException;
+import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.List;
 import java.util.Map;
@@ -142,7 +143,7 @@ public IntrospectionResult introspect(String token) throws IOException {
 
         // Add Basic authentication header
         String auth = clientId + ":" + clientSecret;
-        String encodedAuth = Base64.getEncoder().encodeToString(auth.getBytes());
+        String encodedAuth = Base64.getEncoder().encodeToString(auth.getBytes(StandardCharsets.UTF_8));
         request.setHeader("Authorization", "Basic " + encodedAuth);
         request.setHeader("Content-Type", "application/x-www-form-urlencoded");
 

components/camel-smpp/src/main/java/org/apache/camel/component/smpp/SmppConnectionFactory.java

@@ -53,6 +53,7 @@
 import java.io.OutputStream;
 import java.net.InetSocketAddress;
 import java.net.Socket;
+import java.nio.charset.StandardCharsets;
 import java.util.Base64;
 import java.util.Map;
 
@@ -171,33 +172,33 @@ private void connectProxy(String host, int port, Socket socket) throws IOExcepti
             InputStream in = socket.getInputStream();
 
             String connectString = "CONNECT " + host + ":" + port + " HTTP/1.0\r\n";
-            out.write(connectString.getBytes());
+            out.write(connectString.getBytes(StandardCharsets.UTF_8));
 
             String username = config.getHttpProxyUsername();
             String password = config.getHttpProxyPassword();
 
             if (username != null && password != null) {
                 String usernamePassword = username + ":" + password;
-                byte[] code = Base64.getEncoder().encode(usernamePassword.getBytes());
-                out.write("Proxy-Authorization: Basic ".getBytes());
+                byte[] code = Base64.getEncoder().encode(usernamePassword.getBytes(StandardCharsets.UTF_8));
+                out.write("Proxy-Authorization: Basic ".getBytes(StandardCharsets.UTF_8));
                 out.write(code);
-                out.write("\r\n".getBytes());
+                out.write("\r\n".getBytes(StandardCharsets.UTF_8));
             }
 
             Map<String, String> proxyHeaders = config.getProxyHeaders();
             if (proxyHeaders != null) {
                 for (Map.Entry<String, String> entry : proxyHeaders.entrySet()) {
-                    out.write((entry.getKey() + ": " + entry.getValue()).getBytes());
-                    out.write("\r\n".getBytes());
+                    out.write((entry.getKey() + ": " + entry.getValue()).getBytes(StandardCharsets.UTF_8));
+                    out.write("\r\n".getBytes(StandardCharsets.UTF_8));
                 }
             }
 
-            out.write("\r\n".getBytes());
+            out.write("\r\n".getBytes(StandardCharsets.UTF_8));
             out.flush();
 
             int ch = 0;
 
-            BufferedReader reader = IOHelper.buffered(new InputStreamReader(in));
+            BufferedReader reader = IOHelper.buffered(new InputStreamReader(in, StandardCharsets.UTF_8));
             String response = reader.readLine();
             if (response == null) {
                 throw new RuntimeCamelException("Empty response to CONNECT request to host " + host + ":" + port);

components/camel-wordpress/src/main/java/org/apache/camel/component/wordpress/api/auth/WordpressBasicAuthentication.java

@@ -16,6 +16,8 @@
  */
 package org.apache.camel.component.wordpress.api.auth;
 
+import java.nio.charset.StandardCharsets;
+
 import org.apache.cxf.common.util.Base64Utility;
 import org.apache.cxf.jaxrs.client.ClientConfiguration;
 import org.apache.cxf.jaxrs.client.WebClient;
@@ -51,8 +53,9 @@ public WordpressBasicAuthentication(String username, String password) {
     @Override
     public void configureAuthentication(Object api) {
         if (isCredentialsSet()) {
-            final String authorizationHeader = String.format("Basic %s",
-                    Base64Utility.encode(String.format("%s:%s", this.username, this.password).getBytes()));
+            final String credentials = String.format("%s:%s", this.username, this.password);
+            final String authorizationHeader
+                    = String.format("Basic %s", Base64Utility.encode(credentials.getBytes(StandardCharsets.UTF_8)));
             LOGGER.info("Credentials set for user {}", username);
             WebClient.client(api).header("Authorization", authorizationHeader);
         } else {