diff --git a/src/main/java/com/mercadopago/webhook/WebhookSignatureValidator.java b/src/main/java/com/mercadopago/webhook/WebhookSignatureValidator.java index 9dd1e996..82c36306 100644 --- a/src/main/java/com/mercadopago/webhook/WebhookSignatureValidator.java +++ b/src/main/java/com/mercadopago/webhook/WebhookSignatureValidator.java @@ -53,7 +53,7 @@ private WebhookSignatureValidator() { * manifest before computing the HMAC * @param dataId value of the {@code data.id} query parameter; may be {@code null} or * blank, in which case the {@code id:} pair is omitted. When present, - * it is lowercased before being included in the manifest + * it is included in the manifest exactly as received * @param secret secret signature configured for the application in Tus Integraciones, * used as the HMAC key * @throws MPInvalidWebhookSignatureException when the signature is missing, malformed, or @@ -201,7 +201,7 @@ private static ParsedSignature parseSignatureHeader(String header) { private static String buildManifest(String dataId, String requestId, String timestamp) { StringBuilder sb = new StringBuilder(); if (dataId != null) { - sb.append("id:").append(dataId.toLowerCase()).append(';'); + sb.append("id:").append(dataId).append(';'); } if (requestId != null) { sb.append("request-id:").append(requestId).append(';'); diff --git a/src/test/java/com/mercadopago/webhook/WebhookSignatureValidatorTest.java b/src/test/java/com/mercadopago/webhook/WebhookSignatureValidatorTest.java index 79cac0e8..2f622af1 100644 --- a/src/test/java/com/mercadopago/webhook/WebhookSignatureValidatorTest.java +++ b/src/test/java/com/mercadopago/webhook/WebhookSignatureValidatorTest.java @@ -27,7 +27,7 @@ private static String computeHash(String dataId, String requestId, String ts, St try { StringBuilder mb = new StringBuilder(); if (dataId != null && !dataId.isEmpty()) { - mb.append("id:").append(dataId.toLowerCase()).append(';'); + mb.append("id:").append(dataId).append(';'); } if (requestId != null && !requestId.isEmpty()) { mb.append("request-id:").append(requestId).append(';'); @@ -68,9 +68,10 @@ void happyPathLowercase() { // case 2 @Test - void uppercaseDataIdIsLowercased() { + void uppercaseDataIdIsPreserved() { + String upperHash = computeHash(DATA_ID_RAW, REQUEST_ID, TS, SECRET); assertDoesNotThrow(() -> - WebhookSignatureValidator.validate(buildHeader(validHash()), REQUEST_ID, DATA_ID_RAW, SECRET)); + WebhookSignatureValidator.validate(buildHeader(upperHash), REQUEST_ID, DATA_ID_RAW, SECRET)); } // case 3