-
Notifications
You must be signed in to change notification settings - Fork 916
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Scrub secrets from process arguments #13225
Changes from 1 commit
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -14,7 +14,6 @@ | |
import java.lang.management.ManagementFactory; | ||
import java.lang.management.RuntimeMXBean; | ||
import java.util.ArrayList; | ||
import java.util.Arrays; | ||
import java.util.List; | ||
import java.util.Locale; | ||
import java.util.regex.Pattern; | ||
|
@@ -35,6 +34,9 @@ public final class ProcessResource { | |
// Important: This is statically used in buildResource, so must be declared/initialized first. | ||
private static final Pattern JAR_FILE_PATTERN = | ||
Pattern.compile("^\\S+\\.(jar|war)", Pattern.CASE_INSENSITIVE); | ||
// scrub values for system properties containing "secret" or "password" in the name | ||
private static final Pattern SCRUB_PATTERN = | ||
Pattern.compile("(-D.*(password|secret).*=).*", Pattern.CASE_INSENSITIVE); | ||
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Would it be worth to also scrub properties containing There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'll leave that to @trask to decide. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. IMO, it's another option to provide an environment variable for users so that they can set some keys themselves. There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I think ok to go with just |
||
|
||
private static final Resource INSTANCE = buildResource(); | ||
|
||
|
@@ -94,12 +96,14 @@ private static Resource doBuildResource() { | |
if (args.length > 0) { | ||
List<String> commandArgs = new ArrayList<>(args.length + 1); | ||
commandArgs.add(executablePath.toString()); | ||
commandArgs.addAll(Arrays.asList(args)); | ||
for (String arg : args) { | ||
commandArgs.add(scrub(arg)); | ||
} | ||
attributes.put(PROCESS_COMMAND_ARGS, commandArgs); | ||
} else { // Java 8 | ||
StringBuilder commandLine = new StringBuilder(executablePath); | ||
for (String arg : runtime.getInputArguments()) { | ||
commandLine.append(' ').append(arg); | ||
commandLine.append(' ').append(scrub(arg)); | ||
} | ||
// sun.java.command isn't well document and may not be available on all systems. | ||
String javaCommand = System.getProperty("sun.java.command"); | ||
|
@@ -118,5 +122,9 @@ private static Resource doBuildResource() { | |
return Resource.create(attributes.build(), SchemaUrls.V1_24_0); | ||
} | ||
|
||
private static String scrub(String argument) { | ||
return SCRUB_PATTERN.matcher(argument).replaceFirst("$1***"); | ||
} | ||
|
||
private ProcessResource() {} | ||
} |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I changed it to
use the final jar instead of directories with built classes to test the mrjar functionality
wdyt?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm