Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Mask sensitive placeholders in env endpoint

Browse Source 
Closes gh-8282
This commit is contained in:
Madhura Bhave
2017-03-07 16:59:10 -08:00
parent 703b7d9268
commit 7da70a52fd
4 changed files with 126 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/EnvironmentEndpointTests.java
View File

@@ -39,6 +39,7 @@ import static org.assertj.core.api.Assertions.assertThat;
* @author Christian Dupuis
* @author Nicolas Lejeune
* @author Stephane Nicoll
* @author Madhura Bhave
*/
public class EnvironmentEndpointTests extends AbstractEndpointTests<EnvironmentEndpoint> {
@@ -194,6 +195,66 @@ public class EnvironmentEndpointTests extends AbstractEndpointTests<EnvironmentE
assertThat(systemProperties.get("apiKey")).isEqualTo("******");
}
@SuppressWarnings("unchecked")
@Test
public void propertyWithPlaceholderResolved() throws Exception {
this.context = new AnnotationConfigApplicationContext();
EnvironmentTestUtils.addEnvironment(this.context,
"my.foo: ${bar.blah}", "bar.blah: hello");
this.context.register(Config.class);
this.context.refresh();
EnvironmentEndpoint report = getEndpointBean();
Map<String, Object> env = report.invoke();
Map<String, Object> testProperties = (Map<String, Object>) env
.get("test");
assertThat(testProperties.get("my.foo")).isEqualTo("hello");
}
@SuppressWarnings("unchecked")
@Test
public void propertyWithPlaceholderNotResolved() throws Exception {
this.context = new AnnotationConfigApplicationContext();
EnvironmentTestUtils.addEnvironment(this.context,
"my.foo: ${bar.blah}");
this.context.register(Config.class);
this.context.refresh();
EnvironmentEndpoint report = getEndpointBean();
Map<String, Object> env = report.invoke();
Map<String, Object> testProperties = (Map<String, Object>) env
.get("test");
assertThat(testProperties.get("my.foo")).isEqualTo("${bar.blah}");
}
@SuppressWarnings("unchecked")
@Test
public void propertyWithSensitivePlaceholderResolved() throws Exception {
this.context = new AnnotationConfigApplicationContext();
EnvironmentTestUtils.addEnvironment(this.context,
"my.foo: http://${bar.password}://hello", "bar.password: hello");
this.context.register(Config.class);
this.context.refresh();
EnvironmentEndpoint report = getEndpointBean();
Map<String, Object> env = report.invoke();
Map<String, Object> testProperties = (Map<String, Object>) env
.get("test");
assertThat(testProperties.get("my.foo")).isEqualTo("http://******://hello");
}
@SuppressWarnings("unchecked")
@Test
public void propertyWithSensitivePlaceholderNotResolved() throws Exception {
this.context = new AnnotationConfigApplicationContext();
EnvironmentTestUtils.addEnvironment(this.context,
"my.foo: http://${bar.password}://hello");
this.context.register(Config.class);
this.context.refresh();
EnvironmentEndpoint report = getEndpointBean();
Map<String, Object> env = report.invoke();
Map<String, Object> testProperties = (Map<String, Object>) env
.get("test");
assertThat(testProperties.get("my.foo")).isEqualTo("http://${bar.password}://hello");
}
@Configuration
@EnableConfigurationProperties
public static class Config {

11
spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/EnvironmentMvcEndpointTests.java
View File

@@ -148,6 +148,17 @@ public class EnvironmentMvcEndpointTests {
.andExpect(content().string(containsString("\"my.foo\":\"${my.bar}\"")));
}
@Test
public void nestedPathWithSensitivePlaceholderShouldSanitize() throws Exception {
Map<String, Object> map = new HashMap<String, Object>();
map.put("my.foo", "${my.password}");
map.put("my.password", "hello");
((ConfigurableEnvironment) this.context.getEnvironment()).getPropertySources()
.addFirst(new MapPropertySource("placeholder", map));
this.mvc.perform(get("/env/my.*")).andExpect(status().isOk())
.andExpect(content().string(containsString("\"my.foo\":\"******\"")));
}
@Configuration
@Import({ JacksonAutoConfiguration.class,
HttpMessageConvertersAutoConfiguration.class, WebMvcAutoConfiguration.class,