SpringCloud/spring-cloud-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Ensure EnvironmentController does not leak system properties

Browse Source 
In the JSON and YAML endpoints system properties and env vars could
leak if the config contains placeholders with default values.
This change explicitly switches off that replacement (making the
JSON and JAML consistent with the properties endpoint).

Fixes gh-480, closes gh-492
This commit is contained in:
Dave Syer
2016-09-20 10:55:15 +01:00
parent 4d458ee593
commit 53e049a812
3 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pom.xml
View File

@@ -11,7 +11,7 @@
<parent>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-build</artifactId>
<version>1.2.0.RELEASE</version>
<version>1.2.1.BUILD-SNAPSHOT</version>
<relativePath/> <!-- lookup parent from repository -->
</parent>
<scm>

9
spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/environment/EnvironmentController.java
View File

@@ -152,7 +152,7 @@ public class EnvironmentController {
throws Exception {
validateProfiles(profiles);
Environment environment = labelled(name, profiles, label);
Map<String, Object> properties = convertToMap(environment);
Map<String, Object> properties = convertToMap(environment, resolvePlaceholders);
String json = this.objectMapper.writeValueAsString(properties);
if (resolvePlaceholders) {
json = resolvePlaceholders(prepareEnvironment(environment), json);
@@ -188,7 +188,7 @@ public class EnvironmentController {
throws Exception {
validateProfiles(profiles);
Environment environment = labelled(name, profiles, label);
Map<String, Object> result = convertToMap(environment);
Map<String, Object> result = convertToMap(environment, resolvePlaceholders);
if (this.stripDocument && result.size() == 1
&& result.keySet().iterator().next().equals("document")) {
Object value = result.get("document");
@@ -208,10 +208,13 @@ public class EnvironmentController {
return getSuccess(yaml);
}
private Map<String, Object> convertToMap(Environment input) throws BindException {
private Map<String, Object> convertToMap(Environment input, boolean resolvePlaceholders) throws BindException {
Map<String, Object> target = new LinkedHashMap<>();
PropertiesConfigurationFactory<Map<String, Object>> factory = new PropertiesConfigurationFactory<>(
target);
if (!resolvePlaceholders) {
factory.setResolvePlaceholders(false);
}
Map<String, Object> data = convertToProperties(input);
LinkedHashMap<String, Object> properties = new LinkedHashMap<>();
for (String key : data.keySet()) {

22
spring-cloud-config-server/src/test/java/org/springframework/cloud/config/server/environment/EnvironmentControllerTests.java
View File

@@ -138,7 +138,15 @@ public class EnvironmentControllerTests {
public void placeholdersNotResolvedInYamlFromSystemPropertiesWhenNotFlaggedWithDefault() throws Exception {
whenPlaceholdersSystemPropsWithDefault();
String yaml = this.controller.yaml("foo", "bar", false).getBody();
// If there is a default value we can't prevent the placeholder being resolved
// If there is a default value we prevent the placeholder being resolved
assertEquals("a:\n b:\n c: ${foo:spam}\n", yaml);
}
@Test
public void placeholdersResolvedInYamlFromSystemPropertiesWhenFlagged() throws Exception {
whenPlaceholdersSystemPropsWithDefault();
String yaml = this.controller.yaml("foo", "bar", true).getBody();
// If there is a default value we do not prevent the placeholder being resolved
assertEquals("a:\n b:\n c: spam\n", yaml);
}
@@ -335,10 +343,18 @@ public class EnvironmentControllerTests {
}
@Test
public void placeholdersResolvedInJsonFromSystemPropertiesWhenNotFlaggedWithDefault() throws Exception {
public void placeholdersNotResolvedInJsonFromSystemPropertiesWhenNotFlaggedWithDefault() throws Exception {
whenPlaceholdersSystemPropsWithDefault();
String json = this.controller.jsonProperties("foo", "bar", false).getBody();
// If there is a default value we can't prevent the placeholder being resolved
// If there is a default value we do not prevent the placeholder being resolved
assertEquals("{\"a\":{\"b\":{\"c\":\"${foo:spam}\"}}}", json);
}
@Test
public void placeholdersResolvedInJsonFromSystemPropertiesWhenFlagged() throws Exception {
whenPlaceholdersSystemPropsWithDefault();
String json = this.controller.jsonProperties("foo", "bar", true).getBody();
// If there is a default value we prevent the placeholder being resolved
assertEquals("{\"a\":{\"b\":{\"c\":\"spam\"}}}", json);
}