asmhatreandClaude Sonnet 5
f59c1de96d
Co-Authored-By: Claude Sonnet 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01B38FGKKam5SCGgwgduVAh3
35 lines
2.1 KiB
Bash
Executable File
35 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# JEP 536: JFR in-process data redaction. Start a JVM that has secrets in its arguments, system
|
|
# properties and environment, record it with JFR, and print what ended up in the recording.
|
|
# ./scripts/jfr-redaction.sh -> docs/output/40-jfr-redaction.txt
|
|
set -euo pipefail
|
|
source "$(dirname "$0")/env.sh"
|
|
B="$ROOT/build/jfr"; rm -rf "$B"; mkdir -p "$B"
|
|
"$JDK27/bin/javac" --release 26 -d "$B" "$ROOT/jep-tour/src/Idle.java"
|
|
|
|
# record <label> <jdk> <FlightRecorderOptions value or empty>
|
|
record() {
|
|
local label="$1" jdk="$2" opts="${3:-}" jfr="$B/$1.jfr"
|
|
local fropt=(); [ -n "$opts" ] && fropt=("-XX:FlightRecorderOptions:$opts")
|
|
DB_PASSWORD=hunter2 "$jdk/bin/java" -Dapi.token=abc123 -Dregion=ap-south-1 "${fropt[@]}" \
|
|
-XX:StartFlightRecording:filename="$jfr" -cp "$B" Idle --password=hunter2 --user=ankur >/dev/null 2>&1
|
|
echo "=== $label"
|
|
[ -n "$opts" ] && echo " -XX:FlightRecorderOptions:$opts"
|
|
"$jdk/bin/jfr" print --events jdk.JVMInformation "$jfr" | grep -E 'jvmArguments|javaArguments' | sed 's/^ *//' | sed -E 's/(-XX:StartFlightRecording:filename=)[^ "]*/\1<file>/'
|
|
"$jdk/bin/jfr" print --events jdk.InitialSystemProperty "$jfr" | grep -A1 -E 'key = "(api.token|region)"' | grep -v -- '^--$' | sed 's/^ *//' | paste - -
|
|
"$jdk/bin/jfr" print --events jdk.InitialEnvironmentVariable "$jfr" | grep -A1 -E 'key = "DB_PASSWORD"' | grep -v -- '^--$' | sed 's/^ *//' | paste - -
|
|
echo
|
|
}
|
|
|
|
{
|
|
echo "# The process under test: java -Dapi.token=abc123 -Dregion=ap-south-1 ... Idle --password=hunter2 --user=ankur"
|
|
echo "# with DB_PASSWORD=hunter2 in the environment. Which of those values reach the recording?"
|
|
echo
|
|
record "jdk26-default" "$JDK26"
|
|
record "jdk27-default" "$JDK27"
|
|
record "jdk27-own-list-replaces-defaults" "$JDK27" "redact-argument=--user*,redact-key=region"
|
|
record "jdk27-plus-extends-defaults" "$JDK27" "redact-argument=+--user*,redact-key=+region"
|
|
record "jdk27-none-disables-redaction" "$JDK27" "redact-argument=none,redact-key=none"
|
|
} > "$OUT/40-jfr-redaction.txt" 2>&1
|
|
cat "$OUT/40-jfr-redaction.txt"
|