Add redaction module: JFR in-process data redaction (JEP 536) on JDK 27

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
2026-10-26 01:43:28 +00:00
parent c7eccd1db5
commit e84684e2c7
17 changed files with 682 additions and 0 deletions
@@ -0,0 +1,44 @@
+# redaction — JFR In-Process Data Redaction (JEP 536)
+
+Companion module for the ankurm.com post
+**"JFR In-Process Data Redaction (JEP 536): Safe Flight Recordings in Production"**
+(https://ankurm.com/jfr-data-redaction-jep-536-safe-flight-recordings-in-production/).
+It extends the JFR / Mission Control post's workflow with the JDK 27 feature that
+removes secrets from recordings before they are written.
+
+No Maven and no dependencies: two small Java files and shell scripts.
+
+| Component | Version | Verified against |
+|---|---|---|
+| JDK (redaction runs) | Temurin 27.0.1.0.2+1 | `java -version`; JEP 536 status "Closed / Delivered", release 27 |
+| JDK (leak baseline) | Temurin 25.0.5+8 | `java -version`; JDK 25 has no redaction |
+
+## Layout
+
+| Path | What it is |
+|---|---|
+| `src/Workload.java` | Trivial program; the secrets are on its command line, `-D` flags and environment |
+| `src/Scan.java` | Checks a `.jfr` file for planted secrets, by raw bytes and by decoded events |
+| `filters/keys.txt`, `filters/args.txt` | Filter files for `redact-key=@...` / `redact-argument=@...` |
+| `scripts/common.sh` | Plants seven fake secrets under `env -i` (your real environment is never passed in) |
+| `scripts/run-all.sh` | Regenerates every file in `output/` |
+| `output/*.txt` | Captured real output, quoted verbatim in the post |
+
+## Run it
+
+```bash
+JDK27=/path/to/jdk-27 JDK25=/path/to/jdk-25 redaction/scripts/run-all.sh
+```
+
+## Output index
+
+| File | What it shows |
+|---|---|
+| `01-jdk25-leak.txt` | JDK 25: all seven secrets sit in the recording |
+| `02-jdk27-defaults.txt` | JDK 27, no flags: three secrets redacted, four still leak |
+| `03-jdk27-opt-out.txt` | `redact-argument=none,redact-key=none` brings every leak back |
+| `04-jdk27-custom-inline.txt` | `conn*` fails to match `DB_CONN` (globs are anchored); `*conn*` fixes it |
+| `05-jdk27-filter-files-and-debug-log.txt` | Filter files with `@`, and `-Xlog:jfr+redact=debug` |
+| `06-jdk27-missing-filter-file.txt` | A missing filter file stops the JVM at startup |
+| `07-jdk27-no-plus-replaces-defaults.txt` | Without `+`, your list replaces the defaults |
+| `08-jdk27-jcmd-late-recording.txt` | A recording started later with `jcmd JFR.start` is redacted the same way |