asmhatre/jfr
1
0
Fork 0
Code Activity

Add redaction module: JFR in-process data redaction (JEP 536) on JDK 27

Browse Source 
Co-Authored-By: Claude Sonnet 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
This commit is contained in:
asmhatre
2026-10-26 01:43:28 +00:00
co-authored by Claude Sonnet 5.5
parent c7eccd1db5
commit e84684e2c7
17 changed files with 682 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
redaction/output/01-jdk25-leak.txt
+163
View File
@@ -0,0 +1,163 @@
### JDK 25: no redaction exists. What is in the recording?
openjdk version "25.0.5" 2026-10-20 LTS
OpenJDK Runtime Environment Temurin-25.0.5+8 (build 25.0.5+8-LTS)
OpenJDK 64-Bit Server VM Temurin-25.0.5+8 (build 25.0.5+8-LTS, mixed mode, sharing)
LEAK-ENV-TOKEN-1 RAW=LEAK EVENTS=1
LEAK-PROP-PASSWORD-2 RAW=LEAK EVENTS=3
LEAK-ARG-DBPASSWORD-3 RAW=LEAK EVENTS=3
LEAK-URL-PW-4 RAW=LEAK EVENTS=3
LEAK-ENV-CONN-5 RAW=LEAK EVENTS=1
LEAK-PROP-DBPASS-6 RAW=LEAK EVENTS=3
LEAK-ARG-DBPASS-7 RAW=LEAK EVENTS=3
exit=2
### jfr print
jdk.JVMInformation {
startTime = 01:42:36.460 (2026-10-26)
jvmName = "OpenJDK 64-Bit Server VM"
jvmVersion = "OpenJDK 64-Bit Server VM (25.0.5+8-LTS) for linux-amd64 JRE (25.0.5+8-LTS), built on 2026-10-20T00:00:00Z with gcc 14.2.0"
jvmArguments = "-XX:StartFlightRecording:filename=/tmp/jfr-redaction/jdk25.jfr -Xmx256m -Djavax.net.ssl.keyStorePassword=LEAK-PROP-PASSWORD-2 -Ddb-pass=LEAK-PROP-DBPASS-6 -Dapp.region=mumbai"
jvmFlags = N/A
javaArguments = "Workload --dbpassword LEAK-ARG-DBPASSWORD-3 --db-pass LEAK-ARG-DBPASS-7 https://john:[email protected]/login --verbose"
jvmStartTime = 01:42:35.982 (2026-10-26)
pid = 6378
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.vm.specification.name"
value = "Java Virtual Machine Specification"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.vm.name"
value = "OpenJDK 64-Bit Server VM"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.home"
value = "/tmp/claude-0/post2/j25/jdk-25.0.5+8"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "app.region"
value = "mumbai"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "sun.java.command"
value = "Workload --dbpassword LEAK-ARG-DBPASSWORD-3 --db-pass LEAK-ARG-DBPASS-7 https://john:[email protected]/login --verbose"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.class.path"
value = "/tmp/claude-0/post2/repo/redaction/build"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "sun.java.launcher"
value = "SUN_STANDARD"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.vm.compressedOopsMode"
value = "32-bit"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "jdk.debug"
value = "release"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "db-pass"
value = "LEAK-PROP-DBPASS-6"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "javax.net.ssl.keyStorePassword"
value = "LEAK-PROP-PASSWORD-2"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.vm.vendor"
value = "Eclipse Adoptium"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.vm.specification.version"
value = "25"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.vm.info"
value = "mixed mode, sharing"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.vm.specification.vendor"
value = "Oracle Corporation"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.vm.version"
value = "25.0.5+8-LTS"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "sun.boot.library.path"
value = "/tmp/claude-0/post2/j25/jdk-25.0.5+8/lib"
}
jdk.InitialSystemProperty {
startTime = 01:42:36.460 (2026-10-26)
key = "java.library.path"
value = "/usr/java/packages/lib:/usr/lib64:/lib64:/lib:/usr/lib"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:36.460 (2026-10-26)
key = "PATH"
value = "/usr/bin:/bin"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:36.460 (2026-10-26)
key = "DEPLOY_REGION"
value = "eu-west-1"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:36.460 (2026-10-26)
key = "HOME"
value = "/nonexistent"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:36.460 (2026-10-26)
key = "ACCESS_TOKEN"
value = "LEAK-ENV-TOKEN-1"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:36.460 (2026-10-26)
key = "DB_CONN"
value = "LEAK-ENV-CONN-5"
}
redaction/output/02-jdk27-defaults.txt
+163
View File
@@ -0,0 +1,163 @@
### JDK 27 with NO redaction flags at all
openjdk version "27.0.1.0.2" 2026-10-21
OpenJDK Runtime Environment Temurin-27.0.1.0.2+1 (build 27.0.1.0.2+1)
OpenJDK 64-Bit Server VM Temurin-27.0.1.0.2+1 (build 27.0.1.0.2+1, mixed mode, sharing)
LEAK-ENV-TOKEN-1 RAW=clean EVENTS=0
LEAK-PROP-PASSWORD-2 RAW=clean EVENTS=0
LEAK-ARG-DBPASSWORD-3 RAW=clean EVENTS=0
LEAK-URL-PW-4 RAW=LEAK EVENTS=2
LEAK-ENV-CONN-5 RAW=LEAK EVENTS=1
LEAK-PROP-DBPASS-6 RAW=LEAK EVENTS=2
LEAK-ARG-DBPASS-7 RAW=LEAK EVENTS=2
exit=2
### jfr print
jdk.JVMInformation {
startTime = 01:42:38.133 (2026-10-26)
jvmName = "OpenJDK 64-Bit Server VM"
jvmVersion = "OpenJDK 64-Bit Server VM (27.0.1.0.2+1) for linux-amd64 JRE (27.0.1.0.2+1), built on 2026-10-21T00:00:00Z with gcc 14.2.0"
jvmArguments = "-XX:StartFlightRecording:filename=/tmp/jfr-redaction/default.jfr -Xmx256m [REDACTED] -Ddb-pass=LEAK-PROP-DBPASS-6 -Dapp.region=mumbai"
jvmFlags = N/A
javaArguments = "Workload [REDACTED] [REDACTED] --db-pass LEAK-ARG-DBPASS-7 https://john:[email protected]/login --verbose"
jvmStartTime = 01:42:37.505 (2026-10-26)
pid = 6463
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.vm.specification.name"
value = "Java Virtual Machine Specification"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.vm.name"
value = "OpenJDK 64-Bit Server VM"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.home"
value = "/tmp/claude-0/post2/jdk-27.0.1.0.2+1"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "app.region"
value = "mumbai"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "sun.java.command"
value = "Workload [REDACTED] [REDACTED] --db-pass LEAK-ARG-DBPASS-7 https://john:[email protected]/login --verbose"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.class.path"
value = "/tmp/claude-0/post2/repo/redaction/build"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "sun.java.launcher"
value = "SUN_STANDARD"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.vm.compressedOopsMode"
value = "32-bit"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "jdk.debug"
value = "release"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "db-pass"
value = "LEAK-PROP-DBPASS-6"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "javax.net.ssl.keyStorePassword"
value = "[REDACTED]"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.vm.vendor"
value = "Eclipse Adoptium"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.vm.specification.version"
value = "27"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.vm.info"
value = "mixed mode, sharing"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.vm.specification.vendor"
value = "Oracle Corporation"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.vm.version"
value = "27.0.1.0.2+1"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "sun.boot.library.path"
value = "/tmp/claude-0/post2/jdk-27.0.1.0.2+1/lib"
}
jdk.InitialSystemProperty {
startTime = 01:42:38.133 (2026-10-26)
key = "java.library.path"
value = "/usr/java/packages/lib:/usr/lib64:/lib64:/lib:/usr/lib"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:38.133 (2026-10-26)
key = "PATH"
value = "/usr/bin:/bin"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:38.133 (2026-10-26)
key = "DEPLOY_REGION"
value = "eu-west-1"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:38.133 (2026-10-26)
key = "HOME"
value = "/nonexistent"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:38.133 (2026-10-26)
key = "ACCESS_TOKEN"
value = "[REDACTED]"
}
jdk.InitialEnvironmentVariable {
startTime = 01:42:38.133 (2026-10-26)
key = "DB_CONN"
value = "LEAK-ENV-CONN-5"
}
redaction/output/03-jdk27-opt-out.txt
+9
View File
@@ -0,0 +1,9 @@
### JDK 27 with redact-argument=none,redact-key=none (the opt-out)
LEAK-ENV-TOKEN-1 RAW=LEAK EVENTS=1
LEAK-PROP-PASSWORD-2 RAW=LEAK EVENTS=2
LEAK-ARG-DBPASSWORD-3 RAW=LEAK EVENTS=2
LEAK-URL-PW-4 RAW=LEAK EVENTS=2
LEAK-ENV-CONN-5 RAW=LEAK EVENTS=1
LEAK-PROP-DBPASS-6 RAW=LEAK EVENTS=2
LEAK-ARG-DBPASS-7 RAW=LEAK EVENTS=2
exit=2
redaction/output/04-jdk27-custom-inline.txt
+46
View File
@@ -0,0 +1,46 @@
### JDK 27, first attempt: conn* and a +prefix
flags: -XX:FlightRecorderOptions:redact-key=+db-pass;conn*,redact-argument=+--db-pass *;https://*:*@*
LEAK-ENV-TOKEN-1 RAW=clean EVENTS=0
LEAK-PROP-PASSWORD-2 RAW=clean EVENTS=0
LEAK-ARG-DBPASSWORD-3 RAW=clean EVENTS=0
LEAK-URL-PW-4 RAW=clean EVENTS=0
LEAK-ENV-CONN-5 RAW=LEAK EVENTS=1
LEAK-PROP-DBPASS-6 RAW=clean EVENTS=0
LEAK-ARG-DBPASS-7 RAW=clean EVENTS=0
exit=2
### jfr print (JVMInformation and the DB_CONN variable)
jdk.JVMInformation {
startTime = 01:42:44.988 (2026-10-26)
jvmName = "OpenJDK 64-Bit Server VM"
jvmVersion = "OpenJDK 64-Bit Server VM (27.0.1.0.2+1) for linux-amd64 JRE (27.0.1.0.2+1), built on 2026-10-21T00:00:00Z with gcc 14.2.0"
jvmArguments = "-XX:StartFlightRecording:filename=/tmp/jfr-redaction/wrongglob.jfr -XX:FlightRecorderOptions:redact-key=+db-pass;conn*,redact-argument=[REDACTED] -Xmx256m [REDACTED] -Ddb-pass=[REDACTED] -Dapp.region=mumbai"
jvmFlags = N/A
javaArguments = "Workload [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] --verbose"
jvmStartTime = 01:42:43.787 (2026-10-26)
pid = 6681
}
key = "DB_CONN"
value = "LEAK-ENV-CONN-5"
### fixed: *conn* instead of conn*
flags: -XX:FlightRecorderOptions:redact-key=+db-pass;*conn*,redact-argument=+--db-pass *;https://*:*@*
LEAK-ENV-TOKEN-1 RAW=clean EVENTS=0
LEAK-PROP-PASSWORD-2 RAW=clean EVENTS=0
LEAK-ARG-DBPASSWORD-3 RAW=clean EVENTS=0
LEAK-URL-PW-4 RAW=clean EVENTS=0
LEAK-ENV-CONN-5 RAW=clean EVENTS=0
LEAK-PROP-DBPASS-6 RAW=clean EVENTS=0
LEAK-ARG-DBPASS-7 RAW=clean EVENTS=0
exit=0
### jfr print (JVMInformation)
jdk.JVMInformation {
startTime = 01:42:49.421 (2026-10-26)
jvmName = "OpenJDK 64-Bit Server VM"
jvmVersion = "OpenJDK 64-Bit Server VM (27.0.1.0.2+1) for linux-amd64 JRE (27.0.1.0.2+1), built on 2026-10-21T00:00:00Z with gcc 14.2.0"
jvmArguments = "-XX:StartFlightRecording:filename=/tmp/jfr-redaction/fixed.jfr -XX:FlightRecorderOptions:redact-key=+db-pass;*conn*,redact-argument=[REDACTED] -Xmx256m [REDACTED] -Ddb-pass=[REDACTED] -Dapp.region=mumbai"
jvmFlags = N/A
javaArguments = "Workload [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] --verbose"
jvmStartTime = 01:42:47.483 (2026-10-26)
pid = 6823
}
redaction/output/05-jdk27-filter-files-and-debug-log.txt
+28
View File
@@ -0,0 +1,28 @@
### JDK 27, filters loaded from files with @, plus -Xlog:jfr+redact=debug
keys.txt:
*db-pass*
*conn*
args.txt:
--db-pass *
--connection-string *
https://*:*@*
[0.153s][debug][jfr,redact] Redaction file <module>/filters/args.txt read successfully
[0.156s][debug][jfr,redact] Redaction file <module>/filters/keys.txt read successfully
[0.157s][debug][jfr,redact] Redacted initial environment variable named 'ACCESS_TOKEN'
[0.157s][debug][jfr,redact] Redacted initial environment variable named 'DB_CONN'
[0.157s][debug][jfr,redact] Redacted initial system property named 'javax.net.ssl.keyStorePassword'
[0.157s][debug][jfr,redact] Redacted initial system property named 'db-pass'
[0.157s][debug][jfr,redact] Redacted initial system property named 'sun.java.command'
[0.157s][debug][jfr,redact] Redacted Java Arguments 'Workload [REDACTED] [REDACTED] [REDACTED] [REDACTED] [REDACTED] --verbose'
[0.157s][debug][jfr,redact] Redacted JVM Arguments '-XX:StartFlightRecording:filename=/tmp/jfr-redaction/files.jfr -XX:FlightRecorderOptions:redact-key=+@<module>/filters/keys.txt,redact-argument=[REDACTED] -Xlog:jfr+redact=debug -Xmx256m [REDACTED] -Ddb-pass=[REDACTED] -Dapp.region=mumbai'
[0.157s][debug][jfr,redact] Redacted string flag 'FlightRecorderOptions'
LEAK-ENV-TOKEN-1 RAW=clean EVENTS=0
LEAK-PROP-PASSWORD-2 RAW=clean EVENTS=0
LEAK-ARG-DBPASSWORD-3 RAW=clean EVENTS=0
LEAK-URL-PW-4 RAW=clean EVENTS=0
LEAK-ENV-CONN-5 RAW=clean EVENTS=0
LEAK-PROP-DBPASS-6 RAW=clean EVENTS=0
LEAK-ARG-DBPASS-7 RAW=clean EVENTS=0
exit=0
redaction/output/06-jdk27-missing-filter-file.txt
+8
View File
@@ -0,0 +1,8 @@
### JDK 27, a filter file that does not exist
[0.105s][warning][jfr,redact] Default redaction filters are replaced. Prepend with '+' to add filters to the
[0.105s][warning][jfr,redact] defaults, or specify -XX:FlightRecorderOptions:'redact-key=none;<filters>'
[0.105s][warning][jfr,redact] to replace without a warning.
[0.105s][error ][jfr,redact] Failed to access redaction file /no/such/keys.txt
Error occurred during initialization of VM
Failure when starting JFR on_create_vm_2
exit=1
redaction/output/07-jdk27-no-plus-replaces-defaults.txt
+12
View File
@@ -0,0 +1,12 @@
### JDK 27, redact-key=db-pass WITHOUT the + prefix replaces the defaults
[0.127s][warning][jfr,redact] Default redaction filters are replaced. Prepend with '+' to add filters to the
[0.127s][warning][jfr,redact] defaults, or specify -XX:FlightRecorderOptions:'redact-key=none;<filters>'
[0.127s][warning][jfr,redact] to replace without a warning.
LEAK-ENV-TOKEN-1 RAW=LEAK EVENTS=1
LEAK-PROP-PASSWORD-2 RAW=LEAK EVENTS=1
LEAK-ARG-DBPASSWORD-3 RAW=clean EVENTS=0
LEAK-URL-PW-4 RAW=LEAK EVENTS=2
LEAK-ENV-CONN-5 RAW=LEAK EVENTS=1
LEAK-PROP-DBPASS-6 RAW=clean EVENTS=0
LEAK-ARG-DBPASS-7 RAW=LEAK EVENTS=2
exit=2
redaction/output/08-jdk27-jcmd-late-recording.txt
+17
View File
@@ -0,0 +1,17 @@
### JDK 27, recording started later with jcmd JFR.start (JVM launched without any JFR flag)
7047:
Started recording 1. No limit specified, using maxsize=250MB as default.
Use jcmd 7047 JFR.dump name=late to copy recording data to file.
7047:
Stopped recording "late", 206.8 kB written to:
<tmp>/late.jfr
LEAK-ENV-TOKEN-1 RAW=clean EVENTS=0
LEAK-PROP-PASSWORD-2 RAW=clean EVENTS=0
LEAK-ARG-DBPASSWORD-3 RAW=clean EVENTS=0
LEAK-URL-PW-4 RAW=LEAK EVENTS=2
LEAK-ENV-CONN-5 RAW=LEAK EVENTS=1
LEAK-PROP-DBPASS-6 RAW=LEAK EVENTS=2
LEAK-ARG-DBPASS-7 RAW=LEAK EVENTS=2
exit=2