Add redaction module: JFR in-process data redaction (JEP 536) on JDK 27

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
2026-10-26 01:43:28 +00:00
parent c7eccd1db5
commit e84684e2c7
17 changed files with 682 additions and 0 deletions
@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+# Shared helpers. Source this; do not run it.
+#
+# run_case <jdk-home> <recording.jfr> <extra JVM flags...>
+#   Runs the Workload with the SAME planted secrets every time, under a clean
+#   environment (env -i), so only the fake secrets below can ever end up in a
+#   recording. Your real shell environment is never passed through.
+HERE="$(cd "$(dirname "$0")/.." && pwd)"
+BUILD="$HERE/build"
+
+# The planted secrets. Each one has a name that tells you where it hides.
+SECRETS=(LEAK-ENV-TOKEN-1 LEAK-PROP-PASSWORD-2 LEAK-ARG-DBPASSWORD-3 LEAK-URL-PW-4
+         LEAK-ENV-CONN-5 LEAK-PROP-DBPASS-6 LEAK-ARG-DBPASS-7)
+
+compile() { # <jdk-home>
+  mkdir -p "$BUILD"
+  "$1/bin/javac" --release 21 -d "$BUILD" "$HERE/src/Workload.java" "$HERE/src/Scan.java" 2>&1 | grep -v '^Picked up' || true
+}
+
+run_jvm() { # <jdk-home> [flags...]   (no recording flag: caller decides)
+  local jdk="$1"; shift
+  env -i PATH=/usr/bin:/bin HOME=/nonexistent \
+      ACCESS_TOKEN=LEAK-ENV-TOKEN-1 DB_CONN=LEAK-ENV-CONN-5 DEPLOY_REGION=eu-west-1 \
+    "$jdk/bin/java" "$@" \
+      -Xmx256m \
+      -Djavax.net.ssl.keyStorePassword=LEAK-PROP-PASSWORD-2 \
+      -Ddb-pass=LEAK-PROP-DBPASS-6 \
+      -Dapp.region=mumbai \
+      -cp "$BUILD" Workload \
+      --dbpassword LEAK-ARG-DBPASSWORD-3 \
+      --db-pass LEAK-ARG-DBPASS-7 \
+      https://john:[email protected]/login \
+      --verbose
+}
+
+run_case() { # <jdk-home> <jfr-out> [flags...]   (recording from JVM start)
+  local jdk="$1" out="$2"; shift 2
+  run_jvm "$jdk" -XX:StartFlightRecording:filename="$out" "$@"
+}
+
+scan() { "$1/bin/java" -cp "$BUILD" Scan "$2" "${SECRETS[@]}" 2>&1 | grep -v '^Picked up'; }
+
+print_events() { # <jdk-home> <jfr>
+  "$1/bin/jfr" print --events InitialSystemProperty,JVMInformation,InitialEnvironmentVariable "$2" 2>&1 | grep -v '^Picked up'
+}