Add redaction module: JFR in-process data redaction (JEP 536) on JDK 27

Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
2026-10-26 01:43:28 +00:00
parent c7eccd1db5
commit e84684e2c7
17 changed files with 682 additions and 0 deletions
@@ -0,0 +1,82 @@
+#!/usr/bin/env bash
+# Regenerates every file under redaction/output/.
+# Usage: JDK27=/path/to/jdk-27 JDK25=/path/to/jdk-25 redaction/scripts/run-all.sh
+# Each case plants the same seven fake secrets (see common.sh), records, then
+# greps the recording for them. Recordings go to a scratch dir, not the repo.
+set -uo pipefail
+source "$(dirname "$0")/common.sh"
+: "${JDK27:?set JDK27 to a JDK 27 home}" "${JDK25:?set JDK25 to a JDK 25 home}"
+OUT="$HERE/output"; TMP=/tmp/jfr-redaction; rm -rf "$TMP"; mkdir -p "$OUT" "$TMP"
+cd "$HERE"
+unset JAVA_TOOL_OPTIONS   # keep proxy banners out of committed output
+compile "$JDK27"
+vers() { "$1/bin/java" -version 2>&1 | grep -v '^Picked up'; }
+hdr() { echo "### $*"; }
+
+{ hdr "JDK 25: no redaction exists. What is in the recording?"
+  vers "$JDK25"
+  run_case "$JDK25" "$TMP/jdk25.jfr" >/dev/null
+  scan "$JDK25" "$TMP/jdk25.jfr"; echo "exit=${PIPESTATUS[0]}"
+  echo; hdr "jfr print"; print_events "$JDK25" "$TMP/jdk25.jfr"
+} > "$OUT/01-jdk25-leak.txt" 2>&1
+
+{ hdr "JDK 27 with NO redaction flags at all"
+  vers "$JDK27"
+  run_case "$JDK27" "$TMP/default.jfr" >/dev/null
+  scan "$JDK27" "$TMP/default.jfr"; echo "exit=${PIPESTATUS[0]}"
+  echo; hdr "jfr print"; print_events "$JDK27" "$TMP/default.jfr"
+} > "$OUT/02-jdk27-defaults.txt" 2>&1
+
+{ hdr "JDK 27 with redact-argument=none,redact-key=none (the opt-out)"
+  run_case "$JDK27" "$TMP/none.jfr" -XX:FlightRecorderOptions:redact-argument=none,redact-key=none >/dev/null
+  scan "$JDK27" "$TMP/none.jfr"; echo "exit=${PIPESTATUS[0]}"
+} > "$OUT/03-jdk27-opt-out.txt" 2>&1
+
+{ hdr "JDK 27, first attempt: conn* and a +prefix"
+  F="-XX:FlightRecorderOptions:redact-key=+db-pass;conn*,redact-argument=+--db-pass *;https://*:*@*"
+  echo "flags: $F"
+  run_case "$JDK27" "$TMP/wrongglob.jfr" "$F" >/dev/null
+  scan "$JDK27" "$TMP/wrongglob.jfr"; echo "exit=${PIPESTATUS[0]}"
+  echo; hdr "jfr print (JVMInformation and the DB_CONN variable)"
+  print_events "$JDK27" "$TMP/wrongglob.jfr" | awk '/jdk.JVMInformation/,/^}/ {print} /key = "DB_CONN"/ {print; getline; print}'
+  hdr "fixed: *conn* instead of conn*"
+  F="-XX:FlightRecorderOptions:redact-key=+db-pass;*conn*,redact-argument=+--db-pass *;https://*:*@*"
+  echo "flags: $F"
+  run_case "$JDK27" "$TMP/fixed.jfr" "$F" >/dev/null
+  scan "$JDK27" "$TMP/fixed.jfr"; echo "exit=${PIPESTATUS[0]}"
+  echo; hdr "jfr print (JVMInformation)"
+  print_events "$JDK27" "$TMP/fixed.jfr" | awk '/jdk.JVMInformation/,/^}/ {print}'
+} > "$OUT/04-jdk27-custom-inline.txt" 2>&1
+
+{ hdr "JDK 27, filters loaded from files with @, plus -Xlog:jfr+redact=debug"
+  echo "keys.txt:"; sed 's/^/  /' "$HERE/filters/keys.txt"
+  echo "args.txt:"; sed 's/^/  /' "$HERE/filters/args.txt"
+  echo
+  F="-XX:FlightRecorderOptions:redact-key=+@$HERE/filters/keys.txt,redact-argument=+@$HERE/filters/args.txt"
+  run_case "$JDK27" "$TMP/files.jfr" "$F" -Xlog:jfr+redact=debug 2>&1 \
+    | grep -E 'jfr,redact' | sed "s#$HERE#<module>#g"
+  echo; scan "$JDK27" "$TMP/files.jfr"; echo "exit=${PIPESTATUS[0]}"
+} > "$OUT/05-jdk27-filter-files-and-debug-log.txt" 2>&1
+
+{ hdr "JDK 27, a filter file that does not exist"
+  env -i PATH=/usr/bin:/bin "$JDK27/bin/java" -XX:FlightRecorderOptions:redact-key=@/no/such/keys.txt -version 2>&1 | grep -v '^Picked up'
+  echo "exit=${PIPESTATUS[0]}"
+} > "$OUT/06-jdk27-missing-filter-file.txt" 2>&1
+
+{ hdr "JDK 27, redact-key=db-pass WITHOUT the + prefix replaces the defaults"
+  run_case "$JDK27" "$TMP/noplus.jfr" -XX:FlightRecorderOptions:redact-key=db-pass 2>&1 | grep -E 'jfr,redact'
+  scan "$JDK27" "$TMP/noplus.jfr"; echo "exit=${PIPESTATUS[0]}"
+} > "$OUT/07-jdk27-no-plus-replaces-defaults.txt" 2>&1
+
+{ hdr "JDK 27, recording started later with jcmd JFR.start (JVM launched without any JFR flag)"
+  run_jvm "$JDK27" -Dworkload.sleep.ms=8000 >/dev/null &
+  sleep 2
+  PID=$(pgrep -f 'Workload' | head -1)
+  "$JDK27/bin/jcmd" "$PID" JFR.start name=late filename="$TMP/late.jfr" 2>&1 | grep -v '^Picked up' | sed "s#$TMP#<tmp>#g"
+  sleep 1
+  "$JDK27/bin/jcmd" "$PID" JFR.stop name=late 2>&1 | grep -v '^Picked up' | sed "s#$TMP#<tmp>#g"
+  wait
+  scan "$JDK27" "$TMP/late.jfr"; echo "exit=${PIPESTATUS[0]}"
+} > "$OUT/08-jdk27-jcmd-late-recording.txt" 2>&1
+
+echo "regenerated:"; ls -1 "$OUT"