asmhatreandClaude Sonnet 5.5
e84684e2c7
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_01CifR2BE7PBvRy5hT8TS9oz
45 lines
2.2 KiB
Markdown
45 lines
2.2 KiB
Markdown
# redaction — JFR In-Process Data Redaction (JEP 536)
|
|
|
|
Companion module for the ankurm.com post
|
|
**"JFR In-Process Data Redaction (JEP 536): Safe Flight Recordings in Production"**
|
|
(https://ankurm.com/jfr-data-redaction-jep-536-safe-flight-recordings-in-production/).
|
|
It extends the JFR / Mission Control post's workflow with the JDK 27 feature that
|
|
removes secrets from recordings before they are written.
|
|
|
|
No Maven and no dependencies: two small Java files and shell scripts.
|
|
|
|
| Component | Version | Verified against |
|
|
|---|---|---|
|
|
| JDK (redaction runs) | Temurin 27.0.1.0.2+1 | `java -version`; JEP 536 status "Closed / Delivered", release 27 |
|
|
| JDK (leak baseline) | Temurin 25.0.5+8 | `java -version`; JDK 25 has no redaction |
|
|
|
|
## Layout
|
|
|
|
| Path | What it is |
|
|
|---|---|
|
|
| `src/Workload.java` | Trivial program; the secrets are on its command line, `-D` flags and environment |
|
|
| `src/Scan.java` | Checks a `.jfr` file for planted secrets, by raw bytes and by decoded events |
|
|
| `filters/keys.txt`, `filters/args.txt` | Filter files for `redact-key=@...` / `redact-argument=@...` |
|
|
| `scripts/common.sh` | Plants seven fake secrets under `env -i` (your real environment is never passed in) |
|
|
| `scripts/run-all.sh` | Regenerates every file in `output/` |
|
|
| `output/*.txt` | Captured real output, quoted verbatim in the post |
|
|
|
|
## Run it
|
|
|
|
```bash
|
|
JDK27=/path/to/jdk-27 JDK25=/path/to/jdk-25 redaction/scripts/run-all.sh
|
|
```
|
|
|
|
## Output index
|
|
|
|
| File | What it shows |
|
|
|---|---|
|
|
| `01-jdk25-leak.txt` | JDK 25: all seven secrets sit in the recording |
|
|
| `02-jdk27-defaults.txt` | JDK 27, no flags: three secrets redacted, four still leak |
|
|
| `03-jdk27-opt-out.txt` | `redact-argument=none,redact-key=none` brings every leak back |
|
|
| `04-jdk27-custom-inline.txt` | `conn*` fails to match `DB_CONN` (globs are anchored); `*conn*` fixes it |
|
|
| `05-jdk27-filter-files-and-debug-log.txt` | Filter files with `@`, and `-Xlog:jfr+redact=debug` |
|
|
| `06-jdk27-missing-filter-file.txt` | A missing filter file stops the JVM at startup |
|
|
| `07-jdk27-no-plus-replaces-defaults.txt` | Without `+`, your list replaces the defaults |
|
|
| `08-jdk27-jcmd-late-recording.txt` | A recording started later with `jcmd JFR.start` is redacted the same way |
|