#!/usr/bin/env bash
# Shows what a packaged Spring Boot app exposes about its secrets to anyone who can look at the
# process or the jar. Writes output/10-exposure.txt. Linux only (/proc).
#
#   ./scripts/exposure.sh
set -euo pipefail
cd "$(dirname "$0")/.."
mkdir -p output
OUT=output/10-exposure.txt
: > "$OUT"
say() { echo "$@" | tee -a "$OUT"; }

mvn -B -q -DskipTests package 2>&1 | grep -v '^Picked up\|^WARNING' || true
JAR=target/secrets-1.0.0.jar

say "1. the jar: src/main/resources/application-leaky.yml (a deliberately committed secret) as packaged"
say "   \$ unzip -p $JAR BOOT-INF/classes/application-leaky.yml | grep password"
unzip -p "$JAR" BOOT-INF/classes/application-leaky.yml | grep 'password' | sed 's/^/   /' | tee -a "$OUT"

DB_PASSWORD_FROM_ENV=env-secret-123 SIGNING_KEY=env-signing-key-456 \
  java -jar "$JAR" --spring.profiles.active=hold --spring.main.web-application-type=none \
    --spring.cloud.vault.enabled=false --spring.cloud.aws.secretsmanager.enabled=false \
    --db.password=arg-secret-789 > /tmp/secrets-exposure.log 2>&1 &
PID=$!
trap 'kill $PID 2>/dev/null || true' EXIT
for _ in $(seq 1 60); do grep -q 'Started SecretsApplication' /tmp/secrets-exposure.log && break; sleep 0.5; done

say "2. command-line argument, as any user on the host sees it"
say "   \$ ps -o args= -p <pid> | tr ' ' '\\n' | grep db.password"
ps -o args= -p "$PID" | tr ' ' '\n' | grep 'db.password' | sed 's/^/   /' | tee -a "$OUT"

say "3. environment variables, readable by the same user"
say "   \$ tr '\\0' '\\n' < /proc/<pid>/environ | grep -E 'DB_PASSWORD_FROM_ENV|SIGNING_KEY'"
tr '\0' '\n' < "/proc/$PID/environ" | grep -E 'DB_PASSWORD_FROM_ENV|SIGNING_KEY' | sed 's/^/   /' | tee -a "$OUT"

say "4. /proc/<pid>/cmdline, what the kernel keeps of the arguments"
tr '\0' '\n' < "/proc/$PID/cmdline" | grep 'db.password' | sed 's/^/   /' | tee -a "$OUT"