#!/usr/bin/env bash
# What an unauthenticated caller actually gets when exposure is "*" and the chain permits all.
set -uo pipefail
cd "$(dirname "$0")/.."
OUT=docs/output/03-open-actuator-leak.txt
B=http://localhost:8080/actuator
{
  echo "### profiles: exposeall,open   -- NO credentials are sent on any request below"
  echo
  echo "--- 1. /actuator/env does NOT leak values in Spring Boot 4 ---"
  echo "\$ curl -s $B/env/spring.datasource.password | jq .property"
  curl -s "$B/env/spring.datasource.password" | python3 -c 'import json,sys;print(json.dumps(json.load(sys.stdin)["property"],indent=2))'
  echo "\$ curl -s $B/env/acme.partner.credential | jq .property"
  curl -s "$B/env/acme.partner.credential" | python3 -c 'import json,sys;print(json.dumps(json.load(sys.stdin)["property"],indent=2))'
  echo
  echo "  Note the second one. 'acme.partner.credential' matches none of the classic"
  echo "  password/secret/token key patterns, and it is still masked. Masking is driven by"
  echo "  management.endpoint.env.show-values, which defaults to 'never' - not by key names."
  echo
  echo "--- 2. /actuator/heapdump is NOT exposed by 'include: \"*\"' ---"
  echo "\$ curl -s -o /dev/null -w '%{http_code}' $B/heapdump"
  curl -s -o /dev/null -w '%{http_code}\n' "$B/heapdump"
  echo "  management.endpoint.heapdump.access defaults to 'none'. So does shutdown."
  echo "  They are the only two endpoints that do."
  echo
  echo "--- 3. /actuator/loggers: an unauthenticated WRITE ---"
  echo "\$ curl -s -X POST -d '{\"configuredLevel\":\"TRACE\"}' -H 'Content-Type: application/json' $B/loggers/org.springframework"
  curl -s -o /dev/null -w '  status=%{http_code}\n' -X POST -H 'Content-Type: application/json' \
       -d '{"configuredLevel":"TRACE"}' "$B/loggers/org.springframework"
  echo "\$ curl -s $B/loggers/org.springframework"
  curl -s "$B/loggers/org.springframework" | python3 -m json.tool
  curl -s -o /dev/null -X POST -H 'Content-Type: application/json' \
       -d '{"configuredLevel":null}' "$B/loggers/org.springframework"
  echo "  (level reset). An attacker who can flip your root logger to TRACE has both a"
  echo "  denial-of-service primitive and a way to get request bodies written to disk."
  echo
  echo "--- 4. /actuator/beans and /actuator/mappings: your whole application, described ---"
  echo "\$ curl -s $B/mappings | python3 -c 'count the URL patterns'"
  curl -s "$B/mappings" | python3 -c '
import json,sys
d=json.load(sys.stdin)
n=0
for ctx in d["contexts"].values():
    for m in ctx["mappings"].get("dispatcherServlets",{}).values():
        n+=len(m)
print(f"  {n} servlet mappings disclosed")'
  curl -s "$B/beans" | python3 -c '
import json,sys
d=json.load(sys.stdin)
n=sum(len(c["beans"]) for c in d["contexts"].values())
print(f"  {n} beans disclosed, each with its type and dependencies")'
} > "$OUT" 2>&1
echo "wrote $OUT"