Ankur Mhatre
958b401f0f
Adds spring-boot-startup-time/, the companion project for BLOG-618: a runnable Spring Boot 4.1.1 application on JDK 25 that installs BufferingApplicationStartup and FlightRecorderApplicationStartup behind a system property, and a /diag/startup endpoint that computes step self time -- the number /actuator/startup does not give you and the one that names the actual culprits. Captured under docs/output/: the step tree sorted both ways, the same startup as JFR events, a +5000-class experiment putting 0.11 ms per scanned class on the classpath scan tax, the silent truncation a 2048-step buffer performs, and JDK 25 AOT cache timings (6.93 s to 4.82 s). Post body and metadata live in post/. Moves the existing Actuator project into actuator-in-production/ so the repository holds one directory per article; the root README is now an index.
40 lines
1.8 KiB
Plaintext
40 lines
1.8 KiB
Plaintext
### profiles: exposeall,open -- NO credentials are sent on any request below
|
|
|
|
--- 1. /actuator/env does NOT leak values in Spring Boot 4 ---
|
|
$ curl -s http://localhost:8080/actuator/env/spring.datasource.password | jq .property
|
|
{
|
|
"source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
|
|
"value": "******"
|
|
}
|
|
$ curl -s http://localhost:8080/actuator/env/acme.partner.credential | jq .property
|
|
{
|
|
"source": "Config resource 'class path resource [application.yaml]' via location 'optional:classpath:/'",
|
|
"value": "******"
|
|
}
|
|
|
|
Note the second one. 'acme.partner.credential' matches none of the classic
|
|
password/secret/token key patterns, and it is still masked. Masking is driven by
|
|
management.endpoint.env.show-values, which defaults to 'never' - not by key names.
|
|
|
|
--- 2. /actuator/heapdump is NOT exposed by 'include: "*"' ---
|
|
$ curl -s -o /dev/null -w '%{http_code}' http://localhost:8080/actuator/heapdump
|
|
404
|
|
management.endpoint.heapdump.access defaults to 'none'. So does shutdown.
|
|
They are the only two endpoints that do.
|
|
|
|
--- 3. /actuator/loggers: an unauthenticated WRITE ---
|
|
$ curl -s -X POST -d '{"configuredLevel":"TRACE"}' -H 'Content-Type: application/json' http://localhost:8080/actuator/loggers/org.springframework
|
|
status=204
|
|
$ curl -s http://localhost:8080/actuator/loggers/org.springframework
|
|
{
|
|
"configuredLevel": "TRACE",
|
|
"effectiveLevel": "TRACE"
|
|
}
|
|
(level reset). An attacker who can flip your root logger to TRACE has both a
|
|
denial-of-service primitive and a way to get request bodies written to disk.
|
|
|
|
--- 4. /actuator/beans and /actuator/mappings: your whole application, described ---
|
|
$ curl -s http://localhost:8080/actuator/mappings | python3 -c 'count the URL patterns'
|
|
30 servlet mappings disclosed
|
|
426 beans disclosed, each with its type and dependencies
|