Ankur Mhatre
958b401f0f
Adds spring-boot-startup-time/, the companion project for BLOG-618: a runnable Spring Boot 4.1.1 application on JDK 25 that installs BufferingApplicationStartup and FlightRecorderApplicationStartup behind a system property, and a /diag/startup endpoint that computes step self time -- the number /actuator/startup does not give you and the one that names the actual culprits. Captured under docs/output/: the step tree sorted both ways, the same startup as JFR events, a +5000-class experiment putting 0.11 ms per scanned class on the classpath scan tax, the silent truncation a 2048-step buffer performs, and JDK 25 AOT cache timings (6.93 s to 4.82 s). Post body and metadata live in post/. Moves the existing Actuator project into actuator-in-production/ so the repository holds one directory per article; the root README is now an index.
24 lines
1.2 KiB
Bash
Executable File
24 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# The endpoint that really does hand over your secrets - once you turn it on.
|
|
set -uo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
OUT=docs/output/04-heapdump-leak.txt
|
|
B=http://localhost:8080/actuator
|
|
{
|
|
echo "### profiles: exposeall,open PLUS --management.endpoint.heapdump.access=unrestricted"
|
|
echo
|
|
echo "\$ curl -s -o /tmp/heap.hprof -w 'status=%{http_code} bytes=%{size_download} type=%{content_type}' $B/heapdump"
|
|
curl -s -o /tmp/heap.hprof -w 'status=%{http_code} bytes=%{size_download} type=%{content_type}\n' "$B/heapdump"
|
|
echo
|
|
echo "\$ strings /tmp/heap.hprof | grep -c 'S3CRET-partner-credential'"
|
|
strings /tmp/heap.hprof 2>/dev/null | grep -c 'S3CRET-partner-credential'
|
|
echo "\$ strings /tmp/heap.hprof | grep -o 'not-a-real-password[^\"]*' | head -1"
|
|
strings /tmp/heap.hprof 2>/dev/null | grep -o 'not-a-real-password[^\"]*' | head -1
|
|
echo
|
|
echo " /actuator/env masked both of these to ******."
|
|
echo " /actuator/heapdump handed over the process memory that contains them in plaintext."
|
|
echo " Sanitisation is a property-rendering feature. It is not a security boundary."
|
|
rm -f /tmp/heap.hprof
|
|
} > "$OUT" 2>&1
|
|
echo "wrote $OUT"
|