asmhatreandClaude Sonnet 5.5
1497fba911
Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Claude-Session: https://claude.ai/code/session_017ic4b6tTs7ivgTNq4ZrurU
38 lines
1.8 KiB
Bash
Executable File
38 lines
1.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Shows what a packaged Spring Boot app exposes about its secrets to anyone who can look at the
|
|
# process or the jar. Writes output/10-exposure.txt. Linux only (/proc).
|
|
#
|
|
# ./scripts/exposure.sh
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
mkdir -p output
|
|
OUT=output/10-exposure.txt
|
|
: > "$OUT"
|
|
say() { echo "$@" | tee -a "$OUT"; }
|
|
|
|
mvn -B -q -DskipTests package 2>&1 | grep -v '^Picked up\|^WARNING' || true
|
|
JAR=target/secrets-1.0.0.jar
|
|
|
|
say "1. the jar: src/main/resources/application-leaky.yml (a deliberately committed secret) as packaged"
|
|
say " \$ unzip -p $JAR BOOT-INF/classes/application-leaky.yml | grep password"
|
|
unzip -p "$JAR" BOOT-INF/classes/application-leaky.yml | grep 'password' | sed 's/^/ /' | tee -a "$OUT"
|
|
|
|
DB_PASSWORD_FROM_ENV=env-secret-123 SIGNING_KEY=env-signing-key-456 \
|
|
java -jar "$JAR" --spring.profiles.active=hold --spring.main.web-application-type=none \
|
|
--spring.cloud.vault.enabled=false --spring.cloud.aws.secretsmanager.enabled=false \
|
|
--db.password=arg-secret-789 > /tmp/secrets-exposure.log 2>&1 &
|
|
PID=$!
|
|
trap 'kill $PID 2>/dev/null || true' EXIT
|
|
for _ in $(seq 1 60); do grep -q 'Started SecretsApplication' /tmp/secrets-exposure.log && break; sleep 0.5; done
|
|
|
|
say "2. command-line argument, as any user on the host sees it"
|
|
say " \$ ps -o args= -p <pid> | tr ' ' '\\n' | grep db.password"
|
|
ps -o args= -p "$PID" | tr ' ' '\n' | grep 'db.password' | sed 's/^/ /' | tee -a "$OUT"
|
|
|
|
say "3. environment variables, readable by the same user"
|
|
say " \$ tr '\\0' '\\n' < /proc/<pid>/environ | grep -E 'DB_PASSWORD_FROM_ENV|SIGNING_KEY'"
|
|
tr '\0' '\n' < "/proc/$PID/environ" | grep -E 'DB_PASSWORD_FROM_ENV|SIGNING_KEY' | sed 's/^/ /' | tee -a "$OUT"
|
|
|
|
say "4. /proc/<pid>/cmdline, what the kernel keeps of the arguments"
|
|
tr '\0' '\n' < "/proc/$PID/cmdline" | grep 'db.password' | sed 's/^/ /' | tee -a "$OUT"
|