Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[OPENJDK-3009] mask passwords from java arguments in logs (UBI8) #493

Merged
merged 3 commits into from
May 15, 2024
Merged

[OPENJDK-3009] mask passwords from java arguments in logs (UBI8) #493

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6bd9180
Possible fix for CSB-3783
jmtd May 14, 2024
d981f03
[OPENJDK-3009] hook masked_args into get_java_options for logging
jmtd May 2, 2024
04f93d0
[OPENJDK-3009] Behave test for masking passwords in logs
jmtd May 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 24 additions & 2 deletions modules/run/artifacts/opt/jboss/container/java/run/run-java.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -225,6 +225,26 @@ function configure_passwd() {
if [ -w "$HOME/passwd" ]; then
sed "/^jboss/s/[^:]*/$(id -u)/3" /etc/passwd > "$HOME/passwd"
fi

# Mask secrets before printing
mask_passwords() {
local content="$1"
local result=""

IFS=' ' read -r -a key_value_pairs <<< "$content"

for pair in "${key_value_pairs[@]}"; do
key=$(echo "$pair" | cut -d '=' -f 1)
value=$(echo "$pair" | cut -d '=' -f 2-)

if [[ $key =~ [Pp][Aa][Ss][Ss][Ww][Oo][Rr][Dd] ]]; then
result+="$key=***** "
else
result+="$pair "
fi
done

echo "${result% }"
}

# Start JVM
Expand All @@ -242,9 +262,11 @@ startup() {
args="-jar ${JAVA_APP_JAR}"
fi

procname="${JAVA_APP_NAME-java}"
local procname="${JAVA_APP_NAME-java}"

local masked_opts=$(mask_passwords "$(get_java_options)")

log_info "exec -a \"${procname}\" java $(get_java_options) -cp \"$(get_classpath)\" ${args} $*"
log_info "exec -a \"${procname}\" java ${masked_opts} -cp \"$(get_classpath)\" ${args} $*"
log_info "running in $PWD"
exec -a "${procname}" java $(get_java_options) -cp "$(get_classpath)" ${args} $*
}
Expand Down
8 changes: 8 additions & 0 deletions modules/run/tests/features/run.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
@ubi8
Feature: OpenJDK run script tests
Scenario: OPENJDK-3009: Ensure command-line options containing 'password' are masked in logs
Given container is started with env
| variable | value |
| JAVA_OPTS_APPEND | -Djavax.net.ssl.trustStorePassword=sensitiveString |
Then container log should not contain sensitiveString

Loading