Skip to content

Commit 5a8a863

Browse files
committed
Sanitize individual env entry that is matched exactly
Closes gh-9918 See gh-8282
1 parent 362a8ea commit 5a8a863

File tree

2 files changed

+31
-4
lines changed

2 files changed

+31
-4
lines changed

spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/mvc/EnvironmentMvcEndpoint.java

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -93,8 +93,7 @@ private void getNames(PropertySources propertySources, NameCallback callback) {
9393

9494
@Override
9595
protected Object getOptionalValue(Environment source, String name) {
96-
Object result = ((EnvironmentEndpoint) getDelegate()).getResolver()
97-
.getProperty(name, Object.class);
96+
Object result = getValue(name);
9897
if (result != null) {
9998
result = ((EnvironmentEndpoint) getDelegate()).sanitize(name, result);
10099
}
@@ -103,13 +102,18 @@ protected Object getOptionalValue(Environment source, String name) {
103102

104103
@Override
105104
protected Object getValue(Environment source, String name) {
106-
Object result = source.getProperty(name, Object.class);
105+
Object result = getValue(name);
107106
if (result == null) {
108107
throw new NoSuchPropertyException("No such property: " + name);
109108
}
110109
return ((EnvironmentEndpoint) getDelegate()).sanitize(name, result);
111110
}
112111

112+
private Object getValue(String name) {
113+
return ((EnvironmentEndpoint) getDelegate()).getResolver().getProperty(name,
114+
Object.class);
115+
}
116+
113117
}
114118

115119
/**

spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/mvc/EnvironmentMvcEndpointTests.java

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ public void nestedPathWhenPlaceholderCannotBeResolvedShouldReturnUnresolvedPrope
147147
map.put("my.foo", "${my.bar}");
148148
((ConfigurableEnvironment) this.context.getEnvironment()).getPropertySources()
149149
.addFirst(new MapPropertySource("unresolved-placeholder", map));
150-
this.mvc.perform(get("/env/my.*")).andExpect(status().isOk())
150+
this.mvc.perform(get("/env/my.foo")).andExpect(status().isOk())
151151
.andExpect(content().string(containsString("\"my.foo\":\"${my.bar}\"")));
152152
}
153153

@@ -156,6 +156,29 @@ public void nestedPathWithSensitivePlaceholderShouldSanitize() throws Exception
156156
Map<String, Object> map = new HashMap<String, Object>();
157157
map.put("my.foo", "${my.password}");
158158
map.put("my.password", "hello");
159+
((ConfigurableEnvironment) this.context.getEnvironment()).getPropertySources()
160+
.addFirst(new MapPropertySource("placeholder", map));
161+
this.mvc.perform(get("/env/my.foo")).andExpect(status().isOk())
162+
.andExpect(content().string(containsString("\"my.foo\":\"******\"")));
163+
}
164+
165+
@Test
166+
public void nestedPathMatchedByRegexWhenPlaceholderCannotBeResolvedShouldReturnUnresolvedProperty()
167+
throws Exception {
168+
Map<String, Object> map = new HashMap<String, Object>();
169+
map.put("my.foo", "${my.bar}");
170+
((ConfigurableEnvironment) this.context.getEnvironment()).getPropertySources()
171+
.addFirst(new MapPropertySource("unresolved-placeholder", map));
172+
this.mvc.perform(get("/env/my.*")).andExpect(status().isOk())
173+
.andExpect(content().string(containsString("\"my.foo\":\"${my.bar}\"")));
174+
}
175+
176+
@Test
177+
public void nestedPathMatchedByRegexWithSensitivePlaceholderShouldSanitize()
178+
throws Exception {
179+
Map<String, Object> map = new HashMap<String, Object>();
180+
map.put("my.foo", "${my.password}");
181+
map.put("my.password", "hello");
159182
((ConfigurableEnvironment) this.context.getEnvironment()).getPropertySources()
160183
.addFirst(new MapPropertySource("placeholder", map));
161184
this.mvc.perform(get("/env/my.*")).andExpect(status().isOk())

0 commit comments

Comments
 (0)