Skip to content

Commit acc453d

Browse files
mbhavembhave
committed
Polish contribution
See gh-19999
1 parent badc83d commit acc453d

File tree

4 files changed

+52
-37
lines changed

4 files changed

+52
-37
lines changed

‎spring-boot-project/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java

Lines changed: 19 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2019 the original author or authors.
2+
* Copyright 2012-2020 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -17,6 +17,8 @@
1717
package org.springframework.boot.actuate.endpoint;
1818

1919
import java.util.Arrays;
20+
import java.util.LinkedHashSet;
21+
import java.util.Set;
2022
import java.util.regex.Matcher;
2123
import java.util.regex.Pattern;
2224
import java.util.stream.Collectors;
@@ -41,16 +43,22 @@ public class Sanitizer {
4143

4244
private static final String[] REGEX_PARTS = { "*", "$", "^", "+" };
4345

44-
private static final String[] DEFAULT_KEYS_TO_SANITIZE = { "password", "secret", "key", "token", ".*credentials.*", "vcap_services", "sun.java.command", "uri", "uris", "address", "addresses" };
46+
private static final Set<String> DEFAULT_KEYS_TO_SANITIZE = new LinkedHashSet<>(Arrays.asList("password", "secret",
47+
"key", "token", ".*credentials.*", "vcap_services", "sun.java.command"));
4548

46-
private static final String[] URI_USERINFO_KEYS = { "uri", "uris", "address", "addresses" };
49+
private static final Set<String> URI_USERINFO_KEYS = new LinkedHashSet<>(
50+
Arrays.asList("uri", "uris", "address", "addresses"));
4751

4852
private static final Pattern URI_USERINFO_PATTERN = Pattern.compile("[A-Za-z]+://.+:(.*)@.+$");
4953

5054
private Pattern[] keysToSanitize;
5155

56+
static {
57+
DEFAULT_KEYS_TO_SANITIZE.addAll(URI_USERINFO_KEYS);
58+
}
59+
5260
public Sanitizer() {
53-
this(DEFAULT_KEYS_TO_SANITIZE);
61+
this(DEFAULT_KEYS_TO_SANITIZE.toArray(new String[0]));
5462
}
5563

5664
public Sanitizer(String... keysToSanitize) {
@@ -116,19 +124,17 @@ private boolean keyIsUriWithUserInfo(Pattern pattern) {
116124
return false;
117125
}
118126

119-
private Object sanitizeUris(String uriString) {
120-
// Treat each uri value as possibly containing multiple uris (comma separated)
121-
return Arrays.stream(uriString.split(","))
122-
.map(this::sanitizeUri)
123-
.collect(Collectors.joining(","));
127+
private Object sanitizeUris(String value) {
128+
return Arrays.stream(value.split(",")).map(this::sanitizeUri).collect(Collectors.joining(","));
124129
}
125130

126-
private String sanitizeUri(String uriString) {
127-
Matcher matcher = URI_USERINFO_PATTERN.matcher(uriString);
131+
private String sanitizeUri(String value) {
132+
Matcher matcher = URI_USERINFO_PATTERN.matcher(value);
128133
String password = matcher.matches() ? matcher.group(1) : null;
129134
if (password != null) {
130-
return StringUtils.replace(uriString, ":" + password + "@", ":******@");
135+
return StringUtils.replace(value, ":" + password + "@", ":******@");
131136
}
132-
return uriString;
137+
return value;
133138
}
139+
134140
}

‎spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/context/properties/ConfigurationPropertiesReportEndpointTests.java

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2019 the original author or authors.
2+
* Copyright 2012-2020 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -19,7 +19,6 @@
1919
import java.net.URI;
2020
import java.time.Duration;
2121
import java.util.ArrayList;
22-
import java.util.Arrays;
2322
import java.util.Collections;
2423
import java.util.HashMap;
2524
import java.util.List;

‎spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java

Lines changed: 24 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2019 the original author or authors.
2+
* Copyright 2012-2020 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,12 +16,12 @@
1616

1717
package org.springframework.boot.actuate.endpoint;
1818

19+
import java.util.stream.Stream;
20+
1921
import org.junit.jupiter.api.Test;
2022
import org.junit.jupiter.params.ParameterizedTest;
2123
import org.junit.jupiter.params.provider.MethodSource;
2224

23-
import java.util.stream.Stream;
24-
2525
import static org.assertj.core.api.Assertions.assertThat;
2626

2727
/**
@@ -49,60 +49,65 @@ void defaultNonUriKeys() {
4949

5050
@ParameterizedTest(name = "key = {0}")
5151
@MethodSource("matchingUriUserInfoKeys")
52-
void uriWithSingleEntryWithPasswordShouldBeSanitized(String key) {
52+
void uriWithSingleValueWithPasswordShouldBeSanitized(String key) {
5353
Sanitizer sanitizer = new Sanitizer();
54-
assertThat(sanitizer.sanitize(key, "http://user:password@localhost:8080")).isEqualTo("http://user:******@localhost:8080");
54+
assertThat(sanitizer.sanitize(key, "http://user:password@localhost:8080"))
55+
.isEqualTo("http://user:******@localhost:8080");
5556
}
5657

5758
@ParameterizedTest(name = "key = {0}")
5859
@MethodSource("matchingUriUserInfoKeys")
59-
void uriWithSingleEntryWithNoPasswordShouldNotBeSanitized(String key) {
60+
void uriWithSingleValueWithNoPasswordShouldNotBeSanitized(String key) {
6061
Sanitizer sanitizer = new Sanitizer();
6162
assertThat(sanitizer.sanitize(key, "http://localhost:8080")).isEqualTo("http://localhost:8080");
6263
assertThat(sanitizer.sanitize(key, "http://user@localhost:8080")).isEqualTo("http://user@localhost:8080");
6364
}
6465

6566
@ParameterizedTest(name = "key = {0}")
6667
@MethodSource("matchingUriUserInfoKeys")
67-
void uriWithSingleEntryWithPasswordMatchingOtherPartsOfStringShouldBeSanitized(String key) {
68+
void uriWithSingleValueWithPasswordMatchingOtherPartsOfStringShouldBeSanitized(String key) {
6869
Sanitizer sanitizer = new Sanitizer();
69-
assertThat(sanitizer.sanitize(key, "http://user://@localhost:8080")).isEqualTo("http://user:******@localhost:8080");
70+
assertThat(sanitizer.sanitize(key, "http://user://@localhost:8080"))
71+
.isEqualTo("http://user:******@localhost:8080");
7072
}
7173

7274
@ParameterizedTest(name = "key = {0}")
7375
@MethodSource("matchingUriUserInfoKeys")
74-
void uriWithMultipleEntriesEachWithPasswordShouldHaveAllSanitized(String key) {
76+
void uriWithMultipleValuesEachWithPasswordShouldHaveAllSanitized(String key) {
7577
Sanitizer sanitizer = new Sanitizer();
76-
assertThat(sanitizer.sanitize(key, "http://user1:password1@localhost:8080,http://user2:password2@localhost:8082"))
77-
.isEqualTo("http://user1:******@localhost:8080,http://user2:******@localhost:8082");
78+
assertThat(
79+
sanitizer.sanitize(key, "http://user1:password1@localhost:8080,http://user2:password2@localhost:8082"))
80+
.isEqualTo("http://user1:******@localhost:8080,http://user2:******@localhost:8082");
7881
}
7982

8083
@ParameterizedTest(name = "key = {0}")
8184
@MethodSource("matchingUriUserInfoKeys")
82-
void uriWithMultipleEntriesNoneWithPasswordShouldHaveNoneSanitized(String key) {
85+
void uriWithMultipleValuesNoneWithPasswordShouldHaveNoneSanitized(String key) {
8386
Sanitizer sanitizer = new Sanitizer();
8487
assertThat(sanitizer.sanitize(key, "http://user@localhost:8080,http://localhost:8082"))
8588
.isEqualTo("http://user@localhost:8080,http://localhost:8082");
8689
}
8790

8891
@ParameterizedTest(name = "key = {0}")
8992
@MethodSource("matchingUriUserInfoKeys")
90-
void uriWithMultipleEntriesSomeWithPasswordShouldHaveThoseSanitized(String key) {
93+
void uriWithMultipleValuesSomeWithPasswordShouldHaveThoseSanitized(String key) {
9194
Sanitizer sanitizer = new Sanitizer();
92-
assertThat(sanitizer.sanitize(key, "http://user1:password1@localhost:8080,http://user2@localhost:8082,http://localhost:8083"))
93-
.isEqualTo("http://user1:******@localhost:8080,http://user2@localhost:8082,http://localhost:8083");
95+
assertThat(sanitizer.sanitize(key,
96+
"http://user1:password1@localhost:8080,http://user2@localhost:8082,http://localhost:8083")).isEqualTo(
97+
"http://user1:******@localhost:8080,http://user2@localhost:8082,http://localhost:8083");
9498
}
9599

96100
@ParameterizedTest(name = "key = {0}")
97101
@MethodSource("matchingUriUserInfoKeys")
98-
void uriWithMultipleEntriesWithPasswordMatchingOtherPartsOfStringShouldBeSanitized(String key) {
102+
void uriWithMultipleValuesWithPasswordMatchingOtherPartsOfStringShouldBeSanitized(String key) {
99103
Sanitizer sanitizer = new Sanitizer();
100104
assertThat(sanitizer.sanitize(key, "http://user1://@localhost:8080,http://user2://@localhost:8082"))
101105
.isEqualTo("http://user1:******@localhost:8080,http://user2:******@localhost:8082");
102106
}
103107

104-
static private Stream<String> matchingUriUserInfoKeys() {
105-
return Stream.of("uri", "my.uri", "myuri", "uris", "my.uris", "myuris", "address", "my.address", "myaddress", "addresses", "my.addresses", "myaddresses");
108+
private static Stream<String> matchingUriUserInfoKeys() {
109+
return Stream.of("uri", "my.uri", "myuri", "uris", "my.uris", "myuris", "address", "my.address", "myaddress",
110+
"addresses", "my.addresses", "myaddresses");
106111
}
107112

108113
@Test
@@ -111,4 +116,5 @@ void regex() {
111116
assertThat(sanitizer.sanitize("verylOCkish", "secret")).isEqualTo("******");
112117
assertThat(sanitizer.sanitize("veryokish", "secret")).isEqualTo("secret");
113118
}
119+
114120
}

‎spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/env/EnvironmentEndpointTests.java

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2012-2019 the original author or authors.
2+
* Copyright 2012-2020 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -257,9 +257,13 @@ void uriPropertyWithSensitiveInfo() {
257257
@Test
258258
void addressesPropertyWithMultipleEntriesEachWithSensitiveInfo() {
259259
ConfigurableEnvironment environment = new StandardEnvironment();
260-
TestPropertyValues.of("sensitive.addresses=http://user:password@localhost:8080,http://user2:password2@localhost:8082").applyTo(environment);
261-
EnvironmentEntryDescriptor descriptor = new EnvironmentEndpoint(environment).environmentEntry("sensitive.addresses");
262-
assertThat(descriptor.getProperty().getValue()).isEqualTo("http://user:******@localhost:8080,http://user2:******@localhost:8082");
260+
TestPropertyValues
261+
.of("sensitive.addresses=http://user:password@localhost:8080,http://user2:password2@localhost:8082")
262+
.applyTo(environment);
263+
EnvironmentEntryDescriptor descriptor = new EnvironmentEndpoint(environment)
264+
.environmentEntry("sensitive.addresses");
265+
assertThat(descriptor.getProperty().getValue())
266+
.isEqualTo("http://user:******@localhost:8080,http://user2:******@localhost:8082");
263267
}
264268

265269
private static ConfigurableEnvironment emptyEnvironment() {

0 commit comments

Comments
 (0)