Skip to content

Mask sensitive placeholders for specific properties in /env endpoint #8282

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
shakuzen opened this issue Feb 14, 2017 · 1 comment
Closed
Assignees
Labels
type: enhancement A general enhancement
Milestone

Comments

@shakuzen
Copy link
Member

shakuzen commented Feb 14, 2017

This will I think be an enhancement request somewhat related but different from #6876 (and #6903).

As mentioned on the Spring Cloud Gitter, I would like to mask the password for MongoDB in the /env and /configprops Actuator endpoints. Mongo essentially requires using the spring.data.mongodb.uri for multiple hosts, so spring.data.mongodb.password cannot be used.

Since I am using Spring Cloud Config and want to encrypt the MongoDB password, I am using a separate property for that (mongo.password in the snippets below). I then use this variable as a placeholder in spring.data.mongodb.uri. This works well, but I would still need to add uri to the list of keys to sanitize to avoid leaking the password as shown below.

It would be a useful enhancement if placeholders of properties to be sanitized were not resolved and instead masked.

Here is a snippet from GET /env
The mongo.password property is sanitized since it ends in password, and from here placeholders are not resolved, so everything is fine.

{
	"configService:ssh://git@git-server:9999/cloud-config/mongo-demo/mongo-demo.yml": {
		"spring.application.name":"mongo-demo",
		"spring.data.mongodb.uri":"mongodb://user:${mongo.password}@host1:27017,host2:27017,host3:27017/dbname",
		"mongo.password":"******"
	}
}

When retrieving the value for a specific property from the /env endpoint, currently the placeholders are unconditionally resolved as follows.
GET /env/spring.data.mongodb.uri

{
	"spring.data.mongodb.uri":"mongodb://user:password@host1:27017,host2:27017,host3:27017/dbname",
}

With this ticket's requested enhancement, the placeholder ${mongo.password} will be masked because it is a key to be sanitized (endpoints.env.keys-to-sanitize)
GET /env/spring.data.mongodb.uri

{
	"spring.data.mongodb.uri":"mongodb://user:********@host1:27017,host2:27017,host3:27017/dbname",
}

The above applies to the /configprops endpoint also.

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Feb 14, 2017
@wilkinsona
Copy link
Member

I think it should be possible to improve this for the env endpoint, and it may be something that we want to look at in a maintenance release.

I'm not sure what we can do for a @ConfigurationProperties bean as the fact that placeholders were involved in configuring a property's value is lost by the time the beans are being queried. We are hoping to provide some provenance for configuration properties in 2.0 so this may become possible as part of that, although I'm not sure how likely that is.

Can you please open a separate issue for /configprops so that we can consider these two changes individually?

@wilkinsona wilkinsona changed the title Mask sensitive placeholders in /env and /configprops endpoints Mask sensitive placeholders in for specific properties in /env endpoint Feb 14, 2017
@wilkinsona wilkinsona changed the title Mask sensitive placeholders in for specific properties in /env endpoint Mask sensitive placeholders for specific properties in /env endpoint Feb 14, 2017
@wilkinsona wilkinsona added for: team-call type: enhancement A general enhancement and removed status: waiting-for-triage An issue we've not yet triaged labels Feb 14, 2017
@philwebb philwebb added this to the 1.5.3 milestone Mar 2, 2017
@mbhave mbhave self-assigned this Mar 7, 2017
@mbhave mbhave closed this as completed in 7da70a5 Mar 8, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: enhancement A general enhancement
Projects
None yet
Development

No branches or pull requests

5 participants