-
Notifications
You must be signed in to change notification settings - Fork 913
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Scrub secrets from process arguments #13225
Conversation
@@ -35,6 +34,9 @@ public final class ProcessResource { | |||
// Important: This is statically used in buildResource, so must be declared/initialized first. | |||
private static final Pattern JAR_FILE_PATTERN = | |||
Pattern.compile("^\\S+\\.(jar|war)", Pattern.CASE_INSENSITIVE); | |||
// scrub values for system properties containing "secret" or "password" in the name | |||
private static final Pattern SCRUB_PATTERN = | |||
Pattern.compile("(-D.*(password|secret).*=).*", Pattern.CASE_INSENSITIVE); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Would it be worth to also scrub properties containing pwd
or credential
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'll leave that to @trask to decide.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
IMO, it's another option to provide an environment variable for users so that they can set some keys themselves.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think ok to go with just password
and secret
initially and see if we get further reports
test { | ||
dependsOn(jar) | ||
doFirst { | ||
// use test the final jar instead of directories with built classes to test the mrjar functionality |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
// use test the final jar instead of directories with built classes to test the mrjar functionality | |
// used to test the final jar instead of directories with built classes to test the mrjar functionality |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I changed it to use the final jar instead of directories with built classes to test the mrjar functionality
wdyt?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
lgtm
Related to #10151