Commit 7f2b16d1 by Johannes Edmeier

Add option to configure the sanitized metadata keys

fixes #590
parent e15d7d2d
...@@ -27,7 +27,12 @@ ...@@ -27,7 +27,12 @@
| spring.boot.admin.routes.endpoints | spring.boot.admin.routes.endpoints
| The enpoints which will be available via spring boot admin zuul proxy. If you write ui modules using other endpoints you need to add them. | The enpoints which will be available via spring boot admin zuul proxy. If you write ui modules using other endpoints you need to add them.
| `"env, metrics, trace, dump, jolokia, info, configprops, activiti, logfile, refresh, flyway, liquibase, loggers"` | `"env", "metrics", "trace", "dump", "jolokia", "info", "configprops", "activiti", "logfile", "refresh", "flyway", "liquibase", "loggers"`
| spring.boot.admin.metadata-keys-to-sanitize
| Metadata values for the keys matching these regex patterns will be sanitized in all json output.
| `".*password$", ".*secret$", ".*key$", ".*$token$", ".*credentials.*", ".*vcap_services$"`
|=== |===
include::server-discovery.adoc[] include::server-discovery.adoc[]
......
...@@ -16,6 +16,11 @@ public class AdminServerProperties { ...@@ -16,6 +16,11 @@ public class AdminServerProperties {
private RoutesProperties routes = new RoutesProperties(); private RoutesProperties routes = new RoutesProperties();
/**
* The metadata keys which should be sanitized when serializing to json
*/
private String[] metadataKeysToSanitize = new String[]{".*password$", ".*secret$", ".*key$", ".*$token$", ".*credentials.*", ".*vcap_services$"};
public void setContextPath(String pathPrefix) { public void setContextPath(String pathPrefix) {
if (!pathPrefix.startsWith("/") || pathPrefix.endsWith("/")) { if (!pathPrefix.startsWith("/") || pathPrefix.endsWith("/")) {
throw new IllegalArgumentException("ContextPath must start with '/' and not end with '/'"); throw new IllegalArgumentException("ContextPath must start with '/' and not end with '/'");
...@@ -27,6 +32,14 @@ public class AdminServerProperties { ...@@ -27,6 +32,14 @@ public class AdminServerProperties {
return contextPath; return contextPath;
} }
public String[] getMetadataKeysToSanitize() {
return metadataKeysToSanitize;
}
public void setMetadataKeysToSanitize(String[] metadataKeysToSanitize) {
this.metadataKeysToSanitize = metadataKeysToSanitize;
}
public MonitorProperties getMonitor() { public MonitorProperties getMonitor() {
return monitor; return monitor;
} }
......
package de.codecentric.boot.admin.jackson;
import de.codecentric.boot.admin.model.Application;
import java.util.List;
import com.fasterxml.jackson.databind.BeanDescription;
import com.fasterxml.jackson.databind.JsonSerializer;
import com.fasterxml.jackson.databind.SerializationConfig;
import com.fasterxml.jackson.databind.ser.BeanPropertyWriter;
import com.fasterxml.jackson.databind.ser.BeanSerializerModifier;
public class ApplicationBeanSerializerModifier extends BeanSerializerModifier {
private final JsonSerializer<Object> metadataSerializer;
@SuppressWarnings("unchecked")
public ApplicationBeanSerializerModifier(SanitizingMapSerializer metadataSerializer) {
this.metadataSerializer = (JsonSerializer<Object>) (JsonSerializer) metadataSerializer;
}
@Override
public List<BeanPropertyWriter> changeProperties(SerializationConfig config, BeanDescription beanDesc, List<BeanPropertyWriter> beanProperties) {
if (!Application.class.isAssignableFrom(beanDesc.getBeanClass())) {
return beanProperties;
}
for (BeanPropertyWriter beanProperty : beanProperties) {
if ("metadata".equals(beanProperty.getName())) {
beanProperty.assignSerializer(metadataSerializer);
}
}
return beanProperties;
}
}
package de.codecentric.boot.admin.jackson;
import de.codecentric.boot.admin.model.Application;
import java.io.IOException;
import java.util.Iterator;
import java.util.Map;
import com.fasterxml.jackson.core.JsonParser;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.DeserializationContext;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.deser.std.StdDeserializer;
public class ApplicationDeserializer extends StdDeserializer<Application> {
private static final long serialVersionUID = 1L;
public ApplicationDeserializer() {
super(Application.class);
}
@Override
public Application deserialize(JsonParser p, DeserializationContext ctxt) throws IOException, JsonProcessingException {
JsonNode node = p.readValueAsTree();
Application.Builder builder = Application.create(node.get("name").asText());
if (node.has("url")) {
String url = node.get("url").asText();
builder.withHealthUrl(url.replaceFirst("/+$", "") + "/health").withManagementUrl(url);
} else {
if (node.has("healthUrl")) {
builder.withHealthUrl(node.get("healthUrl").asText());
}
if (node.has("managementUrl")) {
builder.withManagementUrl(node.get("managementUrl").asText());
}
if (node.has("serviceUrl")) {
builder.withServiceUrl(node.get("serviceUrl").asText());
}
}
if (node.has("metadata")) {
Iterator<Map.Entry<String, JsonNode>> it = node.get("metadata").fields();
while (it.hasNext()) {
Map.Entry<String, JsonNode> entry = it.next();
builder.addMetadata(entry.getKey(), entry.getValue().asText());
}
}
return builder.build();
}
}
package de.codecentric.boot.admin.jackson;
import java.io.IOException;
import java.util.Map;
import java.util.regex.Pattern;
import com.fasterxml.jackson.core.JsonGenerator;
import com.fasterxml.jackson.databind.SerializerProvider;
import com.fasterxml.jackson.databind.ser.std.StdSerializer;
public class SanitizingMapSerializer extends StdSerializer<Map<String, String>> {
private static final long serialVersionUID = 1L;
private final Pattern[] keysToSanitize;
@SuppressWarnings("unchecked")
public SanitizingMapSerializer(String[] patterns) {
super((Class<Map<String, String>>) (Class<?>) Map.class);
keysToSanitize = createPatterns(patterns);
}
private static Pattern[] createPatterns(String... keys) {
Pattern[] patterns = new Pattern[keys.length];
for (int i = 0; i < keys.length; i++) {
patterns[i] = Pattern.compile(keys[i], Pattern.CASE_INSENSITIVE);
}
return patterns;
}
@Override
public void serialize(Map<String, String> value, JsonGenerator gen, SerializerProvider provider) throws IOException {
gen.writeStartObject();
for (Map.Entry<String, String> entry : value.entrySet()) {
gen.writeStringField(entry.getKey(), sanitize(entry.getKey(), entry.getValue()));
}
gen.writeEndObject();
}
private String sanitize(String key, String value) {
for (Pattern pattern : this.keysToSanitize) {
if (pattern.matcher(key).matches()) {
return (value == null ? null : "******");
}
}
return value;
}
}
\ No newline at end of file
...@@ -40,7 +40,6 @@ import com.fasterxml.jackson.databind.ser.std.StdSerializer; ...@@ -40,7 +40,6 @@ import com.fasterxml.jackson.databind.ser.std.StdSerializer;
/** /**
* The domain model for all registered application at the spring boot admin application. * The domain model for all registered application at the spring boot admin application.
*/ */
@JsonDeserialize(using = Application.Deserializer.class)
public class Application implements Serializable { public class Application implements Serializable {
private static final long serialVersionUID = 2L; private static final long serialVersionUID = 2L;
...@@ -51,7 +50,6 @@ public class Application implements Serializable { ...@@ -51,7 +50,6 @@ public class Application implements Serializable {
private final String serviceUrl; private final String serviceUrl;
private final StatusInfo statusInfo; private final StatusInfo statusInfo;
private final String source; private final String source;
@JsonSerialize(using = Application.MetadataSerializer.class)
private final Map<String, String> metadata; private final Map<String, String> metadata;
private final Info info; private final Info info;
...@@ -263,83 +261,4 @@ public class Application implements Serializable { ...@@ -263,83 +261,4 @@ public class Application implements Serializable {
} }
return true; return true;
} }
public static class Deserializer extends StdDeserializer<Application> {
private static final long serialVersionUID = 1L;
protected Deserializer() {
super(Application.class);
}
@Override
public Application deserialize(JsonParser p, DeserializationContext ctxt)
throws IOException, JsonProcessingException {
JsonNode node = p.readValueAsTree();
Builder builder = create(node.get("name").asText());
if (node.has("url")) {
String url = node.get("url").asText();
builder.withHealthUrl(url.replaceFirst("/+$", "") + "/health")
.withManagementUrl(url);
} else {
if (node.has("healthUrl")) {
builder.withHealthUrl(node.get("healthUrl").asText());
}
if (node.has("managementUrl")) {
builder.withManagementUrl(node.get("managementUrl").asText());
}
if (node.has("serviceUrl")) {
builder.withServiceUrl(node.get("serviceUrl").asText());
}
}
if (node.has("metadata")) {
Iterator<Entry<String, JsonNode>> it = node.get("metadata").fields();
while (it.hasNext()) {
Entry<String, JsonNode> entry = it.next();
builder.addMetadata(entry.getKey(), entry.getValue().asText());
}
}
return builder.build();
}
}
public static class MetadataSerializer extends StdSerializer<Map<String, String>> {
private static final long serialVersionUID = 1L;
private static Pattern[] keysToSanitize = createPatterns(".*password$", ".*secret$",
".*key$", ".*$token$", ".*credentials.*", ".*vcap_services$");
@SuppressWarnings("unchecked")
public MetadataSerializer() {
super((Class<Map<String, String>>) (Class<?>) Map.class);
}
private static Pattern[] createPatterns(String... keys) {
Pattern[] patterns = new Pattern[keys.length];
for (int i = 0; i < keys.length; i++) {
patterns[i] = Pattern.compile(keys[i], Pattern.CASE_INSENSITIVE);
}
return patterns;
}
@Override
public void serialize(Map<String, String> value, JsonGenerator gen,
SerializerProvider provider) throws IOException {
gen.writeStartObject();
for (Entry<String, String> entry : value.entrySet()) {
gen.writeStringField(entry.getKey(), sanitize(entry.getKey(), entry.getValue()));
}
gen.writeEndObject();
}
private String sanitize(String key, String value) {
for (Pattern pattern : MetadataSerializer.keysToSanitize) {
if (pattern.matcher(key).matches()) {
return (value == null ? null : "******");
}
}
return value;
}
}
} }
package de.codecentric.boot.admin.jackson;
import de.codecentric.boot.admin.model.Application;
import java.util.Collections;
import org.json.JSONObject;
import org.junit.Assert;
import org.junit.Test;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.module.SimpleModule;
import static org.hamcrest.CoreMatchers.containsString;
import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.not;
import static org.hamcrest.Matchers.nullValue;
public class ApplicationJacksonTest {
private final SimpleModule module = new SimpleModule()//
.addDeserializer(Application.class,
new ApplicationDeserializer())
.setSerializerModifier(new ApplicationBeanSerializerModifier(
new SanitizingMapSerializer(
new String[]{".*password$"})));
private final ObjectMapper objectMapper = Jackson2ObjectMapperBuilder.json().modules(module).build();
@Test
public void test_1_2_json_format() throws Exception {
String json = new JSONObject().put("name", "test").put("url", "http://test").toString();
Application value = objectMapper.readValue(json, Application.class);
Assert.assertThat(value.getName(), is("test"));
Assert.assertThat(value.getManagementUrl(), is("http://test"));
Assert.assertThat(value.getHealthUrl(), is("http://test/health"));
Assert.assertThat(value.getServiceUrl(), nullValue());
}
@Test
public void test_1_4_json_format() throws Exception {
String json = new JSONObject().put("name", "test")
.put("managementUrl", "http://test")
.put("healthUrl", "http://health")
.put("serviceUrl", "http://service")
.put("statusInfo", new JSONObject().put("status", "UNKNOWN"))
.toString();
Application value = objectMapper.readValue(json, Application.class);
Assert.assertThat(value.getName(), is("test"));
Assert.assertThat(value.getManagementUrl(), is("http://test"));
Assert.assertThat(value.getHealthUrl(), is("http://health"));
Assert.assertThat(value.getServiceUrl(), is("http://service"));
}
@Test
public void test_1_5_json_format() throws Exception {
String json = new JSONObject().put("name", "test")
.put("managementUrl", "http://test")
.put("healthUrl", "http://health")
.put("serviceUrl", "http://service")
.put("metadata", new JSONObject().put("labels", "foo,bar"))
.toString();
Application value = objectMapper.readValue(json, Application.class);
Assert.assertThat(value.getName(), is("test"));
Assert.assertThat(value.getManagementUrl(), is("http://test"));
Assert.assertThat(value.getHealthUrl(), is("http://health"));
Assert.assertThat(value.getServiceUrl(), is("http://service"));
Assert.assertThat(value.getMetadata(), is(Collections.singletonMap("labels", "foo,bar")));
}
@Test
public void test_onlyHealthUrl() throws Exception {
String json = new JSONObject().put("name", "test").put("healthUrl", "http://test").toString();
Application value = objectMapper.readValue(json, Application.class);
Assert.assertThat(value.getName(), is("test"));
Assert.assertThat(value.getHealthUrl(), is("http://test"));
Assert.assertThat(value.getManagementUrl(), nullValue());
Assert.assertThat(value.getServiceUrl(), nullValue());
}
@Test(expected = IllegalArgumentException.class)
public void test_name_expected() throws Exception {
String json = new JSONObject().put("name", "")
.put("managementUrl", "http://test")
.put("healthUrl", "http://health")
.put("serviceUrl", "http://service")
.toString();
objectMapper.readValue(json, Application.class);
}
@Test(expected = IllegalArgumentException.class)
public void test_healthUrl_expected() throws Exception {
String json = new JSONObject().put("name", "test")
.put("managementUrl", "http://test")
.put("healthUrl", "")
.put("serviceUrl", "http://service")
.toString();
objectMapper.readValue(json, Application.class);
}
@Test
public void test_sanitize_metadata() throws JsonProcessingException {
Application app = Application.create("test")
.withHealthUrl("http://health")
.addMetadata("PASSWORD", "qwertz123")
.addMetadata("user", "humptydumpty")
.build();
String json = objectMapper.writeValueAsString(app);
Assert.assertThat(json, not(containsString("qwertz123")));
Assert.assertThat(json, containsString("humptydumpty"));
}
}
\ No newline at end of file
package de.codecentric.boot.admin.model; package de.codecentric.boot.admin.model;
import static org.hamcrest.CoreMatchers.containsString; import org.junit.Test;
import static org.hamcrest.Matchers.is; import static org.hamcrest.Matchers.is;
import static org.hamcrest.Matchers.not; import static org.hamcrest.Matchers.not;
import static org.hamcrest.Matchers.nullValue;
import static org.junit.Assert.assertThat; import static org.junit.Assert.assertThat;
import java.util.Collections;
import org.json.JSONObject;
import org.junit.Test;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
import com.fasterxml.jackson.core.JsonProcessingException;
import com.fasterxml.jackson.databind.ObjectMapper;
public class ApplicationTest { public class ApplicationTest {
private ObjectMapper objectMapper = Jackson2ObjectMapperBuilder.json().build();
@Test
public void test_1_2_json_format() throws Exception {
String json = new JSONObject().put("name", "test").put("url", "http://test").toString();
Application value = objectMapper.readValue(json, Application.class);
assertThat(value.getName(), is("test"));
assertThat(value.getManagementUrl(), is("http://test"));
assertThat(value.getHealthUrl(), is("http://test/health"));
assertThat(value.getServiceUrl(), nullValue());
}
@Test
public void test_1_4_json_format() throws Exception {
String json = new JSONObject().put("name", "test").put("managementUrl", "http://test")
.put("healthUrl", "http://health").put("serviceUrl", "http://service")
.put("statusInfo", new JSONObject().put("status", "UNKNOWN")).toString();
Application value = objectMapper.readValue(json, Application.class);
assertThat(value.getName(), is("test"));
assertThat(value.getManagementUrl(), is("http://test"));
assertThat(value.getHealthUrl(), is("http://health"));
assertThat(value.getServiceUrl(), is("http://service"));
}
@Test
public void test_1_5_json_format() throws Exception {
String json = new JSONObject().put("name", "test").put("managementUrl", "http://test")
.put("healthUrl", "http://health").put("serviceUrl", "http://service")
.put("metadata", new JSONObject().put("labels", "foo,bar")).toString();
Application value = objectMapper.readValue(json, Application.class);
assertThat(value.getName(), is("test"));
assertThat(value.getManagementUrl(), is("http://test"));
assertThat(value.getHealthUrl(), is("http://health"));
assertThat(value.getServiceUrl(), is("http://service"));
assertThat(value.getMetadata(), is(Collections.singletonMap("labels", "foo,bar")));
}
@Test
public void test_onlyHealthUrl() throws Exception {
String json = new JSONObject().put("name", "test").put("healthUrl", "http://test")
.toString();
Application value = objectMapper.readValue(json, Application.class);
assertThat(value.getName(), is("test"));
assertThat(value.getHealthUrl(), is("http://test"));
assertThat(value.getManagementUrl(), nullValue());
assertThat(value.getServiceUrl(), nullValue());
}
@Test(expected = IllegalArgumentException.class)
public void test_name_expected() throws Exception {
String json = new JSONObject().put("name", "").put("managementUrl", "http://test")
.put("healthUrl", "http://health").put("serviceUrl", "http://service").toString();
objectMapper.readValue(json, Application.class);
}
@Test(expected = IllegalArgumentException.class)
public void test_healthUrl_expected() throws Exception {
String json = new JSONObject().put("name", "test").put("managementUrl", "http://test")
.put("healthUrl", "").put("serviceUrl", "http://service").toString();
objectMapper.readValue(json, Application.class);
}
@Test
public void test_sanitize_metadata() throws JsonProcessingException {
Application app = Application.create("test").withHealthUrl("http://health")
.addMetadata("PASSWORD", "qwertz123").addMetadata("user", "humptydumpty").build();
String json = objectMapper.writeValueAsString(app);
assertThat(json, not(containsString("qwertz123")));
assertThat(json, containsString("humptydumpty"));
}
@Test
public void test_equals_hashCode() {
Application a1 = Application.create("foo").withHealthUrl("healthUrl")
.withManagementUrl("mgmt").withServiceUrl("svc").withId("id").build();
Application a2 = Application.create("foo").withHealthUrl("healthUrl")
.withManagementUrl("mgmt").withServiceUrl("svc").withId("id").build();
assertThat(a1, is(a2));
assertThat(a1.hashCode(), is(a2.hashCode()));
Application a3 = Application.create("foo").withHealthUrl("healthUrl2")
.withManagementUrl("mgmt").withServiceUrl("svc").withId("other").build();
assertThat(a1, not(is(a3)));
assertThat(a2, not(is(a3)));
}
@Test @Test
public void test_builder_copy() { public void test_equals_hashCode() {
Application app = Application.create("App").withId("-id-").withHealthUrl("http://health") Application a1 = Application.create("foo")
.withManagementUrl("http://mgmgt").withServiceUrl("http://svc") .withHealthUrl("healthUrl")
.withStatusInfo(StatusInfo.ofUp()).build(); .withManagementUrl("mgmt")
Application copy = Application.copyOf(app).build(); .withServiceUrl("svc")
assertThat(app, is(copy)); .withId("id")
} .build();
Application a2 = Application.create("foo")
.withHealthUrl("healthUrl")
.withManagementUrl("mgmt")
.withServiceUrl("svc")
.withId("id")
.build();
assertThat(a1, is(a2));
assertThat(a1.hashCode(), is(a2.hashCode()));
Application a3 = Application.create("foo")
.withHealthUrl("healthUrl2")
.withManagementUrl("mgmt")
.withServiceUrl("svc")
.withId("other")
.build();
assertThat(a1, not(is(a3)));
assertThat(a2, not(is(a3)));
}
@Test
public void test_builder_copy() {
Application app = Application.create("App")
.withId("-id-")
.withHealthUrl("http://health")
.withManagementUrl("http://mgmgt")
.withServiceUrl("http://svc")
.withStatusInfo(StatusInfo.ofUp())
.build();
Application copy = Application.copyOf(app).build();
assertThat(app, is(copy));
}
} }
\ No newline at end of file
...@@ -35,12 +35,18 @@ import org.mockito.internal.matchers.Matches; ...@@ -35,12 +35,18 @@ import org.mockito.internal.matchers.Matches;
import org.springframework.context.ApplicationEventPublisher; import org.springframework.context.ApplicationEventPublisher;
import org.springframework.http.HttpHeaders; import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType; import org.springframework.http.MediaType;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;
import org.springframework.http.converter.json.MappingJackson2HttpMessageConverter;
import org.springframework.test.web.servlet.MockMvc; import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.MvcResult; import org.springframework.test.web.servlet.MvcResult;
import org.springframework.test.web.servlet.setup.MockMvcBuilders; import org.springframework.test.web.servlet.setup.MockMvcBuilders;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.module.SimpleModule;
import com.jayway.jsonpath.JsonPath; import com.jayway.jsonpath.JsonPath;
import de.codecentric.boot.admin.jackson.ApplicationDeserializer;
import de.codecentric.boot.admin.model.Application;
import de.codecentric.boot.admin.registry.ApplicationRegistry; import de.codecentric.boot.admin.registry.ApplicationRegistry;
import de.codecentric.boot.admin.registry.HashingApplicationUrlIdGenerator; import de.codecentric.boot.admin.registry.HashingApplicationUrlIdGenerator;
import de.codecentric.boot.admin.registry.store.SimpleApplicationStore; import de.codecentric.boot.admin.registry.store.SimpleApplicationStore;
...@@ -70,7 +76,11 @@ public class RegistryControllerTest { ...@@ -70,7 +76,11 @@ public class RegistryControllerTest {
ApplicationRegistry registry = new ApplicationRegistry(new SimpleApplicationStore(), ApplicationRegistry registry = new ApplicationRegistry(new SimpleApplicationStore(),
new HashingApplicationUrlIdGenerator()); new HashingApplicationUrlIdGenerator());
registry.setApplicationEventPublisher(Mockito.mock(ApplicationEventPublisher.class)); registry.setApplicationEventPublisher(Mockito.mock(ApplicationEventPublisher.class));
mvc = MockMvcBuilders.standaloneSetup(new RegistryController(registry)).build(); SimpleModule module = new SimpleModule().addDeserializer(Application.class, new ApplicationDeserializer());
ObjectMapper objectMapper = Jackson2ObjectMapperBuilder.json().modules(module).build();
mvc = MockMvcBuilders.standaloneSetup(new RegistryController(registry))
.setMessageConverters(new MappingJackson2HttpMessageConverter(objectMapper))
.build();
} }
@Test @Test
...@@ -78,7 +88,8 @@ public class RegistryControllerTest { ...@@ -78,7 +88,8 @@ public class RegistryControllerTest {
MvcResult result = mvc.perform( MvcResult result = mvc.perform(
post("/api/applications").contentType(MediaType.APPLICATION_JSON).content(APPLICATION_TEST_JSON)) post("/api/applications").contentType(MediaType.APPLICATION_JSON).content(APPLICATION_TEST_JSON))
.andExpect(status().isCreated()) .andExpect(status().isCreated())
.andExpect(header().string(HttpHeaders.LOCATION, new Matches("http://localhost/[0-9a-f]+"))) .andExpect(
header().string(HttpHeaders.LOCATION, new Matches("http://localhost/[0-9a-f]+")))
.andExpect(jsonPath("$.id").isNotEmpty()) .andExpect(jsonPath("$.id").isNotEmpty())
.andReturn(); .andReturn();
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment