diff options
author | Antoine Vigneau <antoine.vigneau@sonarsource.com> | 2023-06-07 15:44:35 +0200 |
---|---|---|
committer | Antoine Vigneau <antoine.vigneau@sonarsource.com> | 2023-06-08 13:59:50 +0200 |
commit | 528022bc8aa28d2fcef2e1e54370d874ff9965ab (patch) | |
tree | 9c023c5061a36d25d48b632a69c8e243b3c52d1d /src | |
parent | 6529bb38fb5df5918151d4e9b0c08c5841ae7439 (diff) | |
download | sonar-scanner-cli-528022bc8aa28d2fcef2e1e54370d874ff9965ab.tar.gz sonar-scanner-cli-528022bc8aa28d2fcef2e1e54370d874ff9965ab.zip |
SQSCANNER-115 Fix SSF-392
Diffstat (limited to 'src')
-rw-r--r-- | src/main/java/org/sonarsource/scanner/cli/SystemInfo.java | 25 | ||||
-rw-r--r-- | src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java | 12 |
2 files changed, 36 insertions, 1 deletions
diff --git a/src/main/java/org/sonarsource/scanner/cli/SystemInfo.java b/src/main/java/org/sonarsource/scanner/cli/SystemInfo.java index 5dfd6bd..84696fb 100644 --- a/src/main/java/org/sonarsource/scanner/cli/SystemInfo.java +++ b/src/main/java/org/sonarsource/scanner/cli/SystemInfo.java @@ -19,7 +19,16 @@ */ package org.sonarsource.scanner.cli; +import java.util.Set; +import java.util.regex.Pattern; +import java.util.stream.Collectors; + class SystemInfo { + private static final Set<String> SENSITIVE_JVM_ARGUMENTS = Set.of( + "-Dsonar.login", + "-Dsonar.password", + "-Dsonar.token"); + private static final Pattern PATTERN_ARGUMENT_SEPARATOR = Pattern.compile("\\s+"); private static System2 system = new System2(); private SystemInfo() { @@ -35,8 +44,22 @@ class SystemInfo { logger.info(os()); String scannerOpts = system.getenv("SONAR_SCANNER_OPTS"); if (scannerOpts != null) { - logger.info("SONAR_SCANNER_OPTS=" + scannerOpts); + logger.info("SONAR_SCANNER_OPTS=" + redactSensitiveArguments(scannerOpts)); + } + } + + private static String redactSensitiveArguments(String scannerOpts) { + return PATTERN_ARGUMENT_SEPARATOR.splitAsStream(scannerOpts) + .map(SystemInfo::redactArgumentIfSensistive) + .collect(Collectors.joining(" ")); + } + + private static String redactArgumentIfSensistive(String argument) { + String[] elems = argument.split("="); + if (elems.length > 0 && SENSITIVE_JVM_ARGUMENTS.contains(elems[0])) { + return elems[0] + "=*"; } + return argument; } static String java() { diff --git a/src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java b/src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java index c6c0585..3e11c44 100644 --- a/src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java +++ b/src/test/java/org/sonarsource/scanner/cli/SystemInfoTest.java @@ -89,4 +89,16 @@ public class SystemInfoTest { verify(logs).info("SONAR_SCANNER_OPTS=arg"); verifyNoMoreInteractions(logs); } + + @Test + public void should_not_print_sensitive_data() { + mockOs(); + mockJava(); + when(mockSystem.getenv("SONAR_SCANNER_OPTS")) + .thenReturn("-Dsonar.login=login -Dsonar.whatever=whatever -Dsonar.password=password -Dsonar.whatever2=whatever2 -Dsonar.token=token"); + + SystemInfo.print(logs); + + verify(logs).info("SONAR_SCANNER_OPTS=-Dsonar.login=* -Dsonar.whatever=whatever -Dsonar.password=* -Dsonar.whatever2=whatever2 -Dsonar.token=*"); + } } |