0ct0pu5/kafka-ui
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Sanitizer disable property added (#1531)

Browse source
This commit is contained in:
Ilya Kuramshin 2022-02-01 21:35:42 +03:00 • committed by GitHub
parent 982d29709b
commit 81ecea1c91
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 30 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

27
kafka-ui-api/src/main/java/com/provectus/kafka/ui/service/KafkaConfigSanitizer.java
View file

@ -1,6 +1,7 @@
package com.provectus.kafka.ui.service;
import java.util.Arrays;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
@ -20,17 +21,27 @@ class KafkaConfigSanitizer extends Sanitizer {
);
KafkaConfigSanitizer(
@Value("${kafka.config.sanitizer.patterns:}") List<String> patternsToSanitize
@Value("${kafka.config.sanitizer.enabled:true}") boolean enabled,
@Value("${kafka.config.sanitizer.patterns:}") List<String> patternsToSanitize
) {
if (!enabled) {
setKeysToSanitize();
} else {
var keysToSanitize = new HashSet<>(
patternsToSanitize.isEmpty() ? DEFAULT_PATTERNS_TO_SANITIZE : patternsToSanitize);
keysToSanitize.addAll(kafkaConfigKeysToSanitize());
setKeysToSanitize(keysToSanitize.toArray(new String[]{}));
}
}
private static Set<String> kafkaConfigKeysToSanitize() {
final ConfigDef configDef = new ConfigDef();
SslConfigs.addClientSslSupport(configDef);
SaslConfigs.addClientSaslSupport(configDef);
final Set<String> keysToSanitize = configDef.configKeys().entrySet().stream()
.filter(entry -> entry.getValue().type().equals(ConfigDef.Type.PASSWORD))
.map(Map.Entry::getKey)
.collect(Collectors.toSet());
keysToSanitize.addAll(
patternsToSanitize.isEmpty() ? DEFAULT_PATTERNS_TO_SANITIZE : patternsToSanitize);
this.setKeysToSanitize(keysToSanitize.toArray(new String[0]));
return configDef.configKeys().entrySet().stream()
.filter(entry -> entry.getValue().type().equals(ConfigDef.Type.PASSWORD))
.map(Map.Entry::getKey)
.collect(Collectors.toSet());
}
}

14
kafka-ui-api/src/test/java/com/provectus/kafka/ui/service/KafkaConfigSanitizerTest.java
View file

@ -9,9 +9,17 @@ import org.springframework.boot.actuate.endpoint.Sanitizer;
class KafkaConfigSanitizerTest {
@Test
void doNothingIfEnabledPropertySetToFalse() {
final Sanitizer sanitizer = new KafkaConfigSanitizer(false, Collections.emptyList());
assertThat(sanitizer.sanitize("password", "secret")).isEqualTo("secret");
assertThat(sanitizer.sanitize("sasl.jaas.config", "secret")).isEqualTo("secret");
assertThat(sanitizer.sanitize("database.password", "secret")).isEqualTo("secret");
}
@Test
void obfuscateCredentials() {
final Sanitizer sanitizer = new KafkaConfigSanitizer(Collections.emptyList());
final Sanitizer sanitizer = new KafkaConfigSanitizer(true, Collections.emptyList());
assertThat(sanitizer.sanitize("sasl.jaas.config", "secret")).isEqualTo("******");
assertThat(sanitizer.sanitize("consumer.sasl.jaas.config", "secret")).isEqualTo("******");
assertThat(sanitizer.sanitize("producer.sasl.jaas.config", "secret")).isEqualTo("******");
@ -22,7 +30,7 @@ class KafkaConfigSanitizerTest {
@Test
void notObfuscateNormalConfigs() {
final Sanitizer sanitizer = new KafkaConfigSanitizer(Collections.emptyList());
final Sanitizer sanitizer = new KafkaConfigSanitizer(true, Collections.emptyList());
assertThat(sanitizer.sanitize("security.protocol", "SASL_SSL")).isEqualTo("SASL_SSL");
final String[] bootstrapServer = new String[] {"test1:9092", "test2:9092"};
assertThat(sanitizer.sanitize("bootstrap.servers", bootstrapServer)).isEqualTo(bootstrapServer);
@ -30,7 +38,7 @@ class KafkaConfigSanitizerTest {
@Test
void obfuscateCredentialsWithDefinedPatterns() {
final Sanitizer sanitizer = new KafkaConfigSanitizer(Arrays.asList("kafka.ui", ".*test.*"));
final Sanitizer sanitizer = new KafkaConfigSanitizer(true, Arrays.asList("kafka.ui", ".*test.*"));
assertThat(sanitizer.sanitize("consumer.kafka.ui", "secret")).isEqualTo("******");
assertThat(sanitizer.sanitize("this.is.test.credentials", "secret")).isEqualTo("******");
assertThat(sanitizer.sanitize("this.is.not.credential", "not.credential"))