CFID-236: hide /varz keys in config hash ending in "password" or "sec…

…ret"

Change-Id: I372e3dd990efefa007bd3419183bbd22f9580167

common/src/main/java/org/cloudfoundry/identity/uaa/varz/VarzEndpoint.java

@@ -65,7 +65,7 @@ public void setBaseUrl(String baseUrl) {
 	 * @param environmentProperties the environment properties to set
 	 */
 	public void setEnvironmentProperties(Properties environmentProperties) {
-		this.environmentProperties = environmentProperties;
+		this.environmentProperties = hidePasswords(environmentProperties);
 	}
 
 	@Override
@@ -294,6 +294,21 @@ private Map<String, String> getHostProperties() {
 		return env;
 	}
 
+	/**
+	 * @param properties
+	 * @return new properties with no plaintext passwords
+	 */
+	private Properties hidePasswords(Properties properties) {
+		Properties result = new Properties();
+		result.putAll(properties);
+		for (String key : properties.stringPropertyNames()) {
+			if (key.endsWith("password") || key.endsWith("secret")) {
+				result.put(key, "#");
+			}
+		}
+		return result;
+	}
+
 	class MapWrapper {
 
 		private final SpelExpressionParser parser;

common/src/test/java/org/cloudfoundry/identity/uaa/varz/VarzEndpointTests.java

@@ -14,8 +14,10 @@
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
 
 import java.util.Map;
+import java.util.Properties;
 
 import javax.management.MBeanServerConnection;
 
@@ -24,11 +26,14 @@
 import org.springframework.core.env.StandardEnvironment;
 import org.springframework.jmx.support.MBeanServerFactoryBean;
 import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.util.StringUtils;
 
 public class VarzEndpointTests {
 
 	private MBeanServerConnection server;
+
 	private VarzEndpoint endpoint;
+
 	private MockHttpServletRequest request;
 
 	@Before
@@ -78,6 +83,21 @@ public void testDefaultVarz() throws Exception {
 		assertNotNull(varz.get("mem"));
 	}
 
+	@Test
+	public void testVarzWithConfig() throws Exception {
+		Properties properties = StringUtils.splitArrayElementsIntoProperties(
+				StringUtils.commaDelimitedListToStringArray("foo=bar,password=spam,client.secret=baz"), "=");
+		endpoint.setEnvironmentProperties(properties);
+		Map<String, ?> varz = endpoint.getVarz("http://uua.vcap.me");
+		// System.err.println(varz);
+		@SuppressWarnings("unchecked")
+		Map<String, ?> map = (Map<String, ?>) varz.get("config");
+		assertNotNull(map);
+		assertTrue(map.containsKey("foo"));
+		assertEquals("#", map.get("password"));
+		assertEquals("#", map.get("client.secret"));
+	}
+
 	@Test
 	public void testActiveProfiles() throws Exception {
 		endpoint.setEnvironment(new StandardEnvironment());