Problem
The key-name obfuscation rules for sensitive config (passw|pass|passwd|secret|key|token + the OBFUSCATE_SYSTEM_ENVIRONMENTAL_VARIABLES override) are defined as statics on JVMInfoResource, a JAX-RS resource. Other layers reach into it:
SystemTableImpl.set() calls JVMInfoResource.obfuscateIfNeeded() for security logging — business layer depending on a REST classConfigurationResource.isOnBlackList() reads JVMInfoResource.obfuscatePattern directly
As more surfaces need the same masking (e.g. the config-overrides fix in #36919), the pattern needs one authoritative home.
Fix
- New
com.dotcms.util.ObfuscationUtil owning the default pattern, the config-driven custom pattern, shouldObfuscate(), matchesCustomPattern(), obfuscateIfNeeded() and obfuscate()
JVMInfoResource keeps its public members as thin @Deprecated delegates (they are public static and may be referenced by plugins)SystemTableImpl and ConfigurationResource switch to the utility
No behavior change — same patterns, same masking format.
Related: #36919 (config overrides not obfuscated).
Problem
The key-name obfuscation rules for sensitive config (
passw|pass|passwd|secret|key|token+ theOBFUSCATE_SYSTEM_ENVIRONMENTAL_VARIABLESoverride) are defined as statics onJVMInfoResource, a JAX-RS resource. Other layers reach into it:SystemTableImpl.set()callsJVMInfoResource.obfuscateIfNeeded()for security logging — business layer depending on a REST classConfigurationResource.isOnBlackList()readsJVMInfoResource.obfuscatePatterndirectlyAs more surfaces need the same masking (e.g. the config-overrides fix in #36919), the pattern needs one authoritative home.
Fix
com.dotcms.util.ObfuscationUtilowning the default pattern, the config-driven custom pattern,shouldObfuscate(),matchesCustomPattern(),obfuscateIfNeeded()andobfuscate()JVMInfoResourcekeeps its public members as thin@Deprecateddelegates (they arepublic staticand may be referenced by plugins)SystemTableImplandConfigurationResourceswitch to the utilityNo behavior change — same patterns, same masking format.
Related: #36919 (config overrides not obfuscated).