This is an automated email from the ASF dual-hosted git repository. heneveld pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git
commit 10096f2e796c2dc59bf331cb0978f3c4b28264b1 Author: Alex Heneveld <[email protected]> AuthorDate: Tue Sep 14 22:53:07 2021 +0100 block deployment if passwords in plain text --- .../spi/creation/CampTypePlanTransformer.java | 41 ++++++++++++++++++++-- 1 file changed, 39 insertions(+), 2 deletions(-) diff --git a/camp/camp-brooklyn/src/main/java/org/apache/brooklyn/camp/brooklyn/spi/creation/CampTypePlanTransformer.java b/camp/camp-brooklyn/src/main/java/org/apache/brooklyn/camp/brooklyn/spi/creation/CampTypePlanTransformer.java index c6d0cb3..09c3834 100644 --- a/camp/camp-brooklyn/src/main/java/org/apache/brooklyn/camp/brooklyn/spi/creation/CampTypePlanTransformer.java +++ b/camp/camp-brooklyn/src/main/java/org/apache/brooklyn/camp/brooklyn/spi/creation/CampTypePlanTransformer.java @@ -18,6 +18,8 @@ */ package org.apache.brooklyn.camp.brooklyn.spi.creation; +import com.google.common.annotations.Beta; +import com.google.common.base.Predicate; import java.util.List; import java.util.Map; import java.util.function.BiFunction; @@ -27,11 +29,14 @@ import org.apache.brooklyn.api.typereg.BrooklynTypeRegistry.RegisteredTypeKind; import org.apache.brooklyn.api.typereg.RegisteredType; import org.apache.brooklyn.api.typereg.RegisteredType.TypeImplementationPlan; import org.apache.brooklyn.api.typereg.RegisteredTypeLoadingContext; +import org.apache.brooklyn.camp.brooklyn.spi.dsl.BrooklynDslDeferredSupplier; +import org.apache.brooklyn.core.config.Sanitizer; import org.apache.brooklyn.core.typereg.*; import org.apache.brooklyn.util.exceptions.Exceptions; import org.apache.brooklyn.util.guava.Maybe; import com.google.common.collect.ImmutableList; +import org.apache.brooklyn.util.javalang.Boxing; public class CampTypePlanTransformer extends AbstractTypePlanTransformer { @@ -104,8 +109,11 @@ public class CampTypePlanTransformer extends AbstractTypePlanTransformer { @Override protected AbstractBrooklynObjectSpec<?, ?> createSpec(RegisteredType type, RegisteredTypeLoadingContext context) throws Exception { try { - return decorateWithCommonTags(new CampResolver(mgmt, type, context).createSpec(), type, null, null, - prevHeadSpecSummary -> "Based on "+prevHeadSpecSummary); + return decorateWithCommonTags( + checkSecuritySensitiveFields( + new CampResolver(mgmt, type, context).createSpec() + ), + type, null, null, prevHeadSpecSummary -> "Based on "+prevHeadSpecSummary); } catch (Exception e) { Exceptions.propagateIfFatal(e); @@ -132,6 +140,35 @@ public class CampTypePlanTransformer extends AbstractTypePlanTransformer { } } + @Beta + public static AbstractBrooklynObjectSpec<?,?> checkSecuritySensitiveFields(AbstractBrooklynObjectSpec<?,?> spec) { + if (Sanitizer.isSensitiveFieldsPlaintextBlocked()) { + // if blocking plaintext values, check them before instantiating + Predicate<Object> predicate = Sanitizer.IS_SECRET_PREDICATE; + spec.getConfig().forEach( (key,val) -> failOnInsecureValueForSensitiveNamedField(predicate, key.getName(), val) ); + spec.getFlags().forEach( (key,val) -> failOnInsecureValueForSensitiveNamedField(predicate, key, val) ); + } + return spec; + } + + public static void failOnInsecureValueForSensitiveNamedField(Predicate<Object> tokens, String key, Object val) { + if (val instanceof BrooklynDslDeferredSupplier || val==null) { + // value allowed; key is irrelevant + return; + } + if (!tokens.apply(key)) { + // not a sensitive named key + return; + } + + // sensitive named key + if (val instanceof String || Boxing.isPrimitiveOrBoxedClass(val.getClass()) || val instanceof Number) { + // value + throw new IllegalStateException("Insecure value supplied for '"+key+"'; external suppliers must be used here"); + } + // complex values allowed + } + @Override protected Object createBean(RegisteredType type, RegisteredTypeLoadingContext context) throws Exception { // beans not supported by this?
