-
-
Notifications
You must be signed in to change notification settings - Fork 647
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat(topic-data): added new ability to mask the record key and values (…
…#1291) this can be used to obscure sensitive data from all akhq users
- Loading branch information
1 parent
a3d1bdb
commit cc20b74
Showing
9 changed files
with
174 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,13 @@ | ||
package org.akhq.configs; | ||
|
||
import io.micronaut.context.annotation.ConfigurationProperties; | ||
import lombok.Data; | ||
|
||
import java.util.ArrayList; | ||
import java.util.List; | ||
|
||
@ConfigurationProperties("akhq.security.data-masking") | ||
@Data | ||
public class DataMasking { | ||
List<DataMaskingFilter> filters = new ArrayList<>(); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,12 @@ | ||
package org.akhq.configs; | ||
|
||
import io.micronaut.context.annotation.EachProperty; | ||
import lombok.Data; | ||
|
||
@EachProperty("filters") | ||
@Data | ||
public class DataMaskingFilter { | ||
String description; | ||
String searchRegex; | ||
String replacement; | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,38 @@ | ||
package org.akhq.utils; | ||
|
||
import jakarta.inject.Inject; | ||
import jakarta.inject.Singleton; | ||
import org.akhq.configs.DataMasking; | ||
import org.akhq.configs.DataMaskingFilter; | ||
import org.akhq.models.Record; | ||
import org.slf4j.Logger; | ||
import org.slf4j.LoggerFactory; | ||
|
||
@Singleton | ||
public class MaskingUtils { | ||
private static final Logger LOG = LoggerFactory.getLogger(MaskingUtils.class); | ||
|
||
@Inject | ||
DataMasking dataMasking; | ||
|
||
public Record maskRecord(Record record) { | ||
LOG.trace("masking record"); | ||
|
||
String value = record.getValue(); | ||
String key = record.getKey(); | ||
|
||
for (DataMaskingFilter filter : dataMasking.getFilters()) { | ||
if (value != null) { | ||
value = value.replaceAll(filter.getSearchRegex(), filter.getReplacement()); | ||
} | ||
if (key != null) { | ||
key = key.replaceAll(filter.getSearchRegex(), filter.getReplacement()); | ||
} | ||
} | ||
|
||
record.setValue(value); | ||
record.setKey(key); | ||
|
||
return record; | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,64 @@ | ||
package org.akhq.utils; | ||
|
||
import io.micronaut.context.ApplicationContext; | ||
import org.akhq.models.Record; | ||
import org.junit.jupiter.api.Test; | ||
|
||
import static org.junit.jupiter.api.Assertions.assertEquals; | ||
|
||
class MaskingUtilsTest { | ||
|
||
@Test | ||
void shouldMasksRecordValue() { | ||
ApplicationContext ctx = ApplicationContext.run("data-masking"); | ||
MaskingUtils maskingUtils = ctx.getBean(MaskingUtils.class); | ||
|
||
Record record = new Record(); | ||
record.setValue("{\"secret-key\":\"my-secret-value\"}"); | ||
|
||
Record maskedRecord = maskingUtils.maskRecord(record); | ||
|
||
assertEquals( | ||
"{\"secret-key\":\"xxxx\"}", | ||
maskedRecord.getValue() | ||
); | ||
|
||
ctx.close(); | ||
} | ||
|
||
@Test | ||
void shouldMasksRecordKey() { | ||
ApplicationContext ctx = ApplicationContext.run("data-masking"); | ||
MaskingUtils maskingUtils = ctx.getBean(MaskingUtils.class); | ||
|
||
Record record = new Record(); | ||
record.setKey("{\"secret-key\":\"my-secret-value\"}"); | ||
|
||
Record maskedRecord = maskingUtils.maskRecord(record); | ||
|
||
assertEquals( | ||
"{\"secret-key\":\"xxxx\"}", | ||
maskedRecord.getKey() | ||
); | ||
|
||
ctx.close(); | ||
} | ||
|
||
@Test | ||
void shouldReturnGroupsToAllowPartialMasking() { | ||
ApplicationContext ctx = ApplicationContext.run("data-masking"); | ||
MaskingUtils maskingUtils = ctx.getBean(MaskingUtils.class); | ||
|
||
Record record = new Record(); | ||
record.setValue("{\"some-key\":\"+12092503766\"}"); | ||
|
||
Record maskedRecord = maskingUtils.maskRecord(record); | ||
|
||
assertEquals( | ||
"{\"some-key\":\"+120925xxxx\"}", | ||
maskedRecord.getValue() | ||
); | ||
|
||
ctx.close(); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,10 @@ | ||
akhq: | ||
security: | ||
data-masking: | ||
filters: | ||
- description: "Masks value for secret-key fields" | ||
search-regex: '"(secret-key)":".*"' | ||
replacement: '"$1":"xxxx"' | ||
- description: "Masks last digits of phone numbers" | ||
search-regex: '"([\+]?[(]?[0-9]{3}[)]?[-\s\.]?[0-9]{3}[-\s\.]?)[0-9]{4,6}"' | ||
replacement: '"$1xxxx"' |