Skip to content

Commit 140bdce

Browse files
jyeminjyemin
authored
Replace security-sensitive system properties with env vars (#1314)
This prevents then from being echoed in build logs. JAVA-5311
1 parent 2b68ece commit 140bdce

19 files changed

+184
-160
lines changed

‎.evergreen/.evg.yml

Lines changed: 52 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -227,24 +227,29 @@ functions:
227227
type: test
228228
params:
229229
working_dir: "src"
230+
env:
231+
AWS_ACCESS_KEY_ID: ${aws_access_key_id}
232+
AWS_SECRET_ACCESS_KEY: ${aws_secret_access_key}
233+
AWS_DEFAULT_REGION: us-east-1
234+
AZURE_TENANT_ID: ${azure_tenant_id}
235+
AZURE_CLIENT_ID: ${azure_client_id}
236+
AZURE_CLIENT_SECRET: ${azure_client_secret}
237+
GCP_EMAIL: ${gcp_email}
238+
GCP_PRIVATE_KEY: ${gcp_private_key}
239+
AZUREKMS_KEY_VAULT_ENDPOINT: ${testazurekms_keyvaultendpoint}
240+
AZUREKMS_KEY_NAME: ${testazurekms_keyname}
230241
script: |
231242
${PREPARE_SHELL}
232-
export AWS_ACCESS_KEY_ID=${aws_access_key_id}
233-
export AWS_SECRET_ACCESS_KEY=${aws_secret_access_key}
234-
export AWS_DEFAULT_REGION=us-east-1
243+
235244
. ${DRIVERS_TOOLS}/.evergreen/csfle/set-temp-creds.sh
245+
246+
export AWS_TEMP_ACCESS_KEY_ID=$CSFLE_AWS_TEMP_ACCESS_KEY_ID
247+
export AWS_TEMP_SECRET_ACCESS_KEY=$CSFLE_AWS_TEMP_SECRET_ACCESS_KEY
248+
export AWS_TEMP_SESSION_TOKEN=$CSFLE_AWS_TEMP_SESSION_TOKEN
249+
export CRYPT_SHARED_LIB_PATH=${CRYPT_SHARED_LIB_PATH}
250+
236251
AUTH="${AUTH}" SSL="${SSL}" MONGODB_URI="${MONGODB_URI}" SAFE_FOR_MULTI_MONGOS="${SAFE_FOR_MULTI_MONGOS}" TOPOLOGY="${TOPOLOGY}" \
237-
COMPRESSOR="${COMPRESSOR}" JAVA_VERSION="${JAVA_VERSION}" \
238-
AWS_ACCESS_KEY_ID=${aws_access_key_id} AWS_SECRET_ACCESS_KEY=${aws_secret_access_key} \
239-
AWS_TEMP_ACCESS_KEY_ID=$CSFLE_AWS_TEMP_ACCESS_KEY_ID \
240-
AWS_TEMP_SECRET_ACCESS_KEY=$CSFLE_AWS_TEMP_SECRET_ACCESS_KEY \
241-
AWS_TEMP_SESSION_TOKEN=$CSFLE_AWS_TEMP_SESSION_TOKEN \
242-
AZURE_TENANT_ID=${azure_tenant_id} AZURE_CLIENT_ID=${azure_client_id} AZURE_CLIENT_SECRET=${azure_client_secret} \
243-
GCP_EMAIL=${gcp_email} GCP_PRIVATE_KEY=${gcp_private_key} \
244-
AZUREKMS_KEY_VAULT_ENDPOINT=${testazurekms_keyvaultendpoint} \
245-
AZUREKMS_KEY_NAME=${testazurekms_keyname} \
246-
REQUIRE_API_VERSION=${REQUIRE_API_VERSION} \
247-
CRYPT_SHARED_LIB_PATH="${CRYPT_SHARED_LIB_PATH}" \
252+
COMPRESSOR="${COMPRESSOR}" JAVA_VERSION="${JAVA_VERSION}" REQUIRE_API_VERSION=${REQUIRE_API_VERSION} \
248253
.evergreen/run-tests.sh
249254
250255
"run load-balancer tests":
@@ -784,52 +789,65 @@ functions:
784789
type: test
785790
params:
786791
working_dir: "src"
792+
env:
793+
AWS_ACCESS_KEY_ID: ${aws_access_key_id}
794+
AWS_SECRET_ACCESS_KEY: ${aws_secret_access_key}
787795
script: |
788796
${PREPARE_SHELL}
789797
set +o xtrace
790-
MONGODB_URI="${MONGODB_URI}" AWS_ACCESS_KEY_ID=${aws_access_key_id} AWS_SECRET_ACCESS_KEY=${aws_secret_access_key} \
791-
.evergreen/run-csfle-aws-from-environment.sh
798+
MONGODB_URI="${MONGODB_URI}" .evergreen/run-csfle-aws-from-environment.sh
792799
793800
"run csfle tests with mongocryptd":
794801
- command: shell.exec
795802
type: test
796803
params:
797804
working_dir: "src"
805+
env:
806+
AWS_ACCESS_KEY_ID: ${aws_access_key_id}
807+
AWS_SECRET_ACCESS_KEY: ${aws_secret_access_key}
808+
AWS_DEFAULT_REGION: us-east-1
809+
AZURE_TENANT_ID: ${azure_tenant_id}
810+
AZURE_CLIENT_ID: ${azure_client_id}
811+
AZURE_CLIENT_SECRET: ${azure_client_secret}
812+
GCP_EMAIL: ${gcp_email}
813+
GCP_PRIVATE_KEY: ${gcp_private_key}
814+
AZUREKMS_KEY_VAULT_ENDPOINT: ${testazurekms_keyvaultendpoint}
815+
AZUREKMS_KEY_NAME: ${testazurekms_keyname}
798816
script: |
799817
${PREPARE_SHELL}
800-
export AWS_ACCESS_KEY_ID=${aws_access_key_id}
801-
export AWS_SECRET_ACCESS_KEY=${aws_secret_access_key}
802-
export AWS_DEFAULT_REGION=us-east-1
803818
. ${DRIVERS_TOOLS}/.evergreen/csfle/set-temp-creds.sh
804-
MONGODB_URI="${MONGODB_URI}" \
805-
JAVA_VERSION="${JAVA_VERSION}" \
806-
AWS_ACCESS_KEY_ID=${aws_access_key_id} AWS_SECRET_ACCESS_KEY=${aws_secret_access_key} \
807-
AWS_TEMP_ACCESS_KEY_ID=$CSFLE_AWS_TEMP_ACCESS_KEY_ID \
808-
AWS_TEMP_SECRET_ACCESS_KEY=$CSFLE_AWS_TEMP_SECRET_ACCESS_KEY \
809-
AWS_TEMP_SESSION_TOKEN=$CSFLE_AWS_TEMP_SESSION_TOKEN \
810-
AZURE_TENANT_ID=${azure_tenant_id} AZURE_CLIENT_ID=${azure_client_id} AZURE_CLIENT_SECRET=${azure_client_secret} \
811-
GCP_EMAIL=${gcp_email} GCP_PRIVATE_KEY=${gcp_private_key} \
812-
AZUREKMS_KEY_VAULT_ENDPOINT=${testazurekms_keyvaultendpoint} \
813-
AZUREKMS_KEY_NAME=${testazurekms_keyname} \
814-
.evergreen/run-csfle-tests-with-mongocryptd.sh
819+
820+
export AWS_TEMP_ACCESS_KEY_ID=$CSFLE_AWS_TEMP_ACCESS_KEY_ID
821+
export AWS_TEMP_SECRET_ACCESS_KEY=$CSFLE_AWS_TEMP_SECRET_ACCESS_KEY
822+
export AWS_TEMP_SESSION_TOKEN=$CSFLE_AWS_TEMP_SESSION_TOKEN
823+
824+
MONGODB_URI="${MONGODB_URI}" JAVA_VERSION="${JAVA_VERSION}" .evergreen/run-csfle-tests-with-mongocryptd.sh
815825
816826
"publish snapshot":
817827
- command: shell.exec
818828
type: test
819829
params:
820830
working_dir: "src"
831+
env:
832+
NEXUS_USERNAME: ${nexus_username}
833+
NEXUS_PASSWORD: ${nexus_password}
834+
SIGNING_PASSWORD: ${signing_password}
835+
SIGNING_KEY: ${gpg_ascii_armored}
821836
script: |
822-
# DO NOT ECHO WITH XTRACE (which PREPARE_SHELL does)
823-
RELEASE=false PROJECT_DIRECTORY=${PROJECT_DIRECTORY} NEXUS_USERNAME=${nexus_username} NEXUS_PASSWORD=${nexus_password} SIGNING_PASSWORD=${signing_password} SIGNING_KEY="${gpg_ascii_armored}" .evergreen/publish.sh
837+
RELEASE=false PROJECT_DIRECTORY=${PROJECT_DIRECTORY} .evergreen/publish.sh
824838
825839
"publish release":
826840
- command: shell.exec
827841
type: test
828842
params:
829843
working_dir: "src"
844+
env:
845+
NEXUS_USERNAME: ${nexus_username}
846+
NEXUS_PASSWORD: ${nexus_password}
847+
SIGNING_PASSWORD: ${signing_password}
848+
SIGNING_KEY: ${gpg_ascii_armored}
830849
script: |
831-
# DO NOT ECHO WITH XTRACE (which PREPARE_SHELL does)
832-
RELEASE=true PROJECT_DIRECTORY=${PROJECT_DIRECTORY} NEXUS_USERNAME=${nexus_username} NEXUS_PASSWORD=${nexus_password} SIGNING_PASSWORD=${signing_password} SIGNING_KEY="${gpg_ascii_armored}" .evergreen/publish.sh
850+
RELEASE=true PROJECT_DIRECTORY=${PROJECT_DIRECTORY} .evergreen/publish.sh
833851
834852
"cleanup":
835853
- command: shell.exec

‎.evergreen/run-csfle-tests-with-mongocryptd.sh

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -49,19 +49,14 @@ provision_ssl () {
4949
provision_ssl
5050

5151
echo "Running tests with Java ${JAVA_VERSION}"
52+
5253
./gradlew -version
5354

54-
# By not specifying the path to the `crypt_shared` via the `org.mongodb.test.crypt.shared.lib.path` Java system property,
55+
# By not specifying the path to the `crypt_shared` via the `CRYPT_SHARED_LIB_PATH` Java system property,
5556
# we force the driver to start `mongocryptd` instead of loading and using `crypt_shared`.
5657
./gradlew -PjavaVersion=${JAVA_VERSION} -Dorg.mongodb.test.uri=${MONGODB_URI} \
57-
-Dorg.mongodb.test.fle.on.demand.credential.test.failure.enabled="true" \
58-
-Dorg.mongodb.test.fle.on.demand.credential.test.azure.keyVaultEndpoint="${AZUREKMS_KEY_VAULT_ENDPOINT}" \
59-
-Dorg.mongodb.test.fle.on.demand.credential.test.azure.keyName="${AZUREKMS_KEY_NAME}" \
60-
-Dorg.mongodb.test.awsAccessKeyId=${AWS_ACCESS_KEY_ID} -Dorg.mongodb.test.awsSecretAccessKey=${AWS_SECRET_ACCESS_KEY} \
61-
-Dorg.mongodb.test.tmpAwsAccessKeyId=${AWS_TEMP_ACCESS_KEY_ID} -Dorg.mongodb.test.tmpAwsSecretAccessKey=${AWS_TEMP_SECRET_ACCESS_KEY} -Dorg.mongodb.test.tmpAwsSessionToken=${AWS_TEMP_SESSION_TOKEN} \
62-
-Dorg.mongodb.test.azureTenantId=${AZURE_TENANT_ID} -Dorg.mongodb.test.azureClientId=${AZURE_CLIENT_ID} -Dorg.mongodb.test.azureClientSecret=${AZURE_CLIENT_SECRET} \
63-
-Dorg.mongodb.test.gcpEmail=${GCP_EMAIL} -Dorg.mongodb.test.gcpPrivateKey=${GCP_PRIVATE_KEY} \
6458
${GRADLE_EXTRA_VARS} \
59+
-Dorg.mongodb.test.fle.on.demand.credential.test.failure.enabled=true \
6560
--stacktrace --info --continue \
6661
driver-legacy:test \
6762
--tests "*.Client*Encryption*" \

‎.evergreen/run-fle-on-demand-credential-test.sh

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -20,20 +20,16 @@ if ! which java ; then
2020
sudo apt install openjdk-17-jdk -y
2121
fi
2222

23+
export PROVIDER=${PROVIDER}
24+
2325
./gradlew -Dorg.mongodb.test.uri="${MONGODB_URI}" \
24-
-Dorg.mongodb.test.fle.on.demand.credential.test.success.enabled="true" \
25-
-Dorg.mongodb.test.fle.on.demand.credential.test.azure.keyVaultEndpoint="${AZUREKMS_KEY_VAULT_ENDPOINT}" \
26-
-Dorg.mongodb.test.fle.on.demand.credential.test.azure.keyName="${AZUREKMS_KEY_NAME}" \
27-
-Dorg.mongodb.test.fle.on.demand.credential.provider="${PROVIDER}" \
26+
-Dorg.mongodb.test.fle.on.demand.credential.test.success.enabled=true \
2827
--stacktrace --debug --info driver-sync:test --tests ClientSideEncryptionOnDemandCredentialsTest
2928
first=$?
3029
echo $first
3130

3231
./gradlew -Dorg.mongodb.test.uri="${MONGODB_URI}" \
33-
-Dorg.mongodb.test.fle.on.demand.credential.test.success.enabled="true" \
34-
-Dorg.mongodb.test.fle.on.demand.credential.test.azure.keyVaultEndpoint="${AZUREKMS_KEY_VAULT_ENDPOINT}" \
35-
-Dorg.mongodb.test.fle.on.demand.credential.test.azure.keyName="${AZUREKMS_KEY_NAME}" \
36-
-Dorg.mongodb.test.fle.on.demand.credential.provider="${PROVIDER}" \
32+
-Dorg.mongodb.test.fle.on.demand.credential.test.success.enabled=true \
3733
--stacktrace --debug --info driver-reactive-streams:test --tests ClientSideEncryptionOnDemandCredentialsTest
3834
second=$?
3935
echo $second

‎.evergreen/run-tests.sh

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -141,15 +141,8 @@ if [ "$SLOW_TESTS_ONLY" == "true" ]; then
141141
--stacktrace --info testSlowOnly
142142
else
143143
./gradlew -PjavaVersion=${JAVA_VERSION} -Dorg.mongodb.test.uri=${MONGODB_URI} \
144-
-Dorg.mongodb.test.fle.on.demand.credential.test.failure.enabled="true" \
145-
-Dorg.mongodb.test.fle.on.demand.credential.test.azure.keyVaultEndpoint="${AZUREKMS_KEY_VAULT_ENDPOINT}" \
146-
-Dorg.mongodb.test.fle.on.demand.credential.test.azure.keyName="${AZUREKMS_KEY_NAME}" \
147-
-Dorg.mongodb.test.awsAccessKeyId=${AWS_ACCESS_KEY_ID} -Dorg.mongodb.test.awsSecretAccessKey=${AWS_SECRET_ACCESS_KEY} \
148-
-Dorg.mongodb.test.tmpAwsAccessKeyId=${AWS_TEMP_ACCESS_KEY_ID} -Dorg.mongodb.test.tmpAwsSecretAccessKey=${AWS_TEMP_SECRET_ACCESS_KEY} -Dorg.mongodb.test.tmpAwsSessionToken=${AWS_TEMP_SESSION_TOKEN} \
149-
-Dorg.mongodb.test.azureTenantId=${AZURE_TENANT_ID} -Dorg.mongodb.test.azureClientId=${AZURE_CLIENT_ID} -Dorg.mongodb.test.azureClientSecret=${AZURE_CLIENT_SECRET} \
150-
-Dorg.mongodb.test.gcpEmail=${GCP_EMAIL} -Dorg.mongodb.test.gcpPrivateKey=${GCP_PRIVATE_KEY} \
151144
${MULTI_MONGOS_URI_SYSTEM_PROPERTY} ${API_VERSION} ${GRADLE_EXTRA_VARS} ${ASYNC_TYPE} \
152-
-Dorg.mongodb.test.crypt.shared.lib.path=${CRYPT_SHARED_LIB_PATH} \
153145
${JAVA_SYSPROP_NETTY_SSL_PROVIDER} \
146+
-Dorg.mongodb.test.fle.on.demand.credential.test.failure.enabled=true \
154147
--stacktrace --info --continue test
155148
fi

‎driver-core/src/test/functional/com/mongodb/ClusterFixture.java

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -201,7 +201,7 @@ public static boolean hasEncryptionTestsEnabled() {
201201
List<String> requiredSystemProperties = asList("awsAccessKeyId", "awsSecretAccessKey", "azureTenantId", "azureClientId",
202202
"azureClientSecret", "gcpEmail", "gcpPrivateKey", "tmpAwsAccessKeyId", "tmpAwsSecretAccessKey", "tmpAwsSessionToken");
203203
return requiredSystemProperties.stream()
204-
.map(name -> System.getProperty("org.mongodb.test." + name, ""))
204+
.map(name -> getEnv("org.mongodb.test." + name, ""))
205205
.filter(s -> !s.isEmpty())
206206
.count() == requiredSystemProperties.size();
207207
}
@@ -228,6 +228,16 @@ public void run() {
228228
}
229229
}
230230

231+
public static String getEnv(final String name, final String defaultValue) {
232+
String value = getEnv(name);
233+
return value == null ? defaultValue : value;
234+
}
235+
236+
@Nullable
237+
public static String getEnv(final String name) {
238+
return System.getenv(name);
239+
}
240+
231241
public static boolean getOcspShouldSucceed() {
232242
return Integer.parseInt(System.getProperty(MONGODB_OCSP_SHOULD_SUCCEED)) == 1;
233243
}
@@ -541,7 +551,7 @@ public static boolean isAuthenticated() {
541551
}
542552

543553
public static boolean isClientSideEncryptionTest() {
544-
return !System.getProperty("org.mongodb.test.awsAccessKeyId", "").isEmpty();
554+
return !getEnv("AWS_ACCESS_KEY_ID", "").isEmpty();
545555
}
546556

547557
public static boolean isAtlasSearchTest() {

‎driver-reactive-streams/src/test/functional/com/mongodb/reactivestreams/client/ClientEncryptionDataKeyAndDoubleEncryptionTest.java

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@
4040
import java.util.HashMap;
4141
import java.util.Map;
4242

43+
import static com.mongodb.ClusterFixture.getEnv;
4344
import static com.mongodb.ClusterFixture.hasEncryptionTestsEnabled;
4445
import static com.mongodb.ClusterFixture.serverVersionAtLeast;
4546
import static com.mongodb.client.Fixture.getMongoClientSettingsBuilder;
@@ -81,17 +82,17 @@ public void setUp() {
8182
// Step 2: Create encrypted client and client encryption
8283
Map<String, Map<String, Object>> kmsProviders = new HashMap<String, Map<String, Object>>() {{
8384
put("aws", new HashMap<String, Object>() {{
84-
put("accessKeyId", System.getProperty("org.mongodb.test.awsAccessKeyId"));
85-
put("secretAccessKey", System.getProperty("org.mongodb.test.awsSecretAccessKey"));
85+
put("accessKeyId", getEnv("AWS_ACCESS_KEY_ID"));
86+
put("secretAccessKey", getEnv("AWS_SECRET_ACCESS_KEY"));
8687
}});
8788
put("azure", new HashMap<String, Object>() {{
88-
put("tenantId", System.getProperty("org.mongodb.test.azureTenantId"));
89-
put("clientId", System.getProperty("org.mongodb.test.azureClientId"));
90-
put("clientSecret", System.getProperty("org.mongodb.test.azureClientSecret"));
89+
put("tenantId", getEnv("AZURE_TENANT_ID"));
90+
put("clientId", getEnv("AZURE_CLIENT_ID"));
91+
put("clientSecret", getEnv("AZURE_CLIENT_SECRET"));
9192
}});
9293
put("gcp", new HashMap<String, Object>() {{
93-
put("email", System.getProperty("org.mongodb.test.gcpEmail"));
94-
put("privateKey", System.getProperty("org.mongodb.test.gcpPrivateKey"));
94+
put("email", getEnv("GCP_EMAIL"));
95+
put("privateKey", getEnv("GCP_PRIVATE_KEY"));
9596
}});
9697
put("local", new HashMap<String, Object>() {{
9798
put("key", "Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBM"

‎driver-reactive-streams/src/test/functional/com/mongodb/reactivestreams/client/ClientSideEncryptionBsonSizeLimitsSpecification.groovy

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ class ClientSideEncryptionBsonSizeLimitsSpecification extends FunctionalSpecific
5353
def setup() {
5454
assumeTrue(serverVersionAtLeast(4, 2))
5555
assumeTrue('Key vault tests disabled',
56-
!System.getProperty('org.mongodb.test.awsAccessKeyId', '').isEmpty())
56+
!System.getProperty('AWS_ACCESS_KEY_ID', '').isEmpty())
5757
drop(keyVaultNamespace)
5858
drop(autoEncryptingCollectionNamespace)
5959

‎driver-reactive-streams/src/test/functional/com/mongodb/reactivestreams/client/ClientSideEncryptionCorpusTest.java

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@
4848
import java.util.Map;
4949

5050
import static com.mongodb.ClusterFixture.TIMEOUT_DURATION;
51+
import static com.mongodb.ClusterFixture.getEnv;
5152
import static com.mongodb.ClusterFixture.hasEncryptionTestsEnabled;
5253
import static com.mongodb.ClusterFixture.serverVersionAtLeast;
5354
import static com.mongodb.reactivestreams.client.Fixture.getMongoClientBuilderFromConnectionString;
@@ -109,20 +110,20 @@ public void setUp() throws IOException, URISyntaxException {
109110
// Step 4: Configure our objects
110111
Map<String, Map<String, Object>> kmsProviders = new HashMap<String, Map<String, Object>>() {{
111112
put("aws", new HashMap<String, Object>() {{
112-
put("accessKeyId", System.getProperty("org.mongodb.test.awsAccessKeyId"));
113-
put("secretAccessKey", System.getProperty("org.mongodb.test.awsSecretAccessKey"));
113+
put("accessKeyId", getEnv("AWS_ACCESS_KEY_ID"));
114+
put("secretAccessKey", getEnv("AWS_SECRET_ACCESS_KEY"));
114115
}});
115116
put("azure", new HashMap<String, Object>() {{
116-
put("tenantId", System.getProperty("org.mongodb.test.azureTenantId"));
117-
put("clientId", System.getProperty("org.mongodb.test.azureClientId"));
118-
put("clientSecret", System.getProperty("org.mongodb.test.azureClientSecret"));
117+
put("tenantId", getEnv("AZURE_TENANT_ID"));
118+
put("clientId", getEnv("AZURE_CLIENT_ID"));
119+
put("clientSecret", getEnv("AZURE_CLIENT_SECRET"));
119120
}});
120121
put("gcp", new HashMap<String, Object>() {{
121-
put("email", System.getProperty("org.mongodb.test.gcpEmail"));
122-
put("privateKey", System.getProperty("org.mongodb.test.gcpPrivateKey"));
122+
put("email", getEnv("GCP_EMAIL"));
123+
put("privateKey", getEnv("GCP_PRIVATE_KEY"));
123124
}});
124125
put("kmip", new HashMap<String, Object>() {{
125-
put("endpoint", System.getProperty("org.mongodb.test.kmipEndpoint", "localhost:5698"));
126+
put("endpoint", getEnv("org.mongodb.test.kmipEndpoint", "localhost:5698"));
126127
}});
127128
put("local", new HashMap<String, Object>() {{
128129
put("key", "Mng0NCt4ZHVUYUJCa1kxNkVyNUR1QURhZ2h2UzR2d2RrZzh0cFBwM3R6NmdWMDFBM"

0 commit comments

Comments
 (0)