Merge branch '2.4.x' into 2.5.x

Closes gh-28081
spring-projects · Sep 21, 2021 · a862ebc · a862ebc
2 parents 40d65a7 + bbb4ac1
commit a862ebc
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/...ring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java b/...ring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/Sanitizer.java
@@ -44,8 +44,9 @@ public class Sanitizer {
 
 	private static final String[] REGEX_PARTS = { "*", "$", "^", "+" };
 
-	private static final Set<String> DEFAULT_KEYS_TO_SANITIZE = new LinkedHashSet<>(Arrays.asList("password", "secret",
-			"key", "token", ".*credentials.*", "vcap_services", "sun.java.command"));
+	private static final Set<String> DEFAULT_KEYS_TO_SANITIZE = new LinkedHashSet<>(
+			Arrays.asList("password", "secret", "key", "token", ".*credentials.*", "vcap_services", "sun.java.command",
+					"^spring[\\._]application[\\\\._]json$"));
 
 	private static final Set<String> URI_USERINFO_KEYS = new LinkedHashSet<>(
 			Arrays.asList("uri", "uris", "url", "urls", "address", "addresses"));

diff --git a/...boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java b/...boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/SanitizerTests.java
@@ -46,6 +46,8 @@ void defaultNonUriKeys() {
 		assertThat(sanitizer.sanitize("sometoken", "secret")).isEqualTo("******");
 		assertThat(sanitizer.sanitize("find", "secret")).isEqualTo("secret");
 		assertThat(sanitizer.sanitize("sun.java.command", "--spring.redis.password=pa55w0rd")).isEqualTo("******");
+		assertThat(sanitizer.sanitize("SPRING_APPLICATION_JSON", "{password:123}")).isEqualTo("******");
+		assertThat(sanitizer.sanitize("spring.application.json", "{password:123}")).isEqualTo("******");
 	}
 
 	@Test