[Java] Add support of 'x-obfuscated' property allowing for generated model classes an obfuscation of sensitive data (e.g. password) in toString() output (#2662) #7060

SergeyLyakhov · 2017-11-26T16:13:55Z

PR checklist

[+] Read the contribution guidelines.
[+] Ran the shell script under ./bin/ to update Petstore sample so that CIs can verify the change. (For instance, only need to run ./bin/{LANG}-petstore.sh and ./bin/security/{LANG}-petstore.sh if updating the {LANG} (e.g. php, ruby, python, etc) code generator or {LANG} client's mustache templates). Windows batch files can be found in .\bin\windows\.
[+] Filed the PR against the correct branch: 3.0.0 branch for changes related to OpenAPI spec 3.0. Default: master.
[+ ] Copied the technical committee to review the pull request if your PR is targeting a particular programming language.
@bbdouglas @JFCote @sreeshas @jfiala @lukoyanov @cbornet

Description of the PR

This change adds support of "x-obfuscated" [true|false] vendor extension property.
E.g.:

  User:
    properties:
      password:
        type: string
        x-obfuscated: true

This will allow to exclude (obfuscate) sensitive data from toString() result for generated model class.

The following changes added:

For 13 java-based "language" templates:
1.1. changed pojo.mustache toString() to allow obfuscation of properties with "x-obfuscated: true" attribute;
1.2. added templates for model test generation: model_test.mustache pojo_test.mustache modelEnum_test.mustache. Where pojo_test.mustache contains testObfuscation_* junit method;
1.3. added util/ModelTestUtils.mustache utility class for model tests.
added "x-obfuscated: true" for User.password in 4 petstore test models (yaml/json).
In swagger-codegen module (java code):
3.1 enabled model tests (model_test.mustache) generation for java-based languages.
3.2. added support for static resources for model test generation (util/ModelTestUtils.java).
Added missed projects to /bin/java-petstore-all.sh (also separated into client and server scripts).
Fixed pom.mustache for few java-based language templates (projects were not built before the fix).
Added to /bin/utils/maven/ two helper scripts for executing maven builds for java-petstore-* projects.
Updated (generated) java-based samples (also includes changes for earlier commits, missed to be added before).

P.S. There are few sample projects which are not built because of errors in its templates (not related to this change):

Clients:

jersey2-java6
okhttp-gson-parcelableModel

Servers:

java-msf4j
java-vertx
jaxrs-spec
jaxrs-spec-interface

SergeyLyakhov · 2017-11-26T16:25:12Z

bin/java-petstore-all.sh

-./bin/java-petstore-resttemplate.sh
-./bin/java-petstore-resttemplate-withxml.sh
-./bin/java-petstore-resteasy.sh
-./bin/java-petstore-google-api-client.sh


Moved these scripts to java-petstore-client-all.sh (all of them are clients).
Also added there retrofit2-play25 and vertx clients.

SergeyLyakhov · 2017-11-26T16:27:31Z

bin/utils/maven/java-petstore-client-all-build.sh

@@ -0,0 +1,48 @@
+#!/bin/sh


Build clients generated by /bin/java-petstore-client-all.sh

SergeyLyakhov · 2017-11-26T16:29:59Z

bin/utils/maven/java-petstore-server-all-build.sh

@@ -0,0 +1,48 @@
+#!/bin/sh


Build projects generated by /bin/java-petstore-server-all.sh
Does not include sbt-based java-play-framework* projects.

SergeyLyakhov · 2017-11-26T16:31:28Z

modules/swagger-codegen/src/main/java/io/swagger/codegen/DefaultGenerator.java

@@ -578,44 +607,7 @@ private void generateSupportingFiles(List<File> files, Map<String, Object> bundl
                }

                if (ignoreProcessor.allowsFile(new File(outputFilename))) {
-                    if (templateFile.endsWith("mustache")) {


Moved into a separate method for reusing.

SergeyLyakhov · 2017-11-26T17:27:22Z

modules/swagger-codegen/src/main/java/io/swagger/codegen/DefaultGenerator.java

@@ -249,6 +251,28 @@ private void generateModelTests(List<File> files, Map<String, Object> models, St
        }
    }

+    /**


This method generates/copies "static" resources for model build. This is similar to "generateSupportingFiles", but "generateSupportingFiles" and "generateModelTests" are independent "phases".

SergeyLyakhov · 2017-11-26T19:40:23Z

Build with samples profile (-Psamples) fails on server/java-msf4j, and this is not related to the fix.
Is it necessary to fix all sample projects which are failed?

wing328 · 2017-11-30T08:20:25Z

Thanks for the PR but your commit (as shown in the Commits tab) is not linked to your Github account, which means this PR won't count as your contribution in https://github.com/swagger-api/swagger-codegen/graphs/contributors.

Let me know if you need help fixing it.

Ref: https://github.com/swagger-api/swagger-codegen/wiki/FAQ#how-can-i-update-commits-that-are-not-linked-to-my-github-account

… samples.

SergeyLyakhov · 2017-12-02T17:14:06Z

@wing328 Sorry for missing that. Fixed.

SergeyLyakhov · 2017-12-15T12:39:22Z

@wing328
Should I perform any additional actions for this request?
I'm not able to trigger the rebuild task. But think there are only issues with samples test builds for several languages (listed in my 1st comment), which are not caused by this fix.

wing328 · 2017-12-15T12:48:17Z

Build with samples profile (-Psamples) fails on server/java-msf4j, and this is not related to the fix.

I've fixed that in the latest master.

wing328 · 2017-12-15T16:39:16Z

@SergeyLyakhov can you merge the latest origin/master to see if the CI errors are fixed?

SergeyLyakhov · 2017-12-16T14:23:41Z

@wing328 Merged latest origin/master into feature/x-obfuscated-java

wing328 · 2017-12-16T14:28:57Z

@SergeyLyakhov thanks. Let's see if all the tests pass.

SergeyLyakhov · 2017-12-16T16:37:13Z

@wing328 >I've fixed that in the latest master.
It looks like the sample for server java-msf4j was not updated in master (see my last commit).

SergeyLyakhov · 2017-12-16T17:05:33Z

@wing328 Also other projects with errors (listed in the description section of PR) are still not built.
See the build results for java samples https://ibb.co/hWpFEm

Clients:

jersey2-java6: uses jersey-version==2.6 where LoggingFeature.class doesn't exist.
okhttp-gson-parcelableModel: bug in template (for type: array).

Servers:

java-vertx: requires *Impl model classes.
jaxrs-spec:
2.1. missed jackson dependencies in pom.xml;
2.2. incorrect sourceDirectory in pom.xml;
2.3. errors in templates (missed imports).

carolmorneau · 2018-02-16T11:20:44Z

This is an interesting PR. Is it still being worked on?

SergeyLyakhov · 2018-02-16T13:08:28Z

@carolmorneau

This is an interesting PR. Is it still being worked on?

This fix is completed, tested and covered by unit tests.
However there are some issues in several java configurations (not related to this fix). Those issues prevent this PR to pass build checks successfully.

SergeyLyakhov · 2018-03-21T02:39:20Z

@wing328

For #7060, I'll ping you via email to discuss the best way

Thank you!
I may split this PR into 2-4 more simple changes, if needed.

Add support for static resources for model test (in my case shared utility test class) - java code.
Template changes with x-obfuscated vendor extension - mustache.
2.1. Model tests of obfuscation in toString() - mustache + java.
Samples re-generated with new templates.
Exclude changes in bash scripts if needed (suppose this change was useful/correct however).

wing328 · 2018-03-21T18:09:52Z

@SergeyLyakhov I would appreciate if you can do (1) and (2) in a single PR based on the latest master.

I'll do (3) and (4) later after merging the PR.

smiklosovic · 2018-04-28T16:43:34Z

@SergeyLyakhov please can you continue on this? I would love to see this in action.

SergeyLyakhov · 2018-05-09T12:50:01Z

@smiklosovic
I'm waiting on another #7910 PR approval. Will upate this pull request as soon as #7910 is approved.

gumuszee · 2019-08-13T14:58:56Z

Hello, is this feature by any chance still alive? Is there any possibility of a merge, or was it abandoned altogether? Thank you.

rchalaszczyk · 2020-02-10T12:43:29Z

Any chance for it?

Thiruj · 2020-03-25T18:38:13Z

is there any work around to hide the sensitive field information ?

samuelrcitx · 2021-12-02T11:09:15Z

hey, is there any solution to this problem already?

ashastr · 2023-03-28T16:02:46Z

Team, can we please get this PR merged? This would address a major security concern.

SergeyLyakhov mentioned this pull request Nov 26, 2017

password in toString in generated model #2662

Open

SergeyLyakhov commented Nov 26, 2017

View reviewed changes

wing328 added Enhancement: General Server: Java labels Nov 30, 2017

wing328 added this to the v2.3.0 milestone Nov 30, 2017

SergeyLyakhov closed this Dec 2, 2017

SergeyLyakhov force-pushed the feature/x-obfuscated-java branch from d65be9e to 8cc8c1e Compare December 2, 2017 14:55

SergeyLyakhov added 2 commits December 2, 2017 18:43

[Java] Add support for x-obfuscated vendor extension property.

e69e0fa

[Java] Add support for x-obfuscated vendor extension property. Update…

1f97393

… samples.

SergeyLyakhov reopened this Dec 2, 2017

Merge branch 'master' into feature/x-obfuscated-java

758d14c

Merge branch 'master' into feature/x-obfuscated-java.

f7f0d8c

Regenerate samples for server java-msf4j.

64ca726

wing328 modified the milestones: v2.3.0, v2.4.0 Dec 23, 2017

SergeyLyakhov mentioned this pull request Jan 9, 2018

[Java][jersey2] Fix logging for jersey2 (Java6) #7348

Merged

SergeyLyakhov mentioned this pull request Mar 18, 2018

[JAVA] 4709: codegen with parcelableMode fails to build if using arra… #7867

Merged

frantuma added the Language: java label Jun 27, 2018

pnewhook mentioned this pull request Nov 30, 2018

Add x-root-ancestor vendor extension boolean property to use inheritance w/o discriminator (see #6127). #7910

Open

rybchinsky mentioned this pull request Mar 28, 2022

[Java] Added x-obfuscated for toString() support fomin/oas-gen#47

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Java] Add support of 'x-obfuscated' property allowing for generated model classes an obfuscation of sensitive data (e.g. password) in toString() output (#2662) #7060

[Java] Add support of 'x-obfuscated' property allowing for generated model classes an obfuscation of sensitive data (e.g. password) in toString() output (#2662) #7060

SergeyLyakhov commented Nov 26, 2017 •

edited

Loading

SergeyLyakhov Nov 26, 2017

SergeyLyakhov Nov 26, 2017

SergeyLyakhov Nov 26, 2017 •

edited

Loading

SergeyLyakhov Nov 26, 2017

SergeyLyakhov Nov 26, 2017

SergeyLyakhov commented Nov 26, 2017

wing328 commented Nov 30, 2017

SergeyLyakhov commented Dec 2, 2017

SergeyLyakhov commented Dec 15, 2017

wing328 commented Dec 15, 2017

wing328 commented Dec 15, 2017

SergeyLyakhov commented Dec 16, 2017

wing328 commented Dec 16, 2017

SergeyLyakhov commented Dec 16, 2017 •

edited

Loading

SergeyLyakhov commented Dec 16, 2017 •

edited

Loading

carolmorneau commented Feb 16, 2018

SergeyLyakhov commented Feb 16, 2018 •

edited

Loading

SergeyLyakhov commented Mar 21, 2018 •

edited

Loading

wing328 commented Mar 21, 2018

smiklosovic commented Apr 28, 2018

SergeyLyakhov commented May 9, 2018 •

edited

Loading

gumuszee commented Aug 13, 2019

rchalaszczyk commented Feb 10, 2020

Thiruj commented Mar 25, 2020

samuelrcitx commented Dec 2, 2021

ashastr commented Mar 28, 2023

                       }
                   }
+                  /**

[Java] Add support of 'x-obfuscated' property allowing for generated model classes an obfuscation of sensitive data (e.g. password) in toString() output (#2662) #7060

Are you sure you want to change the base?

[Java] Add support of 'x-obfuscated' property allowing for generated model classes an obfuscation of sensitive data (e.g. password) in toString() output (#2662) #7060

Conversation

SergeyLyakhov commented Nov 26, 2017 • edited Loading

PR checklist

Description of the PR

SergeyLyakhov Nov 26, 2017

Choose a reason for hiding this comment

SergeyLyakhov Nov 26, 2017

Choose a reason for hiding this comment

SergeyLyakhov Nov 26, 2017 • edited Loading

Choose a reason for hiding this comment

SergeyLyakhov Nov 26, 2017

Choose a reason for hiding this comment

SergeyLyakhov Nov 26, 2017

Choose a reason for hiding this comment

SergeyLyakhov commented Nov 26, 2017

wing328 commented Nov 30, 2017

SergeyLyakhov commented Dec 2, 2017

SergeyLyakhov commented Dec 15, 2017

wing328 commented Dec 15, 2017

wing328 commented Dec 15, 2017

SergeyLyakhov commented Dec 16, 2017

wing328 commented Dec 16, 2017

SergeyLyakhov commented Dec 16, 2017 • edited Loading

SergeyLyakhov commented Dec 16, 2017 • edited Loading

carolmorneau commented Feb 16, 2018

SergeyLyakhov commented Feb 16, 2018 • edited Loading

SergeyLyakhov commented Mar 21, 2018 • edited Loading

wing328 commented Mar 21, 2018

smiklosovic commented Apr 28, 2018

SergeyLyakhov commented May 9, 2018 • edited Loading

gumuszee commented Aug 13, 2019

rchalaszczyk commented Feb 10, 2020

Thiruj commented Mar 25, 2020

samuelrcitx commented Dec 2, 2021

ashastr commented Mar 28, 2023

SergeyLyakhov commented Nov 26, 2017 •

edited

Loading

SergeyLyakhov Nov 26, 2017 •

edited

Loading

SergeyLyakhov commented Dec 16, 2017 •

edited

Loading

SergeyLyakhov commented Dec 16, 2017 •

edited

Loading

SergeyLyakhov commented Feb 16, 2018 •

edited

Loading

SergeyLyakhov commented Mar 21, 2018 •

edited

Loading

SergeyLyakhov commented May 9, 2018 •

edited

Loading