From 43e900d4a5c8266721c87ada1e5ea71a7062cd12 Mon Sep 17 00:00:00 2001 From: Will Ezell Date: Thu, 6 Aug 2026 12:55:48 -0400 Subject: [PATCH] fix(security): obfuscate system config overrides in JVM info endpoint (#36919) getDBOverrides() copied SystemTable.all() into the /api/v1/jvm response unmasked, while the system-properties and environment sections already run values through obfuscateIfNeeded(). Apply the same pattern-based masking (passw|pass|passwd|secret|key|token + OBFUSCATE_SYSTEM_ENVIRONMENTAL_VARIABLES) to config overrides shown in the maintenance portlet. Co-Authored-By: Claude Fable 5 --- .../com/dotcms/rest/api/v1/maintenance/JVMInfoResource.java | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/dotCMS/src/main/java/com/dotcms/rest/api/v1/maintenance/JVMInfoResource.java b/dotCMS/src/main/java/com/dotcms/rest/api/v1/maintenance/JVMInfoResource.java index 1eb101fa1e66..95f6ab786f60 100644 --- a/dotCMS/src/main/java/com/dotcms/rest/api/v1/maintenance/JVMInfoResource.java +++ b/dotCMS/src/main/java/com/dotcms/rest/api/v1/maintenance/JVMInfoResource.java @@ -116,10 +116,8 @@ private Map getDBOverrides(){ SystemTable systemTable =APILocator.getSystemAPI().getSystemTable(); - resultMap.putAll(systemTable.all()); - - - + systemTable.all().forEach((key, value) -> + resultMap.put(key, obfuscateIfNeeded(key, value))); return resultMap; }