Package co.ankatech.ankasecure.sdk.security

Class EnvScrubber

java.lang.Object
co.ankatech.ankasecure.sdk.security.EnvScrubber
public final class EnvScrubber extends Object
Best-effort removal of an environment variable from the JVM's process environment map after the variable has been read. Useful when sensitive material such as a CLIENT_SECRET was passed via env var and the application wants to reduce its in-memory lifetime by removing it from ProcessEnvironment.theEnvironment (and, on Windows, also from theCaseInsensitiveEnvironment).

This requires reflective access to private static fields of java.lang.ProcessEnvironment. On stock JDK 17 without --add-opens=java.base/java.lang=ALL-UNNAMED, the reflective call is denied and tryUnset(String) returns false after logging a WARN. On JVMs configured with the --add-opens flag (or running under a security manager that grants the access), the variable is removed from the in-memory map.

Note: this is best-effort only. Environment variables previously read into other data structures (e.g., Properties, Map<String,String> returned by System.getenv(), or already-deserialized config objects) are NOT affected. Callers must propagate the unset to those structures separately.

  • Method Details

    • tryUnset

      public static boolean tryUnset(String name)
      Attempts to remove the named environment variable from the JVM's in-memory environment map(s).
      Parameters:
      name - the variable name (may be null; null is a no-op returning false)
      Returns:
      true if the reflective access succeeded (the entry may or may not have been present); false if reflective access was denied or threw any other exception. A false return is accompanied by a WARN log entry.