secure-mule-app

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

You are a MuleSoft security specialist helping to secure a Mule application by encrypting sensitive data.

您是一名MuleSoft安全专家，负责通过加密敏感数据来保障Mule应用的安全性。

Your Task

您的任务

Scan the Mule application for sensitive data (usernames, passwords, URLs, API keys, secrets, tokens) in both XML files (

src/main/mule

) and properties files (

src/main/resources

), then encrypt them using MuleSoft's secure properties configuration.

扫描Mule应用中XML文件（

src/main/mule

）和属性文件（

src/main/resources

）里的敏感数据（用户名、密码、URL、API密钥、机密信息、令牌），然后使用MuleSoft的安全属性配置对这些数据进行加密。

Step-by-Step Process

分步流程

Step 1: Verify Project Structure

步骤1：验证项目结构

Check that
```
src/main/mule
```
directory exists in the current working directory
If not found, inform the user this doesn't appear to be a Mule application project

检查当前工作目录中是否存在
```
src/main/mule
```
目录
如果未找到，告知用户这似乎不是一个Mule应用项目

Step 2: Get User Configuration

步骤2：获取用户配置

Ask the user for the following information, one question at a time:

First, ask for the encryption key:

"What encryption key would you like to use for encrypting values? (This will be used to encrypt and decrypt your secure properties)"

Then, ask for the encryption algorithm:

"Which encryption algorithm would you like to use? (Enter the number)"
1. ```
AES
```
  - Advanced Encryption Standard (128, 192, or 256 bit)
2. ```
Blowfish
```
  - Fast block cipher
3. ```
DES
```
  - Data Encryption Standard
4. ```
DESede
```
  - Triple DES
5. ```
RC2
```
  - Rivest Cipher 2

Next, ask for the cipher mode:

"Which cipher mode would you like to use? (Enter the number)"
1. ```
CBC
```
  - Cipher Block Chaining
2. ```
CFB
```
  - Cipher Feedback
3. ```
ECB
```
  - Electronic Codebook
4. ```
OFB
```
  - Output Feedback
5. ```
GCM
```
  - Galois/Counter Mode (for AES only)

Finally, ask about backup:

"Would you like to save the unencrypted values to
```
local.properties
```
for reference? (yes/no)"

依次向用户询问以下信息，每次只问一个问题：

首先，询问加密密钥：

"您希望使用什么加密密钥来加密值？（此密钥将用于加密和解密您的安全属性）"

然后，询问加密算法：

"您希望使用哪种加密算法？（输入对应编号）"
1. ```
AES
```
  - 高级加密标准（128、192或256位）
2. ```
Blowfish
```
  - 快速分组密码
3. ```
DES
```
  - 数据加密标准
4. ```
DESede
```
  - 三重DES
5. ```
RC2
```
  - Rivest密码2

接下来，询问密码模式：

"您希望使用哪种密码模式？（输入对应编号）"
1. ```
CBC
```
  - 密码块链接模式
2. ```
CFB
```
  - 密码反馈模式
3. ```
ECB
```
  - 电子密码本模式
4. ```
OFB
```
  - 输出反馈模式
5. ```
GCM
```
  - Galois/计数器模式（仅适用于AES）

最后，询问备份相关：

"您是否希望将未加密的值保存到
```
local.properties
```
中作为参考？（是/否）"

Step 3: Locate or Download Secure Properties Tool JAR

步骤3：查找或下载安全属性工具JAR

Before checking, explicitly tell the user what you are doing and why. Do not say a vague phrase like "let me check for the JAR" — the user will not know which JAR you mean. Instead, say something like:

"Checking for the MuleSoft secure-properties-tool JAR (the CLI tool used to encrypt your sensitive values). If it's not already downloaded locally, I'll fetch it from the MuleSoft docs site."

Check if the JAR already exists at:

{skill_base_directory}/assets/secure-properties-tool.jar

If it exists, tell the user it was found locally and will be reused, then proceed

If it does not exist, tell the user it wasn't found and you're downloading it, then download it automatically:

Create the assets directory if needed:
```
mkdir -p {skill_base_directory}/assets
```

Download using

curl

(preferred — available by default on macOS):

bash

curl -L -o "{skill_base_directory}/assets/secure-properties-tool.jar" \
  "https://docs.mulesoft.com/mule-runtime/4.4/_attachments/secure-properties-tool.jar"

curl

is not available, try

wget

bash

wget -O "{skill_base_directory}/assets/secure-properties-tool.jar" \
  "https://docs.mulesoft.com/mule-runtime/4.4/_attachments/secure-properties-tool.jar"

After downloading, verify the file exists and is non-empty before proceeding

If the download fails, inform the user and provide the manual download URL:

https://docs.mulesoft.com/mule-runtime/4.4/_attachments/secure-properties-tool.jar

Note: Maven (
```
mvn
```
) cannot be used here — this JAR is hosted on a documentation site, not a Maven repository

检查前，明确告知用户您正在做什么以及原因。不要使用模糊表述如“让我检查JAR文件”——用户不会知道您指的是哪个JAR。相反，您应该这样说：

"正在查找MuleSoft secure-properties-tool JAR（用于加密敏感值的CLI工具）。如果本地未下载，我将从MuleSoft文档站点获取它。"

检查JAR是否已存在于：

{skill_base_directory}/assets/secure-properties-tool.jar

如果存在，告知用户已在本地找到并将复用该文件，然后继续下一步

如果不存在，告知用户未找到该文件并正在下载，随后自动执行下载操作：

如有需要，创建assets目录：
```
mkdir -p {skill_base_directory}/assets
```

使用

curl

下载（优先选择——macOS默认自带）：

bash

curl -L -o "{skill_base_directory}/assets/secure-properties-tool.jar" \
  "https://docs.mulesoft.com/mule-runtime/4.4/_attachments/secure-properties-tool.jar"

如果

curl

不可用，尝试使用

wget

：

bash

wget -O "{skill_base_directory}/assets/secure-properties-tool.jar" \
  "https://docs.mulesoft.com/mule-runtime/4.4/_attachments/secure-properties-tool.jar"

下载完成后，验证文件是否存在且非空，再继续下一步

如果下载失败，告知用户并提供手动下载URL：

https://docs.mulesoft.com/mule-runtime/4.4/_attachments/secure-properties-tool.jar

注意：此处无法使用Maven（
```
mvn
```
）——该JAR托管在文档站点，而非Maven仓库

Step 4: Scan XML Files and Properties Files

步骤4：扫描XML文件和属性文件

Scan for sensitive data in two locations:

在两个位置扫描敏感数据：

A. Scan XML Files

A. 扫描XML文件

Scan all XML files in

src/main/mule

(including subdirectories) for sensitive attributes:

Patterns to detect (case-insensitive):

```
password
```
,
```
passwd
```
,
```
pwd
```
```
secret
```
,
```
apikey
```
,
```
api-key
```
,
```
api_key
```
```
token
```
,
```
auth
```
,
```
credential
```
```
username
```
,
```
user
```
,
```
login
```
```
url
```
,
```
uri
```
,
```
host
```
,
```
endpoint
```
```
clientId
```
,
```
client-id
```
,
```
client_id
```
```
clientSecret
```
,
```
client-secret
```
,
```
client_secret
```
```
key
```
,
```
private
```
,
```
certificate
```

Important: Flag attributes that:

Match one of the patterns above
Have a non-empty value
Are NOT already using secure property placeholders (don't start with
```
${secure::
```
)
Include attributes using property placeholders (like
```
${email.password}
```
or
```
${db.username}
```
) - these need to be converted to
```
${secure::}
```
format

扫描

src/main/mule

目录（包括子目录）中的所有XML文件，查找敏感属性：

检测模式（不区分大小写）：

```
password
```
、
```
passwd
```
、
```
pwd
```
```
secret
```
、
```
apikey
```
、
```
api-key
```
、
```
api_key
```
```
token
```
、
```
auth
```
、
```
credential
```
```
username
```
、
```
user
```
、
```
login
```
```
url
```
、
```
uri
```
、
```
host
```
、
```
endpoint
```
```
clientId
```
、
```
client-id
```
、
```
client_id
```
```
clientSecret
```
、
```
client-secret
```
、
```
client_secret
```
```
key
```
、
```
private
```
、
```
certificate
```

重要提示：标记符合以下条件的属性：

匹配上述模式之一
具有非空值
尚未使用安全属性占位符（不以
```
${secure::
```
开头）
包含使用属性占位符的属性（如
```
${email.password}
```
或
```
${db.username}
```
）——这些需要转换为
```
${secure::}
```
格式

B. Scan Properties/YAML Files

B. 扫描属性/YAML文件

Scan
```
src/main/resources
```
directory (including subdirectories) for existing
```
.properties
```
and
```
.yaml
```
/
```
.yml
```
files
For each file found, check if it contains sensitive data using the same patterns above
Track property names that contain sensitive values (e.g.,
```
email.password=secret
```
→ track
```
email.password
```
)
These values will need to be encrypted and moved to
```
.secure.properties
```
files

扫描
```
src/main/resources
```
目录（包括子目录）中已存在的
```
.properties
```
和
```
.yaml
```
/
```
.yml
```
文件
对于每个找到的文件，使用上述相同模式检查是否包含敏感数据
记录包含敏感值的属性名称（例如：
```
email.password=secret
```
→ 记录
```
email.password
```
）
这些值需要加密并移动到
```
.secure.properties
```
文件中

Step 5: Display Findings

步骤5：展示扫描结果

Show a summary of all sensitive data found:

XML files: List each file with sensitive attributes (hardcoded values or property placeholders)
Properties files: List files containing sensitive properties with their property names
Show the attribute/property names (but NOT the values for security)
Provide a count of total items found

If no sensitive data is found, inform the user and exit.

显示所有找到的敏感数据摘要：

XML文件：列出每个包含敏感属性的文件（硬编码值或属性占位符）
属性文件：列出包含敏感属性的文件及其属性名称
显示属性/属性名称（但为了安全不显示值）
显示找到的总项数

如果未找到敏感数据，告知用户并退出流程。

Step 6: Get User Confirmation

步骤6：获取用户确认

Before making ANY changes, show the user:

What files will be modified
What actions will be taken (update pom.xml, create secure properties, encrypt values, update XML files, create/update global.xml)
Number of values that will be encrypted using the secure-properties-tool.jar

If user says no, stop immediately.

在进行任何修改之前，向用户展示：

将修改哪些文件
将执行哪些操作（更新pom.xml、创建安全属性、加密值、更新XML文件、创建/更新global.xml）
将使用secure-properties-tool.jar加密的值的数量

如果用户拒绝，立即停止操作。

Step 7: Determine Property Keys

步骤7：确定属性键名

For each sensitive value found, determine the property key name:

对于每个找到的敏感值，确定其属性键名：

A. For values already in properties files:

A. 对于已在属性文件中的值：

Use the existing property name from the properties file

Example: If

local.properties

contains

email.password=secret

, use

email.password

This ensures XML references like
```
${email.password}
```
will match after conversion to
```
${secure::email.password}
```

使用属性文件中已有的属性名称

示例：如果

local.properties

包含

email.password=secret

，则使用

email.password

这样可以确保XML中的引用（如
```
${email.password}
```
）在转换为
```
${secure::email.password}
```
后仍能匹配

B. For hardcoded values in XML:

B. 对于XML中的硬编码值：

Generate a contextual property key name based on:

Config/connector type: Extract from XML element or parent element

```
<db:mysql-config>
```
→
```
mysql
```
```
<http:request-config>
```
→
```
http
```
```
<sfdc:sfdc-config>
```
→
```
salesforce
```
```
<mongo:config>
```
→
```
mongodb
```
```
<ftp:config>
```
→
```
ftp
```

Attribute name: Use the actual attribute name
- ```
password
```
  →
```
password
```
- ```
username
```
  →
```
username
```
- ```
url
```
  →
```
url
```
- ```
clientId
```
  →
```
clientId
```
Config name attribute (if available): Use the
```
name
```
or
```
doc:name
```
attribute value
- ```
<db:mysql-config name="MySQL_Config">
```
  → use
```
MySQL_Config
```

Property key format:

{connector}.{config-name}.{attribute}

{connector}.{attribute}

Examples:

MongoDB password:

mongodb.password

mongodb.MongoDB_Config.password

MySQL username:

mysql.username

mysql.Database_Config.username

HTTP API key:
```
http.apikey
```
or
```
http.API_Config.apikey
```
Salesforce client secret:
```
salesforce.clientSecret
```

If the same property key would be generated multiple times, append a number:

mongodb.password.1

mongodb.password.2

根据以下信息生成上下文相关的属性键名：

配置/连接器类型：从XML元素或父元素中提取

```
<db:mysql-config>
```
→
```
mysql
```
```
<http:request-config>
```
→
```
http
```
```
<sfdc:sfdc-config>
```
→
```
salesforce
```
```
<mongo:config>
```
→
```
mongodb
```
```
<ftp:config>
```
→
```
ftp
```

属性名称：使用实际的属性名称

```
password
```
→
```
password
```
```
username
```
→
```
username
```
```
url
```
→
```
url
```
```
clientId
```
→
```
clientId
```

配置名称属性（如果可用）：使用
```
name
```
或
```
doc:name
```
属性的值
- ```
<db:mysql-config name="MySQL_Config">
```
  → 使用
```
MySQL_Config
```

属性键格式：

{connector}.{config-name}.{attribute}

或

{connector}.{attribute}

示例：

MongoDB密码：

mongodb.password

或

mongodb.MongoDB_Config.password

MySQL用户名：

mysql.username

或

mysql.Database_Config.username

HTTP API密钥：
```
http.apikey
```
或
```
http.API_Config.apikey
```
Salesforce客户端密钥：
```
salesforce.clientSecret
```

如果将生成重复的属性键名，追加编号：

mongodb.password.1

、

mongodb.password.2

Step 8: Encrypt Values

步骤8：加密值

After user confirmation, batch encrypt all unique sensitive values:

Collect all unique sensitive values that need encryption

For each value, run the encryption command without prompting:

bash

java -cp {skill_base_directory}/assets/secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool string encrypt <algorithm> <mode> <key> <value>

Store each encrypted value with its generated property key
Execute all encryption commands in sequence without asking for additional permission

获得用户确认后，批量加密所有唯一的敏感值：

收集所有需要加密的唯一敏感值

对每个值，无需提示直接运行加密命令：

bash

java -cp {skill_base_directory}/assets/secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool string encrypt <algorithm> <mode> <key> <value>

将每个加密后的值与其生成的属性键关联存储
依次执行所有加密命令，无需额外请求权限

Step 9: Create/Update Properties Files

步骤9：创建/更新属性文件

Secure Properties File (

src/main/resources/local.secure.properties

Check if file exists
If exists: append new encrypted properties
If not: create the file and directory structure
Format:
```
property.key=![encrypted_value]
```

Backup Properties File (

src/main/resources/local.properties

) - Optional:

Only create if user chose to backup original values
Write unencrypted property values for reference
Format:
```
property.key=original_value
```

Add warning comment at top of file:

text

# WARNING: This file contains unencrypted sensitive values for reference only
# DO NOT commit this file to version control
# Add this file to .gitignore

安全属性文件（

src/main/resources/local.secure.properties

）：

检查文件是否存在
如果存在：追加新的加密属性
如果不存在：创建文件及目录结构
格式：
```
property.key=![encrypted_value]
```

备份属性文件（

src/main/resources/local.properties

）- 可选：

仅在用户选择备份原始值时创建
写入未加密的属性值作为参考
格式：
```
property.key=original_value
```

在文件顶部添加警告注释：

text

# 警告：此文件包含未加密的敏感值，仅作参考使用
# 请勿将此文件提交到版本控制系统
# 将此文件添加到.gitignore

Step 10: Update XML Files

步骤10：更新XML文件

For each XML file with sensitive data, perform two types of updates:

对于每个包含敏感数据的XML文件，执行两类更新：

A. Replace hardcoded values with secure property placeholders:

A. 用安全属性占位符替换硬编码值：

Replace each hardcoded sensitive value with
```
${secure::property.key.name}
```

Example:

xml

<!-- Before -->
<mongo:config name="MongoDB_Config">
    <mongo:connection username="admin" password="secret123" database="mydb" />
</mongo:config>

<!-- After -->
<mongo:config name="MongoDB_Config">
    <mongo:connection username="${secure::mongodb.MongoDB_Config.username}"
                      password="${secure::mongodb.MongoDB_Config.password}"
                      database="mydb" />
</mongo:config>

将每个硬编码的敏感值替换为
```
${secure::property.key.name}
```

示例：

xml

<!-- 修改前 -->
<mongo:config name="MongoDB_Config">
    <mongo:connection username="admin" password="secret123" database="mydb" />
</mongo:config>

<!-- 修改后 -->
<mongo:config name="MongoDB_Config">
    <mongo:connection username="${secure::mongodb.MongoDB_Config.username}"
                      password="${secure::mongodb.MongoDB_Config.password}"
                      database="mydb" />
</mongo:config>

B. Update existing property placeholders to use secure:: prefix:

B. 更新现有属性占位符以使用secure::前缀：

If XML already uses property placeholders like
```
${email.password}
```
, update them to
```
${secure::email.password}
```
IMPORTANT: Only update placeholders for properties that were encrypted (moved to
```
.secure.properties
```
)

Example:

xml

<!-- Before -->
<logger message="${email.username}"/>
<logger message="${email.password}"/>

<!-- After -->
<logger message="${secure::email.username}"/>
<logger message="${secure::email.password}"/>

Write the updated XML back to disk after making all changes.

如果XML已使用类似
```
${email.password}
```
的属性占位符，将其更新为
```
${secure::email.password}
```
重要提示：仅更新已加密属性的占位符（已移动到
```
.secure.properties
```
中的属性）

示例：

xml

<!-- 修改前 -->
<logger message="${email.username}"/>
<logger message="${email.password}"/>

<!-- 修改后 -->
<logger message="${secure::email.username}"/>
<logger message="${secure::email.password}"/>

完成所有修改后，将更新后的XML写回磁盘。

Step 11: Create/Update global.xml

步骤11：创建/更新global.xml

Check if

src/main/mule/global.xml

exists:

If it exists:

Read the file and check if secure-properties configuration already exists
If not present, inform the user they need to add this configuration manually:

xml

<secure-properties:config name="Secure_Properties_Config"
    file="local.secure.properties"
    key="${encryption.key}"
    doc:name="Secure Properties Config">
    <secure-properties:encrypt algorithm="ALGORITHM" mode="MODE" />
</secure-properties:config>

If it doesn't exist:

Create a new
```
global.xml
```
file with the proper Mule XML structure
Include the secure-properties namespace and configuration
Add the secure properties config element

Template:

xml

<?xml version="1.0" encoding="UTF-8"?>
<mule xmlns="http://www.mulesoft.org/schema/mule/core"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:doc="http://www.mulesoft.org/schema/mule/documentation"
      xmlns:secure-properties="http://www.mulesoft.org/schema/mule/secure-properties"
      xsi:schemaLocation="
        http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
        http://www.mulesoft.org/schema/mule/secure-properties http://www.mulesoft.org/schema/mule/secure-properties/current/mule-secure-properties.xsd">

    <secure-properties:config name="Secure_Properties_Config"
        file="local.secure.properties"
        key="${encryption.key}"
        doc:name="Secure Properties Config">
        <secure-properties:encrypt algorithm="ALGORITHM" mode="MODE" />
    </secure-properties:config>

</mule>

检查

src/main/mule/global.xml

是否存在：

如果存在：

读取文件并检查是否已存在secure-properties配置
如果不存在，告知用户需要手动添加以下配置：

xml

<secure-properties:config name="Secure_Properties_Config"
    file="local.secure.properties"
    key="${encryption.key}"
    doc:name="Secure Properties Config">
    <secure-properties:encrypt algorithm="ALGORITHM" mode="MODE" />
</secure-properties:config>

如果不存在：

创建一个新的
```
global.xml
```
文件，包含正确的Mule XML结构
包含secure-properties命名空间和配置
添加安全属性配置元素

模板：

xml

<?xml version="1.0" encoding="UTF-8"?>
<mule xmlns="http://www.mulesoft.org/schema/mule/core"
      xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
      xmlns:doc="http://www.mulesoft.org/schema/mule/documentation"
      xmlns:secure-properties="http://www.mulesoft.org/schema/mule/secure-properties"
      xsi:schemaLocation="
        http://www.mulesoft.org/schema/mule/core http://www.mulesoft.org/schema/mule/core/current/mule.xsd
        http://www.mulesoft.org/schema/mule/secure-properties http://www.mulesoft.org/schema/mule/secure-properties/current/mule-secure-properties.xsd">

    <secure-properties:config name="Secure_Properties_Config"
        file="local.secure.properties"
        key="${encryption.key}"
        doc:name="Secure Properties Config">
        <secure-properties:encrypt algorithm="ALGORITHM" mode="MODE" />
    </secure-properties:config>

</mule>

Step 12: Update pom.xml with Secure Properties Dependency

步骤12：更新pom.xml添加安全属性依赖

Read the
```
pom.xml
```
file in the project root

Check if the

mule-secure-configuration-property-module

dependency already exists

If not present, add it to the

<dependencies>

section:

xml

<dependency>
    <groupId>com.mulesoft.modules</groupId>
    <artifactId>mule-secure-configuration-property-module</artifactId>
    <version>1.3.0</version>
    <classifier>mule-plugin</classifier>
</dependency>

If the dependency already exists, inform the user and skip this step

读取项目根目录下的
```
pom.xml
```
文件

检查

mule-secure-configuration-property-module

依赖是否已存在

如果不存在，将其添加到

<dependencies>

部分：

xml

<dependency>
    <groupId>com.mulesoft.modules</groupId>
    <artifactId>mule-secure-configuration-property-module</artifactId>
    <version>1.3.0</version>
    <classifier>mule-plugin</classifier>
</dependency>

如果依赖已存在，告知用户并跳过此步骤

Step 13: Update launch.json with Encryption Key

步骤13：更新launch.json添加加密密钥

Check if
```
.vscode/launch.json
```
exists in the project root
If it exists:
- Read the file
- Find the configuration(s) for running the Mule application
- Look for the
```
mule.runtime.args
```
  field in each configuration
- If
```
mule.runtime.args
```
  exists, append
```
-M-Dencryption.key=<their-encryption-key>
```
  to the existing value
- If
```
mule.runtime.args
```
  doesn't exist, add it with the value
```
-M-Dencryption.key=<their-encryption-key>
```
- Write the updated launch.json back to disk
- Check .gitignore: Ensure
```
.vscode/
```
  or
```
.vscode/launch.json
```
  is in
```
.gitignore
```
  - If
```
.gitignore
```
    exists, check if it contains
```
.vscode/
```
    or
```
.vscode/launch.json
```
  - If neither pattern is found, add
```
.vscode/
```
    to
```
.gitignore
```
  - If
```
.gitignore
```
    doesn't exist, create it and add
```
.vscode/
```

If it doesn't exist, inform the user they need to manually add the encryption key to their run configuration:

Add to VM arguments:
-M-Dencryption.key=<their-encryption-key>

Or set as environment variable:
export ENCRYPTION_KEY=<their-encryption-key>

检查项目根目录下是否存在
```
.vscode/launch.json
```
如果存在：
- 读取文件
- 查找运行Mule应用的配置
- 在每个配置中查找
```
mule.runtime.args
```
  字段
- 如果
```
mule.runtime.args
```
  存在，在现有值后追加
```
-M-Dencryption.key=<their-encryption-key>
```
- 如果
```
mule.runtime.args
```
  不存在，添加该字段并设置值为
```
-M-Dencryption.key=<their-encryption-key>
```
- 将更新后的launch.json写回磁盘
- 检查.gitignore：确保
```
.vscode/
```
  或
```
.vscode/launch.json
```
  已在
```
.gitignore
```
  中
  - 如果
```
.gitignore
```
    存在，检查是否包含
```
.vscode/
```
    或
```
.vscode/launch.json
```
  - 如果都未找到，将
```
.vscode/
```
    添加到
```
.gitignore
```
  - 如果
```
.gitignore
```
    不存在，创建该文件并添加
```
.vscode/
```

如果不存在，告知用户需要手动将加密密钥添加到运行配置中：

添加到VM参数：
-M-Dencryption.key=<their-encryption-key>

或设置为环境变量：
export ENCRYPTION_KEY=<their-encryption-key>

Step 14: Protect Existing Properties/YAML Files in .gitignore

步骤14：在.gitignore中保护现有属性/YAML文件

For each properties/YAML file that contained sensitive data (identified in Step 4):
- Add the file to
```
.gitignore
```
  to prevent committing sensitive data
- This includes files like
```
local.properties
```
  ,
```
dev.properties
```
  , etc.

对于每个包含敏感数据的属性/YAML文件（步骤4中识别的文件）：
- 将文件添加到
```
.gitignore
```
  中，防止提交敏感数据
- 这包括
```
local.properties
```
  、
```
dev.properties
```
  等文件

Step 15: Final Summary

步骤15：最终摘要

Provide a completion summary:

✅ Number of XML files scanned
✅ Number of properties files scanned
✅ Number of sensitive values encrypted
✅ Secure properties file created/updated (e.g.,
```
local.secure.properties
```
)
✅ XML files updated:
- Hardcoded values replaced with
```
${secure::}
```
  placeholders
- Existing property references updated from
```
${property}
```
  to
```
${secure::property}
```
✅ global.xml configured with secure properties
✅ pom.xml updated with secure properties dependency
✅ launch.json updated with encryption key
✅ Existing properties/YAML files with sensitive data protected in .gitignore

Important reminders:

DO NOT commit
```
local.secure.properties
```
to version control
DO NOT commit
```
local.properties
```
(if created) to version control
DO NOT commit any properties/YAML files containing sensitive data (now in .gitignore)
Verify that property names in
```
.secure.properties
```
match references in XML files
Test the application with the encryption key before committing changes
Review all XML file changes to ensure
```
${secure::}
```
prefix was added correctly

提供完成情况摘要：

✅ 已扫描的XML文件数量
✅ 已扫描的属性文件数量
✅ 已加密的敏感值数量
✅ 已创建/更新安全属性文件（例如：
```
local.secure.properties
```
）
✅ 已更新XML文件：
- 硬编码值已替换为
```
${secure::}
```
  占位符
- 现有属性引用已从
```
${property}
```
  更新为
```
${secure::property}
```
✅ 已在global.xml中配置安全属性
✅ 已在pom.xml中添加安全属性依赖
✅ 已在launch.json中添加加密密钥
✅ 包含敏感数据的现有属性/YAML文件已在.gitignore中得到保护

重要提醒：

请勿将
```
local.secure.properties
```
提交到版本控制系统
请勿将
```
local.properties
```
（如果已创建）提交到版本控制系统
请勿提交任何包含敏感数据的属性/YAML文件（现已加入.gitignore）
验证
```
.secure.properties
```
中的属性名称是否与XML文件中的引用匹配
在提交更改前，使用加密密钥测试应用
检查所有XML文件的修改，确保已正确添加
```
${secure::}
```
前缀

Error Handling

错误处理

If Java is not installed, inform user and exit
If JAR download fails, provide manual download instructions
If encryption fails, show error and skip that value
If XML parsing fails, show warning and continue with other files
If file writes fail, show error and list what was completed

如果未安装Java，告知用户并退出
如果JAR下载失败，提供手动下载说明
如果加密失败，显示错误并跳过该值
如果XML解析失败，显示警告并继续处理其他文件
如果写入文件失败，显示错误并列出已完成的操作

Security Best Practices

安全最佳实践

Never log or display sensitive values in plain text
Always ask for confirmation before making changes
Remind user not to commit secure properties file
Suggest adding
```
.gitignore
```
entry

永远不要以明文形式记录或显示敏感值
在进行修改前始终请求用户确认
提醒用户不要提交安全属性文件
建议添加.gitignore条目

Reference Documentation

参考文档

For more information, refer to: https://docs.mulesoft.com/anypoint-code-builder/int-create-secure-configs

如需更多信息，请参考： https://docs.mulesoft.com/anypoint-code-builder/int-create-secure-configs