Marking and obscuring sensitive values in traces

1. A method for providing trace data for display to a user, the method comprising:

generating trace data during execution of a target application by instrumentation code in the target application monitoring execution of the target application;

applying a marking process to identify a first occurrence of a sensitive value in the trace data;

storing the sensitive value in a data structure separate from the trace data;

receiving the trace data;

obtaining the sensitive value from the data structure;

obscuring

occurrences of the sensitive value in the trace data, including

identifying a distinct second occurrence of the sensitive value by matching the sensitive value obtained from the data structure and not by applying the marking process, and

obscuring the second occurrence of the sensitive value in the trace data; and

providing the trace data, after obscuring occurrences of the sensitive value, for display to the user.

2. The method of claim 1 , wherein obscuring the second occurrence of the sensitive value in the trace data comprises:

replacing an element in the trace data that includes the sensitive value with an obscuring value from which the sensitive value cannot be recovered.

3. The method of claim 2 , wherein obscuring occurrences of the sensitive value comprises obscuring the first occurrence and all other occurrences of the sensitive value in the trace data based on the sensitive value obtained from the data structure.

4. The method of claim 1 , wherein the marking process comprises:

determining an annotation in the target application identifying a piece of software code in the target application as being associated with the sensitive value;

capturing the value associated with the annotation; and

determining the value as the sensitive value based on the annotation.

5. The method of claim 1 , wherein the marking process comprises:

reading information identifying a place in the target application; and

capturing the value as the sensitive value based on the identifying of the place.

6. The method of claim 1 , wherein the marking process comprises:

determining that a value is a sensitive value when a pattern matching expression, applied to captured information that identifies an operation performed by the target application, matches the value.

7. The method of claim 1 , wherein the marking process comprises:

receiving a notification from the target application that the value is sensitive; and

capturing the value as the sensitive value based on the notification.

8. The method of claim 1 , wherein generating trace data comprises generating the trace data by instrumentation code that intercepts points of interest in an execution flow of the target application to generate the trace data.

9. The method of claim 1 , wherein the trace data comprises at least one of (i) parameter values for methods invoked in the target application during execution, (ii) return values for methods invoked in the target application during execution, (iii) database queries transmitted by the target application during execution, (iv) database responses received by the target application during execution, (v) web request contents transmitted by the target application during execution, and (vi) web response contents received by the target application during execution.

10. A non-transitory computer-readable storage medium containing instructions for providing trace data for display to a user, the instructions comprising:

instrumentation code operable when executed to:

generate trace data during execution of a target application by monitoring execution of the target application;

apply a marking process to identify a first occurrence of a sensitive value in the trace data;

store the sensitive value in a data structure separate from the trace data; and

obscuring code operable when executed to:

receive the trace data;

obtain the sensitive value from the data structure;

obscure occurrences of the sensitive value in the trace data prior to providing the trace data for display, including instructions operable to:

identify a distinct second occurrence of the sensitive value by matching the sensitive value obtained from the data structure and not by applying the marking process, and

obscure the second occurrence of the sensitive value in the trace data; and

provide the trace data, after obscuring occurrences of the sensitive value, for display to the user.

11. The non-transitory computer-readable storage medium of claim 10 , wherein the code to obscure the second occurrence of the sensitive value in the trace data comprises: code to:

replace an element in the trace data that includes the sensitive value with an obscuring value from which the sensitive value cannot be recovered.

12. The non-transitory computer-readable storage medium of claim 11 , wherein the code to obscure occurrences of the sensitive value comprises code to obscure the first occurrence and all other occurrences of the sensitive value in the trace data based on the sensitive value obtained from the data structure.

13. The non-transitory computer-readable storage medium of claim 10 , wherein the instrumentation code to apply a marking process comprises:

code to determine an annotation in the target application identifying a piece of software code in the target application as being associated with the sensitive value;

code to capture the value associated with the annotation; and

code to determine the value as the sensitive value based on the annotation.

14. The non-transitory computer-readable storage medium of claim 10 , wherein the instrumentation code to apply a marking process comprises:

code to read information identifying a place in the target application; and

code to capture the value as the sensitive value based on the identifying of the place.

15. The non-transitory computer-readable storage medium of claim 10 , wherein the instrumentation code to apply a marking process comprises:

code to determine that a value is a sensitive value when a pattern matching expression, applied to captured information that identifies an operation performed by the target application, matches the value.

16. The non-transitory computer-readable storage medium of claim 10 , wherein the code to applying a marking process comprises:

code to receive a notification from the target application that the value is sensitive; and

code to capture the value as the sensitive value based on the notification.

17. The non-transitory computer-readable storage medium of claim 10 , wherein:

the instrumentation code is configured to be inserted at runtime into the target application; and

the instrumentation code is operable when executed to intercept points of interest in an execution flow of the target application to generate the trace data.

18. The non-transitory computer-readable storage medium of claim 10 , wherein the trace data comprises at least one of (i) parameter values for methods invoked in the target application during execution, (ii) return values for methods invoked in the target application during execution, (iii) database queries transmitted by the target application during execution, (iv) database responses received by the target application during execution, (v) web request contents transmitted by the target application during execution, and (vi) web response contents received by the target application during execution.

19. An apparatus configured to process trace data for display to a user, the apparatus comprising:

one or more computers; and

a non-transitory computer-readable storage medium, operatively coupled to the one or more computers, comprising instructions that when executed cause the one or more computers to:

generate trace data during execution of a target application, wherein instrumentation code inserted in the target application is configured to monitor execution of the target application and to generate the trace data;

apply a marking process to identify a first occurrence of a sensitive value in the trace data;

store the sensitive value in a data structure separate from the trace data;

execute an obscuring process that performs operations comprising:

receiving the trace data,

obtaining the sensitive value from the data structure, and

obscuring occurrences of the sensitive value in the trace data prior to providing the trace data for display, including

identifying a distinct second occurrence of the sensitive value by matching the sensitive value obtained from the data structure and not by applying the marking process, and

obscuring the second occurrence of the sensitive value in the trace data; and

provide the trace data, after obscuring occurrences of the sensitive value, for display to the user.

20. The apparatus of claim 19 , wherein obscuring the second occurrence of the sensitive value in the trace data comprises:

replacing an element in the trace data that includes the sensitive value with an obscuring value from which the sensitive value cannot be recovered.

21. The method of claim 1 , wherein:

the operations of receiving the trace data, of obtaining the sensitive value from the data structure, and of finding and obscuring an occurrence of the sensitive value are performed by an obscuring process operating separately from the application and the instrumentation code.