mybatis数据加密脱敏
在研发过程中某些业务场景是不允许存储明文的，例银行卡 身份证类。怎么实现自动加密解密呢？可以利用mybatis Interceptor 做处理，输入明文参数通过拦截器自动加密。查询出结果集自动解密。在web层展示可以对敏感字段加*处理。
支持mybatis-generator 生成的代码，考虑到可能重新生成会覆盖。支持配置指定字段加密解密，就不用担心代码丢失。自定义对象建议使用注解方式
直接上代码
/**
*
* @author one.xu
*/
@Target({ElementType.TYPE,ElementType.METHOD})
@Retention(RetentionPolicy.RUNTIME)
@Inherited
public @interface EnableEncrypt {
}
@Target({ElementType.FIELD, ElementType.PARAMETER})
@Retention(RetentionPolicy.RUNTIME)
@Documented
@Inherited
public @interface EncryptField {
String value() default "";
/**
* 参数为map逗号连接需要加密的key
* @return
*/
String keys() default "";
}
/**
* @author one.xu
*/
@Slf4j
@Intercepts({
@Signature(type = Executor.class, method = "query", args = {MappedStatement.class, Object.class, RowBounds.class, ResultHandler.class}),
@Signature(type = Executor.class, method = "query", args = {MappedStatement.class, Object.class, RowBounds.class, ResultHandler.class, CacheKey.class, BoundSql.class}),
@Signature(type = Executor.class, method = "queryCursor", args = {MappedStatement.class, Object.class, RowBounds.class}),
@Signature(type = Executor.class, method = "update", args = {MappedStatement.class, Object.class})})
public class DataSecurityInterceptor implements Interceptor {
private EncryptHelper encryptHelper;
/**
* {"examples":{"com.xx.BusinessInfoExample":["app_id"]},
* "resluts":{"com.xx.BusinessInfo":["appId"]}}
*/
private Map<String, Set<String>> exampleClassConfigMap;
private ConcurrentHashMap<String, Class> mapperClassMap = new ConcurrentHashMap<>();
@Override
public Object intercept(Invocation invocation) throws Throwable {
invocation.getArgs()[1] = parameterHand(invocation, true);
Boolean hasCache = invocation.getArgs().length > 2 ? hasCache(invocation) : false;
Object result = invocation.proceed();
invocation.getArgs()[1] = parameterHand(invocation, false);
if (hasCache) {
return result;
}
return resultDecrypt(result, invocation);
}
/**
* 只有 query,queryCursor 进入
*
* @param invocation
* @return
*/
boolean hasCache(Invocation invocation) {
Object[] args = invocation.getArgs();
MappedStatement ms = (MappedStatement) args[0];
Object parameter = args[1];
RowBounds rowBounds = (RowBounds) args[2];
// ResultHandler resultHandler = (ResultHandler) args[3];
Executor executor = (Executor) invocation.getTarget();
CacheKey cacheKey;
BoundSql boundSql;
//由于逻辑关系，只会进入一次
if (args.length <= 4) {
//4 个参数时
boundSql = ms.getBoundSql(parameter);
cacheKey = executor.createCacheKey(ms, parameter, rowBounds, boundSql);
} else {
//6 个参数时
cacheKey = (CacheKey) args[4];
boundSql = (BoundSql) args[5];
}
return executor.isCached(ms, cacheKey);
}
@Override
public Object plugin(Object target) {
return Plugin.wrap(target, this);
}
@SneakyThrows
@Override
public void setProperties(Properties properties) {
String encryptKey = properties.getProperty("encryptKey", "N2Y1ZjA0MjhhNjI2ZGNhOQ==");
if (encryptKey.startsWith("${") && encryptKey.endsWith("}")) {
encryptKey = SpringContextUtil.getApplicationContext().getEnvironment().getProperty(encryptKey.replace("${", "").replace("}", ""));
}
String encryptionService = properties.getProperty("encryptionService", DefaultEncryptionService.class.getName());
Class<?> cls = Class.forName(encryptionService);
if (!IEncryptionService.class.isAssignableFrom(cls)) {
throw new RuntimeException("encryptionService 没有实现IEncryptionService接口");
}
this.encryptHelper = new EncryptHelper((IEncryptionService) cls.newInstance(), encryptKey);
//解析example配置
this.exampleClassConfigMap = new HashMap<>(16);
String exampleClass = properties.getProperty("exampleClassConfig");
if (StringUtils.isBlank(exampleClass)) {
return;
}
JSONObject exampleClassConfigObject = JSON.parseObject(exampleClass);
for (Map.Entry<String, Object> m1 : exampleClassConfigObject.entrySet()) {
JSONObject tmp = exampleClassConfigObject.getJSONObject(m1.getKey());
for (Map.Entry<String, Object> m2 : tmp.entrySet()) {
String newKey = buildConfigKey(m2.getKey(), "examples".equals(m1.getKey()));
Set<String> fields = exampleClassConfigMap.get(newKey);
if (fields == null) {
fields = new HashSet<>();
}
fields.addAll(tmp.getJSONArray(m2.getKey()).toJavaList(String.class));
this.exampleClassConfigMap.put(newKey, fields);
}
}
}
private String buildConfigKey(String key, boolean isExamples) {
String newKey = isExamples ? "examples" : "resluts";
return newKey + "#" + key;
}
private Object resultDecrypt(Object resultObject, Invocation invocation) throws Throwable {
if (Objects.isNull(resultObject)) {
return null;
}
// log.info("resultObject:{}",JSONObject.toJSONString(resultObject));
if (resultObject instanceof List) {
List<Object> resultList = (List<Object>) resultObject;
if (CollectionUtils.isEmpty(resultList)) {
return resultList;
}
}
Set<String> decryptFields = getDecryptFields(resultObject);
MappedStatement mappedStatement = (MappedStatement) invocation.getArgs()[0];
Method method = getMapperMethod(mappedStatement);
EnableEncrypt enableEncrypt = null;
if (method != null && method.getAnnotation(EnableEncrypt.class) != null) {
enableEncrypt = method.getAnnotation(EnableEncrypt.class);
}
if (enableEncrypt != null && StringUtils.isNotBlank(enableEncrypt.keys())) {
decryptFields.addAll(Arrays.asList(enableEncrypt.keys().split(",")));
}
this.encryptHelper.execute(resultObject, decryptFields, false);
return resultObject;
}
private Set<String> getDecryptFields(Object resultObject) {
if (resultObject == null) {
return new HashSet<>();
}
boolean isList = resultObject instanceof List;
Object reallySingleObj = resultObject;
if (isList) {
List<Object> resultList = (List<Object>) resultObject;
if (CollectionUtils.isEmpty(resultList)) {
return new HashSet<>();
}
reallySingleObj = resultList.get(0);
}
//提取注解字段
Set<String> decryptFields = this.encryptHelper.getEncryptField(reallySingleObj);
//针对继承类处理
Class tmpClass = reallySingleObj.getClass();
while (!tmpClass.getName().equals(Object.class.getName())) {
Set<String> fields = this.exampleClassConfigMap.get(buildConfigKey(tmpClass.getName(), false));
if (fields != null) {
decryptFields.addAll(fields);
}
tmpClass = tmpClass.getSuperclass();
}
return decryptFields;
}
private Object parameterHand(Invocation invocation, boolean isEncrypt) throws Throwable {
Object parameter = invocation.getArgs()[1];
MappedStatement mappedStatement = (MappedStatement) invocation.getArgs()[0];
Method method = getMapperMethod(mappedStatement);
if (parameter == null || method == null) {
return parameter;
}
Object newParameter = parameter;
//没有EnableEncrypt注解 且 Example,Result没有加密字段
if (method.getAnnotation(EnableEncrypt.class) == null && !hasExampleOrResult(newParameter)) {
return parameter;
}
log.debug("开始修改方法:{}入参", mappedStatement.getId());
//扫描方法入参注解
Map<String, Set<String>> paramAnnotation = searchParamAnnotation(method);
//多个参数场景
if (newParameter instanceof MapperMethod.ParamMap) {
Map<String, Object> map = ((Map<String, Object>) newParameter);
for (Map.Entry<String, Object> e : map.entrySet()) {
Object value = e.getValue();
if (value == null) {
continue;
}
//没有注解，且无Example Result
if (!paramAnnotation.containsKey(e.getKey()) && !hasExampleOrResult(value)) {
continue;
}
if (value instanceof Map) {
encryptHelper.execute(value, paramAnnotation.get(e.getKey()), isEncrypt);
} else if (value instanceof List) {
List list = (List) value;
if (CollectionUtils.isEmpty(list)) {
continue;
}
boolean isMap = list.get(0) instanceof Map;
if (isMap && !CollectionUtils.isEmpty(list)) {
encryptHelper.execute(value, paramAnnotation.get(e.getKey()), isEncrypt);
} else if (list.get(0).getClass().getClassLoader() != null) {
Set<String> encryptFields = getDecryptFields(list.get(0));
encryptHelper.execute(list, encryptFields, isEncrypt);
} else {
int i = 0;
for (Object o : list) {
list.set(i, encryptHelper.encrypt(String.valueOf(o)));
i = i + 1;
}
}
} else if (hasExample(value)) {
handExample(value, isEncrypt);
} else if (value.getClass().getClassLoader() != null) {
this.encryptHelper.execute(value, getDecryptFields(value), isEncrypt);
} else {
map.put(e.getKey(), isEncrypt ? encryptHelper.encrypt(String.valueOf(value)) : encryptHelper.decrypt(String.valueOf(value)));
}
}
} else if (newParameter instanceof Map) {
Set<String> encryptFields = Sets.newHashSet();
for (Set<String> s : paramAnnotation.values()) {
encryptFields.addAll(s);
}
encryptHelper.execute(newParameter, encryptFields, isEncrypt);
} else if (hasExample(newParameter)) {
handExample(newParameter, isEncrypt);
} else if (newParameter.getClass().getClassLoader() == null && paramAnnotation.size() == 1) {
newParameter = isEncrypt ? encryptHelper.encrypt(String.valueOf(newParameter)) : encryptHelper.decrypt(String.valueOf(newParameter));
} else {
this.encryptHelper.execute(newParameter, getDecryptFields(newParameter), isEncrypt);
}
return newParameter;
}
private boolean hasExampleOrResult(Object parameterObject) {
boolean isParamMap = parameterObject instanceof MapperMethod.ParamMap;
if (!isParamMap) {
return hasExample(parameterObject) || hasResult(parameterObject);
}
Map<String, Object> map = ((Map<String, Object>) parameterObject);
for (Map.Entry<String, Object> e : map.entrySet()) {
if (hasExample(e.getValue()) || hasResult(e.getValue())) {
return true;
}
}
return false;
}
private boolean hasExample(Object parameterObject) {
if(parameterObject==null){
return false;
}
return !CollectionUtils.isEmpty(exampleClassConfigMap.get(buildConfigKey(parameterObject.getClass().getName(), true)));
}
private boolean hasResult(Object parameterObject) {
if (parameterObject == null) {
return false;
}
return !CollectionUtils.isEmpty(getDecryptFields(parameterObject));
}
private boolean handExample(Object parameterObject, boolean isEncrypt) throws Exception {
Set<String> fields = null;
if (!(parameterObject instanceof MapperMethod.ParamMap)) {
fields = exampleClassConfigMap.get(buildConfigKey(parameterObject.getClass().getName(), true));
return handExampleParam(parameterObject, isEncrypt, fields);
}
Map<String, Object> map = ((Map<String, Object>) parameterObject);
for (Map.Entry<String, Object> e : map.entrySet()) {
fields = exampleClassConfigMap.get(buildConfigKey(e.getValue().getClass().getName(), true));
if (fields != null) {
return handExampleParam(e.getValue(), isEncrypt, fields);
}
}
return false;
}
private boolean handExampleParam(Object parameterObject, boolean isEncrypt, Set<String> fields) throws Exception {
if (fields == null) {
return false;
}
Method method = parameterObject.getClass().getMethod("getOredCriteria");
List oredCriterias = (List) method.invoke(parameterObject);
if (CollectionUtils.isEmpty(oredCriterias)) {
return false;
}
boolean result = false;
for (Object oj : oredCriterias) {
method = oj.getClass().getMethod("getCriteria");
for (Object o : (List) method.invoke(oj)) {
Field f = o.getClass().getDeclaredField("condition");
f.setAccessible(true);
Object v = f.get(o);
aa:
for (String f1 : fields) {
if (!v.toString().toUpperCase().replace("`", "").startsWith((f1 + " ").toUpperCase())) {
continue;
}
for (String dd : "value,secondValue".split(",")) {
f = o.getClass().getDeclaredField(dd);
f.setAccessible(true);
v = f.get(o);
if (v == null) {
break aa;
}
if (v instanceof List) {
List tList = (List) v;
for (int i = 0; i < tList.size(); i++) {
tList.set(i, isEncrypt ? encryptHelper.encrypt(tList.get(i).toString()) : encryptHelper.decrypt(tList.get(i).toString()));
}
v = tList;
} else {
v = isEncrypt ? encryptHelper.encrypt(v.toString()) : encryptHelper.decrypt(v.toString());
}
f.set(o, v);
if (!result) {
result = true;
}
}
}
}
}
return result;
}
/**
* key-属性名
* value-map类型时加密字段key
*
* @param method
* @return
*/
private Map<String, Set<String>> searchParamAnnotation(Method method) {
Map<String, Set<String>> paramNames = Maps.newHashMap();
if (method == null) {
return paramNames;
}
Annotation[][] pa = method.getParameterAnnotations();
Parameter[] parameters = method.getParameters();
for (int i = 0; i < pa.length; i++) {
for (Annotation annotation : pa[i]) {
Parameter p = parameters[i];
if (annotation instanceof EncryptField) {
EncryptField encryptField = (EncryptField) annotation;
Set<String> ff = null;
if (Map.class.isAssignableFrom(p.getType()) && StringUtils.isNotBlank(encryptField.keys())) {
ff = new HashSet<>(Arrays.asList(encryptField.keys().split(",")));
}
Param param = p.getAnnotation(Param.class);
String paramName = param == null ? p.getName() : param.value();
paramNames.put(paramName, ff);
}
}
}
return paramNames;
}
private Method getMapperMethod(MappedStatement mappedStatement) {
Class<?> mapperClass = getMapperClass(mappedStatement);
String methodName = mappedStatement.getId();
methodName = methodName.substring(methodName.lastIndexOf('.') + 1);
Method[] methods = mapperClass.getDeclaredMethods();
Method method = null;
for (Method m : methods) {
if (m.getName().equals(methodName)) {
method = m;
break;
}
}
return method;
}
@SneakyThrows
private Class<?> getMapperClass(MappedStatement mappedStatement) {
String mapperClassKey = mappedStatement.getId().substring(0, mappedStatement.getId().lastIndexOf('.'));
Class<?> mapperClass = mapperClassMap.get(mapperClassKey);
if (mapperClass == null) {
mapperClassMap.putIfAbsent(mapperClassKey, Class.forName(mapperClassKey));
mapperClass = mapperClassMap.get(mapperClassKey);
}
return mapperClass;
}
}/**
* @author one.xu
*/
public interface IEncryptionService {
String encrypt(String content, String password);
String decrypt(String content, String password);
}/**
* @author one.xu
*/
public class DefaultEncryptionService implements IEncryptionService {
@Override
public String encrypt(String content, String password) {
return AesUtil.encrypt(content, password);
}
@Override
public String decrypt(String content, String password) {
return AesUtil.decrypt(content, password);
}
}@Data
public class EncryptHelper {
public EncryptHelper(IEncryptionService encryptionService, String encryptKey) {
this.encryptionService = encryptionService;
this.encryptKey = encryptKey;
}
private IEncryptionService encryptionService;
private String encryptKey;
public Set<String> getEncryptField(Object param) {
Set<String> encryptFieldSet = Sets.newHashSet();
Object object = param;
boolean isList = object instanceof List;
if (isList) {
List<Object> resultList = (List<Object>) object;
if (CollectionUtils.isEmpty(resultList)) {
return encryptFieldSet;
}
object = resultList.get(0);
}
Class<?> objectClass = object.getClass();
EnableEncrypt enableEncrypt = AnnotationUtils.findAnnotation(objectClass, EnableEncrypt.class);
if (enableEncrypt == null) {
return encryptFieldSet;
}
for (Field[] fields : getFields(objectClass)) {
for (Field field : fields) {
EncryptField encryptField = field.getAnnotation(EncryptField.class);
if (encryptField == null) {
continue;
}
encryptFieldSet.add(field.getName());
}
}
return encryptFieldSet;
}
private List<Field[]> getFields(Class<?> clazz) {
List<Field[]> fieldsList = Lists.newArrayList();
Class<?> resultClass = clazz;
while (resultClass != null) {
fieldsList.add(resultClass.getDeclaredFields());
resultClass = resultClass.getSuperclass();
}
return fieldsList;
}
public <T> T execute(T result, Set<String> encryptFields, boolean isEncrypt) throws IllegalAccessException {
if (result == null || CollectionUtils.isEmpty(encryptFields)) {
return result;
}
boolean isList = result instanceof List;
if (!isList) {
return executeSingle(result, encryptFields, isEncrypt);
}
List<Object> resultList = (List<Object>) result;
for (Object obj : resultList) {
executeSingle(obj, encryptFields, isEncrypt);
}
return result;
}
private <T> T executeSingle(T result, Set<String> encryptFields, boolean isEncrypt) throws IllegalAccessException {
if (result == null || CollectionUtils.isEmpty(encryptFields)) {
return result;
}
if (result instanceof Map) {
Map<String, Object> map = ((Map<String, Object>) result);
for (String f : encryptFields) {
Object o = map.get(f);
if (o == null) {
continue;
}
if (o instanceof List) {
List tmpList = (List) o;
if (CollectionUtils.isEmpty(tmpList)) {
continue;
}
Set<String> encryptFields2 = getEncryptField(tmpList.get(0));
if (CollectionUtils.isEmpty(encryptFields2)) {
continue;
}
for (Object o1 : tmpList) {
executeSingle(o1, encryptFields2, isEncrypt);
}
} else if (o.getClass().getClassLoader() != null) {
executeSingle(o, getEncryptField(o), isEncrypt);
} else {
String value = String.valueOf(o);
value = isEncrypt ? encrypt(value) : decrypt(value);
map.put(f, value);
}
}
return result;
}
if (result.getClass().getClassLoader() == null) {
result = (T) (isEncrypt ? encrypt(String.valueOf(result)) : decrypt(String.valueOf(result)));
return result;
}
//自定义对象
for (Field[] fields : getFields(result.getClass())) {
for (Field field : fields) {
if (!encryptFields.contains(field.getName())) {
continue;
}
field.setAccessible(true);
Object o = field.get(result);
if (o == null) {
continue;
}
if (o instanceof List) {
List tmpList = (List) o;
if (CollectionUtils.isEmpty(tmpList)) {
continue;
}
Set<String> encryptFields2 = getEncryptField(tmpList.get(0));
if (CollectionUtils.isEmpty(encryptFields2)) {
continue;
}
for (Object o1 : tmpList) {
executeSingle(o1, encryptFields2, isEncrypt);
}
} else if (o.getClass().getClassLoader() != null) {
executeSingle(o, getEncryptField(o), isEncrypt);
} else {
String value = String.valueOf(o);
value = isEncrypt ? encrypt(value) : decrypt(value);
field.set(result, value);
}
}
}
return result;
}
public String encrypt(String value) {
return encryptionService.encrypt(value, this.getEncryptKey());
}
public String decrypt(String value) {
return encryptionService.decrypt(value, this.getEncryptKey());
}
}
public class AesUtil {
private AesUtil() {
}
private static final String KEY_ALGORITHM = "AES";
private static final String DEFAULT_CIPHER_ALGORITHM = "AES/ECB/PKCS5Padding";
private static final String KEY_SECURE_RANDOM_ALGORITHM = "SHA1PRNG";
private static final String CHARSET = "utf-8";
/**
* 加密
*
* @param content 加密正文
* @param password 加密密码
* @return
*/
public static String encrypt(String content, String password) {
try {
// 创建密码器
Cipher cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
byte[] byteContent = content.getBytes(CHARSET);
// 初始化为加密模式的密码器
cipher.init(Cipher.ENCRYPT_MODE, getSecretKey(password));
// 加密
byte[] result = cipher.doFinal(byteContent);
//通过Base64转码返回
return Base64.getEncoder().encodeToString(result);
} catch (Exception e) {
throw new RuntimeException(e);
}
}
/**
* 解密
*
* @param content 加密字符串
* @param password 解密密码
* @return
*/
public static String decrypt(String content, String password) {
try {
//实例化
Cipher cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
//使用密钥初始化，设置为解密模式
cipher.init(Cipher.DECRYPT_MODE, getSecretKey(password));
//执行操作
byte[] result = cipher.doFinal(Base64.getDecoder().decode(content));
return new String(result, CHARSET);
} catch (Exception e) {
throw new RuntimeException(e);
}
}
private static Key getSecretKey(String password) throws NoSuchAlgorithmException {
KeyGenerator kg = KeyGenerator.getInstance(KEY_ALGORITHM);
SecureRandom random = SecureRandom.getInstance(KEY_SECURE_RANDOM_ALGORITHM);
random.setSeed(password.getBytes());
//AES 要求密钥长度为 128
kg.init(128, random);
//生成一个密钥
SecretKey secretKey = kg.generateKey();
// 转换为AES专用密钥
return new SecretKeySpec(secretKey.getEncoded(), KEY_ALGORITHM);
}
public static void main(String[] args) {
String url = "https://www.baidu.com";
String password = "kZNJcCWedTon45KfNyiH";
System.out.println("原始链接:"+url);
String encrypt = encrypt(url, password);
System.out.println("加密:"+encrypt);
String decrypt = decrypt(encrypt, password);
System.out.println("解密:"+decrypt);
}
}配置拦截器
使用
至此mybatis层加密解密搞定，web层代码如下
/**
* @author one.xu
*/
@AllArgsConstructor
@Getter
public enum DesensitionTypeEnum {
NIK(3, 4),
EMAIL(1, null),
OTHER(0,0),
;
/**
* 前多少位
*/
private Integer front;
/**
* 后多少位
*/
private Integer end;
}@Target({ElementType.FIELD})
@Retention(RetentionPolicy.RUNTIME)
@Documented
@Inherited
public @interface Desensitization {
/**
* 脱敏策略
*
* @return
*/
DesensitionTypeEnum type();
/**
* 替换字符串
*
* @return
*/
String replaceStr() default "*";
/**
* type为OTHER生效
* 扩展脱敏策略类型名
* @return
*/
String ext() default "";
}
/**
* @author one.xu
*/
@Target({ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Inherited
public @interface SensitiveObject {
}
/**
* @author one.xu
*/
@Configuration
@ConditionalOnProperty(value = "xuyw.desensitization.enabled", havingValue = "true")
public class DesensitizationConfig {
@Bean
public DefaultDesensitionService defaultDesensitionService() {
return new DefaultDesensitionService();
}
@Bean
public EmailDesensitionService emailDesensitionService() {
return new EmailDesensitionService();
}
@Bean
public DesensitizationHelper desensitizationHelper(@Autowired List<IDesensitionService> list) {
return new DesensitizationHelper(list);
}
@Bean("desensitizeValueFilter")
public DesensitizeValueFilter desensitizeValueFilter(@Autowired DesensitizationHelper desensitizationHelper) {
return new DesensitizeValueFilter(desensitizationHelper);
}
@Bean("fastJsonBeanPostProcessor")
public FastJsonBeanPostProcessor fastJsonBeanPostProcessor(@Autowired DesensitizeValueFilter desensitizeValueFilter) {
return new FastJsonBeanPostProcessor(desensitizeValueFilter);
}
}
本系统使用fastjson为序列化框架，写个过滤器对敏感对象进行脱敏操作
/**
* @author one.xu
*/
public class DesensitizeValueFilter implements ValueFilter {
public DesensitizeValueFilter(DesensitizationHelper desensitizationHelper) {
this.desensitizationHelper = desensitizationHelper;
}
private DesensitizationHelper desensitizationHelper;
@SneakyThrows
@Override
public Object process(Object object, String name, Object value) {
if (null == value || !(value instanceof String) || ((String) value).length() == 0) {
return value;
}
if (object.getClass().getAnnotation(SensitiveObject.class) == null) {
return value;
}
Desensitization annotation;
//获取字段
Field field = object.getClass().getDeclaredField(name);
if (String.class != field.getType() || (annotation = field.getAnnotation(Desensitization.class)) == null) {
return value;
}
return desensitizationHelper.execute(annotation, value.toString());
}
}/**
* 在项目架构中已经统一处理了HttpMessageConverters ,为了不入侵原先代码
* 在bean初始化之后添加过滤器，如果没有配置HttpMessageConverters 则需要手动配置
*
* @author one.xu
*/
@Slf4j
public class FastJsonBeanPostProcessor implements BeanPostProcessor {
public FastJsonBeanPostProcessor(DesensitizeValueFilter desensitizeValueFilter) {
this.desensitizeValueFilter = desensitizeValueFilter;
}
private DesensitizeValueFilter desensitizeValueFilter;
@Override
public Object postProcessAfterInitialization(Object bean, String beanName) {
if (!(bean instanceof HttpMessageConverters)) {
return bean;
}
HttpMessageConverters httpMessageConverters = (HttpMessageConverters) bean;
for (HttpMessageConverter<?> httpMessageConverter : httpMessageConverters.getConverters()) {
if (!(httpMessageConverter instanceof FastJsonHttpMessageConverter)) {
continue;
}
FastJsonHttpMessageConverter fastJsonHttpMessageConverter = (FastJsonHttpMessageConverter) httpMessageConverter;
SerializeFilter[] serializeFilters = fastJsonHttpMessageConverter.getFastJsonConfig().getSerializeFilters();
if (containsDesensitizeValueFilter(serializeFilters)) {
continue;
}
serializeFilters = ArrayUtils.addAll(serializeFilters, desensitizeValueFilter);
fastJsonHttpMessageConverter.getFastJsonConfig().setSerializeFilters(serializeFilters);
log.info("设置fastJson敏感过滤成功:{}",DesensitizeValueFilter.class.getName());
}
return bean;
}
private boolean containsDesensitizeValueFilter(SerializeFilter[] serializeFiltersr) {
for (SerializeFilter s : serializeFiltersr) {
if (s instanceof DesensitizeValueFilter) {
return true;
}
}
return false;
}
}
/**
* @author one.xu
*/
public interface IDesensitionService {
String type();
String execute(Desensitization desensitization, String value);
}
@Data
public class DefaultDesensitionService implements IDesensitionService {
public static final String SERVICE_NAME = "DEFAULT";
@Override
public String type() {
return SERVICE_NAME;
}
@Override
public String execute(Desensitization desensitization, String value) {
if (StringUtils.isBlank(value)) {
return value;
}
DesensitionTypeEnum desensitionTypeEnum = desensitization.type();
Integer front = desensitionTypeEnum.getFront();
if (front == null || front < 0) {
front = 0;
}
Integer end = desensitionTypeEnum.getEnd();
if (end == null || end < 0) {
end = 0;
}
if ((front + end) > value.length()) {
return value;
}
end = value.length() - end;
StringBuilder replaceStr = new StringBuilder();
int i = 0;
for (char c : value.toCharArray()) {
replaceStr.append((i >= front && i < end) ? desensitization.replaceStr() : c);
i = i + 1;
}
return replaceStr.toString();
}
}
public class EmailDesensitionService implements IDesensitionService {
@Override
public String type() {
return DesensitionTypeEnum.EMAIL.name();
}
@Override
public String execute(Desensitization desensitization, String value) {
if (StringUtils.isBlank(value)) {
return value;
}
DesensitionTypeEnum desensitionTypeEnum = desensitization.type();
Integer front = desensitionTypeEnum.getFront();
if (front == null || front < 0) {
front = 0;
}
Integer end = value.lastIndexOf("@");
if (end == null || end < 0) {
end = 0;
}
if ((front + end) > value.length()) {
return value;
}
end = value.length() - end;
StringBuilder replaceStr = new StringBuilder();
int i = 0;
for (char c : value.toCharArray()) {
replaceStr.append((i >= front && i < end) ? desensitization.replaceStr() : c);
i = i + 1;
}
return replaceStr.toString();
}
}
/**
* @author one.xu
*/
public class DesensitizationHelper {
private Map<String, IDesensitionService> desensitionServiceMap;
public DesensitizationHelper(List<IDesensitionService> desensitionServiceList) {
desensitionServiceMap = new HashMap<>();
for (IDesensitionService service : desensitionServiceList) {
if (desensitionServiceMap.containsKey(service.type())) {
throw new RuntimeException("已存在脱敏策略:" + service.type());
}
desensitionServiceMap.put(service.type(), service);
}
}
public String execute(Desensitization desensitization, String value) {
String key = DesensitionTypeEnum.OTHER == desensitization.type() ? desensitization.ext() : desensitization.type().name();
IDesensitionService desensitionService = desensitionServiceMap.get(key);
if (desensitionService == null) {
desensitionService = desensitionServiceMap.get(DefaultDesensitionService.SERVICE_NAME);
}
return desensitionService.execute(desensitization, value);
}
}使用
xuyw.desensitization.enabled=true
效果
