Springboot敏感字段脱敏

偏执的太偏执、 2022-09-10 07:20 126阅读 0赞

生产环境用户的隐私数据，比如手机号、身份证或者一些账号配置等信息，入库时都要进行不落地脱敏，也就是在进入我们系统时就要实时的脱敏处理。

用户数据进入系统，脱敏处理后持久化到数据库，用户查询数据时还要进行反向解密。这种场景一般需要全局处理，那么用`AOP`切面来实现在适合不过了。

首先自定义两个注解`@EncryptField`、`@EncryptMethod`分别用在字段属性和方法上，实现思路很简单，只要方法上应用到`@EncryptMethod`注解，则检查入参字段是否标注`@EncryptField`注解，有则将对应字段内容加密。

@Documented
    @Target({ElementType.FIELD,ElementType.PARAMETER})
    @Retention(RetentionPolicy.RUNTIME)
    public @interface EncryptField {
    
        String[] value() default "";
    }

@Documented
    @Target({ElementType.METHOD})
    @Retention(RetentionPolicy.RUNTIME)
    public @interface EncryptMethod {
    
        String type() default ENCRYPT;
    }

切面的实现也比较简单，对入参加密，返回结果解密。

import com.xiaofu.annotation.EncryptField;
    import com.xiaofu.annotation.EncryptMethod;
    import lombok.extern.slf4j.Slf4j;
    import org.aspectj.lang.ProceedingJoinPoint;
    import org.aspectj.lang.annotation.*;
    import org.aspectj.lang.reflect.MethodSignature;
    import org.jasypt.encryption.StringEncryptor;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.stereotype.Component;
    import org.springframework.util.SerializationUtils;
    
    import java.lang.reflect.Field;
    import java.util.*;
    
    import static com.xiaofu.enums.EncryptConstant.DECRYPT;
    import static com.xiaofu.enums.EncryptConstant.ENCRYPT;
    
    @Slf4j
    @Aspect
    @Component
    public class EncryptHandler {
    
        @Autowired
        private StringEncryptor stringEncryptor;
    
        @Pointcut("@annotation(com.xiaofu.annotation.EncryptMethod)")
        public void pointCut() {
        }
    
        @Around("pointCut()")
        public Object around(ProceedingJoinPoint joinPoint) {
            /**
             * 加密
             */
            encrypt(joinPoint);
            /**
             * 解密
             */
            Object decrypt = decrypt(joinPoint);
            return decrypt;
        }
    
        public void encrypt(ProceedingJoinPoint joinPoint) {
    
            try {
                Object[] objects = joinPoint.getArgs();
                if (objects.length != 0) {
                    for (Object o : objects) {
                        if (o instanceof String) {
                            encryptValue(o);
                        } else {
                            handler(o, ENCRYPT);
                        }
                        //TODO 其余类型自己看实际情况加
                    }
                }
            } catch (IllegalAccessException e) {
                e.printStackTrace();
            }
        }
    
        public Object decrypt(ProceedingJoinPoint joinPoint) {
            Object result = null;
            try {
                Object obj = joinPoint.proceed();
                if (obj != null) {
                    if (obj instanceof String) {
                        decryptValue(obj);
                    } else {
                        result = handler(obj, DECRYPT);
                    }
                    //TODO 其余类型自己看实际情况加
                }
            } catch (Throwable e) {
                e.printStackTrace();
            }
            return result;
        }
    
        private Object handler(Object obj, String type) throws IllegalAccessException {
    
            if (Objects.isNull(obj)) {
                return null;
            }
            Field[] fields = obj.getClass().getDeclaredFields();
            for (Field field : fields) {
                boolean hasSecureField = field.isAnnotationPresent(EncryptField.class);
                if (hasSecureField) {
                    field.setAccessible(true);
                    String realValue = (String) field.get(obj);
                    String value;
                    if (DECRYPT.equals(type)) {
                        value = stringEncryptor.decrypt(realValue);
                    } else {
                        value = stringEncryptor.encrypt(realValue);
                    }
                    field.set(obj, value);
                }
            }
            return obj;
        }
    
        public String encryptValue(Object realValue) {
            String value = null;
            try {
                value = stringEncryptor.encrypt(String.valueOf(realValue));
            } catch (Exception ex) {
                return value;
            }
            return value;
        }
    
        public String decryptValue(Object realValue) {
            String value = String.valueOf(realValue);
            try {
                value = stringEncryptor.decrypt(value);
            } catch (Exception ex) {
                return value;
            }
            return value;
        }
    }

紧接着测试一下切面注解的效果，我们对字段`mobile`、`address`加上注解`@EncryptField`做脱敏处理。

@EncryptMethod
    @PostMapping(value = "test")
    @ResponseBody
    public Object testEncrypt(@RequestBody UserVo user, @EncryptField String name) {
    
        return insertUser(user, name);
    }
    
    private UserVo insertUser(UserVo user, String name) {
        System.out.println("加密后的数据：user" + JSON.toJSONString(user));
        return user;
    }
    
    @Data
    public class UserVo implements Serializable {
    
        private Long userId;
    
        @EncryptField
        private String mobile;
    
        @EncryptField
        private String address;
    
        private String age;
    }

请求这个接口，看到参数被成功加密，而返回给用户的数据依然是脱敏前的数据，符合我们的预期，那到这简单的脱敏实现就完事了。

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Yqq5Yqb5aWL5paXR08_size_20_color_FFFFFF_t_70_g_se_x_16][]

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Yqq5Yqb5aWL5paXR08_size_13_color_FFFFFF_t_70_g_se_x_16][]

[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Yqq5Yqb5aWL5paXR08_size_20_color_FFFFFF_t_70_g_se_x_16]: /images/20220829/182cd605c31b46fb9e57d00a4c682ce6.png
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBA5Yqq5Yqb5aWL5paXR08_size_13_color_FFFFFF_t_70_g_se_x_16]: /images/20220829/12819e92bea2448e9b0b6ff08ce8b103.png