原生mybatis实现数据加密存储和读取

谁借莪１个温暖的怀抱￠ 2024-03-16 20:48 24阅读 0赞

## 原生mybatis实现数据加密存储和读取 ##

物料准备：

1.mysql,mybatis等依赖

2.定义数据库表以及对应的Java实体类、mapper接口/xml等代码

3.定义加密类和字段的Java注解

4.定义mybatis拦截器插件以及数据加解密工具类

5.测试数据插入和查询的效果

### pom.xml中引入相关依赖 ###

<dependency>
                <groupId>cn.hutool</groupId>
                <artifactId>hutool-all</artifactId>
                <version>5.7.8</version>
            </dependency>
            <dependency>
                <groupId>org.mybatis.spring.boot</groupId>
                <artifactId>mybatis-spring-boot-starter</artifactId>
                <version>2.1.3</version>
            </dependency>
             <dependency>
                <groupId>mysql</groupId>
                <artifactId>mysql-connector-java</artifactId>
                <scope>runtime</scope>
            </dependency>

### 定义数据库表以及对应的Java实体类mapper接口xml等代码 ###

#### 数据库表SQL代码 ####

CREATE DATABASE test619; 
    ALTER DATABASE `test619` CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ci;
    USE `test619`; 
    CREATE TABLE `t_account` (
      `id` INT(11) NOT NULL AUTO_INCREMENT,
      `username` VARCHAR(255) NOT NULL,
      `password_ciper` VARCHAR(255) NOT NULL DEFAULT '1',
      PRIMARY KEY (`id`),
      UNIQUE KEY `username` (`username`)
    ) ENGINE=INNODB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8mb4;

#### java实体类 ####

@Data
    @AllArgsConstructor
    @NoArgsConstructor
    @Builder
    @EncryptDecryptClass
    public class Account implements Serializable {
        
        private static final long serialVersionUID = -8114863398578320034L;
        private Integer id;
        private String username;
    
        @EncryptDecryptField
        private String passwordCiper;
    }

#### 对应的mapper接口以及xml ####

package com.example.demo.orm.dao;
    
    import com.example.demo.orm.po.Account;
    import org.apache.ibatis.annotations.Mapper;
    import org.apache.ibatis.annotations.Param;
    import java.util.List;
    
    @Mapper
    public interface AccountMapper {
        
        Account findOneById(@Param("id") Integer id);
    
        List<Account> selectUserList(Account account);
    
        int insertOne(Account account);
    }

<?xml version="1.0" encoding="UTF-8"?>
    <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
    <mapper namespace="com.example.demo.orm.dao.AccountMapper">
    <resultMap id="BaseResultMap"
                   type="com.example.demo.orm.po.Account">
            <id column="id" jdbcType="BIGINT" property="id"/>
            <result column="username" jdbcType="VARCHAR" property="username"/>       
            <result column="password_ciper" jdbcType="VARCHAR" property="passwordCiper"/>
        </resultMap>  
        
        <select id="findOneById" resultMap="BaseResultMap">
            select * from t_account where id = #{id}
        </select>
        
        <select id="selectUserList"
                parameterType="com.example.demo.orm.po.Account"
                resultMap="BaseResultMap">
            select * from t_account
            <where>
                <if test="id != null">
                    and id = #{id}
                </if>
                <if test="username != null and username != '' ">
                    and username = #{username}
                </if>         
                <if test="passwordCiper != null and passwordCiper != '' ">
                    and password_ciper = #{passwordCiper}
                </if>
            </where>
    
        </select>
        
        <insert id="insertOne"
                useGeneratedKeys="true"
                keyProperty="id"
                parameterType="com.example.demo.orm.po.Account">
           insert into t_account(username,password_ciper)
            values (#{username},#{passwordCiper})
        </insert>
        
     </mapper>

#### springboot项目的mybatis配置 ####

yml配置mybatis

server:
      port: 8615
    
    spring:
      datasource:
        driver-class-name: com.mysql.cj.jdbc.Driver
        url: jdbc:mysql://127.0.0.1:3306/test805?useUnicode=true&characterEncoding=UTF-8&serverTimezone=UTC&allowMultiQueries=true
        username: root
        password: 123456
    mybatis:
      # 实体类所在的包
      type-aliases-package: com.example.demo.orm.po
      # *Mapper.xml文件放在resource下的mappers目录里
      mapper-locations: classpath:mappers/*Mapper.xml
      configuration:
        # 打印mybatis执行的日志
        log-impl: org.apache.ibatis.logging.stdout.StdOutImpl
        #数据库下划线名 转 java代码小驼峰
        map-underscore-to-camel-case: true
        # 开启全局缓存(mybatis二级缓存),默认不会开启,需要程序员配置开启
        cache-enabled: true

项目启动类上配置mybatis注解

package com.example.demo;
    
    import org.mybatis.spring.annotation.MapperScan;
    import org.springframework.boot.SpringApplication;
    
    //扫描mybatis的java接口所在的包
    @MapperScan(basePackages = {
        "com.example.demo.orm.dao"})
    @SpringBootApplication
    public class DemoApplication {
        
    
        public static void main(String[] args) {
        
            SpringApplication.run(DemoApplication.class, args);
        }
    }

### 定义加密类和字段的Java注解 ###

#### 定义EncryptDecryptClass.java ####

package com.example.demo.anot;
    import java.lang.annotation.*;
    
    //定义注解@EncryptDecryptClass，用于标记需要加解密的java类
    @Inherited
    @Target({
         ElementType.TYPE })@Retention(RetentionPolicy.RUNTIME)
    public @interface EncryptDecryptClass {
        
    }

#### 定义EncryptDecryptField.java ####

package com.example.demo.anot;
    import java.lang.annotation.*;
    //定义注解@EncryptDecryptField，用于标记需要加解密的java字段
    @Inherited
    @Target({
         ElementType.FIELD })@Retention(RetentionPolicy.RUNTIME)
    public @interface EncryptDecryptField {
        
    }

### 定义mybatis拦截器插件以及数据加解密工具类 ###

#### 定义数据加解密工具类EncryptDecryptUtil.java ####

package com.example.demo.plugin;
    import cn.hutool.crypto.SecureUtil;
    import com.example.demo.anot.EncryptDecryptField;
    import lombok.extern.slf4j.Slf4j;
    import java.lang.reflect.Field;
    import java.util.Objects;
    
    @Slf4j
    public class EncryptDecryptUtil {
        
         /**
         * 对称加密的秘钥
         */
        private final static String key = "asffqqas";
        /**
         * * 加密     *
         * * @param declaredFields paramsObject所声明的字段
         * * @param paramsObject   mapper中paramsType的实例
         * * @return T     * @throws IllegalAccessException 字段不可访问异常
         */
        public static <T> T encrypt(Field[] declaredFields, T paramsObject) throws IllegalAccessException {
        
            for (Field field : declaredFields) {
                    //取出所有被EncryptDecryptField注解的字段
                EncryptDecryptField sensitiveField = field.getAnnotation(EncryptDecryptField.class);
                if (!Objects.isNull(sensitiveField)) {
        
                    field.setAccessible(true);
                    Object object = field.get(paramsObject);                //暂时只实现String类型的加密
                    if (object instanceof String) {
        
                        String value = (String) object;                    //加密  Des加密工具
                        String encryptHexStr = SecureUtil.des(key.getBytes()).encryptHex(value);
                        field.set(paramsObject, encryptHexStr);
                    }
                }
            }
            return paramsObject;
        }
        /**
         * 解密     *     * @param result resultType的实例     * @return T     * @throws IllegalAccessException 字段不可访问异常
         */
        public static <T> T decrypt(T result) throws IllegalAccessException {
        
            //取出resultType的类
            Class<?> resultClass = result.getClass();
            Field[] declaredFields = resultClass.getDeclaredFields();
            for (Field field : declaredFields) {
        
                //取出所有被EncryptDecryptField注解的字段
                EncryptDecryptField sensitiveField = field.getAnnotation(EncryptDecryptField.class);
                if (!Objects.isNull(sensitiveField)) {
        
                    field.setAccessible(true);
                    Object object = field.get(result);                //只支持String的解密
                    if (object instanceof String) {
        
                        String value = (String) object;
                        //对注解的字段进行逐一解密
                        String decryptStr = SecureUtil.des(key.getBytes()).decryptStr(value);
                        log.info("{}字段需要解密,{}解密后的值是{}",field.getName(),value,decryptStr);
                        field.set(result, decryptStr);
                    }
                }
            }
            return result;
        }
    }

#### 定义和配置自定义的mybatis读写拦截器 ####

读取数据拦截器ReadInterceptor.java

package com.example.demo.plugin;
    
    import com.example.demo.anot.EncryptDecryptClass;
    import org.apache.ibatis.executor.resultset.ResultSetHandler;
    import org.apache.ibatis.plugin.*;
    import org.springframework.core.annotation.AnnotationUtils;
    import org.springframework.util.CollectionUtils;
    
    import java.sql.Statement;
    import java.util.ArrayList;
    import java.util.Objects;
    
    @Intercepts({
        
            @Signature(type = ResultSetHandler.class,
                    method = "handleResultSets",
                    args = {
        Statement.class})})
    public class ReadInterceptor implements Interceptor {
        
        @Override
        public Object intercept(Invocation invocation) throws Throwable {
        
            //取出查询的结果
            Object resultObject = invocation.proceed();
            if (Objects.isNull(resultObject)) {
        
                return null;
            }
            //基于selectList
            if (resultObject instanceof ArrayList) {
        
                ArrayList resultList = (ArrayList) resultObject;
                if (!CollectionUtils.isEmpty(resultList) && needToDecrypt(resultList.get(0))) {
        
                    for (Object result : resultList) {
        
                        //逐一解密
                        EncryptDecryptUtil.decrypt(result);
                    }
                }
                //基于selectOne
            } else {
        
                if (needToDecrypt(resultObject)) {
        
                    EncryptDecryptUtil.decrypt(resultObject);
                }
            }
            return resultObject;
        }
    
        private boolean needToDecrypt(Object object) {
        
            Class<?> objectClass = object.getClass();
            EncryptDecryptClass sensitiveData =
                    AnnotationUtils.findAnnotation(objectClass, EncryptDecryptClass.class);
            return Objects.nonNull(sensitiveData);
        }
        
        @Override
        public Object plugin(Object target) {
        
            return Plugin.wrap(target, this);
        }
        
    }

写入数据拦截器WriteInterceptor.java

package com.example.demo.plugin;
    
    import com.example.demo.anot.EncryptDecryptClass;
    import org.apache.ibatis.executor.parameter.ParameterHandler;
    import org.apache.ibatis.plugin.*;
    import org.springframework.core.annotation.AnnotationUtils;
    
    import java.lang.reflect.Field;
    import java.sql.PreparedStatement;
    import java.util.Objects;
    
    
    @Intercepts({
        
            @Signature(type = ParameterHandler.class,
                    method = "setParameters",
                    args = PreparedStatement.class)
    })
    public class WriteInterceptor implements Interceptor {
        
        @Override
        public Object intercept(Invocation invocation) throws Throwable {
        
            //@Signature 指定了 type= parameterHandler 后，
            // 这里的 invocation.getTarget() 便是parameterHandler
            // 若指定ResultSetHandler ，这里则能强转为ResultSetHandler
            ParameterHandler parameterHandler = (ParameterHandler) invocation.getTarget();
            // 获取参数对像，即 mapper 中 paramsType 的实例
            Field parameterField = parameterHandler.getClass().getDeclaredField("parameterObject");
            parameterField.setAccessible(true);        //取出实例
            Object parameterObject = parameterField.get(parameterHandler);
            if (parameterObject != null) {
        
                Class<?> parameterObjectClass = parameterObject.getClass();
    
                //校验该实例的类是否被EncryptDecryptClass所注解
                EncryptDecryptClass encryptDecryptClass =
                        AnnotationUtils.findAnnotation(parameterObjectClass, EncryptDecryptClass.class);
                if (Objects.nonNull(encryptDecryptClass)) {
        
                    //取出当前当前类所有字段，传入加密方法
                    Field[] declaredFields = parameterObjectClass.getDeclaredFields();
                    EncryptDecryptUtil.encrypt(declaredFields, parameterObject);
                }
            }
            return invocation.proceed();
        }
    
        @Override
        public Object plugin(Object o) {
        
            //这里必须写入，会判定是否把当前拦截器启动
            return Plugin.wrap(o, this);
        }
        
    }

配置自定义的mybatis拦截器

package com.example.demo.plugin;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.stereotype.Component;
    
    @Configuration
    @Component
    public class MybatisCryptoConfig {
        
        @Bean
        public ReadInterceptor readInterceptorPlugin(){
        
            return new ReadInterceptor();
        }
    
        @Bean
        public WriteInterceptor writeInterceptorPlugin(){
        
            return new WriteInterceptor();
        }
        
    }

### 测试数据插入和查询的效果 ###

import javax.annotation.Resource;
    @Slf4j
    @SpringBootTest
    public class MyBatisTest {
        
        @Resource
        private AccountMapper accountMapper;
        
        @Test
        void test81901(){
        
            Account build = Account.builder()
                    .username("htgy4")
                    .passwordCiper("tnmt3t")
                    .build();
            accountMapper.insertOne(build);
            //insert插入时，自动加密
            System.err.println(build);
        }
    
        @Test
        void test81902(){
        
            //select查询时,自动解密
            System.out.println(accountMapper.findOneById(14));
            System.err.println(accountMapper.selectUserList(Account.builder()
                    .id(15)
                    .build()));
        }
        
    }

--insret插入操作日志
    2023-06-19 19:50:06.800  INFO 10344 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Starting...
    2023-06-19 19:50:07.165  INFO 10344 --- [           main] com.zaxxer.hikari.HikariDataSource       : HikariPool-1 - Start completed.
    JDBC Connection [HikariProxyConnection@1878045132 wrapping com.mysql.cj.jdbc.ConnectionImpl@3b55dd15] will not be managed by Spring
    ==>  Preparing: insert into t_account(username,password_ciper) values (?,?)
    ==> Parameters: hrwgy4(String),  b72c2ec22d87f504(String)
    <==    Updates: 1
    Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@33feb805]
    Account(id=16, username=hrwgy4,  passwordCiper=b72c2ec22d87f504)
    
    
    --select查询操作日志
    Account(id=14, username=t43t34t,  passwordCiper=aret3t)
    [Account(id=15, username=htgy4,  passwordCiper=tnmt3t)]