SpringBoot利用自定义json序列化器实现敏感字段数据脱敏

落日映苍穹つ 2024-03-17 15:40 16阅读 0赞

## SpringBoot利用自定义json序列化器实现敏感字段数据脱敏 ##

物料准备:

1.hutool依赖

2.自定义的jackson序列化器

3.测试@JsonSerialize效果

### 引入hutool依赖 ###

因为案例代码用到了hutool提供的DesensitizedUtil数据脱敏工具类，这里要引入hutool的依赖。

如果你需要自定义 数据脱敏的逻辑，可以不引入这个依赖

<dependency>
                <groupId>cn.hutool</groupId>
                <artifactId>hutool-all</artifactId>
                <version>5.7.8</version>
            </dependency>

### 自定义jackson序列化器 ###

#### 自定义一个手机号脱敏序列化器 ####

package com.example.demo.plugin;
    
    import cn.hutool.core.util.DesensitizedUtil;
    import com.fasterxml.jackson.core.JsonGenerator;
    import com.fasterxml.jackson.databind.JsonSerializer;
    import com.fasterxml.jackson.databind.SerializerProvider;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.stereotype.Component;
    
    import java.io.IOException;
    @Slf4j
    @Component
    public class MobileMskJsonSerializer extends JsonSerializer<String> {
        
        @Override
        public void serialize(String s,
                              JsonGenerator jsonGenerator,
                              SerializerProvider serializerProvider) throws IOException {
        
    
            String s1 = DesensitizedUtil.mobilePhone(s);
            log.info("mobilePhone数据:{}脱敏后的值是:{}",s,s1);
            jsonGenerator.writeString(s1);
    
    
        }
    }

#### 自定义一个邮箱脱敏序列化器 ####

package com.example.demo.plugin;
    
    import cn.hutool.core.util.DesensitizedUtil;
    import com.fasterxml.jackson.core.JsonGenerator;
    import com.fasterxml.jackson.databind.JsonSerializer;
    import com.fasterxml.jackson.databind.SerializerProvider;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.stereotype.Component;
    
    import java.io.IOException;
    @Slf4j
    @Component
    public class MailMskJsonSerializer extends JsonSerializer<String> {
        
        @Override
        public void serialize(String s, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException {
        
            String s1 = DesensitizedUtil.email(s);
            log.info("email数据:{}脱敏后的值是:{}",s,s1);
            jsonGenerator.writeString(s1);
        }
    }

#### 注册刚刚自定义的json序列化器 ####

package com.example.demo.plugin;
    
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.boot.autoconfigure.jackson.Jackson2ObjectMapperBuilderCustomizer;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    
    @Configuration
    public class JacksonCfg {
        
    
        @Autowired
        private MobileMskJsonSerializer  mobileMskJsonSerializer;
        @Autowired
        private MailMskJsonSerializer mailMskJsonSerializer;
    
        /**
         * 可以同时注册多个自定义的jackson 序列化器
         * @return
         */
        @Bean
        public Jackson2ObjectMapperBuilderCustomizer objectMapperBuilderCustomizer(){
        
            return builder -> {
        
                builder.serializerByType(String.class,mobileMskJsonSerializer);
                builder.serializerByType(String.class,mailMskJsonSerializer);
            };
        }
    
    
    }

### 测试@JsonSerialize效果 ###

#### 在实体类中使用@JsonSerialize注解 ####

package com.example.demo.orm.po;
    
    import cn.hutool.core.util.DesensitizedUtil;
    import com.example.demo.plugin.MailMskJsonSerializer;
    import com.example.demo.plugin.MobileMskJsonSerializer;
    import com.fasterxml.jackson.databind.annotation.JsonSerialize;
    import lombok.AllArgsConstructor;
    import lombok.Builder;
    import lombok.Data;
    import lombok.NoArgsConstructor;
    import java.io.Serializable;
    
    
    @Data
    @AllArgsConstructor
    @NoArgsConstructor
    @Builder
    public class Account implements Serializable {
        
        private static final long serialVersionUID = -8114863398578320034L;
        private Integer id;
        private String username;
    
    
    
        // @JsonSerialize 既可以用在字段上 ，也可以用在类上
        // 用在字段上时，只对某个字段生效
        // 用在类上时，对类中所有字段生效.(优先级更高)
        // 一般常用在 字段上，对某个字段做特殊的序列化处理
    
        //使用 手机号脱敏序列号器
        @JsonSerialize(using = MobileMskJsonSerializer.class)
        private String mobile;
    
        //使用 邮箱脱敏序列号器
        @JsonSerialize(using = MailMskJsonSerializer.class)
        private String mail;
    
    }

#### 测试查询结果 ####

@Test
    void test81902() throws JsonProcessingException {
        
            Account oneById = accountMapper.findOneById(17);
            System.err.println(oneById);
        
            //使用jackson 序列化java对象
            ObjectMapper objectMapper = new ObjectMapper();
            String msk = objectMapper.writerWithDefaultPrettyPrinter()
                    .writeValueAsString(oneById);
            System.err.println(msk);
     }

Closing non transactional SqlSession [org.apache.ibatis.session.defaults.DefaultSqlSession@7135ce0a]
    Account(id=17, username=ert, mobile=13273629312, mail=kew5612@163.com)
    2023-07-05 20:28:38.536  INFO 17952 --- [           main] c.e.demo.plugin.MobileMskJsonSerializer  : mobilePhone数据:13273629312脱敏后的值是:132****9312
    2023-07-05 20:28:38.537  INFO 17952 --- [           main] c.e.demo.plugin.MailMskJsonSerializer    : email数据:kew5612@163.com脱敏后的值是:k******@163.com
    {
      "id" : 17,
      "username" : "ert",
      "mobile" : "132****9312",
      "mail" : "k******@163.com"
    }