河南平顶山网站建设与管理专业,门户网站建设先进性,文化宣传 加强网站建设 创办网站,企业网站建设公司 宣武1 背景需求是某些接口返回的信息#xff0c;涉及到敏感数据的必须进行脱敏操作2 思路①要做成可配置多策略的脱敏操作#xff0c;要不然一个个接口进行脱敏操作#xff0c;重复的工作量太多#xff0c;很显然违背了“多写一行算我输”的程序员规范。思来想去#xff0c;定…1 背景需求是某些接口返回的信息涉及到敏感数据的必须进行脱敏操作2 思路①要做成可配置多策略的脱敏操作要不然一个个接口进行脱敏操作重复的工作量太多很显然违背了“多写一行算我输”的程序员规范。思来想去定义数据脱敏注解和数据脱敏逻辑的接口 在返回类上对需要进行脱敏的属性加上并指定对应的脱敏策略操作。②接下来我只需要拦截控制器返回的数据找到带有脱敏注解的属性操作即可一开始打算用 ControllerAdvice 去实现但发现需要自己去反射类获取注解。当返回对象比较复杂需要递归去反射性能一下子就会降低于是换种思路我想到平时使用的 JsonFormat跟我现在的场景很类似通过自定义注解跟字段解析器对字段进行自定义解析tql。3 实现代码3.1自定义数据注解并可以配置数据脱敏策略package com.wkf.workrecord.tools.desensitization;import java.lang.annotation.*;/*** 注解类* author wuKeFan* date 2023-02-20 09:36:39*/Target({ElementType.FIELD, ElementType.TYPE})
Retention(RetentionPolicy.RUNTIME)
Documented
public interface DataMasking {DataMaskingFunc maskFunc() default DataMaskingFunc.NO_MASK;}3.2 自定义 Serializer参考 jackson 的 StringSerializer下面的示例只针对 String 类型进行脱敏DataMaskingOperation.class:package com.wkf.workrecord.tools.desensitization;/*** 接口脱敏操作接口类* author wuKeFan* date 2023-02-20 09:37:48*/
public interface DataMaskingOperation {String MASK_CHAR *;String mask(String content, String maskChar);}DataMaskingFunc.class:package com.wkf.workrecord.tools.desensitization;import org.springframework.util.StringUtils;/*** 脱敏转换操作枚举类* author wuKeFan* date 2023-02-20 09:38:35*/
public enum DataMaskingFunc {/*** 脱敏转换器*/NO_MASK((str, maskChar) - {return str;}),ALL_MASK((str, maskChar) - {if (StringUtils.hasLength(str)) {StringBuilder sb new StringBuilder();for (int i 0; i str.length(); i) {sb.append(StringUtils.hasLength(maskChar) ? maskChar : DataMaskingOperation.MASK_CHAR);}return sb.toString();} else {return str;}});private final DataMaskingOperation operation;private DataMaskingFunc(DataMaskingOperation operation) {this.operation operation;}public DataMaskingOperation operation() {return this.operation;}}DataMaskingSerializer.class:package com.wkf.workrecord.tools.desensitization;import com.fasterxml.jackson.core.JsonGenerator;
import com.fasterxml.jackson.databind.JavaType;
import com.fasterxml.jackson.databind.JsonMappingException;
import com.fasterxml.jackson.databind.JsonNode;
import com.fasterxml.jackson.databind.SerializerProvider;
import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper;
import com.fasterxml.jackson.databind.jsontype.TypeSerializer;
import com.fasterxml.jackson.databind.ser.std.StdScalarSerializer;import java.io.IOException;
import java.util.Objects;/*** 自定义Serializer* author wuKeFan* date 2023-02-20 09:39:47*/
public final class DataMaskingSerializer extends StdScalarSerializerObject {private final DataMaskingOperation operation;public DataMaskingSerializer() {super(String.class, false);this.operation null;}public DataMaskingSerializer(DataMaskingOperation operation) {super(String.class, false);this.operation operation;}public boolean isEmpty(SerializerProvider prov, Object value) {String str (String)value;return str.isEmpty();}public void serialize(Object value, JsonGenerator gen, SerializerProvider provider) throws IOException {if (Objects.isNull(operation)) {String content DataMaskingFunc.ALL_MASK.operation().mask((String) value, null);gen.writeString(content);} else {String content operation.mask((String) value, null);gen.writeString(content);}}public final void serializeWithType(Object value, JsonGenerator gen, SerializerProvider provider, TypeSerializer typeSer) throws IOException {this.serialize(value, gen, provider);}public JsonNode getSchema(SerializerProvider provider) {return this.createSchemaNode(string, true);}public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper visitor, JavaType typeHint) throws JsonMappingException {this.visitStringFormat(visitor, typeHint);}
}3.3 自定义 AnnotationIntrospector适配我们自定义注解返回相应的 Serializerpackage com.wkf.workrecord.tools.desensitization;import com.fasterxml.jackson.databind.introspect.Annotated;
import com.fasterxml.jackson.databind.introspect.NopAnnotationIntrospector;
import lombok.extern.slf4j.Slf4j;/*** author wuKeFan* date 2023-02-20 09:43:41*/
Slf4j
public class DataMaskingAnnotationIntroSpector extends NopAnnotationIntrospector {Overridepublic Object findSerializer(Annotated am) {DataMasking annotation am.getAnnotation(DataMasking.class);if (annotation ! null) {return new DataMaskingSerializer(annotation.maskFunc().operation());}return null;}}3.4 覆盖 ObjectMapperpackage com.wkf.workrecord.tools.desensitization;import com.fasterxml.jackson.databind.AnnotationIntrospector;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.introspect.AnnotationIntrospectorPair;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder;/*** 覆盖 ObjectMapper* author wuKeFan* date 2023-02-20 09:44:35*/
Configuration(proxyBeanMethods false)
public class DataMaskConfiguration {Configuration(proxyBeanMethods false)ConditionalOnClass({Jackson2ObjectMapperBuilder.class})static class JacksonObjectMapperConfiguration {JacksonObjectMapperConfiguration() {}BeanPrimaryObjectMapper jacksonObjectMapper(Jackson2ObjectMapperBuilder builder) {ObjectMapper objectMapper builder.createXmlMapper(false).build();AnnotationIntrospector ai objectMapper.getSerializationConfig().getAnnotationIntrospector();AnnotationIntrospector newAi AnnotationIntrospectorPair.pair(ai, new DataMaskingAnnotationIntroSpector());objectMapper.setAnnotationIntrospector(newAi);return objectMapper;}}}
3.5 返回对象加上注解package com.wkf.workrecord.tools.desensitization;import lombok.Data;import java.io.Serializable;/*** 需要脱敏的实体类* author wuKeFan* date 2023-02-20 09:35:52*/
Data
public class User implements Serializable {/*** 主键ID*/private Long id;/*** 姓名*/DataMasking(maskFunc DataMaskingFunc.ALL_MASK)private String name;/*** 年龄*/private Integer age;/*** 邮箱*/DataMasking(maskFunc DataMaskingFunc.ALL_MASK)private String email;}4 测试我们写一个Controller测试一下看是不是我们需要的效果4.1 测试的Controller类DesensitizationController.class如下:package com.wkf.workrecord.tools.desensitization;import com.biboheart.brick.model.BhResponseResult;
import com.wkf.workrecord.utils.ResultVOUtils;
import lombok.RequiredArgsConstructor;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RestController;/*** 测试接口脱敏测试控制类* author wuKeFan* date 2022-06-21 17:23*/
Slf4j
RestController
RequiredArgsConstructor
RequestMapping(/desensitization/)
public class DesensitizationController {RequestMapping(value test, method {RequestMethod.GET, RequestMethod.POST})public BhResponseResultUser test() {User user new User();user.setAge(1);user.setEmail(123456789qq.com);user.setName(吴名氏);user.setId(1L);return ResultVOUtils.success(user);}}
4.2 PostMan接口请求,效果符合预期,如图:
