平台戚里带崇墉,网站推广及seo方案,做办公用品网站资料怎么收集,做平台网站需要多少钱1 背景
需求是某些接口返回的信息#xff0c;涉及到敏感数据的必须进行脱敏操作 2 思路
①要做成可配置多策略的脱敏操作#xff0c;要不然一个个接口进行脱敏操作#xff0c;重复的工作量太多#xff0c;很显然违背了“多写一行算我输”的程序员规范。思来想去#xff…1 背景
需求是某些接口返回的信息涉及到敏感数据的必须进行脱敏操作 2 思路
①要做成可配置多策略的脱敏操作要不然一个个接口进行脱敏操作重复的工作量太多很显然违背了“多写一行算我输”的程序员规范。思来想去定义数据脱敏注解和数据脱敏逻辑的接口 在返回类上对需要进行脱敏的属性加上并指定对应的脱敏策略操作。
②接下来我只需要拦截控制器返回的数据找到带有脱敏注解的属性操作即可一开始打算用 ControllerAdvice 去实现但发现需要自己去反射类获取注解。当返回对象比较复杂需要递归去反射性能一下子就会降低于是换种思路我想到平时使用的 JsonFormat跟我现在的场景很类似通过自定义注解跟字段解析器对字段进行自定义解析tql。 3 实现代码 3.1自定义数据注解并可以配置数据脱敏策略
package com.wkf.workrecord.tools.desensitization; import java.lang.annotation.*; /** * 注解类 * author wuKeFan * date 2023-02-20 09:36:39 */ Target({ElementType.FIELD, ElementType.TYPE}) Retention(RetentionPolicy.RUNTIME) Documented public interface DataMasking { DataMaskingFunc maskFunc() default DataMaskingFunc.NO_MASK; }
3.2 自定义 Serializer参考 jackson 的 StringSerializer下面的示例只针对 String 类型进行脱敏
DataMaskingOperation.class:
package com.wkf.workrecord.tools.desensitization; /** * 接口脱敏操作接口类 * author wuKeFan * date 2023-02-20 09:37:48 */ public interface DataMaskingOperation { String MASK_CHAR “*”; String mask(String content, String maskChar); }
DataMaskingFunc.class:
package com.wkf.workrecord.tools.desensitization; import org.springframework.util.StringUtils; /** * 脱敏转换操作枚举类 * author wuKeFan * date 2023-02-20 09:38:35 */ public enum DataMaskingFunc { /** * 脱敏转换器 */ NO_MASK((str, maskChar) - { return str; }), ALL_MASK((str, maskChar) - { if (StringUtils.hasLength(str)) { StringBuilder sb new StringBuilder(); for (int i 0; i str.length(); i) { sb.append(StringUtils.hasLength(maskChar) ? maskChar : DataMaskingOperation.MASK_CHAR); } return sb.toString(); } else { return str; } }); private final DataMaskingOperation operation; private DataMaskingFunc(DataMaskingOperation operation) { this.operation operation; } public DataMaskingOperation operation() { return this.operation; } }
DataMaskingSerializer.class:
package com.wkf.workrecord.tools.desensitization; import com.fasterxml.jackson.core.JsonGenerator; import com.fasterxml.jackson.databind.JavaType; import com.fasterxml.jackson.databind.JsonMappingException; import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.SerializerProvider; import com.fasterxml.jackson.databind.jsonFormatVisitors.JsonFormatVisitorWrapper; import com.fasterxml.jackson.databind.jsontype.TypeSerializer; import com.fasterxml.jackson.databind.ser.std.StdScalarSerializer; import java.io.IOException; import java.util.Objects; /** * 自定义Serializer * author wuKeFan * date 2023-02-20 09:39:47 */ public final class DataMaskingSerializer extends StdScalarSerializer { private final DataMaskingOperation operation; public DataMaskingSerializer() { super(String.class, false); this.operation null; } public DataMaskingSerializer(DataMaskingOperation operation) { super(String.class, false); this.operation operation; } public boolean isEmpty(SerializerProvider prov, Object value) { String str (String)value; return str.isEmpty(); } public void serialize(Object value, JsonGenerator gen, SerializerProvider provider) throws IOException { if (Objects.isNull(operation)) { String content DataMaskingFunc.ALL_MASK.operation().mask((String) value, null); gen.writeString(content); } else { String content operation.mask((String) value, null); gen.writeString(content); } } public final void serializeWithType(Object value, JsonGenerator gen, SerializerProvider provider, TypeSerializer typeSer) throws IOException { this.serialize(value, gen, provider); } public JsonNode getSchema(SerializerProvider provider) { return this.createSchemaNode(“string”, true); } public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper visitor, JavaType typeHint) throws JsonMappingException { this.visitStringFormat(visitor, typeHint); } }
3.3 自定义 AnnotationIntrospector适配我们自定义注解返回相应的 Serializer
package com.wkf.workrecord.tools.desensitization; import com.fasterxml.jackson.databind.introspect.Annotated; import com.fasterxml.jackson.databind.introspect.NopAnnotationIntrospector; import lombok.extern.slf4j.Slf4j; /** * author wuKeFan * date 2023-02-20 09:43:41 */ Slf4j public class DataMaskingAnnotationIntroSpector extends NopAnnotationIntrospector { Override public Object findSerializer(Annotated am) { DataMasking annotation am.getAnnotation(DataMasking.class); if (annotation ! null) { return new DataMaskingSerializer(annotation.maskFunc().operation()); } return null; } }
3.4 覆盖 ObjectMapper
package com.wkf.workrecord.tools.desensitization; import com.fasterxml.jackson.databind.AnnotationIntrospector; import com.fasterxml.jackson.databind.ObjectMapper; import com.fasterxml.jackson.databind.introspect.AnnotationIntrospectorPair; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.context.annotation.Primary; import org.springframework.http.converter.json.Jackson2ObjectMapperBuilder; /** * 覆盖 ObjectMapper * author wuKeFan * date 2023-02-20 09:44:35 */ Configuration(proxyBeanMethods false) public class DataMaskConfiguration { Configuration(proxyBeanMethods false) ConditionalOnClass({Jackson2ObjectMapperBuilder.class}) static class JacksonObjectMapperConfiguration { JacksonObjectMapperConfiguration() { } Bean Primary ObjectMapper jacksonObjectMapper(Jackson2ObjectMapperBuilder builder) { ObjectMapper objectMapper builder.createXmlMapper(false).build(); AnnotationIntrospector ai objectMapper.getSerializationConfig().getAnnotationIntrospector(); AnnotationIntrospector newAi AnnotationIntrospectorPair.pair(ai, new DataMaskingAnnotationIntroSpector()); objectMapper.setAnnotationIntrospector(newAi); return objectMapper; } } }
3.5 返回对象加上注解
package com.wkf.workrecord.tools.desensitization; import lombok.Data; import java.io.Serializable; /** * 需要脱敏的实体类 * author wuKeFan * date 2023-02-20 09:35:52 */ Data public class User implements Serializable { /** * 主键ID */ private Long id; /** * 姓名 */ DataMasking(maskFunc DataMaskingFunc.ALL_MASK) private String name; /** * 年龄 */ private Integer age; /** * 邮箱 */ DataMasking(maskFunc DataMaskingFunc.ALL_MASK) private String email; }
4 测试
我们写一个Controller测试一下看是不是我们需要的效果 4.1 测试的Controller类DesensitizationController.class如下:
package com.wkf.workrecord.tools.desensitization; import com.biboheart.brick.model.BhResponseResult; import com.wkf.workrecord.utils.ResultVOUtils; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestMethod; import org.springframework.web.bind.annotation.RestController; /** * 测试接口脱敏测试控制类 * author wuKeFan * date 2022-06-21 17:23 */ Slf4j RestController RequiredArgsConstructor RequestMapping(“/desensitization/”) public class DesensitizationController { RequestMapping(value “test”, method {RequestMethod.GET, RequestMethod.POST}) public BhResponseResult test() { User user new User(); user.setAge(1); user.setEmail(“123456789qq.com”); user.setName(“吴名氏”); user.setId(1L); return ResultVOUtils.success(user); } }
4.2 PostMan接口请求,效果符合预期,如图:
———————————————— 版权声明本文为CSDN博主「吴名氏.」的原创文章遵循CC 4.0 BY-SA版权协议转载请附上原文出处链接及本声明。 原文链接https://blog.csdn.net/qq_37284798/article/details/129118284
