mybatis拦截器处理敏感字段

利用mybatis拦截器对数据库敏感字段加解密

前言

由于公司业务要求,需要在不影响已有业务上对 数据库中已有数据的敏感字段加密解密,个人解决方案利用mybatis的拦截器加密解密敏感字段

思路解析

  1. 利用注解标明需要加密解密的entity类对象以及其中的数据
  2. mybatis拦截Executor.class对象中的query,update方法
  3. 在方法执行前对parameter进行加密解密,在拦截器执行后,解密返回的结果

代码

1、配置拦截器(interceptor后为自己拦截器的包路径)

<plugins>
		<plugin interceptor="com.github.miemiedev.mybatis.paginator.OffsetLimitInterceptor">
			<property name="dialectClass" value="com.github.miemiedev.mybatis.paginator.dialect.OracleDialect" />
		</plugin>
		<plugin interceptor="com.XXX.XXXX.service.encryptinfo.DaoInterceptor" />
	</plugins>

2、拦截器的实现
特别注意:因为Dao方法参数有可能单一参数,多参数map形式,以及entity对象参数类型,所以不通类型需有不通的处理方式(本文参数 单一字符串和entity对象,返回的结果集 List<?> 和entity)
后续在拦截器中添加了相应的开关,控制参数是否加密查询,解密已实现兼容

package com.ips.fpms.service.encryptinfo;

import java.lang.annotation.Annotation;
import java.lang.reflect.Method;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.Properties;

import com.xxx.xxx.dao.WhiteListDao;
import com.xxx.xxx.entity.db.WhiteListEntity;
import com.xxx.xxx.service.util.SpringBeanUtils;
import org.apache.ibatis.executor.Executor;
import org.apache.ibatis.mapping.MappedStatement;
import org.apache.ibatis.plugin.Interceptor;
import org.apache.ibatis.plugin.Intercepts;
import org.apache.ibatis.plugin.Invocation;
import org.apache.ibatis.plugin.Plugin;
import org.apache.ibatis.plugin.Signature;
import org.apache.ibatis.session.ResultHandler;
import org.apache.ibatis.session.RowBounds;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import com.xxx.xxx.annotation.EncryptField;
import com.xxx.xxx.annotation.EncryptMethod;
import com.xxx.xxx.common.utils.CloneUtil;
import com.xxx.core.psfp.common.support.JsonUtils;
import com.xxx.xxx.service.util.CryptPojoUtils;

@Intercepts({
    @Signature(type=Executor.class,method="update",args={MappedStatement.class,Object.class}),
    @Signature(type=Executor.class,method="query",args={MappedStatement.class,Object.class,RowBounds.class,ResultHandler.class})
})
public class EncryptDaoInterceptor implements Interceptor{
	private final Logger logger = LoggerFactory.getLogger(EncryptDaoInterceptor.class);
	private WhiteListDao whiteListDao;
	static int MAPPED_STATEMENT_INDEX = 0;
	static int PARAMETER_INDEX = 1;
	static int ROWBOUNDS_INDEX = 2;
	static int RESULT_HANDLER_INDEX = 3;
	static String ENCRYPTFIELD = "1";
	static String DECRYPTFIELD = "2";
	private static final String ENCRYPT_KEY = "encry146local";
	private static final String ENCRYPT_NUM = "146";
	private static boolean ENCRYPT_SWTICH = true;
	/**
	 * 是否进行加密查询
	 * @return 1 true 代表加密 0 false 不加密
	 */
	private boolean getFuncSwitch(){
		if(whiteListDao == null){
			whiteListDao = SpringBeanUtils.getBean("whiteListDao",WhiteListDao.class);
		}
		try{
			WhiteListEntity entity = whiteListDao.selectOne(ENCRYPT_KEY,ENCRYPT_NUM);
			if(entity!=null && "1".equals(entity.getFlag())){
				ENCRYPT_SWTICH = true;
			}else{
				ENCRYPT_SWTICH = false;
			}
		}catch (Exception e){
			logger.error(this.getClass().getName()+".getFuncSwitch 白名单查询异常,默认本地数据加密关闭[]:",e.getStackTrace());
			return false;
		}

		return ENCRYPT_SWTICH;
	}

	/**
	 * 校验执行器方法 是否在白名单中
	 * @param statementid
	 * @return true 包含 false 不包含
	 */
	private boolean isWhiteList(String statementid){
		boolean result = false;
		String whiteStatementid = "com.ips.fpms.dao.WhiteListDao.selectOne";
		if(whiteStatementid.indexOf(statementid)!=-1){
			result = true;
		}
		return result;
	}
	@Override
	public Object intercept(Invocation invocation) throws Throwable {
		logger.info("EncryptDaoInterceptor.intercept开始执行==> ");
		MappedStatement statement = (MappedStatement) invocation.getArgs()[MAPPED_STATEMENT_INDEX];
		Object parameter = invocation.getArgs()[PARAMETER_INDEX];
		logger.info(statement.getId()+"未加密参数串:"+JsonUtils.object2jsonString(CloneUtil.deepClone(parameter)));
		/*
		 *
		 * 判断是否拦截白名单 或 加密开关是否配置,
		 * 如果不在白名单中,并且本地加密开关 已打开 执行参数加密
		 *
		 *  */
		if(!isWhiteList(statement.getId()) && getFuncSwitch()){
			parameter = encryptParam(parameter, invocation);
			logger.info(statement.getId()+"加密后参数:"+JsonUtils.object2jsonString(CloneUtil.deepClone(parameter)));
		}
		invocation.getArgs()[PARAMETER_INDEX] = parameter;
		Object returnValue = invocation.proceed();
		logger.info(statement.getId()+"未解密结果集:"+JsonUtils.object2jsonString(CloneUtil.deepClone(returnValue)));
		returnValue = decryptReslut(returnValue, invocation);
		logger.info(statement.getId()+"解密后结果集:"+JsonUtils.object2jsonString(CloneUtil.deepClone(returnValue)));
		logger.info("EncryptDaoInterceptor.intercept执行结束==> ");
		return returnValue;
	}
	/**
	 * 解密结果集
	 * @param @param returnValue
	 * @param @param invocation
	 * @param @return
	 * @return Object
	 * @throws 
	 *
	 */
	public Object decryptReslut(Object returnValue,Invocation invocation){
		MappedStatement statement = (MappedStatement) invocation.getArgs()[MAPPED_STATEMENT_INDEX];
		if(returnValue!=null){
	       	 if(returnValue instanceof ArrayList<?>){
	       		 List<?> list = (ArrayList<?>) returnValue;
	       		 List<Object> newList  = new ArrayList<Object>();
	       		 if (1 <= list.size()){
	       			 for(Object object:list){
	       				 Object obj = CryptPojoUtils.decrypt(object);
	       				 newList.add(obj);
	       			 }
	       			 returnValue = newList;
	       		 }
	       	 }else if(returnValue instanceof Map){
	       		String[] fields = getEncryFieldList(statement,DECRYPTFIELD);
	       		if(fields!=null){
	       			returnValue = CryptPojoUtils.getDecryptMapValue(returnValue,fields);
	       		}
	       	 }else{
	       		 returnValue = CryptPojoUtils.decrypt(returnValue);
	       	 }
        }
		return returnValue;
	}
	/***
	 * 针对不同的参数类型进行加密
	 * @param @param parameter
	 * @param @param invocation
	 * @param @return
	 * @return Object
	 * @throws 
	 *
	 */
	public Object encryptParam(Object parameter,Invocation invocation){
		MappedStatement statement = (MappedStatement) invocation.getArgs()[MAPPED_STATEMENT_INDEX];
		try {
			if(parameter instanceof String){
				if(isEncryptStr(statement)){
					parameter = CryptPojoUtils.encryptStr(parameter);
				}
			}else if(parameter instanceof Map){
				String[] fields = getEncryFieldList(statement,ENCRYPTFIELD);
				if(fields!=null){
					parameter = CryptPojoUtils.getEncryptMapValue(parameter,fields);
				}
			}else{
				parameter = CryptPojoUtils.encrypt(parameter);
			}
		} catch (ClassNotFoundException e) {
			e.printStackTrace();
			logger.info("EncryptDaoInterceptor.encryptParam方法异常==> " + e.getMessage());
		}
		return parameter;
	}
	@Override
	public Object plugin(Object target) {
		return Plugin.wrap(target, this);
	}

	@Override
	public void setProperties(Properties properties) {

	}
	/**
	 * 获取参数map中需要加密字段
	 * @param statement
	 * @param type
	 * @return List<String>
	 * @throws 
	 *
	 */
	private String[] getEncryFieldList(MappedStatement statement,String type){
		String[] strArry = null;
		Method method = getDaoTargetMethod(statement);
		Annotation annotation =method.getAnnotation(EncryptMethod.class);
		if(annotation!=null){
			if(type.equals(ENCRYPTFIELD)){
				String encryString = ((EncryptMethod) annotation).encrypt();
				if(!"".equals(encryString)){
					strArry =encryString.split(",");
				}
			}else if(type.equals(DECRYPTFIELD)){
				String encryString = ((EncryptMethod) annotation).decrypt();
				if(!"".equals(encryString)){
					strArry =encryString.split(",");
				}
			}else{
				strArry = null;
			}
		}
		return strArry;
	}
	/**
	 * 获取Dao层接口方法
	 * @param @return
	 * @return Method
	 * @throws 
	 *
	 */
	private Method getDaoTargetMethod(MappedStatement mappedStatement){
		Method method = null;
		try {
			String namespace = mappedStatement.getId();
		    String className = namespace.substring(0,namespace.lastIndexOf("."));
		    String methedName= namespace.substring(namespace.lastIndexOf(".") + 1,namespace.length());
			Method[] ms = Class.forName(className).getMethods();
			for(Method m : ms){
		        if(m.getName().equals(methedName)){
		        	method = m;
		        	break;
		        }
			}
		} catch (SecurityException e) {
			e.printStackTrace();
			logger.info("EncryptDaoInterceptor.getDaoTargetMethod方法异常==> " + e.getMessage());
			return method;
			
		} catch (ClassNotFoundException e) {
			e.printStackTrace();
			logger.info("EncryptDaoInterceptor.getDaoTargetMethod方法异常==> " + e.getMessage());
			return method;
		}
		return method;
	}
	/**
	 * 判断字符串是否需要加密
	 * @param @param mappedStatement
	 * @param @return
	 * @return boolean
	 * @throws 
	 *
	 */
	private boolean isEncryptStr(MappedStatement mappedStatement) throws ClassNotFoundException{
		boolean reslut = false;
		try {
				Method m = getDaoTargetMethod(mappedStatement);
	        	m.setAccessible(true);
	        	Annotation[][] parameterAnnotations = m.getParameterAnnotations();
		        	 if (parameterAnnotations != null && parameterAnnotations.length > 0) { 
		        		 for (Annotation[] parameterAnnotation : parameterAnnotations) {  
		        	         for (Annotation annotation : parameterAnnotation) {  
		        	          if (annotation instanceof EncryptField) {  
		        	        	  reslut = true;
		        	          }
		        	      }
		        	 }
	        	 }
		} catch (SecurityException e) {
			e.printStackTrace();
			logger.info("EncryptDaoInterceptor.isEncryptStr异常:==> " + e.getMessage());
			reslut = false;
		}
		return reslut;
	}

}


2、注解的entity对象

//是否需要加密解密对象
@EncryptDecryptClass
public class MerDealInfoRequest extends PagingReqMsg {
//属性定义
	@EncryptField
    @DecryptField
    private String cardNo;
}

3、dao方法中的单一参数

List<Dealer> selectDealerAndMercode(@EncryptField String idcardno);

4、封装的工具类(EncryptDecryptUtil.decryptStrValue 解密方法 EncryptDecryptUtil.decryptStrValue 加密方法)

package com.xxx.xxx.service.util;

import java.lang.reflect.Field;
import java.util.ArrayList;

import org.apache.commons.lang.StringUtils;
import org.apache.pdfbox.Encrypt;
import org.apache.poi.ss.formula.functions.T;

import com.xxx.xxx.annotation.DecryptField;
import com.xxx.xxx.annotation.EncryptDecryptClass;
import com.xxx.xxx.annotation.EncryptField;
import com.xxx.xxx.common.utils.EncryptDecryptUtil;

public class CryptPojoUtils {
	 /**
     * 对象t注解字段加密
     * @param t
     * @param <T>
     * @return
     */
    public static <T> T encrypt(T t) {
    	if(isEncryptAndDecrypt(t)){
	        Field[] declaredFields = t.getClass().getDeclaredFields();
	        try {
	            if (declaredFields != null && declaredFields.length > 0) {
	                for (Field field : declaredFields) {
	                    if (field.isAnnotationPresent(EncryptField.class) && field.getType().toString().endsWith("String")) {
	                        field.setAccessible(true);
	                        String fieldValue = (String) field.get(t);
	                        if (StringUtils.isNotEmpty(fieldValue)) {
	    	                    field.set(t, EncryptDecryptUtil.encryStrValue(fieldValue) );
	                        }
	                        field.setAccessible(false);
	                    }
	                }
	            }
	        } catch (IllegalAccessException e) {
	            throw new RuntimeException(e);
	        }
    	}
        return t;
    }
    /**
     * 加密单独的字符串
     *
     * @param @param t
     * @param @return
     * @return T
     * @throws 
     *
     */
    public static <T> T EncryptStr(T t){
    	if(t instanceof String){
    		t = (T) EncryptDecryptUtil.encryStrValue((String) t);
    	}
    	return t;
    }
    /**
     * 对含注解字段解密
     * @param t
     * @param <T>
     */
    public static <T> T decrypt(T t) {
    	if(isEncryptAndDecrypt(t)){
	        Field[] declaredFields = t.getClass().getDeclaredFields();
	        try {
	            if (declaredFields != null && declaredFields.length > 0) {
	                for (Field field : declaredFields) {
	                    if (field.isAnnotationPresent(DecryptField.class) && field.getType().toString().endsWith("String")) {
	                        field.setAccessible(true);
	                        String fieldValue = (String)field.get(t);
	                        if(StringUtils.isNotEmpty(fieldValue)) {
	                            field.set(t, EncryptDecryptUtil.decryptStrValue(fieldValue));
	                        }
	                    }
	                }
	            }
	        } catch (IllegalAccessException e) {
	            throw new RuntimeException(e);
	        }
        }
         return t;
    }
    /**
     * 判断是否需要加密解密的类
     * @param @param t
     * @param @return
     * @return Boolean
     * @throws 
     *
     */
    public static <T> Boolean isEncryptAndDecrypt(T t){
    	Boolean reslut = false;
    	if(t!=null){
    		Object object = t.getClass().getAnnotation(EncryptDecryptClass.class);
        	if(object != null){
        		reslut = true;
        	}
    	}
		return reslut;
    }
}

趟过的坑(敲黑板重点)

1、在实现上述功能后的测试中,其中select查询方法的参数在加密成功后,但是Executor执行器执行方法参数依旧为未加密的参数,找各路大神都没有解决的思路,最后发现项目中引用了开源的分页插件, OffsetLimitInterceptor拦截器把参数设置成为final的,所以自定义拦截器没有修改成功这个sql参数;

解决办法:自定义拦截器放到这个拦截器后,自定义拦截器先执行就可以了

<plugins>
	    //就是这个拦截器 
		<plugin interceptor="com.github.miemiedev.mybatis.paginator.OffsetLimitInterceptor">
			<property name="dialectClass" value="com.github.miemiedev.mybatis.paginator.dialect.OracleDialect" />
		</plugin>
		<plugin interceptor="com.ips.fpms.service.encryptinfo.DaoInterceptor" />
	</plugins>
public Object intercept(final Invocation invocation) throws Throwable {
        final Executor executor = (Executor) invocation.getTarget();
        final Object[] queryArgs = invocation.getArgs();
        final MappedStatement ms = (MappedStatement)queryArgs[MAPPED_STATEMENT_INDEX];
        //拦截器把参数设置成为final的,所以自定义拦截器没有修改到这个参数
        final Object parameter = queryArgs[PARAMETER_INDEX];
        final RowBounds rowBounds = (RowBounds)queryArgs[ROWBOUNDS_INDEX];
        final PageBounds pageBounds = new PageBounds(rowBounds);

        final int offset = pageBounds.getOffset();
        final int limit = pageBounds.getLimit();
        final int page = pageBounds.getPage();
        .....省略代码....
        }

2、数据库存量数据处理
在添加拦截器后,必须对数据库的存量数据进行处理,如果不进行处理,查询参数已经加密,但是数据依旧是明文,会导致查询条件不匹配

结尾话

个人的代码比较乱 贴上好看的人的链接(https://www.cnblogs.com/liu-s/p/8000293.html
可以借鉴

发布了38 篇原创文章 · 获赞 14 · 访问量 11万+
展开阅读全文

没有更多推荐了,返回首页

©️2019 CSDN 皮肤主题: 大白 设计师: CSDN官方博客

分享到微信朋友圈

×

扫一扫,手机浏览