通过注解实现接口返回数据脱敏实现

胡八一、

已于 2022-08-15 18:05:39 修改

阅读量204

点赞数

分类专栏： java 文章标签： java spring spring boot

于 2022-08-15 17:55:04 首次发布

原文链接：https://juejin.cn/post/7110110794188062727

版权

java 专栏收录该内容

88 篇文章 5 订阅

订阅专栏

该博客介绍了如何通过自定义注解和Jackson序列化器实现数据脱敏，避免重复工作。作者创建了一个DataMasking注解，定义了不同的脱敏策略，并实现了基于Jackson的序列化器，动态处理带有注解的属性，以达到高效且灵活的数据脱敏效果。

摘要由CSDN通过智能技术生成

思路

要做成可配置多策略的脱敏操作，要不然一个个接口进行脱敏操作，重复的工作量太多，很显然违背了“多写一行算我输”的程序员规范，思来想去，定义数据脱敏注解和数据脱敏逻辑的接口，在返回类上，对需要进行脱敏的属性加上，并指定对应的脱敏策略操作
接下来我只需要拦截控制器返回的数据，找到带有脱敏注解的属性操作即可，一开始打算用@ControllerAdvice去实现，但发现需要自己去反射类获取注解，当返回对象比较复杂，需要递归去反射，性能一下子就会降低，于是换种思路，我想到平时使用的@JsonFormat，跟我现在的场景很类似，通过自定义注解跟字段解析器，对字段进行自定义解析，tql

代码

依赖
可根据自己的情况进行调整或者使用springboot项目：

<dependencies>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
            <version>3.12.0</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-core</artifactId>
            <version>2.13.3</version>
        </dependency>
        <dependency>
            <groupId>com.fasterxml.jackson.core</groupId>
            <artifactId>jackson-databind</artifactId>
            <version>2.13.3</version>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>1.18.24</version>
        </dependency>
    </dependencies>

自定义数据注解，并可以配置数据脱敏策略

@Target({ElementType.FIELD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface DataMasking {

    DataMaskingFunc maskFunc() default DataMaskingFunc.NO_MASK;
}

自定义Serializer，参考jackson的StringSerializer，下面的示例只针对String类型进行脱敏

DataMaskingOperation

public interface DataMaskingOperation {

    String MASK_CHAR = "*";
    
    String mask(String content, String maskChar);

}

DataMaskingFunc

public enum DataMaskingFunc {

     /**
     *  脱敏转换器
     */
     NO_MASK((str, maskChar) -> {
        return str;
     }),
     ALL_MASK((str, maskChar) -> {
        if (StringUtils.isNoneEmpty(str)) {
            StringBuilder sb = new StringBuilder();
            for (int i = 0; i < str.length(); i++) {
                sb.append(StringUtils.isNoneEmpty(maskChar) ? maskChar : DataMaskingOperation.MASK_CHAR);
            }
            return sb.toString();
        }
        return str;
    });

    private final DataMaskingOperation operation;

    private DataMaskingFunc(DataMaskingOperation operation) {
        this.operation = operation;
    }

    public DataMaskingOperation operation() {
        return this.operation;
    }

}

DataMaskingSerializer

public class DataMaskingSerializer extends StdScalarSerializer<Object> {
    private final DataMaskingOperation operation;

    public DataMaskingSerializer(DataMaskingOperation operation) {
        super(String.class,false);
        this.operation = operation;
    }
    public DataMaskingSerializer() {
        super(String.class,false);
        this.operation = null;
    }


    @Override
    public void serialize(Object value, JsonGenerator jsonGenerator, SerializerProvider serializerProvider) throws IOException {
        if (Objects.isNull(operation)){
            String content=DataMaskingFunc.ALL_MASK.operation().mask(value.toString(),null);
            jsonGenerator.writeString(content);
        }else {
            String content=operation.mask(value.toString(),null);
            jsonGenerator.writeString(content);
        }
    }
    public boolean isEmpty(SerializerProvider  provider,Object value) {
       String str=(String) value;
       return str.isEmpty();
    }
    public final void serializeWithType(Object value, JsonGenerator gen, SerializerProvider provider, TypeSerializer typeSer) throws IOException {
        this.serialize(value, gen, provider);
    }

    public JsonNode getSchema(SerializerProvider provider, Type typeHint) {
        return this.createSchemaNode("string", true);
    }

    public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper visitor, JavaType typeHint) throws JsonMappingException {
        this.visitStringFormat(visitor, typeHint);
    }

}

自定义AnnotationIntrospector，适配我们自定义注解返回相应的Serializer

public class DataMaskingAnnotationIntrospector extends NopAnnotationIntrospector {

    @Override
    public Object findSerializer(Annotated am) {
        DataMasking annotation = am.getAnnotation(DataMasking.class);
        if (annotation != null) {
            return new DataMaskingSerializer(annotation.maskFunc().operation());
        }
        return null;
    }

}

覆盖ObjectMapper(springboot用)

@Configuration(
        proxyBeanMethods = false
)
public class DataMaskConfiguration {

    @Configuration(
            proxyBeanMethods = false
    )
    @ConditionalOnClass({Jackson2ObjectMapperBuilder.class})
    static class JacksonObjectMapperConfiguration {
        JacksonObjectMapperConfiguration() {
        }

        @Bean
        @Primary
        ObjectMapper jacksonObjectMapper(Jackson2ObjectMapperBuilder builder) {
            ObjectMapper objectMapper = builder.createXmlMapper(false).build();
            AnnotationIntrospector ai = objectMapper.getSerializationConfig().getAnnotationIntrospector();
            AnnotationIntrospector newAi = AnnotationIntrospectorPair.pair(ai, new DataMaskingAnnotationIntrospector());
            objectMapper.setAnnotationIntrospector(newAi);
            return objectMapper;
        }
    }

}

对象上面加上注解

public class User implements Serializable {
    /**
     * 主键ID
     */
    private Long id;

    /**
     * 姓名
     */
    @DataMasking(maskFunc = DataMaskingFunc.ALL_MASK)
    private String name;

    /**
     * 年龄
     */
    private Integer age;

    /**
     * 邮箱
     */
    @DataMasking(maskFunc = DataMaskingFunc.ALL_MASK)
    private String email;

}

测试

 public static void main(String[] args) throws JsonProcessingException {
        ObjectMapper objectMapper = new JsonMapper(); //builder.createXmlMapper(false).build();
        AnnotationIntrospector ai = objectMapper.getSerializationConfig().getAnnotationIntrospector();
        AnnotationIntrospector newAi = AnnotationIntrospectorPair.pair(ai, new DataMaskingAnnotationIntrospector());
        objectMapper.setAnnotationIntrospector(newAi);
        User user = new User();
        user.setId(1L);
        user.setName("张三");
        user.setAge(18);
        user.setEmail("511486460@qq.com");
        System.out.println(objectMapper.writerWithDefaultPrettyPrinter().writeValueAsString(user));
    }