spring-boot切面来实现敏感字段加解密【转载】

可以通过自定义注解和spring-boot切面来实现敏感字段加解密。
用法大致如下：
1、自定义注解

package com.zzz.yyy.annotation;

import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;

import java.lang.annotation.*;


/**
 * @author: zxy
 * @desc: 加在敏感字段字段上，实现自动解密/加密
 * @date: 2020/4/29 9:30
 */
@Documented
@Target({ElementType.FIELD})
@Retention(RetentionPolicy.RUNTIME)
@Order(Ordered.HIGHEST_PRECEDENCE)
public @interface SensitiveField {

}

2、加密解密工具类

package com.zzz.yyy.util

import com.jn.ssr.oms.order.annotation.SensitiveField;
import lombok.extern.slf4j.Slf4j;
import org.springframework.core.annotation.AnnotationUtils;

import javax.crypto.Cipher;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.lang.reflect.Field;
import java.lang.reflect.ParameterizedType;
import java.lang.reflect.Type;
import java.security.SecureRandom;
import java.util.List;

/**
 * AES加密解密工具类
 */
@Slf4j
public class AESUtil {
    private static final String defaultCharset = "UTF-8";
    private static final String KEY_AES = "AES";
    public static final String KEY = "something4u";

    /**
     * 加密
     *
     * @param data 需要加密的内容
     * @param key  加密密码
     * @return
     */
    public static String encrypt(String data, String key) {
        return doAES(data, key, Cipher.ENCRYPT_MODE);
    }

    /**
     * 解密
     *
     * @param data 待解密内容
     * @param key  解密密钥
     * @return
     */
    public static String decrypt(String data, String key) {
        return doAES(data, key, Cipher.DECRYPT_MODE);
    }

    /**
     * 加解密
     *
     * @param data 待处理数据
     * @param mode 加解密mode
     * @return
     */
    private static String doAES(String data, String key, int mode) {
        try {
            if (data == null || "".equals(data) || key == null || "".equals(key)) {
                return null;
            }
            boolean encrypt = mode == Cipher.ENCRYPT_MODE;
            byte[] content;
            if (encrypt) {
                content = data.getBytes(defaultCharset);
            } else {
                content = parseHexStr2Byte(data);
            }
            KeyGenerator kgen = KeyGenerator.getInstance(KEY_AES);
            kgen.init(128, new SecureRandom(key.getBytes()));
            SecretKey secretKey = kgen.generateKey();
            byte[] enCodeFormat = secretKey.getEncoded();
            SecretKeySpec keySpec = new SecretKeySpec(enCodeFormat, KEY_AES);
            // 创建密码器
            Cipher cipher = Cipher.getInstance(KEY_AES);
            // 初始化
            cipher.init(mode, keySpec);
            byte[] result = cipher.doFinal(content);
            if (encrypt) {
                return parseByte2HexStr(result);
            } else {
                return new String(result, defaultCharset);
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        return null;
    }

    /**
     * 将二进制转换成16进制
     *
     * @param buf
     * @return
     */
    private static String parseByte2HexStr(byte buf[]) {
        StringBuilder sb = new StringBuilder();
        for (int i = 0; i < buf.length; i++) {
            String hex = Integer.toHexString(buf[i] & 0xFF);
            if (hex.length() == 1) {
                hex = '0' + hex;
            }
            sb.append(hex.toUpperCase());
        }
        return sb.toString();
    }

    /**
     * 将16进制转换为二进制
     *
     * @param hexStr
     * @return
     */
    private static byte[] parseHexStr2Byte(String hexStr) {
        if (hexStr.length() < 1) {
            return null;
        }
        byte[] result = new byte[hexStr.length() / 2];
        for (int i = 0; i < hexStr.length() / 2; i++) {
            int high = Integer.parseInt(hexStr.substring(i * 2, i * 2 + 1), 16);
            int low = Integer.parseInt(hexStr.substring(i * 2 + 1, i * 2 + 2), 16);
            result[i] = (byte) (high * 16 + low);
        }
        return result;
    }

    /**
     * 进行敏感字段解密/加密处理
     */
    public static void handleItem(Object item, String secretKey, boolean isEncrypted) throws IllegalAccessException {
        // 捕获类中的所有字段
        Field[] fields = item.getClass().getDeclaredFields();
        // 遍历所有字段
        for (Field field : fields) {
            // 若该字段被SecurityParameter注解,则进行解密/加密
            Class<?> fieldType = field.getType();
            if (fieldType == String.class) {
                if (null != AnnotationUtils.findAnnotation(field, SensitiveField.class)) {
                    // 设置private类型允许访问
                    field.setAccessible(Boolean.TRUE);
                    handleField(item, field, secretKey, isEncrypted);
                    field.setAccessible(Boolean.FALSE);
                }
            } else if (List.class.isAssignableFrom(field.getType())) {
                Type genericType = field.getGenericType();
                // 是否参数化类型
                if (genericType instanceof ParameterizedType) {
                    ParameterizedType pt = (ParameterizedType) genericType;
                    Class genericClazz = (Class) pt.getActualTypeArguments()[0];
                    if (genericClazz == String.class && null != AnnotationUtils.findAnnotation(field, SensitiveField.class)) {
                        field.setAccessible(Boolean.TRUE);
                        List list = (List) field.get(item);
                        if(list != null && !list.isEmpty()){
                            for (int i=0; i < list.size(); i++) {
                                if (isEncrypted) {
                                    list.set(i, AESUtil.decrypt((String) list.get(i), secretKey));
                                } else {
                                    list.set(i, AESUtil.encrypt((String) list.get(i), secretKey));
                                }
                            }
                        }
                        field.setAccessible(Boolean.FALSE);
                    } else {
                        Field[] subFields = genericClazz.getDeclaredFields();
                        for (Field subField : subFields) {
                            if (subField.getType() == String.class && null != AnnotationUtils.findAnnotation(subField, SensitiveField.class)) {
                                field.setAccessible(Boolean.TRUE);
                                List list = (List) field.get(item);
                                if(list != null && !list.isEmpty()) {
                                    for (Object subObj : list) {
                                        subField.setAccessible(Boolean.TRUE);
                                        handleField(subObj, subField, secretKey, isEncrypted);
                                        subField.setAccessible(Boolean.FALSE);
                                    }
                                    field.setAccessible(Boolean.FALSE);
                                }
                            }
                        }
                    }
                }
            } else if(fieldType.getName().startsWith("com.jn.ssr")){
                Field[] subFields = fieldType.getDeclaredFields();
                for (Field subField : subFields) {
                    if (subField.getType() == String.class && null != AnnotationUtils.findAnnotation(subField, SensitiveField.class)) {
                        field.setAccessible(Boolean.TRUE);
                        Object obj = field.get(item);
                        subField.setAccessible(Boolean.TRUE);
                        handleField(obj, subField, secretKey, isEncrypted);
                        subField.setAccessible(Boolean.FALSE);
                        field.setAccessible(Boolean.FALSE);
                    }
                }
            }
            // T responseData由于泛型擦除，通过反射无法直接获取到实际类型
            else if(fieldType == Object.class){
                field.setAccessible(Boolean.TRUE);
                handleItem(field.get(item), secretKey, isEncrypted);
                field.setAccessible(Boolean.FALSE);
            }
        }
    }

    private static void handleField(Object item, Field field, String secretKey, boolean isEncrypted) throws IllegalAccessException {
        if(null == item){
            return;
        }
        if (isEncrypted) {
            field.set(item, AESUtil.decrypt((String) field.get(item), secretKey));
        } else {
            field.set(item, AESUtil.encrypt((String) field.get(item), secretKey));
        }
    }

}

3、自定义切面

package com.zzz.yyy.advice;

import com.google.common.collect.Lists;
import com.jn.ssr.oms.order.tools.AESUtil;
import lombok.extern.slf4j.Slf4j;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.springframework.stereotype.Component;

import java.util.List;

/**
 * 敏感字段解密/加密切面
 *
 * @Author: zxy
 * @date: 2020/4/29 9:30
 */
@Component
@Aspect
@Slf4j
public class SensitiveFieldAspect {

    @Around("execution(* com.zzz.yyy.controller.RtmController.*(..))")
    public Object doProcess(ProceedingJoinPoint proceedingJoinPoint) throws Throwable {
        // 捕获方法参数列表
        List<Object> methodArgs = this.getMethodArgs(proceedingJoinPoint);
        // 循环所有参数项
        for (Object item : methodArgs) {
            // 对参数项进行敏感字段解密处理
            AESUtil.handleItem(item, AESUtil.KEY,true);
        }
        Object result = proceedingJoinPoint.proceed();
        // 对返回值进行敏感字段加密处理
        AESUtil.handleItem(result, AESUtil.KEY, false);
        return result;
    }

    /**
     * 获取方法的请求参数
     */
    private List<Object> getMethodArgs(ProceedingJoinPoint proceedingJoinPoint) {
        List<Object> methodArgs = Lists.newArrayList();
        for (Object arg : proceedingJoinPoint.getArgs()) {
            if (null != arg) {
                methodArgs.add(arg);
            }
        }
        return methodArgs;
    }

}

4、使用该切面：加在敏感字段字段上，实现自动解密/加密

package com.zzz.yyy.rtm.entity;

import com.jn.ssr.oms.order.annotation.SecurityParameter;
import lombok.Data;

@Data
public class Vehicle {
    /**
     * 车架号
     */
    @SecurityParameter
    String vin;
    /**
     * 生产日期 格式：YYYY-MM-DD
     */
    String mfgDate;
    /**
     * 车牌
     */
    @SecurityParameter
    String plateNo;
    /**
     * 车型
     */
    String model;
    /**
     * 汽车经销商
     */
    String sellingDealer;
    /**
     * 销售类型
     */
    String salesType;
}