Springboot中log4j2日志脱敏处理

最新推荐文章于 2024-07-31 01:16:16 发布

wuningw

最新推荐文章于 2024-07-31 01:16:16 发布

阅读量2.3k

点赞数

本文链接：https://blog.csdn.net/wuningw/article/details/125178459

版权

关键词由CSDN通过智能技术生成

由于项目中的我们日志存在某些敏感字段，需要进行脱敏，废话不多说直接上代码。

1.新建一个类 CustomPatternLayout继承AbstractStringLayout，并编写相应方法如下代码。


import org.apache.commons.collections.MapUtils;
import org.apache.commons.lang3.StringUtils;
import org.apache.logging.log4j.core.Layout;
import org.apache.logging.log4j.core.LogEvent;
import org.apache.logging.log4j.core.config.Node;
import org.apache.logging.log4j.core.config.plugins.Plugin;
import org.apache.logging.log4j.core.config.plugins.PluginAttribute;
import org.apache.logging.log4j.core.config.plugins.PluginFactory;
import org.apache.logging.log4j.core.layout.AbstractStringLayout;
import org.apache.logging.log4j.core.layout.PatternLayout;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

import java.nio.charset.Charset;
import java.util.Arrays;
import java.util.HashMap;
import java.util.Map;
import java.util.Set;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import java.util.stream.Collectors;

/**
 * log4j2 脱敏插件
 * 继承AbstractStringLayout
 *
 **/
@Plugin(name = "CustomPatternLayout", category = Node.CATEGORY, elementType = Layout.ELEMENT_TYPE, printObject = true)
public class CustomPatternLayout extends AbstractStringLayout {


    public final static Logger logger = LoggerFactory.getLogger(CustomPatternLayout.class);
    private final PatternLayout patternLayout;


    protected CustomPatternLayout(Charset charset, String pattern) {
        super(charset);
        patternLayout = PatternLayout.newBuilder().withPattern(pattern).build();
        initRule();
    }

    /**
     * 要匹配的正则表达式map
     */
    private static final Map<String, Pattern> REG_PATTERN_MAP = new HashMap<>();
    private static final Map<String, String> KEY_REG_MAP = new HashMap<>();


    private void initRule() {
        try {
            if (MapUtils.isEmpty(Log4j2Rule.regularMap)) {
                return;
            }
            Log4j2Rule.regularMap.forEach((a, b) -> {
                if (StringUtils.isNotBlank(a)) {
                    Map<String, String> collect = Arrays.stream(a.split(",")).collect(Collectors.toMap(c -> c, w -> b, (key1, key2) -> key1));
                    KEY_REG_MAP.putAll(collect);
                }
                Pattern compile = Pattern.compile(b);
                REG_PATTERN_MAP.put(b, compile);
            });

        } catch (Exception e) {
            logger.info(">>>>>> 初始化日志脱敏规则失败 ERROR：{0}", e);
        }

    }

    /**
     * 处理日志信息，进行脱敏
     * 1.判断配置文件中是否已经配置需要脱敏字段
     * 2.判断内容是否有需要脱敏的敏感信息
     * 2.1 没有需要脱敏信息直接返回
     * 2.2 处理: 身份证 ,姓名,手机号,地址敏感信息
     */
    public String hideMarkLog(String logStr) {
        try {
            //1.判断配置文件中是否已经配置需要脱敏字段
            if (StringUtils.isBlank(logStr) || MapUtils.isEmpty(KEY_REG_MAP) || MapUtils.isEmpty(REG_PATTERN_MAP)) {
                return logStr;
            }
            //2.判断内容是否有需要脱敏的敏感信息
            Set<String> charKeys = KEY_REG_MAP.keySet();
            for (String key : charKeys) {
                if (logStr.contains(key)) {
                    String regExp = KEY_REG_MAP.get(key);
                    logStr = matchingAndEncrypt(logStr, regExp, key);
                }
            }
            return logStr;
        } catch (Exception e) {
            logger.info(">>>>>>>>> 脱敏处理异常 ERROR:{0}", e);
            //如果抛出异常为了不影响流程，直接返回原信息
            return logStr;
        }
    }

    /**
     * 正则匹配对应的对象。
     *
     * @param msg    日志对象
     * @param regExp 正则匹配
     * @param key    字段
     * @return 找到对应对象
     */
    private static String matchingAndEncrypt(String msg, String regExp, String key) {
        Pattern pattern = Pattern.compile(regExp);
        Matcher matcher = pattern.matcher(msg);
        int length = key.length() + 5;
        boolean names = Log4j2Rule.USER_NAME_STR.contains(key);
        boolean address = Log4j2Rule.USER_ADDRESS_STR.contains(key);
        boolean phones = Log4j2Rule.USER_PHONE_STR.contains(key);
        String hiddenStr = "";
        StringBuffer result = new StringBuffer(msg);
        int i=0;
        while (matcher.find()) {
            String originStr = matcher.group();
            // 计算关键词和需要脱敏词的距离小于5。
             i = msg.indexOf(originStr,i);
            if (i < 0) {
                continue;
            }
            int span = i - length;
            int startIndex = Math.max(span, 0);
            String substring = msg.substring(startIndex, i);
            if (StringUtils.isBlank(substring) || !substring.contains(key)) {
                i+=key.length();
                continue;
            }
            if (names) {
                hiddenStr = hideMarkStr(originStr,1);
            }else if(phones){
                hiddenStr = hideMarkStr(originStr,2);
            }else if(address){
                hiddenStr = hideMarkStr(originStr,3);
            }
            msg = result.replace(i,i+originStr.length(), hiddenStr).toString();
        }
        return msg;
    }

    /**
     * 标记敏感文字规则
     *
     * @param needHideMark 日志对象
     *  @param type 脱敏规则类型  1为姓名脱敏规则，2为姓名脱敏规则手机号，3为地址脱敏规则，
     * @return 返回过敏字段
     */
    private static String hideMarkStr(String needHideMark,int type) {
        if (StringUtils.isBlank(needHideMark)) {
            return "";
        }
        int startSize = 0, endSize = 0, mark = 0, length = needHideMark.length();

        StringBuffer hideRegBuffer = new StringBuffer("(\\S{");
        StringBuffer replaceSb = new StringBuffer("$1");
        if(type==1) {
            startSize = 1;
        } else if(type==2) {
            int i = length / 3;
            startSize = i;
            endSize = i+1;
        }else if (type==3) {
            startSize = 3;
        }
        mark = length - startSize - endSize;
        for (int i = 0; i < mark; i++) {
            replaceSb.append("*");
        }
        hideRegBuffer.append(startSize).append("})\\S*(\\S{").append(endSize).append("})");
        replaceSb.append("$2");
        needHideMark = needHideMark.replaceAll(hideRegBuffer.toString(), replaceSb.toString());
        return needHideMark;
    }


    /**
     * 创建插件
     */
    @PluginFactory
    public static Layout createLayout(@PluginAttribute(value = "pattern") final String pattern,
                                      @PluginAttribute(value = "charset") final Charset charset) {
        return new CustomPatternLayout(charset, pattern);
    }


    @Override
    public String toSerializable(LogEvent event) {
        return hideMarkLog(patternLayout.toSerializable(event));
    }

}

2.编写需要脱敏字段配置与匹配规则（自己根据需要自定义）


import java.util.HashMap;
import java.util.Map;

/**
 * 拦截脱敏的日志:
 * 1，身份证
 * 2，姓名
 * 3，身份证号 （目前暂时不脱敏）
 * 4、地址
 * 脱敏规则后续可以优化在配置文件中
 *
 **/
public class Log4j2Rule {

    /**
     * 正则匹配 关键词 类别
     */
    public static Map<String, String> regularMap = new HashMap<>();
    /**
     * TODO  可配置
     * 此项可以后期放在配置项中
     */
    public static final String USER_NAME_STR = "customerName,userName,user,paymentUserName,order_contacts_name";
    public static final String USER_ADDRESS_STR = "receiveAddress,address,order_address";
    //暂时不需要脱敏身份证
//    public static final String USER_IDCARD_STR = "empCard,idCard";
    public static final String USER_PHONE_STR = "mobile,phone,contactPhone,customerTelephone,customerLinkPhone,memberPhone,phoneNumber,mealPhone,order_contacts_phone,from,to";

    /**
     * 正则匹配，根据业务要求自定义
     */
//    private static final String IDCARD_REGEXP = "(\\d{17}[0-9Xx]|\\d{14}[0-9Xx])";
    private static final String USERNAME_REGEXP = "[\\u4e00-\\u9fa5_a-zA-Z0-9-]{2,50}";
    private static final String ADDRESS_REGEXP = "[\\u4e00-\\u9fa5_a-zA-Z0-9-]{3,200}";
    private static final String PHONE_REGEXP = "(?<!\\d)(?:(?:1[3456789]\\d{9})|(?:861[356789]\\d{9}))(?!\\d)";

    static {
        regularMap.put(USER_NAME_STR, USERNAME_REGEXP);
        regularMap.put(USER_ADDRESS_STR, ADDRESS_REGEXP);
//        regularMap.put(USER_IDCARD_STR, IDCARD_REGEXP);
        regularMap.put(USER_PHONE_STR, PHONE_REGEXP);
    }

}

3.将写好的CustomPatternLayout配置到log4j2.xml中并注释掉原来的PatternLayout

<?xml version="1.0" encoding="UTF-8"?>
<configuration status="debug">
	<properties>
		<property name="UCS_LOG_HOME">D:/data/ucs/logs</property>
	</properties>

	<appenders>
		<Console name="STDOUT">
			<ThresholdFilter level="debug" onMatch="ACCEPT"
				onMismatch="DENY" />
<!--			<PatternLayout-->
<!--				pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n"-->
<!--				charset="UTF-8" />-->
			<CustomPatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n" charset="UTF-8" />
		</Console>

		<RollingRandomAccessFile name="FILE-DEBUG"
			fileName="${UCS_LOG_HOME}/ucs-debug.log"
			filePattern="${UCS_LOG_HOME}/logbak/ucs-debug.%d{yyyy-MM-dd}-%i.log">

			<Filters>
				<ThresholdFilter level="info" onMatch="DENY"
					onMismatch="NEUTRAL" />
				<ThresholdFilter level="debug" onMatch="ACCEPT"
					onMismatch="DENY" />
			</Filters>
<!--			<PatternLayout-->
<!--				pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n"-->
<!--				charset="UTF-8" />-->
			<CustomPatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n" charset="UTF-8" />
			<Policies>
				<!-- 关键点在于 filePattern后的日期格式，日期格式精确到哪一位，interval也精确到哪一个单位 -->
				<TimeBasedTriggeringPolicy interval="1"
					modulate="true" />
				<SizeBasedTriggeringPolicy size="500MB" />
			</Policies>
			<!-- 如果不做配置，默认是7，这个7指的是上面i的最大值，超过了就会覆盖之前的 -->
			<DefaultRolloverStrategy max="100" />

		</RollingRandomAccessFile>

		<RollingRandomAccessFile name="FILE-INFO"
			fileName="${UCS_LOG_HOME}/ucs-info.log"
			filePattern="${UCS_LOG_HOME}/logbak/ucs-info.%d{yyyy-MM-dd}-%i.log">
			<Filters>
				<ThresholdFilter level="warn" onMatch="DENY"
					onMismatch="NEUTRAL" />
				<ThresholdFilter level="info" onMatch="ACCEPT"
					onMismatch="DENY" />
			</Filters>
<!--			<PatternLayout-->
<!--				pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n"-->
<!--				charset="UTF-8" />-->
			<CustomPatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n" charset="UTF-8" />
			<Policies>
				<TimeBasedTriggeringPolicy interval="1"
					modulate="true" />
				<SizeBasedTriggeringPolicy size="500MB" />
			</Policies>
			<!-- 如果不做配置，默认是7，这个7指的是上面i的最大值，超过了就会覆盖之前的 -->
			<DefaultRolloverStrategy max="100" />


		</RollingRandomAccessFile>

		<RollingRandomAccessFile name="FILE-WARN"
			fileName="${UCS_LOG_HOME}/ucs-warn.log"
			filePattern="${UCS_LOG_HOME}/logbak/ucs-warn.%d{yyyy-MM-dd}-%i.log">
			<Filters>
				<ThresholdFilter level="error" onMatch="DENY"
					onMismatch="NEUTRAL" />
				<ThresholdFilter level="warn" onMatch="ACCEPT"
					onMismatch="DENY" />
			</Filters>

<!--			<PatternLayout-->
<!--				pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n"-->
<!--				charset="UTF-8" />-->
			<CustomPatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n" charset="UTF-8" />
			<Policies>
				<TimeBasedTriggeringPolicy interval="1"
					modulate="true" />
				<SizeBasedTriggeringPolicy size="500MB" />
			</Policies>
			<!-- 如果不做配置，默认是7，这个7指的是上面i的最大值，超过了就会覆盖之前的 -->
			<DefaultRolloverStrategy max="100" />


		</RollingRandomAccessFile>

		<RollingRandomAccessFile name="FILE-ERROR"
			fileName="${UCS_LOG_HOME}/ucs-error.log"
			filePattern="${UCS_LOG_HOME}/logbak/ucs-error.%d{yyyy-MM-dd}-%i.log">

			<Filters>
				<ThresholdFilter level="fatal" onMatch="DENY"
					onMismatch="NEUTRAL" />
				<ThresholdFilter level="error" onMatch="ACCEPT"
					onMismatch="DENY" />
			</Filters>

<!--			<PatternLayout-->
<!--				pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n"-->
<!--				charset="UTF-8" />-->
			<CustomPatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n" charset="UTF-8" />
			<Policies>
				<TimeBasedTriggeringPolicy interval="1"
					modulate="true" />
				<SizeBasedTriggeringPolicy size="500MB" />
			</Policies>
			<!-- 如果不做配置，默认是7，这个7指的是上面i的最大值，超过了就会覆盖之前的 -->
			<DefaultRolloverStrategy max="100" />


		</RollingRandomAccessFile>

		<RollingRandomAccessFile name="FILE-FATAL"
			fileName="${UCS_LOG_HOME}/ucs-fatal.log"
			filePattern="${UCS_LOG_HOME}/logbak/ucs-fatal.%d{yyyy-MM-dd}-%i.log">
			<ThresholdFilter level="fatal" onMatch="ACCEPT"
				onMismatch="DENY" />
<!--			<PatternLayout-->
<!--				pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n"-->
<!--				charset="UTF-8" />-->
			<CustomPatternLayout pattern="%d{yyyy-MM-dd HH:mm:ss.SSS} [%t] %l %-5level - %msg%n" charset="UTF-8" />
			<Policies>
				<TimeBasedTriggeringPolicy interval="1"
					modulate="true" />
				<SizeBasedTriggeringPolicy size="500MB" />
			</Policies>
			<!-- 如果不做配置，默认是7，这个7指的是上面i的最大值，超过了就会覆盖之前的 -->
			<DefaultRolloverStrategy max="100" />


		</RollingRandomAccessFile>
	</appenders>
	<loggers>
		<AsyncLogger name="springfox" level="off"></AsyncLogger>

	<!--  使用异步Logger方式输出日志
		<AsyncLogger name="com.roadway.DebugUtils"
			additivity="FALSE" level="INFO">
			<appender-ref ref="FILE-DEBUG" />
		</AsyncLogger> 
	-->

		<Root level="DEBUG" includeLocation="true">
			<AppenderRef ref="FILE-DEBUG" />
			<AppenderRef ref="FILE-INFO" />
			<AppenderRef ref="FILE-WARN" />
			<AppenderRef ref="FILE-ERROR" />
			<AppenderRef ref="FILE-FATAL" />
			<AppenderRef ref="STDOUT" />
		</Root>
	</loggers>
</configuration>

4.测试