字段脱敏统一框架

最新推荐文章于 2025-08-22 10:22:06 发布

原创最新推荐文章于 2025-08-22 10:22:06 发布 · 659 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#java

日常开发专栏收录该内容

1 篇文章

订阅专栏

本文探讨了三种Java字段脱敏的方法：切面处理、fastjson序列化过滤器+自定义注解、fastjson序列化器+JSONField+自定义注解。方案一操作接口复杂，方案二通用但可能影响性能，方案三在通用性和性能间取得平衡，推荐使用。所有方案的脱敏规则均维护在枚举中。

方案一：对需要脱敏的接口统一使用切面进行处理，需要找到接口脱敏字段，根据字段和枚举维护的规则进行脱敏处理

优点：可以控制哪个接口哪个方法进行脱敏

缺点：找到需要脱敏属性字段需要递归遍历较为复杂，对象是l数组和对象组合、同名属性字段多以及层数深都会提高复杂度

方案二：利用fastjson序列化过滤器+自定义注解实现，在需要脱敏字段打上注解，然后在自定义fastjson序列化过滤器中对打上自定义注解属性进行脱敏，脱敏规则也维护在枚举中

优点：通用性强、实现简单

缺点：对于所有接口和字段都要遍历检查，控制不住入口流量，所有接口都会进来，每个字段也会进来，影响性能，只适用于fastjson序列化方式

方案三：利用fastjson序列化器+JSONField+自定义注解实现，在需要脱敏字段打上注解，然后在自定义fastjson序列化器中对打上自定义注解属性进行脱敏，脱敏规则也维护在枚举中

优点：通用性强、实现简单，不像序列化过滤器对每个接口每个字段都要遍历，只对带有JSONField和使用序列化过滤器的字段进行拦截，并且只对带有自定义注解字段进行脱敏

缺点：只适用于fastjson序列化方式

方案一实现比较复杂不贴出代码，方案二适合应用中大多数接口都需要脱敏的场景或者性能要求不高的场景，推荐方案三

方案二、三脱敏规则枚举如下：

public enum DesensitizationFieldEnum {

    DRIVER_PHONE(0,"driverPhone",
        "(\\d{3})\\d{4}(\\d{4})","$1****$2"),
    THIRD_DRIVER_PHONE(1,"thirdDriverPhone",
        "(\\d{3})\\d{4}(\\d{4})","$1****$2"),
    CUSTOMER_PHONE(2,"customerPhone",
        "(\\d{3})\\d{4}(\\d{4})","$1****$2"),
    CUSTOMER_DEVICE_ID(3, "customerDeviceId","","****");

    private Integer code;

    private String fieldName;

    private String regularExpression;

    private String targetContent;

    DesensitizationFieldEnum(Integer code, String fieldName, String regularExpression, String targetContent) {

        this.code = code;
        this.fieldName = fieldName;
        this.regularExpression = regularExpression;
        this.targetContent = targetContent;
    }

    public Integer getCode() {

        return code;
    }

    public String getFieldName() {

        return fieldName;
    }

    public String getRegularExpression() {

        return regularExpression;
    }

    public String getTargetContent() {

        return targetContent;
    }

    public static DesensitizationFieldEnum getByCode(Integer code){

        DesensitizationFieldEnum[] orderStatusEnums = values();

        for (DesensitizationFieldEnum desensitizationFieldEnum : orderStatusEnums){

            if (code.equals(desensitizationFieldEnum.getCode())){

                return desensitizationFieldEnum;
            }
        }

        return null;
    }

    public static DesensitizationFieldEnum getDesensitizationFieldEnumByFieldName(String fieldName) {

        for (DesensitizationFieldEnum desensitizationFieldEnum : DesensitizationFieldEnum.values()) {

            if (desensitizationFieldEnum.getFieldName().equals(fieldName)) {

                return desensitizationFieldEnum;
            }
        }

        return null;
    }
}

方案二、三自定义注解如下：

/**
 * 脱敏字段属性注解
 */
@Inherited
@Documented
@Target(ElementType.FIELD)
@Retention(RetentionPolicy.RUNTIME)
public @interface DesensitizationField {

    /**
     * 敏感属性名称 @see com.caocao.cms.web.util.enums.DesensitizationFieldEnum#fieldName
     * 不配置则默认取属性名 但是远程脱敏配置字段和属性名不一致导致脱敏失效 建议配置与属性名一致
     */
    String sensitiveFieldName() default "";
}

方案二脱敏序列化过滤器：

/**
 * fastjson值脱敏序列化过滤器
 */
@Slf4j
public class ValueDesensitizeFilter implements ValueFilter {

    @Override
    public Object process(Object object, String name, Object value) {

        if (Objects.isNull(object)
            || Objects.isNull(value)
            || !(value instanceof String)
            || ((String) value).length() == 0) {

            return value;
        }

        try {

            Field field = object.getClass().getDeclaredField(name);

            if (String.class != field.getType()) {

                return value;
            }

            DesensitizationField desensitizationField = field.getAnnotation(DesensitizationField.class);

            if (Objects.isNull(desensitizationField)) {

                return value;
            }

            String sensitiveFieldName = desensitizationField.sensitiveFieldName();

            if (StringUtils.isEmpty(sensitiveFieldName)) {

                sensitiveFieldName = name;
            }

            DesensitizationFieldEnum desensitizationFieldEnum = DesensitizationFieldEnum
                .getDesensitizationFieldEnumByFieldName(sensitiveFieldName);

            if (Objects.isNull(desensitizationFieldEnum)) {

                return value;
            }

            String desensitizedValue = processDesensitization(desensitizationFieldEnum, (String) value);

            log.info("字段[{}]脱敏前值[{}]脱敏后值[{}]", name, value, desensitizedValue);

            return desensitizedValue;
        } catch (Exception e) {

            log.warn("ValueDesensitizeFilter序列化过滤class[{}]字段field[{}]值value[{}]", object.getClass(), name, value);
            return value;
        }
    }

    /**
     * 对字段进行脱敏
     * @param desensitizationFieldEnum
     * @param value
     * @return
     */
    private String processDesensitization(DesensitizationFieldEnum desensitizationFieldEnum, String value) {

        if (StringUtils.isBlank(value)) {

            return "";
        }

        if (!needDesensitization(desensitizationFieldEnum.getFieldName())) {

            return value;
        }

        String regularExpression = desensitizationFieldEnum.getRegularExpression();

        if (StringUtils.isBlank(regularExpression)) {

            return desensitizationFieldEnum.getTargetContent();
        }

        return value.replaceAll(regularExpression, desensitizationFieldEnum.getTargetContent());
    }

    private String getCurrentUrl() {

        ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();

        if (Objects.isNull(requestAttributes)) {

            return null;
        }

        HttpServletRequest request = requestAttributes.getRequest();

        String uri = request.getRequestURI();
        String contextPath = request.getContextPath();

        uri = StringUtils.isBlank(contextPath) ? uri : uri.replace(contextPath, "");

        return uri;
    }

    /**
     * 是否需要脱敏
     * @param sensitiveFieldName
     * @return true 需要脱敏 false 不需要脱敏
     */
    private Boolean needDesensitization(String sensitiveFieldName) {

        //获取登录用户
        UserDTO userDTO = UserPermissions.getUser();

        //获取脱敏配置URL列表
        List<AcUrlResourceDetailDTO> acUrlResourceDetailDTOList = userDTO.getUrlResourceDetails();

        if (CollectionUtils.isEmpty(acUrlResourceDetailDTOList)) {

            return true;
        }

        //获取当前URL
        String requestUri = getCurrentUrl();

        if (Objects.isNull(requestUri)) {

            return true;
        }

        //遍历已关联配置
        for (AcUrlResourceDetailDTO acUrlResourceDetailDTO : acUrlResourceDetailDTOList) {

            //校验是否针对当前URL做免脱敏操作
            if (!requestUri.equals(acUrlResourceDetailDTO.getUrl())) {

                continue;
            }

            if (Objects.equals(sensitiveFieldName, acUrlResourceDetailDTO.getModelColName())) {

                return false;
            }
        }

        return true;
    }
}

方案二需要在fastjson 配置中加入这个自己实现的序列化过滤器

    @Bean
    public FastJsonHttpMessageConverter messageConverter() {

        FastJsonHttpMessageConverter fastConverter = new FastJsonHttpMessageConverter() {

            @Override
            public Object read(Type type, //
                Class<?> contextClass, //
                HttpInputMessage inputMessage //
            ) throws IOException, HttpMessageNotReadableException {

                try {
                    return super.read(type, contextClass, inputMessage);
                } catch (JSONException jsonException) {
                    throw new IllegalArgumentException("参数异常:" + jsonException.getMessage());
                }
            }
        };
        FastJsonConfig fastJsonConfig = new FastJsonConfig();

        fastJsonConfig.setSerializeFilters(new ValueDesensitizeFilter());

        // 处理中文乱码问题
        List<MediaType> fastMediaTypes = new ArrayList<>();
        fastMediaTypes.add(MediaType.APPLICATION_JSON_UTF8);
        fastConverter.setSupportedMediaTypes(fastMediaTypes);
        fastConverter.setFastJsonConfig(fastJsonConfig);

        return fastConverter;
    }

然后方案二在使用的时候只需要在对应字段上加上自定义注解就行了，新规则需要在枚举中维护一下

方案三脱敏序列化器如下


/**
 * fastjson敏感属性脱敏序列化器
 */
@Slf4j
public class ValueDesensitizeSerializer implements ObjectSerializer {

    @Override
    public void write(JSONSerializer serializer, Object value, Object fieldName, Type fieldType, int features) {

        if (Objects.isNull(value)
            || Objects.isNull(fieldName)
            || Objects.isNull(serializer.getContext())
            || Objects.isNull(serializer.getContext().object)
            || !(value instanceof String)
            || ((String) value).length() == 0) {

            serializer.write(value);
           
            return;
        }

        try {

            // 属性字段所属类对象
            Object object = serializer.getContext().object;

            Field field = object.getClass().getDeclaredField((String) fieldName);

            DesensitizationField desensitizationField = field.getAnnotation(DesensitizationField.class);

            if (Objects.isNull(desensitizationField)) {

                serializer.write(value);

                return;
            }

            String sensitiveFieldName = desensitizationField.sensitiveFieldName();

            // 敏感属性名称不配默认取字段属性名称
            if (StringUtils.isEmpty(sensitiveFieldName)) {

                sensitiveFieldName = (String) fieldName;
            }

            DesensitizationFieldEnum desensitizationFieldEnum = DesensitizationFieldEnum
                .getDesensitizationFieldEnumByFieldName(sensitiveFieldName);

            if (Objects.isNull(desensitizationFieldEnum)) {

                serializer.write(value);

                return;
            }

            String desensitizedValue = processDesensitization(desensitizationFieldEnum, (String) value);

            log.info("字段[{}]脱敏前值[{}]脱敏后值[{}]", fieldName, value, desensitizedValue);

            serializer.write(desensitizedValue);
        } catch (Exception e) {

            log.warn("ValueDesensitizeSerializer序列化字段field[{}]值value[{}]", fieldName, value);
            serializer.write(value);
        }
    }

    /**
     * 对字段进行脱敏
     * @param desensitizationFieldEnum
     * @param value
     * @return
     */
    private String processDesensitization(DesensitizationFieldEnum desensitizationFieldEnum, String value) {

        if (StringUtils.isBlank(value)) {

            return "";
        }

        if (!needDesensitization(desensitizationFieldEnum.getFieldName())) {

            return value;
        }

        String regularExpression = desensitizationFieldEnum.getRegularExpression();

        if (StringUtils.isBlank(regularExpression)) {

            return desensitizationFieldEnum.getTargetContent();
        }

        return value.replaceAll(regularExpression, desensitizationFieldEnum.getTargetContent());
    }

    private String getCurrentUrl() {

        ServletRequestAttributes requestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();

        if (Objects.isNull(requestAttributes)) {

            return null;
        }

        HttpServletRequest request = requestAttributes.getRequest();

        String uri = request.getRequestURI();
        String contextPath = request.getContextPath();

        uri = StringUtils.isBlank(contextPath) ? uri : uri.replace(contextPath, "");

        return uri;
    }

    /**
     * 是否需要脱敏
     * @param sensitiveFieldName
     * @return true 需要脱敏 false 不需要脱敏
     */
    private Boolean needDesensitization(String sensitiveFieldName) {

        //获取登录用户
        UserDTO userDTO = UserPermissions.getUser();

        //获取脱敏配置URL列表
        List<AcUrlResourceDetailDTO> acUrlResourceDetailDTOList = userDTO.getUrlResourceDetails();

        if (CollectionUtils.isEmpty(acUrlResourceDetailDTOList)) {

            return true;
        }

        //获取当前URL
        String requestUri = getCurrentUrl();

        if (Objects.isNull(requestUri)) {

            return true;
        }

        //遍历已关联配置
        for (AcUrlResourceDetailDTO acUrlResourceDetailDTO : acUrlResourceDetailDTOList) {

            //校验是否针对当前URL做免脱敏操作
            if (!requestUri.equals(acUrlResourceDetailDTO.getUrl())) {

                continue;
            }

            if (Objects.equals(sensitiveFieldName, acUrlResourceDetailDTO.getModelColName())) {

                return false;
            }
        }

        return true;
    }
}

方案三在使用的时候需要在对应字段上加上自定义注解和JSONFiled注解（序列化器使用自定义脱敏序列化器），新规则需要在枚举中维护一下

/**
     * 乘客手机设备ID
     **/
    @JSONField(serializeUsing = ValueDesensitizeSerializer.class)
    @DesensitizationField(sensitiveFieldName = "customerDeviceId")
    private String customerDeviceId;