Spring Boot

最近在做项目的过程中，PSS提出配置文件中类似数据库连接需要的用户名、密码等敏感信息需要加密处理（之前一直是明文的）。

为了快速完成任务，网上搜刮到jasypt包，也有相应的starter，使用方法可以参考blog

但是还是想具体弄清楚背后的实现。偶然看到Spring Boot中有个EnvironmentPostProcessor接口。看名字，它的实现类应该在配置文件加载完和Spring容器开始初始化之前起作用。这样的话，我们就可以实现该接口用来定制化配置信息，包括解密。

话不多说，show code，

@Component
public class DecryptAESConfigProcessor implements EnvironmentPostProcessor {

    private static short INDEX = 0;
    private static String ITEM_FORMAT = "spring.config.decrypt-items[%d]";
    private static Pattern PATTERN = Pattern.compile("AES\((.+)\)");
    private static StringBuffer SB = new StringBuffer();

    @Override
    public void postProcessEnvironment(ConfigurableEnvironment environment, SpringApplication application) {
        MutablePropertySources propertySources = environment.getPropertySources();
        for (PropertySource propertySource: propertySources) {
            if (propertySource instanceof OriginTrackedMapPropertySource){
                INDEX = 0;
                OriginTrackedMapPropertySource otmps = (OriginTrackedMapPropertySource)propertySource;
                //System.out.println("property name = " + otmps.getName());
                Map<String, Object> source = otmps.getSource();
                String secretSalt = source.getOrDefault("spring.config.secret-salt", "").toString();
                if (!"".equals(secretSalt)){
                    String salt = CommonUtil.decrypt(secretSalt, "sns");
                    while (INDEX > -1){
                        String item = String.format(ITEM_FORMAT, INDEX);
                        if (source.containsKey(item)){
                            String itemValue = source.get(item).toString();
                            String propertyValue = source.getOrDefault(itemValue, "").toString();
                            Matcher matcher = PATTERN.matcher(propertyValue);
                            boolean findAES = false;
                            while (matcher.find()){
                                //decrypt each AES()
                                findAES = true;
                                String decryptStr = CommonUtil.decrypt(matcher.group(1), salt);
                                matcher.appendReplacement(SB, decryptStr);
                            }
                            if (!findAES){
                                //decrypt entire item
                                source.put(itemValue, CommonUtil.decrypt(propertyValue, salt));
                            } else {
                                matcher.appendTail(SB);
                                source.put(itemValue, SB.toString());
                            }
                            SB.delete(0, SB.length());
                            INDEX++;
                        } else {
                            INDEX = -1;
                        }
                    }
                }
            }
        }

    }
}

注意：需要将DecryptAESConfigProcessor声明到spring.factories中。

org.springframework.boot.env.EnvironmentPostProcessor=
org.chris.springboot.config_encrypt.config.DecryptAESConfigProcessor

　　

public class CommonUtil {

    private static final String KEY_ALGORITHM = "AES";
    private static final String DEFAULT_CIPHER_ALGORITHM = "AES/ECB/PKCS5Padding";
    private static Cipher CIPHER;
    private static KeyGenerator KEY_GENERATOR;

    static {
        try {
            CIPHER = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
            KEY_GENERATOR = KeyGenerator.getInstance(KEY_ALGORITHM);
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (NoSuchPaddingException e) {
            e.printStackTrace();
        }
    }


    /**
     * Decrypt by AES
     * @param content
     * @param salt
     * @return
     */
    public static String decrypt(String content, String salt) {
        if (Objects.nonNull(content)) {
            try {
                byte[] decrypted = Base64.getDecoder().decode(content.getBytes("UTF-8"));
                CIPHER.init(Cipher.DECRYPT_MODE, getSecretKey(salt));
                return new String(CIPHER.doFinal(decrypted));
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        return null;
    }

    /**
     * Encrypt by AES
     * @param content
     * @param salt
     * @return
     */
    public static String encrypt(String content, String salt) {
        if (Objects.nonNull(content)) {
            try {
                CIPHER.init(Cipher.ENCRYPT_MODE, getSecretKey(salt));
                byte[] encrypted = CIPHER.doFinal(content.getBytes("UTF-8"));
                return Base64.getEncoder().encodeToString(encrypted);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        return null;
    }

    /**
     * Generate encrypted salt
     * @param salt
     * @return
     */
    private static SecretKeySpec getSecretKey(final String salt) {
        KEY_GENERATOR.init(128, new SecureRandom(salt.getBytes()));
        SecretKey secretKey = KEY_GENERATOR.generateKey();
        return new SecretKeySpec(secretKey.getEncoded(), KEY_ALGORITHM);
    }
}

最后，配置文件中需要有类似以下配置项

解密规则如下，

1. 采用AES加密解密；

2. 在配置文件中

　(1) 通过spring.config.decrypt-items指定需要解密的配置

　(2) 通过spring.config.secret-salt指定AES的key（最好加密）

3. 如果需要解密的配置项中存在AES()模式的字符串，将会解密 () 中的内容，否则解密整个配置项