关于java:一个注解搞定接口数据脱敏太强了

起源：juejin.cn/post/7110110794188062727

下午惬意时光，忽然产品小姐姐走到我背后，打断我短暂的摸鱼 time，希图与我进行深刻交换，还好我早有防范没有闪，关上瑞 star 的点单页面，暗示没有一杯 coffee 解决不了的需要，需要是某些接口返回的信息，波及到敏感数据的必须进行脱敏操作，我思考一反，示意某问题，马上安顿。

思路

1. 要做成可配置多策略的脱敏操作，要不然一个个接口进行脱敏操作，反复的工作量太多，很显然违反了“多写一行算我输”的程序员标准，思来想去，定义数据脱敏注解和数据脱敏逻辑的接口，在返回类上，对须要进行脱敏的属性加上，并指定对应的脱敏策略操作。

2. 接下来我只须要拦挡控制器返回的数据，找到带有脱敏注解的属性操作即可，一开始打算用 @ControllerAdvice 去实现，但发现须要本人去反射类获取注解，当返回对象比较复杂，须要递归去反射，性能一下子就会升高，于是换种思路，我想到平时应用的 @JsonFormat，跟我当初的场景很相似，通过自定义注解跟字段解析器，对字段进行自定义解析，tql

代码

Spring Boot 根底就不介绍了，举荐下这个实战教程：

https://github.com/javastacks…

1. 自定义数据注解，并能够配置数据脱敏策略

@Target({ElementType.FIELD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface DataMasking {DataMaskingFunc maskFunc() default DataMaskingFunc.NO_MASK;

}

2. 自定义 Serializer，参考 jackson 的 StringSerializer，上面的示例只针对 String 类型进行脱敏

public interface DataMaskingOperation {

    String MASK_CHAR = "*";

    String mask(String content, String maskChar);

}

public enum DataMaskingFunc {

     /**
     *  脱敏转换器
     */
     NO_MASK((str, maskChar) -> {return str;}),
     ALL_MASK((str, maskChar) -> {if (StringUtils.hasLength(str)) {StringBuilder sb = new StringBuilder();
            for (int i = 0; i < str.length(); i++) {sb.append(StringUtils.hasLength(maskChar) ? maskChar : DataMaskingOperation.MASK_CHAR);
            }
            return sb.toString();} else {return str;}
    });

    private final DataMaskingOperation operation;

    private DataMaskingFunc(DataMaskingOperation operation) {this.operation = operation;}

    public DataMaskingOperation operation() {return this.operation;}

}

public final class DataMaskingSerializer extends StdScalarSerializer<Object> {
    private final DataMaskingOperation operation;

    public DataMaskingSerializer() {super(String.class, false);
        this.operation = null;
    }

    public DataMaskingSerializer(DataMaskingOperation operation) {super(String.class, false);
        this.operation = operation;
    }

    public boolean isEmpty(SerializerProvider prov, Object value) {String str = (String)value;
        return str.isEmpty();}

    public void serialize(Object value, JsonGenerator gen, SerializerProvider provider) throws IOException {if (Objects.isNull(operation)) {String content = DataMaskingFunc.ALL_MASK.operation().mask((String) value, null);
            gen.writeString(content);
        } else {String content = operation.mask((String) value, null);
            gen.writeString(content);
        }
    }

    public final void serializeWithType(Object value, JsonGenerator gen, SerializerProvider provider, TypeSerializer typeSer) throws IOException {this.serialize(value, gen, provider);
    }

    public JsonNode getSchema(SerializerProvider provider, Type typeHint) {return this.createSchemaNode("string", true);
    }

    public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper visitor, JavaType typeHint) throws JsonMappingException {this.visitStringFormat(visitor, typeHint);
    }
}

3. 自定义 AnnotationIntrospector，适配咱们自定义注解返回相应的 Serializer

@Slf4j
public class DataMaskingAnnotationIntrospector extends NopAnnotationIntrospector {

    @Override
    public Object findSerializer(Annotated am) {DataMasking annotation = am.getAnnotation(DataMasking.class);
        if (annotation != null) {return new DataMaskingSerializer(annotation.maskFunc().operation());
        }
        return null;
    }

}

4. 笼罩 ObjectMapper

@Configuration(proxyBeanMethods = false)
public class DataMaskConfiguration {

    @Configuration(proxyBeanMethods = false)
    @ConditionalOnClass({Jackson2ObjectMapperBuilder.class})
    static class JacksonObjectMapperConfiguration {JacksonObjectMapperConfiguration() { }

        @Bean
        @Primary
        ObjectMapper jacksonObjectMapper(Jackson2ObjectMapperBuilder builder) {ObjectMapper objectMapper = builder.createXmlMapper(false).build();
            AnnotationIntrospector ai = objectMapper.getSerializationConfig().getAnnotationIntrospector();
            AnnotationIntrospector newAi = AnnotationIntrospectorPair.pair(ai, new DataMaskingAnnotationIntrospector());
            objectMapper.setAnnotationIntrospector(newAi);
            return objectMapper;
        }
    }

}

5. 返回对象加上注解

public class User implements Serializable {
    /**
     * 主键 ID
     */
    private Long id;

    /**
     * 姓名
     */
    @DataMasking(maskFunc = DataMaskingFunc.ALL_MASK)
    private String name;

    /**
     * 年龄
     */
    private Integer age;

    /**
     * 邮箱
     */
    @DataMasking(maskFunc = DataMaskingFunc.ALL_MASK)
    private String email;

}

近期热文举荐：

1.1,000+ 道 Java 面试题及答案整顿 (2022 最新版)

2. 劲爆！Java 协程要来了。。。

3.Spring Boot 2.x 教程，太全了！

4. 别再写满屏的爆爆爆炸类了，试试装璜器模式，这才是优雅的形式！！

5.《Java 开发手册（嵩山版）》最新公布，速速下载！

感觉不错，别忘了顺手点赞 + 转发哦！