Spring Boot - 配置信息后处理

最近在做项目的过程中，PSS提出配置文件中类似数据库连接需要的用户名、密码等敏感信息需要加密处理（之前一直是明文的）。

为了快速完成任务，网上搜刮到jasypt包，也有相应的starter，使用方法可以参考blog

但是还是想具体弄清楚背后的实现。偶然看到Spring Boot中有个EnvironmentPostProcessor接口。看名字，它的实现类应该在配置文件加载完和Spring容器开始初始化之前起作用。这样的话，我们就可以实现该接口用来定制化配置信息，包括解密。

话不多说，show code，

 @Component
 public class DecryptAESConfigProcessor implements EnvironmentPostProcessor {

     private static short INDEX = 0;
     private static String ITEM_FORMAT = "spring.config.decrypt-items[%d]";
     private static Pattern PATTERN = Pattern.compile("AES\\((.+)\\)");
     private static StringBuffer SB = new StringBuffer();

     @Override
     public void postProcessEnvironment(ConfigurableEnvironment environment, SpringApplication application) {
         MutablePropertySources propertySources = environment.getPropertySources();
         for (PropertySource propertySource: propertySources) {
             if (propertySource instanceof OriginTrackedMapPropertySource){
                 INDEX = 0;
                 OriginTrackedMapPropertySource otmps = (OriginTrackedMapPropertySource)propertySource;
                 //System.out.println("property name = " + otmps.getName());
                 Map<String, Object> source = otmps.getSource();
                 String secretSalt = source.getOrDefault("spring.config.secret-salt", "").toString();
                 if (!"".equals(secretSalt)){
                     String salt = CommonUtil.decrypt(secretSalt, "sns");
                     while (INDEX > -1){
                         String item = String.format(ITEM_FORMAT, INDEX);
                         if (source.containsKey(item)){
                             String itemValue = source.get(item).toString();
                             String propertyValue = source.getOrDefault(itemValue, "").toString();
                             Matcher matcher = PATTERN.matcher(propertyValue);
                             boolean findAES = false;
                             while (matcher.find()){
                                 //decrypt each AES()
                                 findAES = true;
                                 String decryptStr = CommonUtil.decrypt(matcher.group(1), salt);
                                 matcher.appendReplacement(SB, decryptStr);
                             }
                             if (!findAES){
                                 //decrypt entire item
                                 source.put(itemValue, CommonUtil.decrypt(propertyValue, salt));
                             } else {
                                 matcher.appendTail(SB);
                                 source.put(itemValue, SB.toString());
                             }
                             SB.delete(0, SB.length());
                             INDEX++;
                         } else {
                             INDEX = -1;
                         }
                     }
                 }
             }
         }

     }
 }

注意：需要将DecryptAESConfigProcessor声明到spring.factories中。

org.springframework.boot.env.EnvironmentPostProcessor=\
org.chris.springboot.config_encrypt.config.DecryptAESConfigProcessor

　　

public class CommonUtil {

    private static final String KEY_ALGORITHM = "AES";
    private static final String DEFAULT_CIPHER_ALGORITHM = "AES/ECB/PKCS5Padding";
    private static Cipher CIPHER;
    private static KeyGenerator KEY_GENERATOR;

    static {
        try {
            CIPHER = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
            KEY_GENERATOR = KeyGenerator.getInstance(KEY_ALGORITHM);
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (NoSuchPaddingException e) {
            e.printStackTrace();
        }
    }

    /**
     * Decrypt by AES
     * @param content
     * @param salt
     * @return
     */
    public static String decrypt(String content, String salt) {
        if (Objects.nonNull(content)) {
            try {
                byte[] decrypted = Base64.getDecoder().decode(content.getBytes("UTF-8"));
                CIPHER.init(Cipher.DECRYPT_MODE, getSecretKey(salt));
                return new String(CIPHER.doFinal(decrypted));
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        return null;
    }

    /**
     * Encrypt by AES
     * @param content
     * @param salt
     * @return
     */
    public static String encrypt(String content, String salt) {
        if (Objects.nonNull(content)) {
            try {
                CIPHER.init(Cipher.ENCRYPT_MODE, getSecretKey(salt));
                byte[] encrypted = CIPHER.doFinal(content.getBytes("UTF-8"));
                return Base64.getEncoder().encodeToString(encrypted);
            } catch (Exception e) {
                e.printStackTrace();
            }
        }
        return null;
    }

    /**
     * Generate encrypted salt
     * @param salt
     * @return
     */
    private static SecretKeySpec getSecretKey(final String salt) {
        KEY_GENERATOR.init(128, new SecureRandom(salt.getBytes()));
        SecretKey secretKey = KEY_GENERATOR.generateKey();
        return new SecretKeySpec(secretKey.getEncoded(), KEY_ALGORITHM);
    }
}

最后，配置文件中需要有类似以下配置项

解密规则如下，

1. 采用AES加密解密；

2. 在配置文件中

　(1) 通过spring.config.decrypt-items指定需要解密的配置

　(2) 通过spring.config.secret-salt指定AES的key（最好加密）

3. 如果需要解密的配置项中存在AES()模式的字符串，将会解密 () 中的内容，否则解密整个配置项