手把手教你ShardingSphere和Mybatis拦截器实现特殊字段动态切换加密

# 配置一个AES加密器，并设置aes.key
encryptRule:
  encryptors:
    aes_encryptor:
      type: aes
      props:
        aes.key.value: xxxxxx
        
# 配置需要加密的表
  tables:
    t_user:
      columns:
        # 加密表的逻辑字段
        c_phone:
          # 明文字段
          plainColumn: c_phone
          # 加密字段
          cipherColumn: c_phone_encrypt
          # 上面配置的加密器
          encryptor: aes_encryptor
          
# 配置不使用密文查询
props:
    query.with.cipher.column: false

props:
    query.with.cipher.column: true

/**
 * 加密字段，标识更新/插入的加密字段
 */
@Alias("encryptString")
public class EncryptString {
}

/**
 * 加密字段，标识查询时的加密字段
 */
@Alias("encryptQuery")
public class EncryptQuery {
}

@MappedTypes(EncryptString.class)
public class StringEncryptTypeHandler extends BaseTypeHandler<String> {

    private static final Logger logger = LoggerFactory.getLogger(StringEncryptTypeHandler.class);

    private Encryptor encryptor;

    public StringEncryptTypeHandler() {
        if (MybatisEncryptEnableHolder.isEnabled()) {
            //获取加密器
            this.encryptor = ServiceLoader.getService(Encryptor.class);
        }
    }

    @Override
    public void setNonNullParameter(PreparedStatement ps, int i, String s,
        JdbcType jdbcType) throws SQLException {
        if (!MybatisEncryptEnableHolder.isEnabled()) {
            ps.setString(i, s);
            return;
        }
        if (encryptor.isEncrypt(s)) {
            //异常，不应该是加密数据
            logger.error("encrypt error {}", s);
        }
        String encryptValue = encryptor.encrypt(s);
        ps.setString(i, encryptValue);
    }

    @Override
    public String getNullableResult(ResultSet rs, String s) throws SQLException {
        String value = rs.getString(s);
        if (!MybatisEncryptEnableHolder.isEnabled()) {
            return value;
        }
        if (value == null) return null;
        try{
            return encryptor.isEncrypt(value) ? encryptor.decrypt(value).toString() : value;
        }catch (Throwable e) {
            return value;
        }
    }

    @Override
    public String getNullableResult(ResultSet rs, int i) throws SQLException {
        //略
    }

    @Override
    public String getNullableResult(CallableStatement cs, int i) throws SQLException {
        //略
    }
}

@MappedTypes(EncryptQuery.class)
public class QueryParamEncryptTypeHandler extends BaseTypeHandler<String> {

    private Encryptor encryptor;

    public QueryParamEncryptTypeHandler() {
        if (MybatisEncryptEnableHolder.isEnabled()) {
            this.encryptor = ConfigurableServiceLoader.getService(Encryptor.class);
        }
    }

    @Override
    public void setNonNullParameter(PreparedStatement ps, int i, String s, JdbcType jdbcType) throws SQLException {
        //这里增加了配置，用于切换在查询时，是否需要将查询参数加密
        if (!MybatisEncryptEnableHolder.isEnabled() || !MybatisEncryptEnableHolder.isEnabledDynamicColumn()) {
            ps.setString(i, s);
            return;
        }
        String encryptValue = encryptor.encrypt(s);
        ps.setString(i, encryptValue);
    }

    @Override
    public String getNullableResult(ResultSet rs, String s) throws SQLException {
        String value = rs.getString(s);
        if (!MybatisEncryptEnableHolder.isEnabled()) {
            return value;
        }
        if (value == null) return null;
        try{
            return encryptor.isEncrypt(value) ? encryptor.decrypt(value).toString() : value;
        }catch (Throwable e) {
            return value;
        }
    }

    @Override
    public String getNullableResult(ResultSet rs, int i) throws SQLException {
        //略
    }

    @Override
    public String getNullableResult(CallableStatement cs, int i) throws SQLException {
       //略
    }
}

@Intercepts({
                @Signature(type = StatementHandler.class, method = "prepare", args = {Connection.class, Integer.class})
        })
public class DynamicColumnInterceptor implements Interceptor {

    private static final Logger log = LoggerFactory.getLogger(DynamicColumnInterceptor.class);

    //加密字段和普通字段的映射关系
    Map<String, String> encryptColumnMap = new HashMap<>();

    //加密的表名
    private Set<String> tableNames = new HashSet<>();

    public DynamicColumnInterceptor() {
        String columnMapStr = ConfigHolder.getProperties().getProperty("encryptColumnMap", "");
        this.encryptColumnMap = toMap(columnMapStr);
    }

    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        if (MybatisEncryptEnableHolder.isEnabledDynamicColumn()) {
            StatementHandler statementHandler = (StatementHandler) realTarget(invocation.getTarget());
            MetaObject metaObject = SystemMetaObject.forObject(statementHandler);
            MappedStatement mappedStatement = (MappedStatement) metaObject.getValue("delegate.mappedStatement");
            SqlCommandType sqlCommandType = mappedStatement.getSqlCommandType();
            //如果是查询语句
            if (sqlCommandType.equals(SqlCommandType.SELECT)) {
                BoundSql boundSql = statementHandler.getBoundSql();
                String sql = boundSql.getSql();
                //如果是加密表
                if (containsTable(sql)) {
                    try{
                        //改写SQL
                        String replacedSql = replaceSql(sql);
                        Field field = boundSql.getClass().getDeclaredField("sql");
                        field.setAccessible(true);
                        field.set(boundSql, replacedSql);
                    }catch (Exception e) {
                        log.error("替换SQL失败，原SQL：" + sql, e);
                    }

                }
            }
        }
        return invocation.proceed();
    }

    private boolean containsTable(String sql) {
        for (String tableName : tableNames) {
            if (sql.contains(tableName)) {
                return true;
            }
        }
        return false;
    }

    private Object realTarget(Object target) {
        if (Proxy.isProxyClass(target.getClass())) {
            MetaObject metaObject = SystemMetaObject.forObject(target);
            return realTarget(metaObject.getValue("h.target"));
        } else {
            return target;
        }
    }

    /**
     * 自己实现replaceAll方法，string.replaceAll中使用正则，性能损耗更高。
     */
    private String replaceAll(String str, String key, String value) {
        //略，可以参考StringUtils实现，同时考虑字段名部分重复的情况
    }

    private String replaceSql(String sql) {
        String replacedSql = sql;
        for (Map.Entry<String, String> entry : encryptColumnMap.entrySet()) {
            replacedSql = replaceAll(replacedSql, entry.getKey(), entry.getValue());
        }
        log.debug("原SQL：{}n替换后的SQL：{}", sql, replacedSql);
        return replacedSql;
    }

    @Override
    public Object plugin(Object o) {
        return Plugin.wrap(o, this);

    }

    @Override
    public void setProperties(Properties properties) {

    }
}