这是我参与8月更文挑战的第7天，活动详情查看：8月更文挑战
数据脱敏方案
一、脱敏方案调研
目的：我们要将查出的数据，根据预设的脱敏规则进行脱敏，将脱敏后的数据返回给调用者！
经过调研，业务方期待少更改或者不更改代码，进行数据脱敏和加密，现阶段，需要数据脱敏和加密的数据基本都是经过JDBC进行查询的，所以一方面考虑减少业务方的代码修改量，一方面考虑JDBC的通用性，所以我们考虑使用字节码插桩技术，再Class编译的时候，就将JDBC修改掉！
原始具体的架构图如下：
我们后续的增强业务：
二、原始JDBC的使用
我们如果是想要拦截JDBC，我们就必须要理解JDBC的查询, 假如我们有这样一个表：
CREATE TABLE `test_sql` (
`id` int(255) NOT NULL AUTO_INCREMENT,
`test1` varchar(255) DEFAULT NULL,
`test2` varchar(255) DEFAULT NULL,
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8mb4;
JDBC查询
/**
* 原生的JDBC测试
*
* @author huangfu
* @date 2021年8月23日09:30:12
*/
public class ProtistJdbcTest {
/**
* 数据库的url
*/
private static final String URL = "jdbc:mysql://10.0.10.118:3306/huangfu_0601?useUnicode=true&characterEncoding=utf8&autoReconnect=true&useSSL=false";
/**
* 数据库的用户名
*/
private static final String USER_NAME = "root";
/**
* 数据库的密码
*/
private static final String PASSWORD = "123456";
public static void main(String[] args) throws Exception {
//加载JDBC的驱动
Class.forName("com.mysql.cj.jdbc.Driver");
//获取连接
Connection connection = DriverManager.getConnection(URL, USER_NAME, PASSWORD);
//验证是否存活
boolean valid = connection.isValid(1000);
System.out.println("连接是否有效:" + valid);
String sql = "select * from test_sql where id=?";
//获取预编译处理器
PreparedStatement preparedStatement = connection.prepareStatement(sql, ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_UPDATABLE);
//设置条件
preparedStatement.setInt(1, 1);
//执行查询
ResultSet resultSet = preparedStatement.executeQuery();
//开始查询数据
while (resultSet.next()) {
System.out.println("----------------------------------------------------");
System.out.println("id:" + resultSet.getInt("id"));
System.out.println("test1:" + resultSet.getString("test1"));
System.out.println("test2:" + resultSet.getString("test2"));
System.out.println("----------------------------------------------------");
}
}
}
我们可以看到，正常的查询基本都是通过PreparedStatement进行查询的，那么我们拦截 executeQuery方法，解析SQL，查询表字段对应的规则，根据规则，对查询到的数据（ResultSet）进行修改后返回！
三、拦截JDBC
1. 架构图例
2. 代码实例
我们以Mysql为例，假设我们有一下需求，还是以上述的SQL代码为例，我们需要将test1字段查询的数据全部都更改为 皇甫科星
我们需要一个拦截器：
/**
* 监听器
*
* @author huangfu
* @date 2021年8月23日12:04:59
*/
public class MysqlJdbcMonitor {
@RuntimeType
public static Object intercept(@This Object thisObject, @SuperCall Callable<?> callable) {
Object call = null;
try {
call = callable.call();
System.out.println("------------------------------拦截器打印开始--------------------------");
System.out.println("这是拦截器打印的：" + thisObject);
System.out.println("开始获取sql");
Class<?> aClass = thisObject.getClass();
Method asSql = aClass.getMethod("asSql");
Object sql = asSql.invoke(thisObject);
System.out.println("*******解析出来的sql为：" + sql);
System.out.println("这是拦截器拦截的结果集：" + call);
if (call instanceof ResultSet) {
ResultSet resultSet = (ResultSet) call;
freeFromImprisonment(resultSet);
System.out.println("修改后的类型:" + resultSet.getType());
while (resultSet.next()) {
System.out.println("------------------------拦截器----------------------------");
System.out.println("**********id:" + resultSet.getInt("id"));
System.out.println("**********test1:" + resultSet.getString("test1"));
System.out.println("**********test2:" + resultSet.getString("test2"));
//获取对应的字段索引
int waitUpdateColumnIndex = resultSet.findColumn("test1");
//计算对应数据索引
int waitUpdateColumnIndexUpdate = waitUpdateColumnIndex - 1;
//internalRowData
ReflectionUtils.doWithFields(resultSet.getClass(), field -> {
field.setAccessible(true);
Object thisRowDataObject = field.get(resultSet);
//开始正式读取数据
ReflectionUtils.doWithFields(thisRowDataObject.getClass(), internalRowDataFieldChild -> {
internalRowDataFieldChild.setAccessible(true);
//获取internalRowData的值
Object internalRowDataByteArray = internalRowDataFieldChild.get(thisRowDataObject);
if (internalRowDataByteArray != null) {
//获取字段的数据
byte[][] rowData = (byte[][]) internalRowDataByteArray;
//获取对应字段的数据
byte[] rowDatum = rowData[waitUpdateColumnIndexUpdate];
System.out.println("初始值：" + new String(rowDatum, StandardCharsets.UTF_8));
System.out.println("修改值为：皇甫科星");
//修改数据
rowData[waitUpdateColumnIndexUpdate] = "皇甫科星".getBytes(StandardCharsets.UTF_8);
internalRowDataFieldChild.set(thisRowDataObject, rowData);
System.out.println("------------------修改数据成功-------------------");
}
}, internalRowDataFieldChild -> "internalRowData".equals(internalRowDataFieldChild.getName()));
}, field -> "thisRow".equals(field.getName()));
System.out.println("-----------------------拦截器-----------------------------");
}
//回归对应的光标
resultSet.absolute(0);
}
System.out.println("------------------------------拦截器打印结束--------------------------");
} catch (Exception e) {
e.printStackTrace();
}
return call;
}
/**
* 解决ResultSet封禁问题
*
* @param resultSet 结果集
*/
protected static void freeFromImprisonment(ResultSet resultSet) {
//修改可翻滚
ReflectionUtils.doWithFields(resultSet.getClass(), field -> {
field.setAccessible(true);
Object o = field.get(resultSet);
System.out.println("原始的值为：" + o);
field.set(resultSet, ResultSet.TYPE_SCROLL_INSENSITIVE);
}, field -> "resultSetType".equals(field.getName()));
//修改只读
ReflectionUtils.doWithFields(resultSet.getClass(), field -> {
field.setAccessible(true);
Object o = field.get(resultSet);
System.out.println("原始的值为：" + o);
field.set(resultSet, ResultSet.CONCUR_UPDATABLE);
}, field -> "resultSetConcurrency".equals(field.getName()));
}
}
我们需要一个拦截器的主体：
/**
* JDBC代理拦截器
*
* @author huangfu
* @date 2021年8月23日11:15:10
*/
public class PinpointBootStrap {
public static void premain(String agentArgs, Instrumentation inst) {
//构建一个转换器
AgentBuilder.Transformer transformer = (builder, typeDescription, classLoader, javaModule) -> builder
// 拦截静态而且前缀为test的方法
.method(ElementMatchers.named("executeQuery"))
// 委托
.intercept(MethodDelegation.to(MysqlJdbcMonitor.class));
AgentBuilder.Listener listener = new AgentBuilder.Listener() {
@Override
public void onDiscovery(String typeName, ClassLoader classLoader, JavaModule module, boolean loaded) {
}
@Override
public void onTransformation(TypeDescription typeDescription, ClassLoader classLoader, JavaModule module, boolean loaded, DynamicType dynamicType) {
}
@Override
public void onIgnored(TypeDescription typeDescription, ClassLoader classLoader, JavaModule module, boolean loaded) {
}
@Override
public void onError(String typeName, ClassLoader classLoader, JavaModule module, boolean loaded, Throwable throwable) {
throwable.printStackTrace();
}
@Override
public void onComplete(String typeName, ClassLoader classLoader, JavaModule module, boolean loaded) {
}
};
new AgentBuilder
.Default()
// 指定需要拦截的类
.type(ElementMatchers.named("com.mysql.cj.jdbc.ClientPreparedStatement"))
//添加一个转换器
.transform(transformer)
.with(listener)
//将上述的转换安装到javaagent的介入器
.installOn(inst);
}
}
我们需要准备javaagent的环境：
<properties>
<maven.compiler.source>8</maven.compiler.source>
<maven.compiler.target>8</maven.compiler.target>
<plugin.jar.version>3.2.0</plugin.jar.version>
<byte-buddy.version>1.11.12</byte-buddy.version>
</properties>
<dependencies>
<dependency>
<groupId>net.bytebuddy</groupId>
<artifactId>byte-buddy</artifactId>
<version>${byte-buddy.version}</version>
</dependency>
<dependency>
<groupId>net.bytebuddy</groupId>
<artifactId>byte-buddy-agent</artifactId>
<version>${byte-buddy.version}</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<version>3.0.0</version>
<configuration>
<createDependencyReducedPom>false</createDependencyReducedPom>
</configuration>
<executions>
<execution>
<phase>package</phase>
<goals>
<goal>shade</goal>
</goals>
<configuration>
<!--指定打包位置-->
<outputDirectory>C:/Users/Administrator/Desktop/asm</outputDirectory>
<transformers>
<transformer
implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer">
<manifestEntries>
<Premain-Class>com.huangfu.jdbc.PinpointBootStrap</Premain-Class>
<Agent-Class>com.huangfu.jdbc.PinpointBootStrap</Agent-Class>
<Can-Redefine-Classes>true</Can-Redefine-Classes>
<Can-Retransform-Classes>true</Can-Retransform-Classes>
<Pinpoint-Version>${project.version}</Pinpoint-Version>
<Boot-Class-Path>${project.build.finalName}.jar</Boot-Class-Path>
</manifestEntries>
</transformer>
</transformers>
<artifactSet>
<includes>
<include>net.bytebuddy:byte-buddy</include>
<include>net.bytebuddy:byte-buddy-agent</include>
</includes>
</artifactSet>
<filters>
<filter>
<artifact>*:*</artifact>
<excludes>
<exclude>META-INF/*.SF</exclude>
<exclude>META-INF/*.DSA</exclude>
<exclude>META-INF/*.RSA</exclude>
</excludes>
</filter>
</filters>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>
3.尝试运行
运行命令：
java -javaagent:./bytebuddy-demo-1.0-SNAPSHOT.jar -cp ./jdbc-demo-1.0-SNAPSHOT.jar com.huangfu.jdbc.ProtistJdbcTest
