日志脱敏
使用Masking
我们使用ValueMasker
假设我们将value作为脱敏的字段
...
<encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
<jsonGeneratorDecorator class="net.logstash.logback.mask.MaskingJsonGeneratorDecorator">
<defaultMask>*****</defaultMask>
<path>value</path>
</jsonGeneratorDecorator>
....
</encoder>
....
注意
不管是valueMasker还是pathMasker打印日志都需要使用net.logstash.logback.argument.StructuredArguments的方法打印否则不生效。
如果不使用则需要对message进行正则处理。
验证
http
POST http://localhost:8081/test
{
"value": "1"
}
结果
{
"param": {
"value": "*****"
},
"date": "2022-07-20 09:22:04.077",
"level": "INFO",
"message": "no-entries",
"traceId": "",
"thread": "http-nio-8081-exec-1",
"serverName": "test"
}
脱敏优化
匹配后会直接变成defaultMask设置的值。不友好。
有时候我们需要设置成手机号 111****223这种。则需要自定义
自定义valueMasker
新建`EncryptingValueMasker1
import cn.hutool.core.util.DesensitizedUtil;
import cn.hutool.core.util.StrUtil;
import com.fasterxml.jackson.core.JsonStreamContext;
import net.logstash.logback.mask.ValueMasker;
import java.util.Arrays;
import java.util.List;
public class EncryptingValueMasker implements ValueMasker {
private static final List<String> PHONE = Arrays.asList("phone");
private static final List<String> NAME = Arrays.asList("identity", "identityName", "name");
private static final List<String> EMAIL = Arrays.asList("email");
private static final List<String> ID_CARD = Arrays.asList("identity");
private static final List<String> PASSWORD = Arrays.asList("password");
private static final List<String> OTHER = Arrays.asList("password");
private static final List<String> BANK_CARD = Arrays.asList("bankCard");
@Override
public Object mask(JsonStreamContext context, Object value) {
String currentName = context.getCurrentName();
if (value instanceof String) {
if (PHONE.contains(currentName)) {
return DesensitizedUtil.mobilePhone((String) value);
} else if (ID_CARD.contains(currentName)) {
return DesensitizedUtil.idCardNum((String) value, 1, 2);
} else if (EMAIL.contains(currentName)) {
return DesensitizedUtil.email((String) value);
} else if (NAME.contains(currentName)) {
return DesensitizedUtil.chineseName((String) value);
} else if (PASSWORD.contains(currentName)) {
return "*****";
} else if (BANK_CARD.contains(currentName)) {
return DesensitizedUtil.bankCard((String) value);
} else if (OTHER.contains(currentName)) {
return StrUtil.hide((String) value, 2, 2);
}
}
return null;
}
}
可以定义不同的脱敏规则，这里使用了Hutool的脱敏工具类。import中有描述。
使用的时候在List中增加对应的属性名即可
使用
...
<encoder class="net.logstash.logback.encoder.LoggingEventCompositeJsonEncoder">
<jsonGeneratorDecorator class="net.logstash.logback.mask.MaskingJsonGeneratorDecorator">
<valueMasker class="相对路径.EncryptingValueMasker"/>
</jsonGeneratorDecorator>
....
</encoder>
....
测试
POST http://localhost:8081/test
{
"name": "舒先生"
}
结果
{
"param": {
"name": "舒**"
},
"date": "2022-07-20 09:30:49.753",
"level": "INFO",
"message": "no-entries",
"traceId": "",
"thread": "http-nio-8081-exec-1",
"serverName": "test"
}
完成。
