From 3bfcaeca6cc98326ff40b6d565921316aa1ff670 Mon Sep 17 00:00:00 2001
From: wsm <2746563060@qq.com>
Date: Tue, 4 Aug 2026 16:09:56 +0800
Subject: [PATCH] =?UTF-8?q?feat(jasypt):=20=E5=BC=95=E5=85=A5jasypt?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E5=8A=A0=E5=AF=86=E6=94=AF=E6=8C=81=E6=95=8F?=
 =?UTF-8?q?=E6=84=9F=E4=BF=A1=E6=81=AF=E8=84=B1=E6=95=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

根pom与启动模块引入jasypt-spring-boot-starter，
application.yml配置encryptor口令走环境变量/JVM参数注入。
---
 jeecg-module-system/jeecg-system-start/pom.xml       |  6 ++++++
 .../src/main/resources/application.yml               | 12 +++++++++++-
 pom.xml                                              |  9 +++++++++
 3 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/jeecg-module-system/jeecg-system-start/pom.xml b/jeecg-module-system/jeecg-system-start/pom.xml
index b590de8..ef6e8ed 100644
--- a/jeecg-module-system/jeecg-system-start/pom.xml
+++ b/jeecg-module-system/jeecg-system-start/pom.xml
@@ -48,6 +48,12 @@
             <groupId>org.flywaydb</groupId>
             <artifactId>flyway-core</artifactId>
         </dependency>
+
+        <!-- jasypt 配置加密（启动时解密 ENC() 包裹的敏感配置） -->
+        <dependency>
+            <groupId>com.github.ulisesbocchio</groupId>
+            <artifactId>jasypt-spring-boot-starter</artifactId>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/jeecg-module-system/jeecg-system-start/src/main/resources/application.yml b/jeecg-module-system/jeecg-system-start/src/main/resources/application.yml
index ba9863a..245dc8a 100644
--- a/jeecg-module-system/jeecg-system-start/src/main/resources/application.yml
+++ b/jeecg-module-system/jeecg-system-start/src/main/resources/application.yml
@@ -3,4 +3,14 @@ spring:
     name: jeecg-system
   profiles:
     active: '@profile.name@'
-    include: flow
\ No newline at end of file
+    include: flow
+
+# ============================================
+# 敏感配置加密（jasypt）
+# 口令 JASYPT_ENCRYPTOR_PASSWORD 走环境变量/JVM参数注入，严禁写死明文
+# ============================================
+jasypt:
+  encryptor:
+    password: ${JASYPT_ENCRYPTOR_PASSWORD:}
+    algorithm: PBEWITHHMACSHA512ANDAES_256
+    iv-generator-classname: org.jasypt.iv.RandomIvGenerator
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index 27311de..ce0e4d7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -102,6 +102,9 @@
 
 		<flowable.version>6.8.0</flowable.version>
 
+		<!-- 配置文件敏感信息加密 -->
+		<jasypt.version>3.0.5</jasypt.version>
+
 		<qiniu-uapp-sdk.version>7.4.0</qiniu-uapp-sdk.version>
 
 		<jsoup.version>1.11.3</jsoup.version>
@@ -527,6 +530,12 @@
 				<artifactId>flyway-core</artifactId>
 				<version>7.15.0</version>
 			</dependency>
+			<!-- jasypt 配置加密 -->
+			<dependency>
+				<groupId>com.github.ulisesbocchio</groupId>
+				<artifactId>jasypt-spring-boot-starter</artifactId>
+				<version>${jasypt.version}</version>
+			</dependency>
 		</dependencies>
 	</dependencyManagement>