feat(syslog): 操作日志支持 @AutoLogIgnore 字段脱敏
新增字段级注解 @AutoLogIgnore,标注在实体字段上; 写操作日志序列化请求参数时,按运行时类型自动识别并 将标注字段的值替换为 ***,避免敏感数据写入日志。
This commit is contained in:
@@ -2,6 +2,7 @@ package org.jeecg.common.aspect;
|
||||
|
||||
import com.alibaba.fastjson.JSONObject;
|
||||
import com.alibaba.fastjson.serializer.PropertyFilter;
|
||||
import com.alibaba.fastjson.serializer.ValueFilter;
|
||||
import lombok.extern.slf4j.Slf4j;
|
||||
import org.apache.shiro.SecurityUtils;
|
||||
import org.aspectj.lang.JoinPoint;
|
||||
@@ -13,6 +14,7 @@ import org.aspectj.lang.reflect.MethodSignature;
|
||||
import org.jeecg.common.api.dto.LogDTO;
|
||||
import org.jeecg.common.api.vo.Result;
|
||||
import org.jeecg.common.aspect.annotation.AutoLog;
|
||||
import org.jeecg.common.aspect.annotation.AutoLogIgnore;
|
||||
import org.jeecg.common.constant.CommonConstant;
|
||||
import org.jeecg.common.constant.enums.ModuleType;
|
||||
import org.jeecg.common.constant.enums.OperateTypeEnum;
|
||||
@@ -29,8 +31,11 @@ import javax.annotation.Resource;
|
||||
import javax.servlet.ServletRequest;
|
||||
import javax.servlet.ServletResponse;
|
||||
import javax.servlet.http.HttpServletRequest;
|
||||
import java.lang.reflect.Field;
|
||||
import java.lang.reflect.Method;
|
||||
import java.util.Date;
|
||||
import java.util.HashSet;
|
||||
import java.util.Set;
|
||||
|
||||
|
||||
/**
|
||||
@@ -48,6 +53,23 @@ public class AutoLogAspect {
|
||||
@Resource
|
||||
private BaseCommonService baseCommonService;
|
||||
|
||||
//update-begin-author:wsm date:20260805 for:按运行时类型缓存标注了@AutoLogIgnore的字段名集合
|
||||
private final ClassValue<Set<String>> autoLogIgnoreCache = new ClassValue<Set<String>>() {
|
||||
@Override
|
||||
protected Set<String> computeValue(Class<?> type) {
|
||||
Set<String> fieldNames = new HashSet<>();
|
||||
for (Class<?> clazz = type; clazz != null && clazz != Object.class; clazz = clazz.getSuperclass()) {
|
||||
for (Field field : clazz.getDeclaredFields()) {
|
||||
if (field.getAnnotation(AutoLogIgnore.class) != null) {
|
||||
fieldNames.add(field.getName());
|
||||
}
|
||||
}
|
||||
}
|
||||
return fieldNames;
|
||||
}
|
||||
};
|
||||
//update-end-author:wsm date:20260805 for:按运行时类型缓存标注了@AutoLogIgnore的字段名集合
|
||||
|
||||
@Pointcut("@annotation(org.jeecg.common.aspect.annotation.AutoLog)")
|
||||
public void logPointCut() {
|
||||
|
||||
@@ -170,8 +192,19 @@ public class AutoLogAspect {
|
||||
return true;
|
||||
}
|
||||
};
|
||||
params = JSONObject.toJSONString(arguments, profilter);
|
||||
//update-end-author:taoyan date:20200724 for:日志数据太长的直接过滤掉
|
||||
//update-begin-author:wsm date:20260805 for:序列化请求参数时对标注了@AutoLogIgnore的字段值脱敏
|
||||
ValueFilter valueFilter = (source, name, value) -> {
|
||||
if (source != null) {
|
||||
Set<String> ignoreFields = autoLogIgnoreCache.get(source.getClass());
|
||||
if (ignoreFields.contains(name)) {
|
||||
return "***";
|
||||
}
|
||||
}
|
||||
return value;
|
||||
};
|
||||
params = JSONObject.toJSONString(arguments, profilter, valueFilter);
|
||||
//update-end-author:wsm date:20260805 for:序列化请求参数时对标注了@AutoLogIgnore的字段值脱敏
|
||||
} else {
|
||||
MethodSignature signature = (MethodSignature) joinPoint.getSignature();
|
||||
Method method = signature.getMethod();
|
||||
|
||||
+16
@@ -0,0 +1,16 @@
|
||||
package org.jeecg.common.aspect.annotation;
|
||||
|
||||
import java.lang.annotation.*;
|
||||
|
||||
/**
|
||||
* 标注在实体字段上
|
||||
* 写操作日志序列化请求参数时,该字段的值会被自动替换为 ***,避免敏感数据写入日志
|
||||
*
|
||||
* @Author wsm
|
||||
* @Date 2026年8月5日
|
||||
*/
|
||||
@Target(ElementType.FIELD)
|
||||
@Retention(RetentionPolicy.RUNTIME)
|
||||
@Documented
|
||||
public @interface AutoLogIgnore {
|
||||
}
|
||||
Reference in New Issue
Block a user