SpringBoot配置文件中密码属性加密的实现

<dependency>
	<groupId>com.github.ulisesbocchio</groupId>
	<artifactId>jasypt-spring-boot-starter</artifactId>
	<version>3.0.4</version>
</dependency>

@SpringBootApplication
@EnableEncryptableProperties
public class Application {
    ...
}

@SpringBootApplication
@EncryptablePropertySource({"classpath:encrypted.properties"})
public class Application {
    ...
}

<plugin>
	<groupId>com.github.ulisesbocchio</groupId>
	<artifactId>jasypt-maven-plugin</artifactId>
	<version>3.0.4</version>
</plugin>

mvn jasypt:encrypt-value -Djasypt.encryptor.password="TKzhc3fz" -Djasypt.plugin.value="123456"

mvn jasypt:decrypt-value -Djasypt.encryptor.password="TKzhc3fz" -Djasypt.plugin.value="ENC(Muhq57xdiHA5jJX9pX7zmNz57w4emX2D/XYIXOMEx0LYcTL7RYyadWe2J7GCi9KJ)"

jasypt:
  encryptor:
    password: TKzhc3fz # 设置加密的password信息 类似秘钥？
test:
  password: ENC(Muhq57xdiHA5jJX9pX7zmNz57w4emX2D/XYIXOMEx0LYcTL7RYyadWe2J7GCi9KJ) # 测试数据

/**
 * Default property detector that detects encrypted property values with the format "$prefix$encrypted_value$suffix"
 * Default values are "ENC(" and ")" respectively.
 *
 * @author Ulises Bocchio
 */
public class DefaultPropertyDetector implements EncryptablePropertyDetector {
    // 默认的前缀和后缀
    private String prefix = "ENC(";
    private String suffix = ")";

    public DefaultPropertyDetector() {
    }

    public DefaultPropertyDetector(String prefix, String suffix) {
        Assert.notNull(prefix, "Prefix can't be null");
        Assert.notNull(suffix, "Suffix can't be null");
        this.prefix = prefix;
        this.suffix = suffix;
    }

    // 判断配置属性是否是按照jasypt约定规则加密的属性
    @Override
    public boolean isEncrypted(String property) {
        if (property == null) {
            return false;
        }
        final String trimmedValue = property.trim();
        return (trimmedValue.startsWith(prefix) &&
                trimmedValue.endsWith(suffix));
    }

    // 去掉默认的前缀和后缀，返回加密的值
    @Override
    public String unwrapEncryptedValue(String property) {
        return property.substring(
                prefix.length(),
                (property.length() - suffix.length()));
    }
}

/**
 * @author Ulises Bocchio
 */
public class DefaultPropertyResolver implements EncryptablePropertyResolver {

    private final Environment environment;
    // 加密和解密的实现
    private StringEncryptor encryptor;
    // jasypt默认发现器
    private EncryptablePropertyDetector detector;

    public DefaultPropertyResolver(StringEncryptor encryptor, Environment environment) {
        this(encryptor, new DefaultPropertyDetector(), environment);
    }

    public DefaultPropertyResolver(StringEncryptor encryptor, EncryptablePropertyDetector detector, Environment environment) {
        this.environment = environment;
        Assert.notNull(encryptor, "String encryptor can't be null");
        Assert.notNull(detector, "Encryptable Property detector can't be null");
        this.encryptor = encryptor;
        this.detector = detector;
    }

    @Override
    public String resolvePropertyValue(String value) {
        // 该方法获取加密的属性，然后使用StringEncryptor解密并返回
        return Optional.ofNullable(value)
                .map(environment::resolvePlaceholders)
                .filter(detector::isEncrypted) // 过滤加密属性
                .map(resolvedValue -> {
                    try {
                        // 去除前缀和后缀获取真正加密的值
                        String unwrappedProperty = detector.unwrapEncryptedValue(resolvedValue.trim());
                        String resolvedProperty = environment.resolvePlaceholders(unwrappedProperty);
                        // 解密获得明文
                        return encryptor.decrypt(resolvedProperty);
                    } catch (EncryptionOperationNotPossibleException e) {
                        throw new DecryptionException("Unable to decrypt property: "   value   " resolved to: "   resolvedValue   ". Decryption of Properties failed,  make sure encryption/decryption "  
                                "passwords match", e);
                    }
                })
                .orElse(value);
    }
}

@Component("encryptablePropertyDetector")
public class Base64EncryptablePropertyDetector implements EncryptablePropertyDetector {
    private static final String PREFIX = "password:";

    @Override
    public boolean isEncrypted(String property) {
        if (property == null) {
            return false;
        }
        return property.startsWith(PREFIX);
    }

    @Override
    public String unwrapEncryptedValue(String property) {
        return property.substring(PREFIX.length());
    }
}

@Component("encryptablePropertyResolver")
public class Base64EncryptablePropertyResolver implements EncryptablePropertyResolver {
    @Autowired
    private Base64EncryptablePropertyDetector encryptablePropertyDetector;

    @Override
    public String resolvePropertyValue(String value) {
        return Optional.ofNullable(value)
            .filter(encryptablePropertyDetector::isEncrypted)
            .map(resolveValue -> {
                final String unwrapEncryptedValue = encryptablePropertyDetector.unwrapEncryptedValue(resolveValue);
                return new String(Base64.getDecoder().decode(unwrapEncryptedValue),
                    StandardCharsets.UTF_8);
            })
            .orElse(value);
    }
}

jasypt:
  encryptor:
    password: TKzhc3fz # 设置加密的password信息 类似秘钥？
test:
  password: password:MTIzNDU2 # 测试数据