feat: data masking

backend/framework/src/main/java/org/jumpserver/chen/framework/datasource/base/BaseSQLActuator.java

@@ -18,11 +18,13 @@
 import org.jumpserver.chen.framework.utils.HexUtils;
 import org.jumpserver.chen.framework.utils.PageUtils;
 import org.jumpserver.chen.framework.utils.ReflectUtils;
+import org.jumpserver.wisp.Common;
 
 import java.math.BigDecimal;
 import java.math.BigInteger;
 import java.sql.*;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -167,7 +169,7 @@ private void executeStatement(SQLExecutePlan plan, Statement statement, SQLQuery
                                 fs.add(HexUtils.bytesToHex((byte[]) obj));
                             } else if (obj instanceof Blob) {
                                 fs.add(HexUtils.bytesToHex(((Blob) obj).getBytes(1, (int) ((Blob) obj).length())));
-                            } else if (obj!= null && obj.getClass().getSimpleName().equalsIgnoreCase("pgobject")) {
+                            } else if (obj != null && obj.getClass().getSimpleName().equalsIgnoreCase("pgobject")) {
                                 fs.add(obj.toString());
                             } else {
                                 fs.add(obj);
@@ -181,6 +183,36 @@ private void executeStatement(SQLExecutePlan plan, Statement statement, SQLQuery
                 resultSet.close();
                 result.setFetchFinishedTime(new Time(System.currentTimeMillis()));
 
+                // 数据脱敏
+
+                var rules = SessionManager.getCurrentSession().getDataMaskingRules();
+                var maskIndexes = new ArrayList<>();
+                var maskRules = new HashMap<Integer, Common.DataMaskingRule>();
+                for (var i = 0; i < result.getFields().size(); i++) {
+                    for (Common.DataMaskingRule rule : rules) {
+                        if (result.getFields().get(i).getName().equalsIgnoreCase(rule.getFieldsPattern())) {
+                            maskIndexes.add(i);
+                            maskRules.put(i, rule);
+                        }
+                    }
+                }
+
+                for (var i = 0; i < result.getData().size(); i++) {
+                    for (var j = 0; j < result.getData().get(i).size(); j++) {
+                        if (maskIndexes.contains(j)) {
+                            var rule = maskRules.get(j);
+                            var val = result.getData().get(i).get(j);
+                            if (val instanceof String) {
+                                var rep = this.replaceColumnVal(rule, (String) val);
+                                result.getData().get(i).set(j, rep);
+                            } else {
+                                result.getData().get(i).set(j, rule.getMaskPattern());
+                            }
+                        }
+                    }
+                }
+
+
                 var total = this.count(plan);
                 if (total < 0) {
                     result.setTotal(result.getData().size());
@@ -198,6 +230,60 @@ private void executeStatement(SQLExecutePlan plan, Statement statement, SQLQuery
         }
     }
 
+
+
+    public  String replaceColumnVal(Common.DataMaskingRule rule, String val) {
+        if (rule == null) {
+            return "####";
+        } else {
+            rule.getMaskingMethod();
+        }
+
+        String method = rule.getMaskingMethod();
+        rule.getMaskPattern();
+        String pattern = rule.getMaskPattern();
+
+        switch (method) {
+            case "fixed_char":
+                // 固定字符替换
+                if (pattern.isEmpty()) {
+                    return "####";
+                }
+                return pattern;
+
+            case "hide_middle":
+                // 隐藏中间
+                if (val == null || val.length() < 3) {
+                    return pattern.isEmpty() ? "####" : pattern;
+                }
+                return val.charAt(0)
+                        + "*".repeat(val.length() - 2)
+                        + val.substring(val.length() - 1);
+
+            case "keep_prefix":
+                // 保留前缀
+                int prefix = 2;
+                if (val == null || prefix >= val.length()) {
+                    return "####";
+                }
+                return val.substring(0, prefix)
+                        + "*".repeat(val.length() - prefix);
+
+            case "keep_suffix":
+                // 保留后缀
+                int suffix = 2;
+                if (val == null || suffix >= val.length()) {
+                    return "####";
+                }
+                return "*".repeat(val.length() - suffix)
+                        + val.substring(val.length() - suffix);
+
+            default:
+                // 未知策略
+                return pattern.isEmpty() ? "####" : pattern;
+        }
+    }
+
     @Override
     public SQLQueryResult executeWithAudit(SQL sql) throws SQLException {
         var plan = this.createPlan(sql);

backend/framework/src/main/java/org/jumpserver/chen/framework/session/Session.java

@@ -8,17 +8,21 @@
 import org.jumpserver.chen.framework.jms.exception.CommandRejectException;
 import org.jumpserver.chen.framework.session.controller.Controller;
 import org.jumpserver.chen.framework.ws.io.PacketIO;
+import org.jumpserver.wisp.Common;
 
 import java.io.File;
 import java.nio.file.Path;
 import java.sql.Connection;
 import java.sql.SQLException;
 import java.time.LocalDateTime;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 
 public interface Session {
 
+    List<Common.DataMaskingRule> getDataMaskingRules();
+
     void refreshLastActiveTime();
 
     LocalDateTime getLastActiveTime();

backend/framework/src/main/java/org/jumpserver/chen/framework/session/impl/BaseSession.java

@@ -15,13 +15,15 @@
 import org.jumpserver.chen.framework.session.controller.Controller;
 import org.jumpserver.chen.framework.session.controller.impl.BaseController;
 import org.jumpserver.chen.framework.ws.io.PacketIO;
+import org.jumpserver.wisp.Common;
 
 import java.io.File;
 import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.sql.Connection;
 import java.sql.SQLException;
 import java.time.LocalDateTime;
+import java.util.List;
 import java.util.Locale;
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
@@ -68,6 +70,11 @@ public BaseSession(Datasource datasource, String remoteAddr) {
     }
 
 
+    @Override
+    public List<Common.DataMaskingRule> getDataMaskingRules() {
+        return List.of();
+    }
+
     @Override
     public void refreshLastActiveTime() {
         this.lastActiveTime = LocalDateTime.now();

backend/framework/src/main/java/org/jumpserver/chen/framework/session/impl/JMSSession.java

@@ -41,6 +41,8 @@ public class JMSSession extends BaseSession {
     @Getter
     private final Common.Session jmsSession;
 
+    @Getter
+    private List<Common.DataMaskingRule> dataMaskingRules;
     private ACLFilter aclFilter;
     private CommandHandler commandHandler;
     private ReplayHandler replayHandler;
@@ -103,6 +105,7 @@ public JMSSession(Common.Session session,
         this.canDownload = tokenResp.getData().getPermission().getEnableDownload();
         this.canCopy = tokenResp.getData().getPermission().getEnableCopy();
         this.canPaste = tokenResp.getData().getPermission().getEnablePaste();
+        this.dataMaskingRules = tokenResp.getData().getDataMaskingRulesList();
     }
 
 

backend/web/pom.xml

@@ -107,6 +107,12 @@
             <version>${revision}</version>
         </dependency>
 
+        <dependency>
+            <groupId>org.jumpserver</groupId>
+            <artifactId>sqlparser</artifactId>
+            <version>${revision}</version>
+        </dependency>
+
     </dependencies>
 
 

backend/wisp/pom.xml

@@ -20,7 +20,7 @@
         <dependency>
             <groupId>com.google.protobuf</groupId>
             <artifactId>protobuf-java</artifactId>
-            <version>4.28.0</version>
+            <version>4.32.1</version>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>