Sunyard/cisd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix：配置加密机制

Browse Source
This commit is contained in:
waner 2026-05-14 14:53:35 +08:00
parent 3a9a76c100
commit e7f9c1d183
4 changed files with 55 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/main/java/com/cisd/tms/common/crypto/config/ConfigDecryptingEnvironmentPostProcessor.java
View File

@ -1,7 +1,9 @@
package com.cisd.tms.common.crypto.config;
import java.util.LinkedHashMap;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.env.EnvironmentPostProcessor;
import org.springframework.core.Ordered;
@ -27,14 +29,18 @@ public class ConfigDecryptingEnvironmentPostProcessor implements EnvironmentPost
@Override
public void postProcessEnvironment(ConfigurableEnvironment environment, SpringApplication application) {
Map<String, Object> decryptedValues = new LinkedHashMap<>();
Set<String> visitedPropertyNames = new HashSet<>();
for (PropertySource<?> propertySource : environment.getPropertySources()) {
if (!(propertySource instanceof EnumerablePropertySource<?> enumerablePropertySource)) {
continue;
}
for (String propertyName : enumerablePropertySource.getPropertyNames()) {
Object rawValue = enumerablePropertySource.getProperty(propertyName);
if (rawValue instanceof String stringValue && encryptor.isEncrypted(stringValue)) {
decryptedValues.putIfAbsent(propertyName, encryptor.decryptIfNecessary(stringValue));
if (!visitedPropertyNames.add(propertyName)) {
continue;
}
String resolvedValue = environment.getProperty(propertyName);
if (encryptor.isEncrypted(resolvedValue)) {
decryptedValues.put(propertyName, encryptor.decryptIfNecessary(resolvedValue));
}
}
}

18
src/main/java/com/cisd/tms/modules/init/executor/ConfigurableInitStepExecutor.java
View File

@ -93,7 +93,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
Process process = null;
try {
ProcessBuilder processBuilder = new ProcessBuilder("/bin/zsh", "-lc", command);
ProcessBuilder processBuilder = new ProcessBuilder("/bin/bash", "-lc", command);
processBuilder.redirectErrorStream(true);
processBuilder.redirectOutput(logFile.toFile());
process = processBuilder.start();
@ -897,7 +897,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
try {
int code = runCommand(
logFile,
Arrays.asList("/bin/zsh", "-lc", applyCommand),
Arrays.asList("/bin/bash", "-lc", applyCommand),
false,
loadDir,
buildStandardDbApplyEnvironment(loadDir, context)
@ -1031,7 +1031,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
try {
int code = runCommand(
logFile,
Arrays.asList("/bin/zsh", "-lc", command),
Arrays.asList("/bin/bash", "-lc", command),
false,
workingDirectory,
buildStandardStartEnvironment(stepName)
@ -1070,7 +1070,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
try {
int code = runCommand(
logFile,
Arrays.asList("/bin/zsh", "-lc", command),
Arrays.asList("/bin/bash", "-lc", command),
false,
null,
buildStandardDbApplyEnvironment(null, context)
@ -1246,7 +1246,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
.toAbsolutePath();
Path logFile = prepareLogPath(task, step);
try {
int code = runCommand(logFile, Arrays.asList("/bin/zsh", "-lc", command), false, scriptDir);
int code = runCommand(logFile, Arrays.asList("/bin/bash", "-lc", command), false, scriptDir);
if (code != 0) {
return InitStepExecutionResult.failure("cae_update 执行失败", code, logFile.toString());
}
@ -1315,7 +1315,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
Path logFile = prepareLogPath(task, step);
try {
int code = runCommand(logFile, Arrays.asList("/bin/zsh", "-lc", command), false);
int code = runCommand(logFile, Arrays.asList("/bin/bash", "-lc", command), false);
if (code != 0) {
return InitStepExecutionResult.failure("restart_tlq 执行失败", code, logFile.toString());
}
@ -2246,7 +2246,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
try {
int code = runCommand(
logFile,
Arrays.asList("/bin/zsh", "-lc", "pgrep -f " + quoteShellValue(pattern) + " >/dev/null"),
Arrays.asList("/bin/bash", "-lc", "pgrep -f " + quoteShellValue(pattern) + " >/dev/null"),
true
);
if (code == 0) {
@ -2270,7 +2270,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
try {
int code = runCommand(
logFile,
Arrays.asList("/bin/zsh", "-lc", command),
Arrays.asList("/bin/bash", "-lc", command),
true,
null,
buildStandardDbApplyEnvironment(null, context)
@ -2301,7 +2301,7 @@ public class ConfigurableInitStepExecutor implements InitStepExecutor {
private void verifyRabbitObjectAbsent(Path logFile, String shellCommand, String message, List<String> failures) throws IOException {
try {
int code = runCommand(logFile, Arrays.asList("/bin/zsh", "-lc", shellCommand), true);
int code = runCommand(logFile, Arrays.asList("/bin/bash", "-lc", shellCommand), true);
if (code == 0) {
failures.add(message);
}

33
src/test/java/com/cisd/tms/common/crypto/config/ConfigDecryptingEnvironmentPostProcessorTest.java
View File

@ -3,7 +3,9 @@ package com.cisd.tms.common.crypto.config;
import java.util.Map;
import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
import org.springframework.boot.WebApplicationType;
import org.springframework.boot.SpringApplication;
import org.springframework.context.ConfigurableApplicationContext;
import org.springframework.core.env.MapPropertySource;
import org.springframework.core.env.StandardEnvironment;
@ -25,4 +27,35 @@ class ConfigDecryptingEnvironmentPostProcessorTest {
Assertions.assertEquals("db-password", environment.getProperty("spring.datasource.password"));
Assertions.assertEquals("8080", environment.getProperty("server.port"));
}
@Test
void decryptsEncryptedPlaceholderDefaultValuesBeforeBinding() {
ConfigTextEncryptor encryptor = ConfigTextEncryptor.withDefaultHardcodedKey();
String encryptedUsername = encryptor.encrypt("db-user");
StandardEnvironment environment = new StandardEnvironment();
environment.getPropertySources().addFirst(new MapPropertySource("test", Map.of(
"spring.datasource.username", "${TMS_DB_USER:" + encryptedUsername + "}"
)));
new ConfigDecryptingEnvironmentPostProcessor()
.postProcessEnvironment(environment, new SpringApplication(Object.class));
Assertions.assertEquals("db-user", environment.getProperty("spring.datasource.username"));
}
@Test
void springBootAutoLoadsPostProcessorFromFactories() {
ConfigTextEncryptor encryptor = ConfigTextEncryptor.withDefaultHardcodedKey();
String encryptedUsername = encryptor.encrypt("dev-user");
SpringApplication application = new SpringApplication(Object.class);
application.setWebApplicationType(WebApplicationType.NONE);
application.setDefaultProperties(Map.of(
"tms.crypto.test.username", encryptedUsername,
"spring.main.banner-mode", "off"
));
try (ConfigurableApplicationContext context = application.run()) {
Assertions.assertEquals("dev-user", context.getEnvironment().getProperty("tms.crypto.test.username"));
}
}
}

7
src/test/java/com/cisd/tms/modules/backup/restore/RestoreCommandInvokerTest.java
View File

@ -18,7 +18,7 @@ class RestoreCommandInvokerTest {
Path logFile = tempDir.resolve("restore.log");
int exitCode = invoker.run(
List.of("/bin/zsh", "-lc", "printf 'hello-restore'"),
List.of("/bin/bash", "-lc", "printf 'hello-restore'"),
logFile,
tempDir
);
@ -35,7 +35,7 @@ class RestoreCommandInvokerTest {
long started = System.nanoTime();
int exitCode = invoker.run(
List.of("/bin/zsh", "-lc", "sleep 2; printf 'done'"),
List.of("/bin/bash", "-lc", "sleep 2; printf 'done'"),
logFile,
tempDir
);
@ -46,12 +46,13 @@ class RestoreCommandInvokerTest {
}
private static void waitUntilLogContains(Path logFile, String expected) throws Exception {
long deadline = System.currentTimeMillis() + 1000;
long deadline = System.currentTimeMillis() + 5000;
while (System.currentTimeMillis() < deadline) {
if (Files.isRegularFile(logFile) && Files.readString(logFile).contains(expected)) {
return;
}
Thread.sleep(20);
}
Assertions.fail("restore log did not contain expected text: " + expected);
}
}