SPRING_JDBC Database Configuration items username and password ciphertext processing class (anti-hacker intrusion)

Original Configuration

Spring combines MySQL, typically separate out profile jdbc.properties,

Configured as follows

Driverclassname=com.mysql.jdbc.driver
db.mysql.url=jdbc:mysql://127.0.0.1:3306/tq?autoreconnect=true& Useunicode=true&characterencoding=utf8
db.mysql.username=test
db.mysql.password=123456

Configure Spring-jdbc.xml so that it loads the configuration item. Examples are as follows:

<?xml version= "1.0" encoding= "UTF-8"?> <beans "xmlns=" xmlns:
	aop= "HTTP://WWW.SPRINGFRAMEWORK.ORG/SCHEMA/AOP" xmlns:context= "Http://www.springframework.org/schema/context" Xmlns:mvc= "Http://www.springframework.org/schema/mvc" xmlns:tx= "Http://www.springframework.org/schema/tx" xmlns: 
		Xsi= "Http://www.w3.org/2001/XMLSchema-instance" xsi:schemalocation= "HTTP://WWW.SPRINGFRAMEWORK.ORG/SCHEMA/AOP Http://www.springframework.org/schema/aop/spring-aop-3.0.xsd Http://www.springframework.org/schema/beans http:// Www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/context http:// Www.springframework.org/schema/context/spring-context-3.0.xsd Http://www.springframework.org/schema/mvc http:// Www.springframework.org/schema/mvc/spring-mvc-3.0.xsd http://www.springframework.org/schema/tx http:// Www.springframework.org/schema/tx/spring-tx-3.0.xsd "default-autowire=" byname "> &LT;context:annotation-config/> <!--scanning components, complete automatic assembly--> <context:component-scan base-package= " Com.tq.app.epg.dao "/> <bean id=" Propertyconfigurer "class="
			Org.springframework.beans.factory.config.PropertyPlaceholderConfigurer "> <property name=" Locations ">
	<list> <value>classpath:jdbc.properties</value> </list> </property> </bean> <bean id= "DataSource" class= "Com.mchange.v2.c3p0.ComboPooledDataSource" destroy-method= "Close" lazy-init= "true" depends-on= "Propertyconfigurer" > <property name= "driverclass" value= "${driverclassname}"/> <property  Name= "Jdbcurl" value= "${db.mysql.url}"/> <property name= "user" value= "${db.mysql.username}"/> Name= "Password" value= "${db.mysql.password}"/> <property name= "Autocommitonclose" value= "true"/> Rty name= "Minpoolsize" value= "5"/> <property name= "maxpoolsize" value= "no"/> <property"MaxIdleTime" value= "1800"/> <property name= "maxstatements" value= "/> <property" name= "AcquireIncreme" NT "value=" 5 "/> <property name=" idleconnectiontestperiod "value=" 6000 "/>" <property name= "TestConnectionO" Ncheckout "value=" true "/> <property name=" checkouttimeout "value=" 10000 "/> </bean> <bean id=" Jdb Ctemplate "class=" org.springframework.jdbc.core.JdbcTemplate "> <property name=" dataSource "ref=" DataSource "/> </bean> </beans>

According to the above configuration, because the database connection, account number, password is clear, there is leakage risk. You can save the redaction in a configuration file and decrypt it when spring reads the profile. Improved Configuration

<?xml version= "1.0" encoding= "UTF-8"?> <beans "xmlns=" xmlns:
	aop= "HTTP://WWW.SPRINGFRAMEWORK.ORG/SCHEMA/AOP" xmlns:context= "Http://www.springframework.org/schema/context" Xmlns:mvc= "Http://www.springframework.org/schema/mvc" xmlns:tx= "Http://www.springframework.org/schema/tx" xmlns: 
		Xsi= "Http://www.w3.org/2001/XMLSchema-instance" xsi:schemalocation= "HTTP://WWW.SPRINGFRAMEWORK.ORG/SCHEMA/AOP Http://www.springframework.org/schema/aop/spring-aop-3.0.xsd Http://www.springframework.org/schema/beans http:// Www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/context http:// Www.springframework.org/schema/context/spring-context-3.0.xsd Http://www.springframework.org/schema/mvc http:// Www.springframework.org/schema/mvc/spring-mvc-3.0.xsd http://www.springframework.org/schema/tx http:// Www.springframework.org/schema/tx/spring-tx-3.0.xsd "default-autowire=" byname "> &LT;context:annotation-config/> <!--scanning components, complete automatic assembly--> <context:component-scan base-package= " Com.tq.app.epg.dao "/> <bean id=" Propertyconfigurer "class="
				Com.tq.app.epg.utils.config.GvtvPropertyPlaceholderConfigurer "> <property name=" Locations "> <list> <value>classpath:jdbc.properties</value> </list> </property> </bean> <bean id= "D Atasource "class=" Com.mchange.v2.c3p0.ComboPooledDataSource "destroy-method=" Close "lazy-init=" true "depends-on=" Propertyconfigurer "> <property name=" driverclass "value=" ${driverclassname} "/> <property name=" JdbcUrl " Value= "${db.mysql.url}"/> <property name= "user" value= "${db.mysql.username}"/> <property name= "Password" ' Value= ' ${db.mysql.password} '/> <property name= ' autocommitonclose ' value= ' true '/> <property ' name= ' minPo Olsize "value=" 5 "/> <property name=" maxpoolsize "value=" ("/> <property" name= "Maxidlet")IME "value=" 1800 "/> <property name=" maxstatements "value=" M "/> <property name=" acquireincrement "value = "5"/> <property name= "idleconnectiontestperiod" value= "6000"/> "<property name=" TestConnectionOnCheckou T "value=" true "/> <property name=" checkouttimeout "value=" 10000 "/> </bean> <bean id=" Jdbctemplat 
    	E "class=" Org.springframework.jdbc.core.JdbcTemplate "> <property name=" dataSource "ref=" DataSource "/> </bean> </beans>

Note that the above class gvtvpropertyplaceholderconfigurer, the implementation of this class is as follows:

Package com.tq.app.epg.utils.config;
Import java.util.Enumeration;

Import java.util.Properties;
Import org.springframework.beans.BeansException;
Import Org.springframework.beans.factory.config.ConfigurableListableBeanFactory;

Import Org.springframework.beans.factory.config.PropertyPlaceholderConfigurer; public class Gvtvpropertyplaceholderconfigurer extends Propertyplaceholderconfigurer {@Override protected void PR
        
        Ocessproperties (configurablelistablebeanfactory beanfactorytoprocess, Properties props) throws Beansexception {
        Aeshelper aeshelper = new Aeshelper ();
        enumeration<?> keys = Props.propertynames ();
            while (Keys.hasmoreelements ()) {string key = (String) keys.nextelement ();
            String value = Props.getproperty (key);
                if (Key.endswith (". Encryption") && null!= value) {props.remove (key);
                Key = key.substring (0, Key.length ()-11); Value = AeshelpeR.decrypt (Value.trim ());
            Props.setproperty (key, value);
        } system.setproperty (key, value);
    } super.processproperties (beanfactorytoprocess, props); }
}

The corresponding jdbc.properties into

Driverclassname=com.mysql.jdbc.driver
db.mysql.url.encryption=xxxxxxxxxxxxxxxxxxxxxxx
db.mysql.username.encryption=d12450e55e370a310c1aaab5189bb42a
db.mysql.password.encryption= adc6327d7db1d55623b70b48614a331b

Attached Aeshelper class:

Package com.tq.app.epg.utils.config;
Import Java.io.InputStream;
Import Java.io.OutputStream;
Import Java.security.MessageDigest;

Import Java.security.spec.AlgorithmParameterSpec;
Import Javax.crypto.Cipher;
Import Javax.crypto.CipherInputStream;
Import Javax.crypto.CipherOutputStream;
Import Javax.crypto.SecretKey;
Import Javax.crypto.spec.IvParameterSpec;

Import Javax.crypto.spec.SecretKeySpec;
    
    /** * < A statement function brief >/public class Aeshelper {Cipher ecipher;
    
    Cipher Dcipher;
     /** * Input A string that'll be MD5 hashed to create the key.  * * @return void, cipher initialized */public Aeshelper () {try {secretkeyspec skey =
            New Secretkeyspec ("9f265d42ab3c66d8f50a3a2e793a30c2". GetBytes (), "AES");
        This.setupcrypto (skey);
        catch (Exception e) {e.printstacktrace (); } public Aeshelper (String key) {Secretkeyspec skey = new Secretkeyspec (getMD5 (key), "AES");
    This.setupcrypto (skey);  } private void Setupcrypto (Secretkey key) {//Create an 8-byte initialization vector byte[] IV =
        
        New byte[] {0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
        Algorithmparameterspec Paramspec = new Ivparameterspec (iv);
            try {ecipher = cipher.getinstance ("aes/cbc/pkcs5padding");
            
            Dcipher = Cipher.getinstance ("aes/cbc/pkcs5padding");
            CBC requires an initialization vector ecipher.init (Cipher.encrypt_mode, Key, Paramspec);
        Dcipher.init (Cipher.decrypt_mode, Key, Paramspec);
        catch (Exception e) {e.printstacktrace ();
    
    }//Buffer used to transport the bytes from one stream to another//byte[] buf = new byte[1024]; public void Encrypt (InputStream into, outputstream out) {byte[] buf = new byte[1024];
            
            try {//Bytes written to out is encrypted out = new CipherOutputStream (out, ecipher);
            Read in the cleartext bytes, and write to encrypt int numread = 0;
            while ((Numread = In.read (buf)) >= 0) {out.write (buf, 0, Numread);
        } out.close ();
        catch (Java.io.IOException e) {e.printstacktrace ();
     }/** * Input is a string to encrypt.
            * @return A Hex string of the The byte array/public string encrypt (string plaintext) {try {
            byte[] ciphertext = ecipher.dofinal (Plaintext.getbytes ("UTF-8"));
        return Bytetohex (ciphertext);
            catch (Exception e) {e.printstacktrace ();
        return null; } public void Decrypt (InputStream in, outputstream out) {try {byte[] buf = n ew BYTE[1024];
            
            Bytes read from to is decrypted in = new CipherInputStream (in, Dcipher);
            Read in the decrypted bytes and write the cleartext to out int numread = 0;
            while ((Numread = In.read (buf)) >= 0) {out.write (buf, 0, Numread);
        } out.close ();
        catch (Java.io.IOException e) {e.printstacktrace (); }/** * Input encrypted string represented in HEX * * @return A string decrypted in plain t Ext/Public String Decrypt (string hexciphertext) {try {String plaintext = new String (DCIP
            Her.dofinal (Hextobyte (Hexciphertext)), "UTF-8");
        return plaintext;
            catch (Exception e) {e.printstacktrace ();
        return null; } public String decrypt (byte[] ciphertext) {try {string plaintext = new String (dcipher.dofinal (ciphertext), "UTF-8");
        return plaintext;
            catch (Exception e) {e.printstacktrace ();
        return null; }} private static byte[] getMD5 (String input) {try {byte[] bytesofmessage = Input.getb
            Ytes ("UTF-8");
            MessageDigest MD = messagedigest.getinstance ("MD5");
        Return Md.digest (Bytesofmessage);
        catch (Exception e) {return null;
    
    } static final String HEXES = "0123456789ABCDEF";
        public static String Bytetohex (byte[] raw) {if (raw = = null) {return null;
        Final StringBuilder hex = new StringBuilder (2 * raw.length); For (final byte b:raw) {Hex.append (Hexes.charat (b & 0xF0) >> 4). Append (Hexes.charat (b & 0x
        0F)));
    return hex.tostring ();
  public static byte[] Hextobyte (String hexstring) {      int len = Hexstring.length ();
        byte[] ba = new BYTE[LEN/2];  for (int i = 0; i < len i = 2) {BA[I/2] = (byte) (Character.digit (Hexstring.charat (i)),
        << 4) + character.digit (Hexstring.charat (i + 1), 16));
    return BA; }
    
}