Java 安全与合规：安全编码、数据脱敏与供应链防护

// OWASP Java Encoder：正确的 HTML/JS/URL 编码
import org.owasp.encoder.Encode;
String safe = Encode.forHtml(userInput);         // HTML 上下文
String safeJs = Encode.forJavaScript(userInput); // JS 上下文
String safeUrl = Encode.forUriComponent(userInput);

// OWASP HTML Sanitizer：富文本消毒（保留安全标签，剔除脚本）
PolicyFactory policy = Sanitizers.FORMATTING.and(Sanitizers.LINKS);
String cleanHtml = policy.sanitize(userHtml);

# find-sec-bugs 扫描示例
mvn com.github.spotbugs:spotbugs-maven-plugin:check
# 常见检出：CWE-798 硬编码密钥、CWE-89 SQL 注入、CWE-330 不安全随机

// 使用 Bean Validation（见专项文章）做声明式校验
@PostMapping("/users")
public User createUser(@Valid @RequestBody UserRequest req) {
    return userService.create(req);
}

// 自定义正则白名单校验
public class PhoneValidator implements ConstraintValidator<ValidPhone, String> {
    private static final Pattern P = Pattern.compile("^1[3-9]\\d{9}$");

    @Override
    public boolean isValid(String value, ConstraintValidatorContext ctx) {
        if (value == null) return true;          // null 交给 @NotNull 处理
        return P.matcher(value).matches();       // 白名单：只允许手机号格式
    }
}

// ✅ JDBC：参数化查询（永远不要字符串拼接 SQL）
PreparedStatement ps = conn.prepareStatement(
    "SELECT * FROM orders WHERE user_id = ? AND status = ?");
ps.setString(1, userId);
ps.setString(2, status);

// ✅ MyBatis：使用 #{} 而非 ${}
// SELECT * FROM orders WHERE user_id = #{userId}   ← 参数化
// ORDER BY ${sortField}                            ← 仅当值来自白名单

// ✅ JPA：JPQL 参数绑定
TypedQuery<Order> q = em.createQuery(
    "SELECT o FROM Order o WHERE o.userId = :uid", Order.class);
q.setParameter("uid", userId);

// MongoDB：使用 Criteria 构建查询，避免 JS 表达式注入
Query query = new Query(Criteria.where("username").is(username));  // ✅ 参数化

// 危险写法：使用 $where / eval / 正则拼接用户输入构造查询对象
// 防御：所有查询参数走 Criteria 值绑定，正则字段做转义

// 命令注入：永远使用 ProcessBuilder 参数列表，而非拼接 shell
ProcessBuilder pb = new ProcessBuilder("git", "checkout", branch);  // ✅ 参数数组
// ❌ 禁止：Runtime.getRuntime().exec("git checkout " + branch)   // shell 注入

// XML 解析必须禁用外部实体（XXE）
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);

// 反序列化：不信任来源的 ObjectInputStream 是高危操作
// 防御方案：
//  1. 优先用 JSON 序列化替代 Java 原生序列化
//  2. 必须用时做类白名单校验（ObjectInputFilter）
ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
    "com.example.dto.*;java.lang.*;java.util.*;!*");   // 只允许白名单类
ois.setObjectInputFilter(filter);

// 上传校验：扩展名 + Content-Type + 魔数 + 大小四重校验
@PostMapping("/upload")
public String upload(@RequestParam("file") MultipartFile file) {
    // 1. 大小限制
    if (file.getSize() > 5 * 1024 * 1024) throw new IllegalArgumentException("too large");
    // 2. 扩展名白名单
    String ext = StringUtils.getFilenameExtension(file.getOriginalFilename());
    if (!Set.of("jpg", "png", "pdf").contains(ext.toLowerCase())) throw new IllegalArgumentException("bad type");
    // 3. 魔数校验（真实文件类型，防伪装）
    byte[] head = new byte[4];
    try (InputStream in = file.getInputStream()) {
        in.read(head);
        if (!(head[0] == (byte)0xFF && head[1] == (byte)0xD8)) throw new IllegalArgumentException("not jpg");
    }
    // 4. 存储：重命名 + 随机文件名 + 单独存储域/对象存储，禁止可执行路径
    String objectKey = UUID.randomUUID() + "." + ext;
    ossClient.putObject(bucket, objectKey, file.getInputStream());
    return objectKey;
}

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.FIELD)
public @interface Mask {
    MaskType type() default MaskType.CUSTOM;   // 手机号/身份证/邮箱/银行卡...
}

public enum MaskType {
    PHONE, ID_CARD, EMAIL, BANK_CARD, NAME, ADDRESS
}

// 序列化层脱敏：Jackson 自定义序列化器
public class MaskSerializer extends JsonSerializer<Object> implements ContextualSerializer {
    private MaskType type;

    @Override
    public void serialize(Object value, JsonGenerator gen, SerializerProvider p) throws IOException {
        gen.writeString(mask(type, String.valueOf(value)));
    }

    @Override
    public JsonSerializer<?> createContextual(SerializerProvider prov, BeanProperty property) {
        Mask m = property.getAnnotation(Mask.class);
        if (m != null) {
            MaskSerializer s = new MaskSerializer();
            s.type = m.type();
            return s;
        }
        return this;
    }

    public static String mask(MaskType t, String raw) {
        if (raw == null || raw.isEmpty()) return raw;
        switch (t) {
            case PHONE:     return raw.replaceAll("(\\d{3})\\d{4}(\\d{4})", "$1****$2");
            case ID_CARD:   return raw.replaceAll("(\\d{4})\\d{10}(\\w{4})", "$1**********$2");
            case EMAIL:     return raw.replaceAll("(^\\w{2})[^@]*(@.*)", "$1***$2");
            case BANK_CARD: return raw.replaceAll("(\\d{4})\\d{8}(\\d{4})", "$1********$2");
            case NAME:      return raw.length() > 1 ? raw.charAt(0) + "*".repeat(raw.length() - 1) : "*";
            default:        return "***";
        }
    }
}

// 使用：@Mask 注解字段，序列化时自动脱敏
public class UserVO {
    @Mask(type = MaskType.PHONE)
    private String phone;
    @Mask(type = MaskType.ID_CARD)
    private String idCard;
    // 明文字段内部可用 @JsonIgnore 或不暴露
}

// 方案一：Logback 自定义 Layout，按正则脱敏后写文件
public class MaskingLayout extends PatternLayout {
    private static final Pattern SENSITIVE = Pattern.compile(
        "(phone|mobile|idCard|password|token)=\\s*\"?([^\\s,&]+)\"?");
    @Override
    public String doLayout(ILoggingEvent event) {
        return SENSITIVE.matcher(super.doLayout(event))
            .replaceAll("$1=***");
    }
}

<!-- logback.xml -->
<encoder class="com.example.logging.MaskingLayout">
    <pattern>%d{HH:mm:ss} %-5level %logger{36} - %msg%n</pattern>
</encoder>

// 数据主体权利接口示例
@RestController
@RequiredArgsConstructor
public class SubjectRightsController {
    private final UserDataService service;

    @GetMapping("/gdpr/users/{id}/data")        // 访问权
    public Mono<SubjectData> export(@PathVariable Long id, Principal principal) {
        // 校验当前主体是本人或授权
        authorize(principal.getName(), id);
        return service.exportSubjectData(id);
    }

    @DeleteMapping("/gdpr/users/{id}")          // 删除权
    public Mono<Void> erase(@PathVariable Long id, Principal principal) {
        authorize(principal.getName(), id);
        return service.anonymizeOrDelete(id);   // 审计记录 + 级联清理
    }
}

// 敏感数据加密存储示例（AES-GCM，带随机 IV）
public String encrypt(String plain, byte[] key) throws Exception {
    byte[] iv = new byte[12];
    SecureRandom.getInstanceStrong().nextBytes(iv);      // 安全随机 IV
    Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
    cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key, "AES"), new GCMParameterSpec(128, iv));
    byte[] ct = cipher.doFinal(plain.getBytes(StandardCharsets.UTF_8));
    return Base64.getEncoder().encodeToString(iv) + "." + Base64.getEncoder().encodeToString(ct);
}
// 密钥由 KMS/Vault 托管，应用只引用别名，不硬编码

// 统一审计切面：记录谁、何时、对什么资源、做了什么操作
@Aspect
@Component
public class AuditAspect {
    @Around("@annotation(audit)")
    public Object audit(ProceedingJoinPoint pjp, Audit audit) throws Throwable {
        String operator = SecurityContextHolder.getContext().getAuthentication().getName();
        String resource = audit.resource();
        long start = System.currentTimeMillis();
        try {
            Object result = pjp.proceed();
            auditService.record(operator, resource, "SUCCESS", null, start);
            return result;
        } catch (Throwable t) {
            auditService.record(operator, resource, "FAILED", t.getMessage(), start);
            throw t;
        }
    }
}

// 审计要点：不可篡改（Append-only）、可检索、保留期达标、与业务日志分离

# 生成 SBOM（CycloneDX 格式）
mvn org.cyclonedx:cyclonedx-maven-plugin:makeBom
# 产出 target/bom.json：全部依赖、版本、许可证、传递依赖

# 发布流水线强制校验：新依赖必须通过漏洞扫描才准入

<!-- Maven 集成 OWASP Dependency-Check -->
<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>9.x.x</version>
    <configuration>
        <failBuildOnCVSS>7</failBuildOnCVSS>   <!-- CVSS ≥ 7 阻断发布 -->
        <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
    </configuration>
</plugin>

mvn org.owasp:dependency-check-maven:check
# 产出 target/dependency-check-report.html
# 修复闭环：升级版本 → 复扫 → 通过后发布

# 镜像签名（cosign）：发布前对镜像做签名，运行环境校验
cosign sign --key cosign.key <registry>/app:v1.2.3
cosign verify --key cosign.pub <registry>/app:v1.2.3

# 制品签名（Maven GPG）
mvn gpg:sign-and-deploy-file

# K8s 侧：配置镜像签名策略，只拉取签名合法的镜像

# Spring Cloud 集成 Vault 获取配置与密钥
spring:
  cloud:
    vault:
      host: vault.example.com
      token: ${VAULT_TOKEN}          # 令牌由 CI 注入，非代码内
      kv:
        enabled: true
        backend: secret