feat enable mask log by maskLog for parameter locally and maskLogResultColumns for result globally

Author: yanxutao89

pom.xml

@@ -196,7 +196,7 @@
     <dependency>
       <groupId>org.postgresql</groupId>
       <artifactId>postgresql</artifactId>
-      <version>42.7.6</version>
+      <version>42.7.5</version>
       <scope>test</scope>
     </dependency>
     <dependency>

src/main/java/org/apache/ibatis/builder/ParameterMappingTokenHandler.java

@@ -113,6 +113,8 @@ private ParameterMapping buildParameterMapping(String content) {
         builder.resultMapId(value);
       } else if ("jdbcTypeName".equals(name)) {
         builder.jdbcTypeName(value);
+      } else if ("maskLog".equals(name)) {
+        builder.maskLog(value);
       } else if ("expression".equals(name)) {
         throw new BuilderException("Expression based parameters are not supported yet");
       } else {

src/main/java/org/apache/ibatis/builder/xml/XMLConfigBuilder.java

@@ -1,5 +1,5 @@
 /*
- *    Copyright 2009-2024 the original author or authors.
+ *    Copyright 2009-2025 the original author or authors.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
@@ -118,6 +118,7 @@ private void parseConfiguration(XNode root) {
       Properties settings = settingsAsProperties(root.evalNode("settings"));
       loadCustomVfsImpl(settings);
       loadCustomLogImpl(settings);
+      loadCustomMaskLogResultColumns(settings);
       typeAliasesElement(root.evalNode("typeAliases"));
       pluginsElement(root.evalNode("plugins"));
       objectFactoryElement(root.evalNode("objectFactory"));
@@ -170,6 +171,10 @@ private void loadCustomLogImpl(Properties props) {
     configuration.setLogImpl(logImpl);
   }
 
+  private void loadCustomMaskLogResultColumns(Properties props) {
+    configuration.setMaskLogResultColumns(props.getProperty("maskLogResultColumns"));
+  }
+
   private void typeAliasesElement(XNode context) {
     if (context == null) {
       return;

src/main/java/org/apache/ibatis/executor/BaseExecutor.java

@@ -355,7 +355,8 @@ private <E> List<E> queryFromDatabase(MappedStatement ms, Object parameter, RowB
   protected Connection getConnection(Log statementLog) throws SQLException {
     Connection connection = transaction.getConnection();
     if (statementLog.isDebugEnabled()) {
-      return ConnectionLogger.newInstance(connection, statementLog, queryStack);
+      return ConnectionLogger.newInstance(connection, statementLog, queryStack,
+          configuration.getMaskLogResultColumns());
     }
     return connection;
   }

src/main/java/org/apache/ibatis/logging/jdbc/BaseJdbcLogger.java

@@ -1,5 +1,5 @@
 /*
- *    Copyright 2009-2024 the original author or authors.
+ *    Copyright 2009-2025 the original author or authors.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
@@ -42,11 +42,13 @@ public abstract class BaseJdbcLogger {
 
   protected static final Set<String> SET_METHODS;
   protected static final Set<String> EXECUTE_METHODS = new HashSet<>();
+  protected static final Set<String> MASK_LOG_RESULT_COLUMNS = new HashSet<>();
 
   private final Map<Object, Object> columnMap = new HashMap<>();
 
   private final List<Object> columnNames = new ArrayList<>();
   private final List<Object> columnValues = new ArrayList<>();
+  private final List<Boolean> columnMasks = new ArrayList<>();
 
   protected final Log statementLog;
   protected final int queryStack;
@@ -55,12 +57,22 @@ public abstract class BaseJdbcLogger {
    * Default constructor
    */
   public BaseJdbcLogger(Log log, int queryStack) {
+    this(log, queryStack, null);
+  }
+
+  /*
+   * Default constructor
+   */
+  public BaseJdbcLogger(Log log, int queryStack, Set<String> maskLogResultColumns) {
     this.statementLog = log;
     if (queryStack == 0) {
       this.queryStack = 1;
     } else {
       this.queryStack = queryStack;
     }
+    if (maskLogResultColumns != null) {
+      MASK_LOG_RESULT_COLUMNS.addAll(maskLogResultColumns);
+    }
   }
 
   static {
@@ -85,12 +97,17 @@ protected Object getColumn(Object key) {
   }
 
   protected String getParameterValueString() {
-    List<Object> typeList = new ArrayList<>(columnValues.size());
-    for (Object value : columnValues) {
+    int size = columnValues.size();
+    boolean equal = size == columnMasks.size();
+    List<Object> typeList = new ArrayList<>(size);
+    for (int i = 0; i < size; ++i) {
+      Object value = columnValues.get(i);
       if (value == null) {
         typeList.add("null");
       } else {
-        typeList.add(objectValueString(value) + "(" + value.getClass().getSimpleName() + ")");
+        String strVal = objectValueString(value);
+        boolean mask = equal && columnMasks.get(i);
+        typeList.add(mask ? mask(strVal) : strVal + "(" + value.getClass().getSimpleName() + ")");
       }
     }
     final String parameters = typeList.toString();
@@ -112,10 +129,15 @@ protected String getColumnString() {
     return columnNames.toString();
   }
 
+  public void addColumnMasks(Boolean maskLog) {
+    this.columnMasks.add(maskLog);
+  }
+
   protected void clearColumnInfo() {
     columnMap.clear();
     columnNames.clear();
     columnValues.clear();
+    columnMasks.clear();
   }
 
   protected String removeExtraWhitespace(String original) {
@@ -142,6 +164,25 @@ protected void trace(String text, boolean input) {
     }
   }
 
+  protected String mask(String value) {
+    if (value == null || value.isEmpty()) {
+      return value;
+    }
+    int length = value.length();
+    if (length == 1) {
+      return value;
+    } else if (length == 2) {
+      return value.charAt(0) + "*";
+    } else if (length == 3) {
+      return value.charAt(0) + "*" + value.charAt(2);
+    } else {
+      int maskLen = length >> 1;
+      int rawLen = length - maskLen;
+      return value.substring(0, (rawLen & 1) == 0 ? rawLen >> 1 : (rawLen >> 1) + 1) + "*".repeat(maskLen)
+          + value.substring(length - (rawLen >> 1));
+    }
+  }
+
   private String prefix(boolean isInput) {
     char[] buffer = new char[queryStack * 2 + 2];
     Arrays.fill(buffer, '=');

src/main/java/org/apache/ibatis/logging/jdbc/ConnectionLogger.java

@@ -1,5 +1,5 @@
 /*
- *    Copyright 2009-2023 the original author or authors.
+ *    Copyright 2009-2025 the original author or authors.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
@@ -21,6 +21,7 @@
 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.Statement;
+import java.util.Set;
 
 import org.apache.ibatis.logging.Log;
 import org.apache.ibatis.reflection.ExceptionUtil;
@@ -36,7 +37,11 @@ public final class ConnectionLogger extends BaseJdbcLogger implements Invocation
   private final Connection connection;
 
   private ConnectionLogger(Connection conn, Log statementLog, int queryStack) {
-    super(statementLog, queryStack);
+    this(conn, statementLog, queryStack, null);
+  }
+
+  private ConnectionLogger(Connection conn, Log statementLog, int queryStack, Set<String> maskLogResultColumns) {
+    super(statementLog, queryStack, maskLogResultColumns);
     this.connection = conn;
   }
 
@@ -55,7 +60,7 @@ public Object invoke(Object proxy, Method method, Object[] params) throws Throwa
       }
       if ("createStatement".equals(method.getName())) {
         Statement stmt = (Statement) method.invoke(connection, params);
-        return StatementLogger.newInstance(stmt, statementLog, queryStack);
+        return StatementLogger.newInstance(stmt, statementLog, queryStack, MASK_LOG_RESULT_COLUMNS);
       }
       return method.invoke(connection, params);
     } catch (Throwable t) {
@@ -76,7 +81,26 @@ public Object invoke(Object proxy, Method method, Object[] params) throws Throwa
    * @return the connection with logging
    */
   public static Connection newInstance(Connection conn, Log statementLog, int queryStack) {
-    InvocationHandler handler = new ConnectionLogger(conn, statementLog, queryStack);
+    return newInstance(conn, statementLog, queryStack, null);
+  }
+
+  /**
+   * Creates a logging version of a connection.
+   *
+   * @param conn
+   *          the original connection
+   * @param statementLog
+   *          the statement log
+   * @param queryStack
+   *          the query stack
+   * @param maskLogResultColumns
+   *          the result columns to be masked
+   *
+   * @return the connection with logging
+   */
+  public static Connection newInstance(Connection conn, Log statementLog, int queryStack,
+      Set<String> maskLogResultColumns) {
+    InvocationHandler handler = new ConnectionLogger(conn, statementLog, queryStack, maskLogResultColumns);
     ClassLoader cl = Connection.class.getClassLoader();
     return (Connection) Proxy.newProxyInstance(cl, new Class[] { Connection.class }, handler);
   }

src/main/java/org/apache/ibatis/logging/jdbc/PreparedStatementLogger.java

@@ -1,5 +1,5 @@
 /*
- *    Copyright 2009-2023 the original author or authors.
+ *    Copyright 2009-2025 the original author or authors.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
@@ -53,7 +53,7 @@ public Object invoke(Object proxy, Method method, Object[] params) throws Throwa
         clearColumnInfo();
         if ("executeQuery".equals(method.getName())) {
           ResultSet rs = (ResultSet) method.invoke(statement, params);
-          return rs == null ? null : ResultSetLogger.newInstance(rs, statementLog, queryStack);
+          return rs == null ? null : ResultSetLogger.newInstance(rs, statementLog, queryStack, MASK_LOG_RESULT_COLUMNS);
         } else {
           return method.invoke(statement, params);
         }

src/main/java/org/apache/ibatis/logging/jdbc/ResultSetLogger.java

@@ -1,5 +1,5 @@
 /*
- *    Copyright 2009-2023 the original author or authors.
+ *    Copyright 2009-2025 the original author or authors.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
@@ -55,7 +55,11 @@ public final class ResultSetLogger extends BaseJdbcLogger implements InvocationH
   }
 
   private ResultSetLogger(ResultSet rs, Log statementLog, int queryStack) {
-    super(statementLog, queryStack);
+    this(rs, statementLog, queryStack, null);
+  }
+
+  private ResultSetLogger(ResultSet rs, Log statementLog, int queryStack, Set<String> maskLogResultColumns) {
+    super(statementLog, queryStack, maskLogResultColumns);
     this.rs = rs;
   }
 
@@ -107,7 +111,10 @@ private void printColumnValues(int columnCount) {
         if (blobColumns.contains(i)) {
           row.add("<<BLOB>>");
         } else {
-          row.add(rs.getString(i));
+          String strVal = rs.getString(i);
+          String column = rs.getMetaData().getColumnName(i);
+          boolean mask = column != null && MASK_LOG_RESULT_COLUMNS.stream().anyMatch(column::equalsIgnoreCase);
+          row.add(mask ? mask(strVal) : strVal);
         }
       } catch (SQLException e) {
         // generally can't call getString() on a BLOB column
@@ -130,7 +137,26 @@ private void printColumnValues(int columnCount) {
    * @return the ResultSet with logging
    */
   public static ResultSet newInstance(ResultSet rs, Log statementLog, int queryStack) {
-    InvocationHandler handler = new ResultSetLogger(rs, statementLog, queryStack);
+    return newInstance(rs, statementLog, queryStack, null);
+  }
+
+  /**
+   * Creates a logging version of a ResultSet.
+   *
+   * @param rs
+   *          the ResultSet to proxy
+   * @param statementLog
+   *          the statement log
+   * @param queryStack
+   *          the query stack
+   * @param maskLogResultColumns
+   *          the result columns to be masked
+   *
+   * @return the ResultSet with logging
+   */
+  public static ResultSet newInstance(ResultSet rs, Log statementLog, int queryStack,
+      Set<String> maskLogResultColumns) {
+    InvocationHandler handler = new ResultSetLogger(rs, statementLog, queryStack, maskLogResultColumns);
     ClassLoader cl = ResultSet.class.getClassLoader();
     return (ResultSet) Proxy.newProxyInstance(cl, new Class[] { ResultSet.class }, handler);
   }

src/main/java/org/apache/ibatis/logging/jdbc/StatementLogger.java

@@ -1,5 +1,5 @@
 /*
- *    Copyright 2009-2023 the original author or authors.
+ *    Copyright 2009-2025 the original author or authors.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
  *    you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@
 import java.lang.reflect.Proxy;
 import java.sql.ResultSet;
 import java.sql.Statement;
+import java.util.Set;
 
 import org.apache.ibatis.logging.Log;
 import org.apache.ibatis.reflection.ExceptionUtil;
@@ -35,7 +36,11 @@ public final class StatementLogger extends BaseJdbcLogger implements InvocationH
   private final Statement statement;
 
   private StatementLogger(Statement stmt, Log statementLog, int queryStack) {
-    super(statementLog, queryStack);
+    this(stmt, statementLog, queryStack, null);
+  }
+
+  private StatementLogger(Statement stmt, Log statementLog, int queryStack, Set<String> maskLogResultColumns) {
+    super(statementLog, queryStack, maskLogResultColumns);
     this.statement = stmt;
   }
 
@@ -51,14 +56,14 @@ public Object invoke(Object proxy, Method method, Object[] params) throws Throwa
         }
         if ("executeQuery".equals(method.getName())) {
           ResultSet rs = (ResultSet) method.invoke(statement, params);
-          return rs == null ? null : ResultSetLogger.newInstance(rs, statementLog, queryStack);
+          return rs == null ? null : ResultSetLogger.newInstance(rs, statementLog, queryStack, MASK_LOG_RESULT_COLUMNS);
         } else {
           return method.invoke(statement, params);
         }
       }
       if ("getResultSet".equals(method.getName())) {
         ResultSet rs = (ResultSet) method.invoke(statement, params);
-        return rs == null ? null : ResultSetLogger.newInstance(rs, statementLog, queryStack);
+        return rs == null ? null : ResultSetLogger.newInstance(rs, statementLog, queryStack, MASK_LOG_RESULT_COLUMNS);
       } else {
         return method.invoke(statement, params);
       }
@@ -80,7 +85,26 @@ public Object invoke(Object proxy, Method method, Object[] params) throws Throwa
    * @return the proxy
    */
   public static Statement newInstance(Statement stmt, Log statementLog, int queryStack) {
-    InvocationHandler handler = new StatementLogger(stmt, statementLog, queryStack);
+    return newInstance(stmt, statementLog, queryStack, null);
+  }
+
+  /**
+   * Creates a logging version of a Statement.
+   *
+   * @param stmt
+   *          the statement
+   * @param statementLog
+   *          the statement log
+   * @param queryStack
+   *          the query stack
+   * @param maskLogResultColumns
+   *          the result columns to be masked
+   *
+   * @return the proxy
+   */
+  public static Statement newInstance(Statement stmt, Log statementLog, int queryStack,
+      Set<String> maskLogResultColumns) {
+    InvocationHandler handler = new StatementLogger(stmt, statementLog, queryStack, maskLogResultColumns);
     ClassLoader cl = Statement.class.getClassLoader();
     return (Statement) Proxy.newProxyInstance(cl, new Class[] { Statement.class }, handler);
   }