3步教你彻底销毁Java中的敏感数据

// 反例：手动调用GC（不可靠）
String sensitiveData = "123456";
sensitiveData = null;
System.gc(); // 不保证立即回收

// 使用弱引用自动回收
WeakReference<String> sensitiveRef = new WeakReference<>("123456");
sensitiveRef.clear(); // 显式清除引用
sensitiveRef = null;
System.gc(); // 建议触发GC

public void processPassword(char[] password) {
    try {
        // 处理密码逻辑
    } finally {
        // 覆盖内存并置空
        Arrays.fill(password, '0');
        password = null;
        System.gc(); // 建议触发GC
    }
}

public class SensitiveDataCache {
    private final Map<Key, WeakReference<String>> cache = new HashMap<>();

    public void put(Key key, String data) {
        cache.put(key, new WeakReference<>(data));
    }

    public String get(Key key) {
        WeakReference<String> ref = cache.get(key);
        return ref != null ? ref.get() : null;
    }
}

public class SensitiveData {
    private final byte[] data;
    private final Cleaner.Cleanable cleanable;

    public SensitiveData(byte[] data) {
        this.data = data;
        this.cleanable = Cleaner.create().register(this, () -> {
            // 覆盖内存并置空
            Arrays.fill(data, (byte) 0);
        });
    }

    public void close() {
        cleanable.clean();
    }
}

// 使用WeakHashMap自动回收
private static final Map<String, String> cache = new WeakHashMap<>();

public class ThreadLocalExample {
    private static final ThreadLocal<String> sensitiveData = new ThreadLocal<>();

    public void process() {
        try {
            sensitiveData.set("123456");
            // 处理逻辑
        } finally {
            sensitiveData.remove(); // 必须显式清除
        }
    }
}

try (Connection conn = dataSource.getConnection();
     PreparedStatement stmt = conn.prepareStatement("SELECT * FROM users")) {
    // 执行查询
} catch (SQLException e) {
    // 处理异常
}

public static String mask(String input) {
    return input.replaceAll("(\\d{3})\\d{4}(\\d{4})", "$1****$2");
}

log.info("用户手机号: {}", mask("13812345678"));

public void processLargeData() {
    byte[] largeData = new byte[1024 * 1024 * 10]; // 10MB
    try {
        // 处理逻辑
    } finally {
        largeData = null;
        System.gc(); // 建议触发GC
    }
}