Python使用加密的XML配置文件保护敏感数据

pip install pycryptodome lxml

from Crypto.Random import get_random_bytes

# 生成256位（32字节）AES密钥
key = get_random_bytes(32)
# 实际项目中应将key保存到安全位置（如环境变量）
print(f"Generated AES Key (Base64): {key.hex()}")

from Crypto.Cipher import AES
from Crypto.Util.Padding import pad
import base64
from lxml import etree

def encrypt_xml_config(input_path, output_path, key):
    # 读取原始XML
    tree = etree.parse(input_path)
    xml_str = etree.tostring(tree.getroot(), encoding='utf-8').decode('utf-8')
    
    # AES加密（CBC模式）
    cipher = AES.new(key, AES.MODE_CBC)
    ct_bytes = cipher.encrypt(pad(xml_str.encode('utf-8'), AES.block_size))
    
    # 保存IV和密文（Base64编码）
    encrypted_data = {
        'iv': cipher.iv.hex(),
        'ciphertext': base64.b64encode(ct_bytes).decode('utf-8')
    }
    
    # 写入加密文件（可自定义格式）
    with open(output_path, 'w') as f:
        f.write(f"""<EncryptedConfig>
    <IV>{encrypted_data['iv']}</IV>
    <Ciphertext>{encrypted_data['ciphertext']}</Ciphertext>
</EncryptedConfig>""")

# 使用示例
key = bytes.fromhex('你的32字节密钥')  # 替换为实际密钥
encrypt_xml_config('config.xml', 'config.enc.xml', key)

from Crypto.Cipher import AES
from Crypto.Util.Padding import unpad
import base64
from lxml import etree

def decrypt_xml_config(input_path, key):
    # 读取加密文件
    tree = etree.parse(input_path)
    root = tree.getroot()
    
    iv = bytes.fromhex(root.find('IV').text)
    ciphertext = base64.b64decode(root.find('Ciphertext').text)
    
    # AES解密
    cipher = AES.new(key, AES.MODE_CBC, iv=iv)
    pt = unpad(cipher.decrypt(ciphertext), AES.block_size)
    
    # 解析XML内容
    return etree.fromstring(pt)

# 使用示例
decrypted_root = decrypt_xml_config('config.enc.xml', key)
print(etree.tostring(decrypted_root, encoding='unicode'))

import os
key = bytes.fromhex(os.getenv('AES_KEY_HEX'))

def decrypt_config(func):
    def wrapper(*args, **kwargs):
        # 解密逻辑...
        decrypted_config = decrypt_xml_config('config.enc.xml', key)
        kwargs['config'] = decrypted_config
        return func(*args, **kwargs)
    return wrapper

@decrypt_config
def load_database_config(config):
    db_host = config.find('.//DBHost').text
    # 使用解密后的配置...

import unittest

class TestConfigEncryption(unittest.TestCase):
    def setUp(self):
        self.key = get_random_bytes(32)
        # 创建测试XML
        test_xml = """<Config>
            <DBHost>localhost</DBHost>
            <DBPort>5432</DBPort>
        </Config>"""
        with open('test_config.xml', 'w') as f:
            f.write(test_xml)
    
    def test_encrypt_decrypt(self):
        encrypt_xml_config('test_config.xml', 'test_enc.xml', self.key)
        decrypted = decrypt_xml_config('test_enc.xml', self.key)
        self.assertEqual(decrypted.find('.//DBHost').text, 'localhost')

<DatabaseConfig>
    <Host>192.168.1.100</Host>
    <Port>3306</Port>
    <Username>admin</Username>
    <Password>S3cr3tP@ssw0rd</Password>
</DatabaseConfig>

<EncryptedConfig>
    <IV>a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6</IV>
    <Ciphertext>U2FsdGVkX1+3v5z8...</Ciphertext>
</EncryptedConfig>

import mysql.connector
from lxml import etree

def get_db_connection():
    key = bytes.fromhex(os.getenv('DB_CONFIG_KEY'))
    config_root = decrypt_xml_config('config.enc.xml', key)
    
    return mysql.connector.connect(
        host=config_root.find('.//Host').text,
        port=int(config_root.find('.//Port').text),
        user=config_root.find('.//Username').text,
        password=config_root.find('.//Password').text
    )

import glob

for filepath in glob.glob('*.xml'):
    if filepath != 'config.enc.xml':  # 跳过已加密文件
        encrypt_xml_config(filepath, f'enc_{filepath}', key)