diff --git a/core/src/main/java/feign/template/Expressions.java b/core/src/main/java/feign/template/Expressions.java index 65fa5123e2..1368364d59 100644 --- a/core/src/main/java/feign/template/Expressions.java +++ b/core/src/main/java/feign/template/Expressions.java @@ -25,7 +25,14 @@ public final class Expressions { - private static final int MAX_EXPRESSION_LENGTH = 10000; + /** + * System property controlling the maximum allowed length of a single expression. Defaults to + * {@link #DEFAULT_MAX_EXPRESSION_LENGTH}. Setting it to {@code 0} (or any non-positive value) + * disables the length check entirely. + */ + static final String MAX_EXPRESSION_LENGTH_PROPERTY = "feign.template.expression.maxLength"; + + private static final int DEFAULT_MAX_EXPRESSION_LENGTH = 10000; private static final String PATH_STYLE_OPERATOR = ";"; @@ -73,10 +80,16 @@ public static Expression create(final String value) { throw new IllegalArgumentException("an expression is required."); } - /* Check if the expression is too long */ - if (expression.length() > MAX_EXPRESSION_LENGTH) { + /* + * Check if the expression is too long. The limit is configurable through the + * "feign.template.expression.maxLength" system property and can be disabled by setting it to a + * non-positive value. + */ + final int maxExpressionLength = + Integer.getInteger(MAX_EXPRESSION_LENGTH_PROPERTY, DEFAULT_MAX_EXPRESSION_LENGTH); + if (maxExpressionLength > 0 && expression.length() > maxExpressionLength) { throw new IllegalArgumentException( - "expression is too long. Max length: " + MAX_EXPRESSION_LENGTH); + "expression is too long. Max length: " + maxExpressionLength); } /* create a new regular expression matcher for the expression */ diff --git a/core/src/test/java/feign/template/ExpressionsTest.java b/core/src/test/java/feign/template/ExpressionsTest.java index 0586bd231e..77241770f5 100644 --- a/core/src/test/java/feign/template/ExpressionsTest.java +++ b/core/src/test/java/feign/template/ExpressionsTest.java @@ -16,13 +16,53 @@ package feign.template; import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.assertThatNoException; import static org.assertj.core.api.Assertions.assertThatObject; +import static org.assertj.core.api.Assertions.assertThatThrownBy; import java.util.Collections; +import org.junit.jupiter.api.AfterEach; import org.junit.jupiter.api.Test; class ExpressionsTest { + @AfterEach + void clearMaxExpressionLengthProperty() { + System.clearProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY); + } + + @Test + void tooLongExpressionFailsWithDefaultLimit() { + String tooLong = "{" + "a".repeat(10001) + "}"; + assertThatThrownBy(() -> Expressions.create(tooLong)) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageContaining("expression is too long"); + } + + @Test + void maxExpressionLengthIsConfigurable() { + System.setProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY, "5"); + assertThatThrownBy(() -> Expressions.create("{foobar}")) + .isInstanceOf(IllegalArgumentException.class) + .hasMessageContaining("Max length: 5"); + } + + @Test + void lengthCheckCanBeDisabled() { + // An expression well beyond the default 10000 limit, expressed as a name plus a regular + // expression value modifier so the disabled length check is exercised in isolation. + String longExpression = "{name:" + "a".repeat(15000) + "}"; + assertThatThrownBy(() -> Expressions.create(longExpression)) + .as("guarded by default limit") + .isInstanceOf(IllegalArgumentException.class) + .hasMessageContaining("expression is too long"); + + System.setProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY, "0"); + assertThatNoException() + .as("length check disabled") + .isThrownBy(() -> Expressions.create(longExpression)); + } + @Test void simpleExpression() { Expression expression = Expressions.create("{foo}");