From fffb68ffef2a097a8ca27e39ae3a142462cc8962 Mon Sep 17 00:00:00 2001
From: seonwoo_jung <79202163+seonwooj0810@users.noreply.github.com>
Date: Wed, 17 Jun 2026 21:08:41 +0900
Subject: [PATCH] Make Expressions max length configurable

The maximum length of a single template expression was hard-coded to
10000 characters in feign.template.Expressions, throwing
IllegalArgumentException for anything longer with no way to opt out.

Make the limit configurable through the
"feign.template.expression.maxLength" system property (default 10000),
and allow disabling the check entirely by setting it to a non-positive
value.

Fixes #2916

Signed-off-by: seonwoo_jung <79202163+seonwooj0810@users.noreply.github.com>
---
 .../main/java/feign/template/Expressions.java | 21 ++++++++--
 .../java/feign/template/ExpressionsTest.java  | 40 +++++++++++++++++++
 2 files changed, 57 insertions(+), 4 deletions(-)

diff --git a/core/src/main/java/feign/template/Expressions.java b/core/src/main/java/feign/template/Expressions.java
index 65fa5123e2..1368364d59 100644
--- a/core/src/main/java/feign/template/Expressions.java
+++ b/core/src/main/java/feign/template/Expressions.java
@@ -25,7 +25,14 @@
 
 public final class Expressions {
 
-  private static final int MAX_EXPRESSION_LENGTH = 10000;
+  /**
+   * System property controlling the maximum allowed length of a single expression. Defaults to
+   * {@link #DEFAULT_MAX_EXPRESSION_LENGTH}. Setting it to {@code 0} (or any non-positive value)
+   * disables the length check entirely.
+   */
+  static final String MAX_EXPRESSION_LENGTH_PROPERTY = "feign.template.expression.maxLength";
+
+  private static final int DEFAULT_MAX_EXPRESSION_LENGTH = 10000;
 
   private static final String PATH_STYLE_OPERATOR = ";";
 
@@ -73,10 +80,16 @@ public static Expression create(final String value) {
       throw new IllegalArgumentException("an expression is required.");
     }
 
-    /* Check if the expression is too long */
-    if (expression.length() > MAX_EXPRESSION_LENGTH) {
+    /*
+     * Check if the expression is too long. The limit is configurable through the
+     * "feign.template.expression.maxLength" system property and can be disabled by setting it to a
+     * non-positive value.
+     */
+    final int maxExpressionLength =
+        Integer.getInteger(MAX_EXPRESSION_LENGTH_PROPERTY, DEFAULT_MAX_EXPRESSION_LENGTH);
+    if (maxExpressionLength > 0 && expression.length() > maxExpressionLength) {
       throw new IllegalArgumentException(
-          "expression is too long. Max length: " + MAX_EXPRESSION_LENGTH);
+          "expression is too long. Max length: " + maxExpressionLength);
     }
 
     /* create a new regular expression matcher for the expression */
diff --git a/core/src/test/java/feign/template/ExpressionsTest.java b/core/src/test/java/feign/template/ExpressionsTest.java
index 0586bd231e..77241770f5 100644
--- a/core/src/test/java/feign/template/ExpressionsTest.java
+++ b/core/src/test/java/feign/template/ExpressionsTest.java
@@ -16,13 +16,53 @@
 package feign.template;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.api.Assertions.assertThatObject;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 import java.util.Collections;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 
 class ExpressionsTest {
 
+  @AfterEach
+  void clearMaxExpressionLengthProperty() {
+    System.clearProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY);
+  }
+
+  @Test
+  void tooLongExpressionFailsWithDefaultLimit() {
+    String tooLong = "{" + "a".repeat(10001) + "}";
+    assertThatThrownBy(() -> Expressions.create(tooLong))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("expression is too long");
+  }
+
+  @Test
+  void maxExpressionLengthIsConfigurable() {
+    System.setProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY, "5");
+    assertThatThrownBy(() -> Expressions.create("{foobar}"))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("Max length: 5");
+  }
+
+  @Test
+  void lengthCheckCanBeDisabled() {
+    // An expression well beyond the default 10000 limit, expressed as a name plus a regular
+    // expression value modifier so the disabled length check is exercised in isolation.
+    String longExpression = "{name:" + "a".repeat(15000) + "}";
+    assertThatThrownBy(() -> Expressions.create(longExpression))
+        .as("guarded by default limit")
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("expression is too long");
+
+    System.setProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY, "0");
+    assertThatNoException()
+        .as("length check disabled")
+        .isThrownBy(() -> Expressions.create(longExpression));
+  }
+
   @Test
   void simpleExpression() {
     Expression expression = Expressions.create("{foo}");