Make Expressions max length configurable (fixes #2916)

core/src/main/java/feign/template/Expressions.java

@@ -25,7 +25,14 @@
 
 public final class Expressions {
 
-  private static final int MAX_EXPRESSION_LENGTH = 10000;
+  /**
+   * System property controlling the maximum allowed length of a single expression. Defaults to
+   * {@link #DEFAULT_MAX_EXPRESSION_LENGTH}. Setting it to {@code 0} (or any non-positive value)
+   * disables the length check entirely.
+   */
+  static final String MAX_EXPRESSION_LENGTH_PROPERTY = "feign.template.expression.maxLength";
+
+  private static final int DEFAULT_MAX_EXPRESSION_LENGTH = 10000;
 
   private static final String PATH_STYLE_OPERATOR = ";";
 
@@ -73,10 +80,16 @@ public static Expression create(final String value) {
       throw new IllegalArgumentException("an expression is required.");
     }
 
-    /* Check if the expression is too long */
-    if (expression.length() > MAX_EXPRESSION_LENGTH) {
+    /*
+     * Check if the expression is too long. The limit is configurable through the
+     * "feign.template.expression.maxLength" system property and can be disabled by setting it to a
+     * non-positive value.
+     */
+    final int maxExpressionLength =
+        Integer.getInteger(MAX_EXPRESSION_LENGTH_PROPERTY, DEFAULT_MAX_EXPRESSION_LENGTH);
+    if (maxExpressionLength > 0 && expression.length() > maxExpressionLength) {
       throw new IllegalArgumentException(
-          "expression is too long. Max length: " + MAX_EXPRESSION_LENGTH);
+          "expression is too long. Max length: " + maxExpressionLength);
     }
 
     /* create a new regular expression matcher for the expression */

core/src/test/java/feign/template/ExpressionsTest.java

@@ -16,13 +16,53 @@
 package feign.template;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.api.Assertions.assertThatObject;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 import java.util.Collections;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 
 class ExpressionsTest {
 
+  @AfterEach
+  void clearMaxExpressionLengthProperty() {
+    System.clearProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY);
+  }
+
+  @Test
+  void tooLongExpressionFailsWithDefaultLimit() {
+    String tooLong = "{" + "a".repeat(10001) + "}";
+    assertThatThrownBy(() -> Expressions.create(tooLong))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("expression is too long");
+  }
+
+  @Test
+  void maxExpressionLengthIsConfigurable() {
+    System.setProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY, "5");
+    assertThatThrownBy(() -> Expressions.create("{foobar}"))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("Max length: 5");
+  }
+
+  @Test
+  void lengthCheckCanBeDisabled() {
+    // An expression well beyond the default 10000 limit, expressed as a name plus a regular
+    // expression value modifier so the disabled length check is exercised in isolation.
+    String longExpression = "{name:" + "a".repeat(15000) + "}";
+    assertThatThrownBy(() -> Expressions.create(longExpression))
+        .as("guarded by default limit")
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("expression is too long");
+
+    System.setProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY, "0");
+    assertThatNoException()
+        .as("length check disabled")
+        .isThrownBy(() -> Expressions.create(longExpression));
+  }
+
   @Test
   void simpleExpression() {
     Expression expression = Expressions.create("{foo}");