Merge master into 14.x

.github/dependabot.yml

@@ -24,6 +24,9 @@ updates:
       # SAAJ impl at 1.x (soap) and 3.x (soap-jakarta)
       - dependency-name: "com.sun.xml.messaging.saaj:saaj-impl"
         update-types: ["version-update:semver-major"]
+      # feign-validation is intentionally on javax.validation; Hibernate Validator 7+ is Jakarta-only.
+      - dependency-name: "org.hibernate.validator:hibernate-validator"
+        update-types: ["version-update:semver-major"]
 
   # Jersey 2.x for jaxrs2
   - package-ecosystem: "maven"

.mvn/extensions.xml

@@ -19,7 +19,7 @@
     <extension>
         <groupId>com.gradle</groupId>
         <artifactId>develocity-maven-extension</artifactId>
-        <version>2.4.1</version>
+        <version>2.4.2</version>
     </extension>
     <extension>
         <groupId>com.gradle</groupId>

api/pom.xml

@@ -58,7 +58,7 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>${spring-context.version}</version>
+      <version>${spring.version}</version>
       <scope>test</scope>
     </dependency>
 

api/src/main/java/feign/BaseBuilder.java

@@ -366,6 +366,8 @@ List<Field> getFieldsToEnrich() {
         .filter(field -> !Objects.equals(field.getName(), "requestInterceptors"))
         .filter(field -> !Objects.equals(field.getName(), "responseInterceptors"))
         .filter(field -> !Objects.equals(field.getName(), "methodInterceptors"))
+        // caller-owned lifecycle resources are not capability-enriched
+        .filter(field -> !Objects.equals(field.getName(), "executorService"))
         // skip primitive types
         .filter(field -> !field.getType().isPrimitive())
         // skip enumerations

api/src/main/java/feign/Response.java

@@ -20,7 +20,9 @@
 import feign.Request.ProtocolVersion;
 import java.io.*;
 import java.nio.charset.Charset;
+import java.nio.charset.IllegalCharsetNameException;
 import java.nio.charset.StandardCharsets;
+import java.nio.charset.UnsupportedCharsetException;
 import java.util.*;
 
 /** An immutable response to an http invocation which only returns string content. */
@@ -219,7 +221,11 @@ public Charset charset() {
           String[] charsetParts = contentTypeParmeters[1].split("=");
           if (charsetParts.length == 2 && "charset".equalsIgnoreCase(charsetParts[0].trim())) {
             String charsetString = charsetParts[1].replaceAll("\"", "");
-            return Charset.forName(charsetString);
+            try {
+              return Charset.forName(charsetString);
+            } catch (IllegalCharsetNameException | UnsupportedCharsetException e) {
+              return Util.UTF_8;
+            }
           }
         }
       }

api/src/main/java/feign/codec/ErrorDecoder.java

@@ -105,14 +105,14 @@ public Long apply(String retryAfter) {
       if (retryAfter == null) {
         return null;
       }
-      if (retryAfter.matches("^[0-9]+\\.?0*$")) {
-        retryAfter = retryAfter.replaceAll("\\.0*$", "");
-        long deltaMillis = SECONDS.toMillis(Long.parseLong(retryAfter));
-        return currentTimeMillis() + deltaMillis;
-      }
       try {
+        if (retryAfter.matches("^[0-9]+\\.?0*$")) {
+          retryAfter = retryAfter.replaceAll("\\.0*$", "");
+          long deltaMillis = SECONDS.toMillis(Long.parseLong(retryAfter));
+          return currentTimeMillis() + deltaMillis;
+        }
         return ZonedDateTime.parse(retryAfter, dateTimeFormatter).toInstant().toEpochMilli();
-      } catch (NullPointerException | DateTimeParseException ignored) {
+      } catch (NumberFormatException | NullPointerException | DateTimeParseException ignored) {
         return null;
       }
     }

api/src/main/java/feign/template/Expressions.java

@@ -22,10 +22,18 @@
 import java.util.Optional;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
+import java.util.regex.PatternSyntaxException;
 
 public final class Expressions {
 
-  private static final int MAX_EXPRESSION_LENGTH = 10000;
+  /**
+   * System property controlling the maximum allowed length of a single expression. Defaults to
+   * {@link #DEFAULT_MAX_EXPRESSION_LENGTH}. Setting it to {@code 0} (or any non-positive value)
+   * disables the length check entirely.
+   */
+  static final String MAX_EXPRESSION_LENGTH_PROPERTY = "feign.template.expression.maxLength";
+
+  private static final int DEFAULT_MAX_EXPRESSION_LENGTH = 10000;
 
   private static final String PATH_STYLE_OPERATOR = ";";
 
@@ -73,10 +81,16 @@ public static Expression create(final String value) {
       throw new IllegalArgumentException("an expression is required.");
     }
 
-    /* Check if the expression is too long */
-    if (expression.length() > MAX_EXPRESSION_LENGTH) {
+    /*
+     * Check if the expression is too long. The limit is configurable through the
+     * "feign.template.expression.maxLength" system property and can be disabled by setting it to a
+     * non-positive value.
+     */
+    final int maxExpressionLength =
+        Integer.getInteger(MAX_EXPRESSION_LENGTH_PROPERTY, DEFAULT_MAX_EXPRESSION_LENGTH);
+    if (maxExpressionLength > 0 && expression.length() > maxExpressionLength) {
       throw new IllegalArgumentException(
-          "expression is too long. Max length: " + MAX_EXPRESSION_LENGTH);
+          "expression is too long. Max length: " + maxExpressionLength);
     }
 
     /* create a new regular expression matcher for the expression */
@@ -104,15 +118,26 @@ public static Expression create(final String value) {
       }
     }
 
-    /* check for an operator */
-    if (PATH_STYLE_OPERATOR.equalsIgnoreCase(operator)) {
-      return new PathStyleExpression(variableName, variablePattern);
-    }
+    /*
+     * The value modifier after the ':' is compiled as a regular expression. When the chunk is a
+     * dynamic value (for example a header-map value that happens to contain '{' and ':') the
+     * modifier is not a valid pattern, so treat the chunk as a literal instead of letting the
+     * PatternSyntaxException escape.
+     */
+    try {
+      /* check for an operator */
+      if (PATH_STYLE_OPERATOR.equalsIgnoreCase(operator)) {
+        return new PathStyleExpression(variableName, variablePattern);
+      }
 
-    /* default to simple */
-    return SimpleExpression.isSimpleExpression(value)
-        ? new SimpleExpression(variableName, variablePattern)
-        : null; // Return null if it can't be validated as a Simple Expression -- Probably a Literal
+      /* default to simple */
+      // Return null if it can't be validated as a Simple Expression -- Probably a Literal
+      return SimpleExpression.isSimpleExpression(value)
+          ? new SimpleExpression(variableName, variablePattern)
+          : null;
+    } catch (PatternSyntaxException e) {
+      return null;
+    }
   }
 
   private static String stripBraces(String expression) {

api/src/test/java/feign/template/ExpressionsTest.java

@@ -16,13 +16,53 @@
 package feign.template;
 
 import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.assertj.core.api.Assertions.assertThatObject;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
 
 import java.util.Collections;
+import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 
 class ExpressionsTest {
 
+  @AfterEach
+  void clearMaxExpressionLengthProperty() {
+    System.clearProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY);
+  }
+
+  @Test
+  void tooLongExpressionFailsWithDefaultLimit() {
+    String tooLong = "{" + "a".repeat(10001) + "}";
+    assertThatThrownBy(() -> Expressions.create(tooLong))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("expression is too long");
+  }
+
+  @Test
+  void maxExpressionLengthIsConfigurable() {
+    System.setProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY, "5");
+    assertThatThrownBy(() -> Expressions.create("{foobar}"))
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("Max length: 5");
+  }
+
+  @Test
+  void lengthCheckCanBeDisabled() {
+    // An expression well beyond the default 10000 limit, expressed as a name plus a regular
+    // expression value modifier so the disabled length check is exercised in isolation.
+    String longExpression = "{name:" + "a".repeat(15000) + "}";
+    assertThatThrownBy(() -> Expressions.create(longExpression))
+        .as("guarded by default limit")
+        .isInstanceOf(IllegalArgumentException.class)
+        .hasMessageContaining("expression is too long");
+
+    System.setProperty(Expressions.MAX_EXPRESSION_LENGTH_PROPERTY, "0");
+    assertThatNoException()
+        .as("length check disabled")
+        .isThrownBy(() -> Expressions.create(longExpression));
+  }
+
   @Test
   void simpleExpression() {
     Expression expression = Expressions.create("{foo}");
@@ -44,6 +84,18 @@ void malformedExpression() {
     }
   }
 
+  @Test
+  void invalidValueModifierIsTreatedAsLiteral() {
+    // The text after ':' is compiled as a regex; an invalid one must not escape as a
+    // PatternSyntaxException, the chunk is a literal instead (Expressions.create returns null).
+    assertThatNoException().isThrownBy(() -> Expressions.create("{range:[1:10}"));
+    assertThat(Expressions.create("{a:[}")).isNull();
+    assertThat(Expressions.create("{a:(}")).isNull();
+
+    // a valid value modifier still produces an expression
+    assertThat(Expressions.create("{id:[0-9]+}")).isNotNull();
+  }
+
   @Test
   void malformedBodyTemplate() {
     String bodyTemplate = "{" + "a".repeat(65536) + "}";

core/pom.xml

@@ -73,7 +73,7 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-context</artifactId>
-      <version>${spring-context.version}</version>
+      <version>${spring.version}</version>
       <scope>test</scope>
     </dependency>
 

core/src/test/java/feign/codec/RetryAfterDecoderTest.java

@@ -54,6 +54,11 @@ void relativeSecondsParseDecimalIntegers() throws Exception {
     assertThat(decoder.apply("86400.0")).isEqualTo(parseDateTime("Sun, 2 Jan 2000 00:00:00 GMT"));
   }
 
+  @Test
+  void overflowingRelativeSecondsFailsGracefully() {
+    assertThat(decoder.apply("99999999999999999999")).isNull();
+  }
+
   private Long parseDateTime(String text) {
     try {
       return ZonedDateTime.parse(text, RFC_1123_DATE_TIME).toInstant().toEpochMilli();

form-spring/pom.xml

@@ -35,6 +35,18 @@
     <moditect.skip>true</moditect.skip>
   </properties>
 
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.springframework.boot</groupId>
+        <artifactId>spring-boot-dependencies</artifactId>
+        <version>${springboot.version}</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <dependencies>
     <dependency>
       <groupId>org.apache.commons</groupId>
@@ -58,7 +70,7 @@
     <dependency>
       <groupId>org.springframework</groupId>
       <artifactId>spring-web</artifactId>
-      <version>${spring-web.version}</version>
+      <version>${spring.version}</version>
       <scope>compile</scope>
     </dependency>
 

form/src/main/java/feign/form/FormEncoder.java

@@ -27,6 +27,8 @@
 import feign.core.codec.DefaultEncoder;
 import java.lang.reflect.Type;
 import java.nio.charset.Charset;
+import java.nio.charset.IllegalCharsetNameException;
+import java.nio.charset.UnsupportedCharsetException;
 import java.util.Collection;
 import java.util.HashMap;
 import java.util.Map;
@@ -129,6 +131,13 @@ private String getContentTypeValue(Map<String, Collection<String>> headers) {
 
   private Charset getCharset(String contentTypeValue) {
     final var matcher = CHARSET_PATTERN.matcher(contentTypeValue);
-    return matcher.find() ? Charset.forName(matcher.group(1)) : UTF_8;
+    if (!matcher.find()) {
+      return UTF_8;
+    }
+    try {
+      return Charset.forName(matcher.group(1));
+    } catch (IllegalCharsetNameException | UnsupportedCharsetException e) {
+      return UTF_8;
+    }
   }
 }

form/src/main/java/feign/form/MultipartFormContentProcessor.java

@@ -34,6 +34,7 @@
 import feign.form.multipart.Writer;
 import java.io.IOException;
 import java.nio.charset.Charset;
+import java.security.SecureRandom;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.Deque;
@@ -49,6 +50,8 @@
 @FieldDefaults(level = PRIVATE, makeFinal = true)
 public class MultipartFormContentProcessor implements ContentProcessor {
 
+  private static final SecureRandom RANDOM = new SecureRandom();
+
   Deque<Writer> writers;
 
   Writer defaultPerocessor;
@@ -75,7 +78,7 @@ public MultipartFormContentProcessor(Encoder delegate) {
   @Override
   public void process(RequestTemplate template, Charset charset, Map<String, Object> data)
       throws EncodeException {
-    final var boundary = Long.toHexString(System.currentTimeMillis());
+    final var boundary = randomBoundary();
     try (final var output = new Output(charset)) {
       for (var entry : data.entrySet()) {
         if (entry == null || entry.getKey() == null || entry.getValue() == null) {
@@ -158,4 +161,15 @@ private Writer findApplicableWriter(Object value) {
     }
     return defaultPerocessor;
   }
+
+  private static String randomBoundary() {
+    var token = new byte[16];
+    RANDOM.nextBytes(token);
+    var builder = new StringBuilder(token.length * 2);
+    for (var octet : token) {
+      builder.append(Character.forDigit((octet >> 4) & 0xF, 16));
+      builder.append(Character.forDigit(octet & 0xF, 16));
+    }
+    return builder.toString();
+  }
 }

form/src/main/java/feign/form/UrlencodedFormContentProcessor.java

@@ -18,7 +18,6 @@
 import static feign.form.ContentType.URLENCODED;
 
 import feign.CollectionFormat;
-import feign.Request;
 import feign.RequestTemplate;
 import feign.codec.EncodeException;
 import java.net.URLEncoder;
@@ -74,7 +73,7 @@ public void process(RequestTemplate template, Charset charset, Map<String, Objec
 
     template.header(CONTENT_TYPE_HEADER, Collections.<String>emptyList()); // reset header
     template.header(CONTENT_TYPE_HEADER, contentTypeValue);
-    template.body(Request.Body.of(bytes));
+    template.body(bytes, charset);
   }
 
   @Override
@@ -106,7 +105,10 @@ private CharSequence createKeyValuePair(
   private CharSequence createKeyValuePair(
       CollectionFormat collectionFormat, String key, Stream<?> values, Charset charset) {
     final var stringValues =
-        values.filter(Objects::nonNull).map(Object::toString).collect(Collectors.toList());
+        values
+            .filter(Objects::nonNull)
+            .map(value -> encode(value, charset))
+            .collect(Collectors.toList());
     return collectionFormat.join(key, stringValues, charset);
   }
 }