Limit the length of outbound X-Correlation-ID header values to 512 bytes to avoid risk of pathological client sending an enormous correlation id and this causing unexpected 400 errors for internal calls

Author: petergeneric

guice/common/src/main/java/com/peterphi/std/guice/restclient/resteasy/impl/TracingClientRequestFilter.java

@@ -2,6 +2,7 @@
 
 import com.peterphi.std.util.tracing.Tracing;
 import com.peterphi.std.util.tracing.TracingConstants;
+import org.apache.commons.lang.StringUtils;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -14,7 +15,9 @@
 public class TracingClientRequestFilter implements ClientRequestFilter
 {
 	private static final Logger log = LoggerFactory.getLogger(TracingClientRequestFilter.class);
+	private static final int MAX_TRACE_SIZE = 512;
 
+	private static boolean hasLoggedOversizedCorrelationId = false;
 
 	@Override
 	public void filter(final ClientRequestContext requestContext) throws IOException
@@ -26,7 +29,30 @@ public void filter(final ClientRequestContext requestContext) throws IOException
 			if (requestContext.getHeaders().containsKey(TracingConstants.HTTP_HEADER_CORRELATION_ID))
 				log.warn("Duplicate call to tracing filter {} for {} for {}", this, requestContext, requestContext.getUri());
 
-			requestContext.getHeaders().putSingle(TracingConstants.HTTP_HEADER_CORRELATION_ID, traceId);
+			final String val;
+			if (traceId.length() <= MAX_TRACE_SIZE)
+			{
+				val = traceId;
+			}
+			else
+			{
+				val = StringUtils.abbreviateMiddle(traceId, "...", MAX_TRACE_SIZE);
+
+				if (!hasLoggedOversizedCorrelationId)
+				{
+					log.warn(
+							"Correlation ID {} is over max size {}, truncating. Future instances of this error in this webapp will be logged at DEBUG.",
+							traceId,
+							MAX_TRACE_SIZE);
+					hasLoggedOversizedCorrelationId = true;
+				}
+				else if (log.isDebugEnabled())
+				{
+					log.debug("Correlation ID {} is over limit, truncating", traceId);
+				}
+			}
+
+			requestContext.getHeaders().putSingle(TracingConstants.HTTP_HEADER_CORRELATION_ID, val);
 
 			final Tracing trace = Tracing.peek();