Merge branch 'TheFreaky/main'

Author: spencergibb

spring-cloud-gateway-server-webflux/src/main/java/org/springframework/cloud/gateway/filter/ratelimit/RedisRateLimiter.java

@@ -84,6 +84,13 @@ public class RedisRateLimiter extends AbstractRateLimiter<RedisRateLimiter.Confi
 	 */
 	public static final String REQUESTED_TOKENS_HEADER = "X-RateLimit-Requested-Tokens";
 
+	/**
+	 * Constant representing the maximum number that can be safely used in Redis scripts.
+	 * This is the largest number that can be represented accurately in Java's `long` type
+	 * and is equal to 2^53 - 1, which is the largest number that Lua can reliably handle.
+	 */
+	private static final Long REDIS_LUA_MAX_SAFE_INTEGER = 9007199254740991L;
+
 	private Log log = LogFactory.getLog(getClass());
 
 	private ReactiveStringRedisTemplate redisTemplate;
@@ -130,7 +137,7 @@ public RedisRateLimiter(ReactiveStringRedisTemplate redisTemplate, RedisScript<L
 	 * @param defaultBurstCapacity how many tokens the bucket can hold in token-bucket
 	 * algorithm.
 	 */
-	public RedisRateLimiter(int defaultReplenishRate, int defaultBurstCapacity) {
+	public RedisRateLimiter(int defaultReplenishRate, long defaultBurstCapacity) {
 		super(Config.class, CONFIGURATION_PROPERTY_NAME, (ConfigurationService) null);
 		this.defaultConfig = new Config().setReplenishRate(defaultReplenishRate).setBurstCapacity(defaultBurstCapacity);
 	}
@@ -142,7 +149,7 @@ public RedisRateLimiter(int defaultReplenishRate, int defaultBurstCapacity) {
 	 * algorithm.
 	 * @param defaultRequestedTokens how many tokens are requested per request.
 	 */
-	public RedisRateLimiter(int defaultReplenishRate, int defaultBurstCapacity, int defaultRequestedTokens) {
+	public RedisRateLimiter(int defaultReplenishRate, long defaultBurstCapacity, int defaultRequestedTokens) {
 		this(defaultReplenishRate, defaultBurstCapacity);
 		this.defaultConfig.setRequestedTokens(defaultRequestedTokens);
 	}
@@ -241,7 +248,7 @@ public Mono<Response> isAllowed(String routeId, String id) {
 		int replenishRate = routeConfig.getReplenishRate();
 
 		// How much bursting do you want to allow?
-		int burstCapacity = routeConfig.getBurstCapacity();
+		long burstCapacity = routeConfig.getBurstCapacity();
 
 		// How many tokens are requested per request?
 		int requestedTokens = routeConfig.getRequestedTokens();
@@ -314,7 +321,7 @@ public static class Config {
 		private int replenishRate;
 
 		@Min(0)
-		private int burstCapacity = 1;
+		private long burstCapacity = 1;
 
 		@Min(1)
 		private int requestedTokens = 1;
@@ -328,13 +335,15 @@ public Config setReplenishRate(int replenishRate) {
 			return this;
 		}
 
-		public int getBurstCapacity() {
+		public long getBurstCapacity() {
 			return burstCapacity;
 		}
 
-		public Config setBurstCapacity(int burstCapacity) {
+		public Config setBurstCapacity(long burstCapacity) {
 			Assert.isTrue(burstCapacity >= this.replenishRate, "BurstCapacity(" + burstCapacity
 					+ ") must be greater than or equal than replenishRate(" + this.replenishRate + ")");
+			Assert.isTrue(burstCapacity <= REDIS_LUA_MAX_SAFE_INTEGER, "BurstCapacity(" + burstCapacity
+					+ ") must not exceed the maximum allowed value of " + REDIS_LUA_MAX_SAFE_INTEGER);
 			this.burstCapacity = burstCapacity;
 			return this;
 		}

spring-cloud-gateway-server-webflux/src/test/java/org/springframework/cloud/gateway/filter/ratelimit/RedisRateLimiterConfigTests.java

@@ -58,6 +58,14 @@ public void shouldThrowAnErrorWhenReplenishRateIsHigherThanBurstCapacity() {
 		Assertions.assertThatThrownBy(() -> new RedisRateLimiter(10, 5)).isInstanceOf(IllegalArgumentException.class);
 	}
 
+	@Test
+	public void shouldThrowAnErrorWhenBurstCapacityExceedsMaxAllowed() {
+		long burstCapacity = Long.MAX_VALUE;
+
+		Assertions.assertThatThrownBy(() -> new RedisRateLimiter(10, burstCapacity))
+			.isInstanceOf(IllegalArgumentException.class);
+	}
+
 	@Test
 	public void redisRateConfiguredFromEnvironment() {
 		assertFilter("redis_rate_limiter_config_test", 10, 20, 1, false);

spring-cloud-gateway-server-webflux/src/test/java/org/springframework/cloud/gateway/filter/ratelimit/RedisRateLimiterLuaScriptTests.java

@@ -47,6 +47,7 @@
 public class RedisRateLimiterLuaScriptTests {
 
 	static final String KEY_PREFIX = "redis-rate-limiter-lua-script-tests";
+	static final Long REDIS_LUA_MAX_SAFE_INTEGER = 9007199254740991L;
 
 	@Container
 	public static GenericContainer redis = new GenericContainer<>("redis:5.0.14-alpine").withExposedPorts(6379);
@@ -147,6 +148,22 @@ public void testTokensNotEnough() {
 		assertThat(result.get(1)).isEqualTo(10);
 	}
 
+	@Test
+	public void testCapacityExceedsMaxInt() {
+		long rate = 1;
+		long capacity = REDIS_LUA_MAX_SAFE_INTEGER;
+		long now = System.currentTimeMillis();
+		long requested = 1;
+
+		List<String> keys = getKeys("capacity_exceeds_max_int");
+		List<String> args = getArgs(rate, capacity, now, requested);
+
+		List<Long> result = redisTemplate.execute(redisScript, keys, args).blockFirst();
+
+		assertThat(result.get(0)).isEqualTo(1);
+		assertThat(result.get(1)).isEqualTo(REDIS_LUA_MAX_SAFE_INTEGER - 1);
+	}
+
 	@EnableAutoConfiguration
 	@SpringBootConfiguration
 	public static class TestConfig {