Skip to content

Add a check to StringUtils.repeat() for large length repeat value#362

Closed
TuranDev wants to merge 2 commits intoapache:masterfrom
TuranDev:master
Closed

Add a check to StringUtils.repeat() for large length repeat value#362
TuranDev wants to merge 2 commits intoapache:masterfrom
TuranDev:master

Conversation

@TuranDev
Copy link

@TuranDev TuranDev commented Oct 1, 2018

I have added a check to ensure that the resultant String from the repeat is not larger than the maximum allowed length.

@coveralls
Copy link

Coverage Status

Coverage increased (+0.0009%) to 95.253% when pulling 3acb09d on Turan91:master into 69e8438 on apache:master.

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

YIKES!

image

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

YIKES!

image

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

YIKES!

image

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

YIKES!

image

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Missing space between parameters

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good spot. Thanks

assertEquals(10000, str.length());
assertTrue(StringUtils.containsOnly(str, 'a'));
try {
StringUtils.repeat("aaa",Integer.MAX_VALUE);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

YIKES!

image

@MarkDacek
Copy link
Contributor

I'm somewhat wary of simply comparing the values, as it's not always intuitive and doesn't save us much in the way of performance. Perhaps comparing it to Integer.MAX_VALUE is a bit more appropriate?

@TuranDev
Copy link
Author

I'm somewhat wary of simply comparing the values, as it's not always intuitive and doesn't save us much in the way of performance. Perhaps comparing it to Integer.MAX_VALUE is a bit more appropriate?

What do you mean?

@MarkDacek
Copy link
Contributor

MarkDacek commented Dec 17, 2018

I'm somewhat wary of simply comparing the values, as it's not always intuitive and doesn't save us much in the way of performance. Perhaps comparing it to Integer.MAX_VALUE is a bit more appropriate?

What do you mean?

https://github.com/apache/commons-lang/pull/362/files#diff-3f4c835875ddc8a211c0272e8be51394R6253

I would sooner do something like:

final long longSize = (long) inputLength * repeat;
if(longSize > Integer.MAX_VALUE)

@MarkDacek
Copy link
Contributor

Other thing of note: I don't think that providing the length in the exception is terribly useful, as the developer would clearly have access to that information.

Is there consensus on whether this is a needed feature? Is there a JIRA ticket open for this? I am having a hard time believing that multi-billion character Strings emanating from this method are common enough to warrant the overhead.

@TuranDev
Copy link
Author

It is convention for exception messages to provide the user with information on the cause of failure. In the same way an ArrayIndexOutOfBoundsException would provide the user with the length which caused it even though the "developer would clearly have access to that information." This provides the user with information on the offending value.

With regards to overhead it is a single check at the start that doesn't add much overhead and prevents issues with both being too large and failing silently (with regards to the expected string not being what the users expects as a result).

@MarkDacek
Copy link
Contributor

Can you think of any kind of use-case where a String over two-billion characters long is created, such that all other calls to this should check for it?

@TuranDev
Copy link
Author

Validation checks are validation checks, we can't begin using occurrence to dictate their place. As with any utility a set number of validation checks are performed before the actual brunt of the logic.

@TuranDev TuranDev closed this Jun 29, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants