Merge branch 'development' into feature/proxy-auth

chillaq · web-flow · commit 4ad96f4cac36 · 2025-08-22T09:02:43.000-07:00
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -60,7 +60,7 @@ jobs:
         run: mvn checkstyle::check
 
 #      - name: Deploy
-#        if: matrix.jdk == '8' && github.event_name == 'push' && github.ref != 'refs/heads/master' && github.ref != 'refs/heads/development'
+#       if: matrix.jdk == '8' && github.event_name == 'push' && github.ref != 'refs/heads/master' && github.ref != 'refs/heads/development'
 #        run: mvn --batch-mode deploy -P test
 
       - name: SonarQube Scan (Push)
diff --git a/CHANGES.txt b/CHANGES.txt
@@ -1,3 +1,8 @@
+4.16.1 (Jul 21, 2025)
+- Fixed vulnerabilities: 
+    - Upgraded org.apache.commons-commons-lang3 to 3.18.0
+    - Upgraded com.google.code.gson.gson to 2.13.1
+
 4.16.0 (May 28, 2025)
 - Added support for rule-based segments. These segments determine membership at runtime by evaluating their configured rules against the user attributes provided to the SDK.
 - Added support for feature flag prerequisites. This allows customers to define dependency conditions between flags, which are evaluated before any allowlists or targeting rules.
diff --git a/client/pom.xml b/client/pom.xml
@@ -176,7 +176,7 @@
         <dependency>
             <groupId>com.google.code.gson</groupId>
             <artifactId>gson</artifactId>
-            <version>2.9.0</version>
+            <version>2.13.1</version>
         </dependency>
         <dependency>
             <groupId>org.yaml</groupId>
@@ -188,7 +188,7 @@
         <dependency>
             <groupId>org.apache.commons</groupId>
             <artifactId>commons-lang3</artifactId>
-            <version>3.4</version>
+            <version>3.18.0</version>
             <scope>test</scope>
         </dependency>
         <dependency>
diff --git a/client/src/main/java/io/split/client/events/EventsSender.java b/client/src/main/java/io/split/client/events/EventsSender.java
@@ -12,7 +12,7 @@
 import java.net.URISyntaxException;
 import java.util.List;
 
-import static com.google.gson.internal.$Gson$Preconditions.checkNotNull;
+import static com.google.common.base.Preconditions.checkNotNull;
 
 public class EventsSender {
 
diff --git a/client/src/main/java/io/split/client/events/InMemoryEventsStorage.java b/client/src/main/java/io/split/client/events/InMemoryEventsStorage.java
@@ -12,7 +12,7 @@
 import java.util.concurrent.BlockingQueue;
 import java.util.concurrent.LinkedBlockingQueue;
 
-import static com.google.gson.internal.$Gson$Preconditions.checkNotNull;
+import static com.google.common.base.Preconditions.checkNotNull;
 
 public class InMemoryEventsStorage implements EventsStorage{
 
diff --git a/client/src/main/java/io/split/client/impressions/UniqueKeysTrackerImp.java b/client/src/main/java/io/split/client/impressions/UniqueKeysTrackerImp.java
@@ -1,5 +1,6 @@
 package io.split.client.impressions;
 
+import com.google.common.collect.Lists;
 import io.split.client.dtos.UniqueKeys;
 import io.split.client.impressions.filters.BloomFilterImp;
 import io.split.client.impressions.filters.Filter;
@@ -21,12 +22,14 @@
 import java.util.concurrent.ThreadFactory;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicInteger;
 
 public class UniqueKeysTrackerImp implements UniqueKeysTracker{
     private static final Logger _log = LoggerFactory.getLogger(UniqueKeysTrackerImp.class);
     private static final double MARGIN_ERROR = 0.01;
-    private static final int MAX_AMOUNT_OF_TRACKED_UNIQUE_KEYS = 30000;
+    private static final int MAX_UNIQUE_KEYS_POST_SIZE = 5000;
     private static final int MAX_AMOUNT_OF_KEYS = 10000000;
+    private final AtomicInteger trackerKeysSize = new AtomicInteger(0);
     private FilterAdapter filterAdapter;
     private final TelemetrySynchronizer _telemetrySynchronizer;
     private final ScheduledExecutorService _uniqueKeysSyncScheduledExecutorService;
@@ -59,10 +62,11 @@ public boolean track(String featureFlagName, String key) {
                 (feature, current) -> {
                     HashSet<String> keysByFeature = Optional.ofNullable(current).orElse(new HashSet<>());
                     keysByFeature.add(key);
+                    trackerKeysSize.incrementAndGet();
                     return keysByFeature;
                 });
         _logger.debug("The feature flag " + featureFlagName + " and key " + key + " was added");
-        if (uniqueKeysTracker.size() >= MAX_AMOUNT_OF_TRACKED_UNIQUE_KEYS){
+        if (trackerKeysSize.intValue() >= MAX_UNIQUE_KEYS_POST_SIZE){
             _logger.warn("The UniqueKeysTracker size reached the maximum limit");
             try {
                 sendUniqueKeys();
@@ -107,6 +111,7 @@ public HashMap<String,HashSet<String>> popAll(){
             HashSet<String> value = uniqueKeysTracker.remove(key);
             toReturn.put(key, value);
         }
+        trackerKeysSize.set(0);
         return toReturn;
     }
 
@@ -115,26 +120,71 @@ private void sendUniqueKeys(){
             _log.debug("SendUniqueKeys already running");
             return;
         }
+
         try {
-            if (uniqueKeysTracker.size() == 0) {
-                _log.warn("The Unique Keys Tracker is empty");
+            if (uniqueKeysTracker.isEmpty()) {
+                _log.debug("The Unique Keys Tracker is empty");
                 return;
             }
+
             HashMap<String, HashSet<String>> uniqueKeysHashMap = popAll();
             List<UniqueKeys.UniqueKey> uniqueKeysFromPopAll = new ArrayList<>();
             for (Map.Entry<String, HashSet<String>> uniqueKeyEntry : uniqueKeysHashMap.entrySet()) {
                 UniqueKeys.UniqueKey uniqueKey = new UniqueKeys.UniqueKey(uniqueKeyEntry.getKey(), new ArrayList<>(uniqueKeyEntry.getValue()));
                 uniqueKeysFromPopAll.add(uniqueKey);
             }
-            _telemetrySynchronizer.synchronizeUniqueKeys(new UniqueKeys(uniqueKeysFromPopAll));
+            uniqueKeysFromPopAll = capChunksToMaxSize(uniqueKeysFromPopAll);
+
+            for (List<UniqueKeys.UniqueKey> chunk : getChunks(uniqueKeysFromPopAll)) {
+                _telemetrySynchronizer.synchronizeUniqueKeys(new UniqueKeys(chunk));
+            }
         } finally {
             sendGuard.set(false);
         }
     }
 
+    private List<UniqueKeys.UniqueKey> capChunksToMaxSize(List<UniqueKeys.UniqueKey> uniqueKeys) {
+        List<UniqueKeys.UniqueKey> finalChunk = new ArrayList<>();
+        for (UniqueKeys.UniqueKey uniqueKey : uniqueKeys) {
+            if (uniqueKey.keysDto.size() > MAX_UNIQUE_KEYS_POST_SIZE) {
+                for(List<String> subChunk : Lists.partition(uniqueKey.keysDto, MAX_UNIQUE_KEYS_POST_SIZE)) {
+                    finalChunk.add(new UniqueKeys.UniqueKey(uniqueKey.featureName, subChunk));
+                }
+                continue;
+            }
+            finalChunk.add(uniqueKey);
+        }
+        return finalChunk;
+    }
+
+    private List<List<UniqueKeys.UniqueKey>> getChunks(List<UniqueKeys.UniqueKey> uniqueKeys) {
+        List<List<UniqueKeys.UniqueKey>> chunks = new ArrayList<>();
+        List<UniqueKeys.UniqueKey> intermediateChunk = new ArrayList<>();
+        for (UniqueKeys.UniqueKey uniqueKey : uniqueKeys) {
+            if ((getChunkSize(intermediateChunk) + uniqueKey.keysDto.size()) > MAX_UNIQUE_KEYS_POST_SIZE) {
+                chunks.add(intermediateChunk);
+                intermediateChunk = new ArrayList<>();
+            }
+            intermediateChunk.add(uniqueKey);
+        }
+        if (!intermediateChunk.isEmpty()) {
+            chunks.add(intermediateChunk);
+        }
+        return chunks;
+    }
+
+    private int getChunkSize(List<UniqueKeys.UniqueKey> uniqueKeysChunk) {
+        int totalSize = 0;
+        for (UniqueKeys.UniqueKey uniqueKey : uniqueKeysChunk) {
+            totalSize += uniqueKey.keysDto.size();
+        }
+        return totalSize;
+    }
+    
     private interface ExecuteUniqueKeysAction{
         void execute();
     }
+
     private class ExecuteCleanFilter implements ExecuteUniqueKeysAction {
 
         @Override
diff --git a/client/src/main/java/io/split/storages/memory/RuleBasedSegmentCacheInMemoryImp.java b/client/src/main/java/io/split/storages/memory/RuleBasedSegmentCacheInMemoryImp.java
@@ -104,6 +104,6 @@ public Set<String> getSegments() {
 
     @Override
     public boolean contains(Set<String> ruleBasedSegmentNames) {
-        return getSegments().containsAll(ruleBasedSegmentNames);
+        return _concurrentMap.keySet().containsAll(ruleBasedSegmentNames);
     }
 }
diff --git a/client/src/main/java/io/split/storages/pluggable/adapters/UserCustomRuleBasedSegmentAdapterConsumer.java b/client/src/main/java/io/split/storages/pluggable/adapters/UserCustomRuleBasedSegmentAdapterConsumer.java
@@ -96,7 +96,7 @@ private List<ParsedRuleBasedSegment> stringsToParsedRuleBasedSegments(List<Strin
 
     @Override
     public boolean contains(Set<String> ruleBasedSegmentNames) {
-        return getSegments().containsAll(ruleBasedSegmentNames);
+        return _userStorageWrapper.getKeysByPrefix(PrefixAdapter.buildGetAllRuleBasedSegment()).containsAll(ruleBasedSegmentNames);
     }
 
 }
diff --git a/client/src/test/java/io/split/client/impressions/UniqueKeysTrackerImpTest.java b/client/src/test/java/io/split/client/impressions/UniqueKeysTrackerImpTest.java
@@ -1,13 +1,21 @@
 package io.split.client.impressions;
 
+import io.split.client.dtos.UniqueKeys;
 import io.split.telemetry.synchronizer.TelemetryInMemorySubmitter;
 import io.split.telemetry.synchronizer.TelemetrySynchronizer;
 import org.junit.Assert;
 import org.junit.Test;
 import org.mockito.Mockito;
 
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.ArrayList;
+import java.util.concurrent.atomic.AtomicInteger;
 
 public class UniqueKeysTrackerImpTest {
     private static TelemetrySynchronizer _telemetrySynchronizer = Mockito.mock(TelemetryInMemorySubmitter.class);
@@ -100,4 +108,71 @@ public void testStopSynchronization() throws Exception {
         uniqueKeysTrackerImp.stop();
         Mockito.verify(telemetrySynchronizer, Mockito.times(1)).synchronizeUniqueKeys(Mockito.anyObject());
     }
+
+    @Test
+    public void testUniqueKeysChunks() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException {
+        UniqueKeysTrackerImp uniqueKeysTrackerImp = new UniqueKeysTrackerImp(_telemetrySynchronizer, 10000, 10000, null);
+        HashMap<String, HashSet<String>> uniqueKeysHashMap = new HashMap<>();
+        HashSet<String> feature1 = new HashSet<>();
+        HashSet<String> feature2 = new HashSet<>();
+        HashSet<String> feature3 = new HashSet<>();
+        HashSet<String> feature4 = new HashSet<>();
+        HashSet<String> feature5 = new HashSet<>();
+        for (Integer i=1; i<6000; i++) {
+            if (i <= 1000) {
+                feature1.add("key" + i);
+            }
+            if (i <= 2000) {
+                feature2.add("key" + i);
+            }
+            if (i <= 3000) {
+                feature3.add("key" + i);
+            }
+            if (i <= 4000) {
+                feature4.add("key" + i);
+            }
+            feature5.add("key" + i);
+        }
+        uniqueKeysHashMap.put("feature1", feature1);
+        uniqueKeysHashMap.put("feature2", feature2);
+        uniqueKeysHashMap.put("feature3", feature3);
+        uniqueKeysHashMap.put("feature4", feature4);
+        uniqueKeysHashMap.put("feature5", feature5);
+
+        List<UniqueKeys.UniqueKey> uniqueKeysFromPopAll = new ArrayList<>();
+        for (Map.Entry<String, HashSet<String>> uniqueKeyEntry : uniqueKeysHashMap.entrySet()) {
+            UniqueKeys.UniqueKey uniqueKey = new UniqueKeys.UniqueKey(uniqueKeyEntry.getKey(), new ArrayList<>(uniqueKeyEntry.getValue()));
+            uniqueKeysFromPopAll.add(uniqueKey);
+        }
+        Method methodCapChunks = uniqueKeysTrackerImp.getClass().getDeclaredMethod("capChunksToMaxSize", List.class);
+        methodCapChunks.setAccessible(true);
+        uniqueKeysFromPopAll = (List<UniqueKeys.UniqueKey>)methodCapChunks.invoke(uniqueKeysTrackerImp, uniqueKeysFromPopAll);
+
+        Method methodGetChunks = uniqueKeysTrackerImp.getClass().getDeclaredMethod("getChunks", List.class);
+        methodGetChunks.setAccessible(true);
+        List<List<UniqueKeys.UniqueKey>> keysChunks = (List<List<UniqueKeys.UniqueKey>>) methodGetChunks.invoke(uniqueKeysTrackerImp, uniqueKeysFromPopAll);
+        for (List<UniqueKeys.UniqueKey> chunk : keysChunks) {
+            int chunkSize = 0;
+            for (UniqueKeys.UniqueKey keys : chunk) {
+                chunkSize += keys.keysDto.size();
+            }
+            Assert.assertTrue(chunkSize <= 5000);
+        }
+    }
+
+    @Test
+    public void testTrackReachMaxKeys() throws NoSuchMethodException, InvocationTargetException, IllegalAccessException, NoSuchFieldException {
+        TelemetrySynchronizer telemetrySynchronizer = Mockito.mock(TelemetryInMemorySubmitter.class);
+        UniqueKeysTrackerImp uniqueKeysTrackerImp = new UniqueKeysTrackerImp(telemetrySynchronizer, 10000, 10000, null);
+        for (int i=1; i<6000; i++) {
+            Assert.assertTrue(uniqueKeysTrackerImp.track("feature1", "key" + i));
+            Assert.assertTrue(uniqueKeysTrackerImp.track("feature2", "key" + i));
+        }
+        Mockito.verify(telemetrySynchronizer, Mockito.times(2)).synchronizeUniqueKeys(Mockito.anyObject());
+
+        Field getTrackerSize = uniqueKeysTrackerImp.getClass().getDeclaredField("trackerKeysSize");
+        getTrackerSize.setAccessible(true);
+        AtomicInteger trackerSize = (AtomicInteger) getTrackerSize.get(uniqueKeysTrackerImp);
+        Assert.assertTrue(trackerSize.intValue() == 1998);
+    }
 }
diff --git a/client/src/test/java/io/split/storages/memory/RuleBasedSegmentCacheInMemoryImplTest.java b/client/src/test/java/io/split/storages/memory/RuleBasedSegmentCacheInMemoryImplTest.java
@@ -16,6 +16,8 @@
 import com.google.common.collect.Lists;
 
 import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashSet;
 import java.util.List;
 
 public class RuleBasedSegmentCacheInMemoryImplTest extends TestCase {
@@ -31,6 +33,8 @@ public void testAddAndDeleteSegment(){
         ruleBasedSegmentCache.update(Lists.newArrayList(parsedRuleBasedSegment), null, 123);
         assertEquals(123, ruleBasedSegmentCache.getChangeNumber());
         assertEquals(parsedRuleBasedSegment, ruleBasedSegmentCache.get("sample_rule_based_segment"));
+        assertTrue(ruleBasedSegmentCache.contains(new HashSet<>(Arrays.asList("sample_rule_based_segment"))));
+        assertFalse(ruleBasedSegmentCache.contains(new HashSet<>(Arrays.asList("sample_rule_based_segment", "123"))));
 
         ruleBasedSegmentCache.update(null, Lists.newArrayList("sample_rule_based_segment"), 124);
         assertEquals(124, ruleBasedSegmentCache.getChangeNumber());
@@ -62,5 +66,7 @@ public void testMultipleSegment(){
         ruleBasedSegmentCache.update(Lists.newArrayList(parsedRuleBasedSegment1, parsedRuleBasedSegment2), null, 123);
         assertEquals(Lists.newArrayList("another_rule_based_segment", "sample_rule_based_segment"), ruleBasedSegmentCache.ruleBasedSegmentNames());
         assertEquals(Sets.newHashSet("segment2", "segment1", "employees"), ruleBasedSegmentCache.getSegments());
+        assertTrue(ruleBasedSegmentCache.contains(new HashSet<>(Arrays.asList("sample_rule_based_segment", "another_rule_based_segment"))));
+        assertTrue(ruleBasedSegmentCache.contains(new HashSet<>(Arrays.asList("sample_rule_based_segment"))));
     }
 }
diff --git a/client/src/test/java/io/split/storages/pluggable/adapters/UserCustomRuleBasedSegmentAdapterConsumerTest.java b/client/src/test/java/io/split/storages/pluggable/adapters/UserCustomRuleBasedSegmentAdapterConsumerTest.java
@@ -1,6 +1,7 @@
 package io.split.storages.pluggable.adapters;
 
 import com.google.common.collect.Lists;
+import com.google.common.collect.Maps;
 import io.split.client.dtos.*;
 import io.split.client.utils.Json;
 import io.split.engine.ConditionsTestUtil;
@@ -16,10 +17,14 @@
 import java.lang.reflect.Field;
 import java.lang.reflect.Modifier;
 import java.util.*;
+import java.util.concurrent.ConcurrentMap;
+import java.util.concurrent.atomic.AtomicLong;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
 import static io.split.TestHelper.makeRuleBasedSegment;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
 
 public class UserCustomRuleBasedSegmentAdapterConsumerTest {
 
@@ -66,10 +71,16 @@ public void testGetChangeNumberWithGsonFailing() {
     public void testGetRuleBasedSegment() {
         RuleBasedSegmentParser ruleBasedSegmentParser = new RuleBasedSegmentParser();
         RuleBasedSegment ruleBasedSegment = getRuleBasedSegment(RULE_BASED_SEGMENT_NAME);
+        ParsedRuleBasedSegment expected = ruleBasedSegmentParser.parse(ruleBasedSegment);
+        ConcurrentMap<String, ParsedRuleBasedSegment> rbsCollection = Maps.newConcurrentMap();
+        rbsCollection.put(RULE_BASED_SEGMENT_NAME, expected);
         Mockito.when(_userStorageWrapper.get(PrefixAdapter.buildRuleBasedSegmentKey(RULE_BASED_SEGMENT_NAME))).thenReturn(getRuleBasedSegmentAsJson(ruleBasedSegment));
+        Mockito.when(_userStorageWrapper.getKeysByPrefix("SPLITIO.rbsegment*")).thenReturn(new HashSet<>(Arrays.asList(RULE_BASED_SEGMENT_NAME)));
         ParsedRuleBasedSegment result = _userCustomRuleBasedSegmentAdapterConsumer.get(RULE_BASED_SEGMENT_NAME);
-        ParsedRuleBasedSegment expected = ruleBasedSegmentParser.parse(ruleBasedSegment);
         Assert.assertEquals(expected, result);
+        assertTrue(_userCustomRuleBasedSegmentAdapterConsumer.contains(new HashSet<>(Arrays.asList(RULE_BASED_SEGMENT_NAME))));
+        assertFalse(_userCustomRuleBasedSegmentAdapterConsumer.contains(new HashSet<>(Arrays.asList(RULE_BASED_SEGMENT_NAME, "123"))));
+
     }
 
     @Test
@@ -135,7 +146,7 @@ public void testGetSegments() {
         Mockito.when(_userStorageWrapper.getMany(Mockito.anyObject())).
                 thenReturn(getManyExpected);
         HashSet<String> segmentResult = (HashSet<String>) _userCustomRuleBasedSegmentAdapterConsumer.getSegments();
-        Assert.assertTrue(segmentResult.contains("employee"));
+        assertTrue(segmentResult.contains("employee"));
     }
 
     @Test
diff --git a/testing/pom.xml b/testing/pom.xml
@@ -39,7 +39,7 @@
                             <publishingServerId>central</publishingServerId>
                             <autoPublish>false</autoPublish>
                             <waitUntil>published</waitUntil>
-                            <ignorePublishedComponents>true</ignorePublishedComponents>
+                            <ignorePublishedComponents>false</ignorePublishedComponents>
                         </configuration>
                     </plugin>
                 </plugins>

Original file line number	Diff line number	Diff line change
`@@ -104,6 +104,6 @@ public Set<String> getSegments() {`
`104`	`104`
`105`	`105`	`@Override`
`106`	`106`	`public boolean contains(Set<String> ruleBasedSegmentNames) {`
`107`		`- return getSegments().containsAll(ruleBasedSegmentNames);`
	`107`	`+ return _concurrentMap.keySet().containsAll(ruleBasedSegmentNames);`
`108`	`108`	`}`
`109`	`109`	`}`
Original file line number	Diff line number	Diff line change
`@@ -96,7 +96,7 @@ private List<ParsedRuleBasedSegment> stringsToParsedRuleBasedSegments(List<Strin`
`96`	`96`
`97`	`97`	`@Override`
`98`	`98`	`public boolean contains(Set<String> ruleBasedSegmentNames) {`
`99`		`- return getSegments().containsAll(ruleBasedSegmentNames);`
	`99`	`+ return _userStorageWrapper.getKeysByPrefix(PrefixAdapter.buildGetAllRuleBasedSegment()).containsAll(ruleBasedSegmentNames);`
`100`	`100`	`}`
`101`	`101`
`102`	`102`	`}`