onblog / snowjena Goto Github PK

View Code? Open in Web Editor NEW

825.0 825.0 221.0 2.86 MB

Distributed lock-free current limiting framework based on token bucket algorithm.基于令牌桶算法实现的分布式无锁限流框架。（欢迎Star，🚫禁止Fork）

License: Apache License 2.0

Java 97.55% HTML 2.45%

cas springboot springboot2 springcloud

snowjena's People

Contributors

Stargazers

Watchers

Forkers

ljwkevin skylinehyc zhoudaqing zhujingling jerry-yu-cn croceit ping203 qinkun11 davidmr001 synpore jm518 lamost710 zhanglei anke522 lltamos leaderyangzi zetig liyujiang372 zhou1hang zxf330301 nanbo99 janck13 wtmmac jianpingh guoxp hwlsniper tingdaodi pn2008 yangmain uamsunshine heyecheng kakarottooo guanglinhe lsy234009 gejaingbo lyc88 pengxiaosong binbindegit gspandy lmubai 10bingo shabaan-go xierui921326 gaoxiong523 kellerli sniperzy zhongzunfa insiston niubangcha neil-zhou liuruizhi webdroid163 blueskyxzy huangjie003 nicky1 luchao0111 barackobamausa endlessc galaxist codebyteme terrylakey shujianhui shargubo spring-gamal janzhou123 thinker1017 gordentam yiliaofan imloama xiashuijun wenxuejiang610 joy-panda hplegend wangerdx baraka-sdw gmdqtd zorrock jackymoto catkins10 zeng8750 a121bc tangyuxiaoyao donaldhan rainyinseptember wangdaowangdao yanghongkjxy bendizhengdao liuxiangfly bender65535 liu165 nickyzhang sanqqiao jinjin110 binghe001 reedfan xu5500509 kiminh guoyaocong manfredma monsdio

snowjena's Issues

麻烦问下，我只想用分布式限流功能，不想使用其他功能，该如何使用

fallback的参数建议可以为空

例如：
public String sayFallback() {
return "访问失败，超过流量限制";
}

code question?

SnowJena/snowjena-core/src/main/java/com/github/onblog/core/limiter/RateLimiterDefault.java

Line 141 in 4131608

l = bucket.longValue();

When does this line of code execute?

这行代码什么情况下会执行？

Pressure test report error

when i set theLimit into 3800, but when i stress test 2000 QPS, it occur error in 2%. i use the TicketServer.jar.

Dependency com.alibaba:fastjson, leading to CVE problem

Hi, In /snowjena-ticket-server，there is a dependency com.alibaba:fastjson:1.2.73 that calls the risk method.

CVE-2022-25845

The scope of this CVE affected version is ** [,1.2.83)**

After further analysis, in this project, the main Api called is com.alibaba.fastjson.parser.ParserConfig: checkAutoType(java.lang.String,java.lang.Class,int)Ljava.lang.Class;

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 10

CVE Bug Invocation Path : 
com.github.onblog.snowjenaticketserver.monitor.MonitorController: monitor(java.lang.String)Lcom.github.onblog.snowjenaticketserver.exception.ResultEnum; .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.JSON: parseArray(java.lang.String,java.lang.Class)Ljava.util.List; .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.JSON: parseArray(java.lang.String,java.lang.Class,com.alibaba.fastjson.parser.ParserConfig)Ljava.util.List; .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.parser.DefaultJSONParser: handleResovleTask(java.lang.Object)V .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.parser.deserializer.ResolveFieldDeserializer: setValue(java.lang.Object,java.lang.Object)V .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.util.TypeUtils: cast(java.lang.Object,java.lang.reflect.Type,com.alibaba.fastjson.parser.ParserConfig)Ljava.lang.Object; .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.util.TypeUtils: cast(java.lang.Object,java.lang.Class,com.alibaba.fastjson.parser.ParserConfig)Ljava.lang.Object; .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.util.TypeUtils: castToJavaBean(java.util.Map,java.lang.Class,com.alibaba.fastjson.parser.ParserConfig)Ljava.lang.Object; .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.parser.ParserConfig: checkAutoType(java.lang.String,java.lang.Class)Ljava.lang.Class; .m2/repository/org/springframework/data/spring-data-redis/2.1.9.RELEASE/spring-data-redis-2.1.9.RELEASE.jar
com.alibaba.fastjson.parser.ParserConfig: checkAutoType(java.lang.String,java.lang.Class,int)Ljava.lang.Class;

Dependency tree--

[INFO] com.github.onblog:snowjena-ticket-server:jar:4.0.0.RELEASE
[INFO] +- com.github.onblog:snowjena-common:jar:4.0.0.RELEASE:compile
[INFO] |  +- com.alibaba:fastjson:jar:1.2.73:compile
[INFO] |  +- org.slf4j:slf4j-api:jar:1.7.26:compile
[INFO] |  \- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] |     \- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] +- com.github.onblog:snowjena-monitor:jar:4.0.0.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-data-redis:jar:2.1.6.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter:jar:2.1.6.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot:jar:2.1.6.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot-autoconfigure:jar:2.1.6.RELEASE:compile
[INFO] |  |  +- org.springframework.boot:spring-boot-starter-logging:jar:2.1.6.RELEASE:compile
[INFO] |  |  |  +- org.apache.logging.log4j:log4j-to-slf4j:jar:2.11.2:compile
[INFO] |  |  |  |  \- org.apache.logging.log4j:log4j-api:jar:2.11.2:compile
[INFO] |  |  |  \- org.slf4j:jul-to-slf4j:jar:1.7.26:compile
[INFO] |  |  +- javax.annotation:javax.annotation-api:jar:1.3.2:compile
[INFO] |  |  \- org.yaml:snakeyaml:jar:1.23:compile
[INFO] |  +- org.springframework.data:spring-data-redis:jar:2.1.9.RELEASE:compile
[INFO] |  |  +- org.springframework.data:spring-data-keyvalue:jar:2.1.9.RELEASE:compile
[INFO] |  |  |  \- org.springframework.data:spring-data-commons:jar:2.1.9.RELEASE:compile
[INFO] |  |  +- org.springframework:spring-tx:jar:5.1.8.RELEASE:compile
[INFO] |  |  +- org.springframework:spring-oxm:jar:5.1.8.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-context-support:jar:5.1.8.RELEASE:compile
[INFO] |  \- io.lettuce:lettuce-core:jar:5.1.7.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-web:jar:2.1.6.RELEASE:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-json:jar:2.1.6.RELEASE:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.9.9:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-jsr310:jar:2.9.9:compile
[INFO] |  |  \- com.fasterxml.jackson.module:jackson-module-parameter-names:jar:2.9.9:compile
[INFO] |  +- org.springframework.boot:spring-boot-starter-tomcat:jar:2.1.6.RELEASE:compile
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-core:jar:9.0.21:compile
[INFO] |  |  +- org.apache.tomcat.embed:tomcat-embed-el:jar:9.0.21:compile
[INFO] |  |  \- org.apache.tomcat.embed:tomcat-embed-websocket:jar:9.0.21:compile
[INFO] |  +- org.hibernate.validator:hibernate-validator:jar:6.0.17.Final:compile
[INFO] |  |  +- javax.validation:validation-api:jar:2.0.1.Final:compile
[INFO] |  |  +- org.jboss.logging:jboss-logging:jar:3.3.2.Final:compile
[INFO] |  |  \- com.fasterxml:classmate:jar:1.4.0:compile
[INFO] |  +- org.springframework:spring-web:jar:5.1.8.RELEASE:compile
[INFO] |  |  \- org.springframework:spring-beans:jar:5.1.8.RELEASE:compile
[INFO] |  \- org.springframework:spring-webmvc:jar:5.1.8.RELEASE:compile
[INFO] |     +- org.springframework:spring-context:jar:5.1.8.RELEASE:compile
[INFO] |     \- org.springframework:spring-expression:jar:5.1.8.RELEASE:compile
[INFO] +- org.springframework.boot:spring-boot-starter-security:jar:2.1.6.RELEASE:compile
[INFO] |  +- org.springframework:spring-aop:jar:5.1.8.RELEASE:compile
[INFO] |  +- org.springframework.security:spring-security-config:jar:5.1.5.RELEASE:compile
[INFO] |  |  \- org.springframework.security:spring-security-core:jar:5.1.5.RELEASE:compile
[INFO] |  \- org.springframework.security:spring-security-web:jar:5.1.5.RELEASE:compile
[INFO] +- redis.clients:jedis:jar:2.9.0:compile
[INFO] |  \- org.apache.commons:commons-pool2:jar:2.6.2:compile
[INFO] +- org.projectlombok:lombok:jar:1.18.6:compile
[INFO] +- org.redisson:redisson:jar:3.11.0:compile
[INFO] |  +- io.netty:netty-common:jar:4.1.36.Final:compile
[INFO] |  +- io.netty:netty-codec:jar:4.1.36.Final:compile
[INFO] |  +- io.netty:netty-buffer:jar:4.1.36.Final:compile
[INFO] |  +- io.netty:netty-transport:jar:4.1.36.Final:compile
[INFO] |  |  \- io.netty:netty-resolver:jar:4.1.36.Final:compile
[INFO] |  +- io.netty:netty-resolver-dns:jar:4.1.36.Final:compile
[INFO] |  |  \- io.netty:netty-codec-dns:jar:4.1.36.Final:compile
[INFO] |  +- io.netty:netty-handler:jar:4.1.36.Final:compile
[INFO] |  +- javax.cache:cache-api:jar:1.1.1:compile
[INFO] |  +- io.projectreactor:reactor-core:jar:3.2.10.RELEASE:compile
[INFO] |  |  \- org.reactivestreams:reactive-streams:jar:1.0.2:compile
[INFO] |  +- io.reactivex.rxjava2:rxjava:jar:2.2.9:compile
[INFO] |  +- de.ruedigermoeller:fst:jar:2.57:compile
[INFO] |  |  +- org.javassist:javassist:jar:3.21.0-GA:compile
[INFO] |  |  \- org.objenesis:objenesis:jar:2.5.1:compile
[INFO] |  +- com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:jar:2.9.9:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-core:jar:2.9.9:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.9.9:compile
[INFO] |  |  \- com.fasterxml.jackson.core:jackson-annotations:jar:2.9.0:compile
[INFO] |  +- net.bytebuddy:byte-buddy:jar:1.9.13:compile
[INFO] |  \- org.jodd:jodd-bean:jar:5.0.10:compile
[INFO] |     \- org.jodd:jodd-core:jar:5.0.10:compile
[INFO] +- org.springframework.boot:spring-boot-configuration-processor:jar:2.1.6.RELEASE:compile (optional) 
[INFO] \- org.springframework.boot:spring-boot-starter-test:jar:2.1.6.RELEASE:test
[INFO]    +- org.springframework.boot:spring-boot-test:jar:2.1.6.RELEASE:test
[INFO]    +- org.springframework.boot:spring-boot-test-autoconfigure:jar:2.1.6.RELEASE:test
[INFO]    +- com.jayway.jsonpath:json-path:jar:2.4.0:test
[INFO]    |  \- net.minidev:json-smart:jar:2.3:test
[INFO]    |     \- net.minidev:accessors-smart:jar:1.2:test
[INFO]    |        \- org.ow2.asm:asm:jar:5.0.4:test
[INFO]    +- junit:junit:jar:4.12:test
[INFO]    +- org.assertj:assertj-core:jar:3.11.1:test
[INFO]    +- org.mockito:mockito-core:jar:2.23.4:test
[INFO]    |  \- net.bytebuddy:byte-buddy-agent:jar:1.9.13:test
[INFO]    +- org.hamcrest:hamcrest-core:jar:1.3:test
[INFO]    +- org.hamcrest:hamcrest-library:jar:1.3:test
[INFO]    +- org.skyscreamer:jsonassert:jar:1.5.0:test
[INFO]    |  \- com.vaadin.external.google:android-json:jar:0.0.20131108.vaadin1:test
[INFO]    +- org.springframework:spring-core:jar:5.1.8.RELEASE:compile
[INFO]    |  \- org.springframework:spring-jcl:jar:5.1.8.RELEASE:compile
[INFO]    +- org.springframework:spring-test:jar:5.1.8.RELEASE:test
[INFO]    \- org.xmlunit:xmlunit-core:jar:2.6.2:test
[INFO]       \- javax.xml.bind:jaxb-api:jar:2.3.1:test
[INFO]          \- javax.activation:javax.activation-api:jar:1.2.0:test

Suggested solutions:

Update dependency version

Thank you very much.

@Limiter(value="limiter",fallback="sayFallback")

你这回调方法根本没有调用上

at cn.yueshutong.annotation.aspect.RateLimiterAspect.around(RateLimiterAspect.java:33)

[Bug] should decrease the batch but limit on the token server side

Regarding line 42 and 45 in TokenServiceImpl.java. I feel like we should use rateLimiterRule.getBatch() but rateLimiterRule.getLimit()

TokenServiceImpl:
//加锁 redisLock.acquire(RuleService.getLockKey(rateLimiterRule)); l = Long.parseLong(valueOperations.get(RuleService.getBucketKey(rateLimiterRule))); long result; if (l<=0){ result = 0L; }else if (l>= rateLimiterRule.getLimit()){ 42: valueOperations.decrement(RuleService.getBucketKey(rateLimiterRule), rateLimiterRule.getLimit()); result = rateLimiterRule.getLimit(); }else { 45: valueOperations.decrement(RuleService.getBucketKey(rateLimiterRule),l); result = l; } //解锁 redisLock.release(RuleService.getLockKey(rateLimiterRule)); return result; }

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.

Jobs

Jooble