Skip to content

Reject malformed numeric Retry-After values - #9019

Open
Dhruvraj-Rana wants to merge 2 commits into
open-telemetry:mainfrom
Dhruvraj-Rana:fix/retry-after-delay-seconds
Open

Dhruvraj-Rana wants to merge 2 commits into
open-telemetry:mainfrom
Dhruvraj-Rana:fix/retry-after-delay-seconds

Conversation

@Dhruvraj-Rana

Copy link
Copy Markdown

Fixes #9018.

RetryUtil currently uses Long.parseLong for Retry-After delay-seconds, which also accepts a leading sign and non-ASCII digits. Consequently, headers such as +30 and -0 override the normal retry backoff despite being malformed under RFC 9110 section 10.2.3, where delay-seconds is 1*DIGIT.

Validate that a parsed numeric value contains only ASCII digits before using it as a delay. Malformed numeric values return an empty OptionalLong, allowing the existing retry policy to apply. Valid zero and leading-zero values remain supported, and the HTTP-date parsing path is unchanged.

The parameterized tests cover positive signs, negative zero, non-ASCII digits, empty input, zero, and leading zeros alongside the existing seconds and date cases.

Validation on Java 25:

  • Added regression cases fail on the original implementation (3 failures out of 12 cases).
  • All 12 parser cases pass with the fix.
  • ./gradlew :exporters:common:spotlessApply :exporters:common:check passes: 105 tests across the main, sender-provider, and without-Unsafe suites, with no failures or skips. Checkstyle, Spotless, Animal Sniffer, and jApiCmp pass.
  • git diff --check passes. No generated API diff files changed.

The full repository and CI platform/JDK matrix were not run; validation is scoped to the affected module.

@Dhruvraj-Rana
Dhruvraj-Rana requested a review from a team as a code owner November 8, 2026 06:33
@linux-foundation-easycla

linux-foundation-easycla Bot commented Nov 8, 2026 •

Copy link
Copy Markdown

CLA Signed
The committers listed above are authorized under a signed CLA.

  • ✅ login: Dhruvraj-Rana / name: Dhruvraj Rana (5e9c8e6)

@opentelemetry-pr-dashboard

opentelemetry-pr-dashboard Bot commented Nov 8, 2026 •

Copy link
Copy Markdown

Pull request dashboard status

Waiting on reviewers · refreshed 2026-11-08 08:39 UTC

Review the latest changes.

Status above doesn't look right?
  • Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
  • Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

@codecov

codecov Bot commented Nov 8, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.37%. Comparing base (f02bddc) to head (b3f0e0a).

Additional details and impacted files
@@             Coverage Diff              @@
##               main    #9019      +/-   ##
============================================
+ Coverage     90.35%   90.37%   +0.02%     
- Complexity    11017    11021       +4     
============================================
  Files          1021     1021              
  Lines         30128    30130       +2     
  Branches       3933     3934       +1     
============================================
+ Hits          27221    27230       +9     
+ Misses         1953     1941      -12     
- Partials        954      959       +5     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Retry-After parser accepts invalid delay-seconds values

1 participant