Skip to content

Timecap on execution of PAC script#8036

Merged
lahodaj merged 1 commit intoapache:masterfrom
subhash-arabhi:timecap-on-pac-script
Feb 24, 2025
Merged

Timecap on execution of PAC script#8036
lahodaj merged 1 commit intoapache:masterfrom
subhash-arabhi:timecap-on-pac-script

Conversation

@subhash-arabhi
Copy link
Copy Markdown
Contributor

Issue

We need to restrict the PAC scripts with high cpu consumption that could lead to crash

Changes

Added time limit to PAC script execution.
Added a config in ProxySettings - pacScriptTimeout with default value set to 60 sec
Added tests for the same

@matthiasblaesing matthiasblaesing added the Platform [ci] enable platform tests (platform/*) label Dec 22, 2024
Copy link
Copy Markdown
Contributor

@matthiasblaesing matthiasblaesing left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In general looks sane to me, but I left two inline comments. Please squash the commits into a single one.

naming changes

few sanitations

Changed default timeout and improved code

Changes in initialisation of Request Processor
Copy link
Copy Markdown
Contributor

@lahodaj lahodaj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks reasonable to me.

@matthiasblaesing
Copy link
Copy Markdown
Contributor

@lahodaj I don't see a blocker for merging, so feel free to do so
@subhash-arabhi (or maybe @lahodaj?) I still would like to know why this construct was used:

private static final RequestProcessor RP = new RequestProcessor(NbPacScriptEvaluator.class.getName(), Runtime.getRuntime().availableProcessors(), true, false);

The common case is a thoughput of 1.

@lahodaj
Copy link
Copy Markdown
Contributor

lahodaj commented Feb 18, 2025

@lahodaj I don't see a blocker for merging, so feel free to do so @subhash-arabhi (or maybe @lahodaj?) I still would like to know why this construct was used:

private static final RequestProcessor RP = new RequestProcessor(NbPacScriptEvaluator.class.getName(), Runtime.getRuntime().availableProcessors(), true, false);

The common case is a thoughput of 1.

Throughput 1 is common, and sometimes needed for correctness, but here probably not. There may be multiple URL connections initialized concurrently at the same time, and for each of them the PAC script may need to be evaluated. Currently (before this PR), there will be as many PAC script evaluations as there are connections, but we need to put the PAC script evaluation to a separate thread, so that it can be cancelled. If we used throughput 1, it would mean the URL connections initialization would be (more or less) sequential.

It is not completely clear what is the ideal throughput, but I suspect it will turn out that there aren't so many concurrent URL connections initializations from the IDE, so the throughput does not matter so much. Overall, I suspect 1 might be too little. We could hardcode some other constant, but available processors does not look too bad. If the experience is bad, we can try to improve/fix.

Note the throughput does not mean the threads are assigned only for this RequestProcessor, it is only the maximum concurrent threads assigned for tasks from this RP. The threads are shared across all instances of RequestProcessor, so if they are not used by this RP, some other RP will use them.

@lahodaj lahodaj merged commit 4de8ce2 into apache:master Feb 24, 2025
@mbien mbien added this to the NB26 milestone Feb 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Platform [ci] enable platform tests (platform/*)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants