API响应时间阈值

[dogourd]

fb64e2d2: fix: api fallback
GraphBuilder 中静态的 URL 和 URI 似乎是线程不安全的，URL 看起来会作为后续请求是否有必要对HttpServletRequest及HttpServletResponse对象包装的依据，是我没发现对应的同步代码？

[lostsnow]

There is no relationship between URL/URI in GraphBuilder and HttpServletRequest/HttpServletResponse, only when the circuit breaker will be used to, the circuit breaker will be re-implemented and will not use this again

[dogourd]

What you said doesn't seem to match the code. Look at here:
io.dongtai.iast.core.handler.hookpoint.SpyDispatcherImpl#leaveHttp

if (EngineManager.SCOPE_TRACKER.isExitedHttp() && EngineManager.isEnterHttp()) {
                    EngineManager.maintainRequestCount();
                    GraphBuilder.buildAndReport(request, response);
                    EngineManager.cleanThreadState();
                    long responseTimeEnd = System.currentTimeMillis()-responseTime.get()+8;
                    DongTaiLog.debug("url {} response time: {} ms",GraphBuilder.getURL(),responseTimeEnd);
                    if (RemoteConfigUtils.enableAutoFallback() && responseTimeEnd > RemoteConfigUtils.getApiResponseTime(null)){
                        RemoteConfigUtils.fallbackReqCount++;
                        DongTaiLog.warn("url {} response time: {} ms, greater than {} ms",GraphBuilder.getURL(),responseTimeEnd,RemoteConfigUtils.getApiResponseTime(null));
                        if (!"/".equals(GraphBuilder.getURL())){
                            ConfigMatcher.getInstance().FALLBACK_URL.add(GraphBuilder.getURI());
                        }
                    }
                }

The URI is added to FALLBACK_URL by ConfigMatcher.getInstance().FALLBACK_URL.add(GraphBuilder.getURI());. Then look at the HttpImpl class.

public static Object cloneResponse(Object response, boolean isJakarta) {
        try {
            if (response == null) {
                return null;
            }
            if (ConfigMatcher.getInstance().disableExtension((String) REQUEST_META.get().get("requestURI"))) {
                return response;
            }
            if (ConfigMatcher.getInstance().getBlackUrl(REQUEST_META.get())) {
                return response;
            }
            if (cloneResponseMethod == null) {
                loadCloneResponseMethod();
            }
            return cloneResponseMethod.invoke(null, response, isJakarta);
        } catch (IllegalAccessException e) {
            return response;
        } catch (InvocationTargetException e) {
            return response;
        } finally {
            REQUEST_META.remove();
        }
    }

if (ConfigMatcher.getInstance().getBlackUrl(REQUEST_META.get())) { return response; }
The preceding FALLBACK URL is used to determine if the response object needs to be wrapped.
Some http responses may miss wrapping if there are concurrency issues causing unexpected urls to be added to the set.

[dogourd]

My fault, it's no big deal if some packaging is missed

[lostsnow]

As mentioned above, this is only used for circuit breaker, for skipping some requests with long response times, affecting at most a fraction of the requests collected, and may replace this dynamic blacklist in the future by remote configuration