Lack of query limits on review search can bring an instance down

Issue Summary

Selecting a large number of code reviews can put an instance under heavy load. Currently API does not provide paging or does not truncate results.

This happens in case REST API is used, such as:

• /rest-service/reviews-v1/details?state=<value> (e.g. closed)
• /rest-service/reviews-v1/filter/<filter> (e.g. 'allReviews')

or when RSS XML feed is called for a search result, such as:

• /cru/rssReviewFilter?<query parameters>

or when Java API is used, such as:

• com.cenqua.crucible.model.managers.ReviewManager#getReviews with details=true
• com.atlassian.crucible.spi.services.ReviewService#getCustomFilterReviews with details=true and too wide filter
• com.atlassian.crucible.spi.services.ReviewService#getFilteredReviews with details=true and too wide filter

The above can be identified by browsing access logs (you have to enable access logging first).

Primary symptom:

• logs contain a warning like:

2020-01-29 05:13:51,493 INFO [qtp1267105885-991957 ] fisheye DefaultReviewManager-getReviewsByIds - Requesting more than 500 reviews may have a negative impact on performance and memory usage of Crucible. 21509 reviews selected.

Additional symptoms:

• high heap consumption and heavy GC activity
• a number of web threads (qtp-*) running for a long time (minutes), thread dumps showing DefaultReviewManager in the stack trace
• instance becoming unresponsive
• OutOfMemoryError

Steps to Reproduce

Load significantly more than 500 code reviews using REST API or RSS feed (an exact number depends on size of your instance)

Expected Results

An instance limits number of results.

Actual Results

The below exception is thrown in the atlassian-fisheye-YYYY-MM-DD.log file:

DefaultReviewManager-getReviewsByIds - Requesting more than 500 reviews may have a negative impact on performance and memory usage of Crucible. NNNN reviews selected.

Workaround

Identify source of these queries (e.g. user's RSS feeds, automated scripts using REST API) and refine the queries used.

Install the following Byteman script. It will truncate results to 500 items.

• script: reviewmanager-getmatchingreviewids-limit.btm
• instruction: https://confluence.atlassian.com/fishkb/enable-byteman-for-additional-logging-in-fisheye-and-crucible-943956769.html