What causes "download xray: archive exceeds %d bytes" in MHSanaei/3x-ui?

curl -sIL the asset URL and inspect Content-Length

download xray: archive exceeds %d bytes

Error message

download xray: archive exceeds %d bytes

What it means

Returned by downloadXRay when the response's declared Content-Length exceeds maxXrayArchiveBytes (200 MiB), before any body is read. It is a pre-flight guard against absurdly large (or malicious) responses. Xray release zips are ~10-25 MiB, so a declared size over 200 MiB means the URL returned the wrong content — usually a proxy error page with a huge declared length or a redirect glitch.

Source

Thrown at internal/web/service/server.go:898

	}

	fileName := fmt.Sprintf("Xray-%s-%s.zip", osName, arch)
	url := fmt.Sprintf("https://github.com/XTLS/Xray-core/releases/download/%s/%s", version, fileName)
	client := s.settingService.NewProxiedHTTPClient(60 * time.Second)
	req, reqErr := http.NewRequestWithContext(context.Background(), http.MethodGet, url, nil)
	if reqErr != nil {
		return "", reqErr
	}
	resp, err := client.Do(req)
	if err != nil {
		return "", err
	}
	defer resp.Body.Close()
	if resp.StatusCode != http.StatusOK {
		return "", fmt.Errorf("download xray: unexpected HTTP %d", resp.StatusCode)
	}
	if resp.ContentLength > maxXrayArchiveBytes {
		return "", fmt.Errorf("download xray: archive exceeds %d bytes", maxXrayArchiveBytes)
	}

	file, err := os.CreateTemp("", "xray-*.zip")
	if err != nil {
		return "", err
	}
	path := file.Name()
	ok := false
	defer func() {
		_ = file.Close()
		if !ok {
			_ = os.Remove(path)
		}
	}()

	n, err := io.Copy(file, io.LimitReader(resp.Body, maxXrayArchiveBytes+1))
	if err != nil {
		return "", err

View on GitHub (pinned to ad32144c42)

Solutions

curl -sIL the asset URL and inspect Content-Length
Bypass or repair the outbound proxy and retry the update
If Xray archives genuinely exceed 200 MiB someday, raise maxXrayArchiveBytes in internal/web/service/server.go and rebuild

Defensive patterns

Strategy: validation

Validate before calling

if resp.ContentLength > 0 && resp.ContentLength > maxXrayArchiveBytes {
    return fmt.Errorf("declared size %d exceeds cap; likely wrong content at URL", resp.ContentLength)
}

Prevention

Check declared Content-Length against a sane cap before reading bodies
Validate that download URLs return the expected binary Content-Type
Keep size caps reviewed when upstream artifact sizes legitimately grow

When it happens

Trigger: Server declares Content-Length > 209715200 for the asset URL; GitHub serves an error artifact; a filtering proxy announces a giant body.

Common situations: Proxy/CDN interception of the download URL; a corrupted release upstream; extremely rare — only fires on declared length, not actual bytes.

Related errors

AI-assisted analysis of MHSanaei/3x-ui@ad32144c42 (2026-08-15). Data as JSON: /api/errors/aa7efd5b34f39300. Report an issue: GitHub.