apache/shenyu · error · IllegalArgumentException

entry count exceeds maximum of " + maxEntryCount

Error message

entry count exceeds maximum of " + maxEntryCount

What it means

ZipUtil.unzip throws this IllegalArgumentException when the archive contains more file entries than the configured maxEntryCount. This is a zip-bomb / resource-exhaustion guard: it caps the number of files extracted from an untrusted or oversized archive.

Solutions

1. Reduce the number of files in the archive — exclude unneeded directories before zipping.
2. If the limit is too low for legitimate uploads, raise the maxEntryCount parameter when calling unzip.
3. Verify the archive contents with `unzip -l file.zip` to count entries first.

Example fix

// before
ZipUtil.unzip(inputStream, 10, maxEntrySize, maxTotalSize);
// after
ZipUtil.unzip(inputStream, 1000, maxEntrySize, maxTotalSize); // sized to actual bundle

int entryCount;
try (ZipFile zf = new ZipFile(zipFile)) {
    entryCount = (int) zf.stream().filter(e -> !e.isDirectory()).count();
}
if (entryCount > maxEntryCount) {
    throw new IllegalArgumentException("zip has " + entryCount + " entries, limit " + maxEntryCount);
}

try {
    ZipUtil.unzip(in, maxEntryCount, maxEntrySize, maxTotalSize);
} catch (IllegalArgumentException e) {
    if (e.getMessage().startsWith("entry count exceeds")) {
        log.error("Upload rejected: too many files in archive");
    }
}

When it happens

Trigger: Unzipping an archive whose non-directory entry count exceeds maxEntryCount, e.g. uploading a zip with thousands of files where the limit is a small value.

Common situations: Uploading plugin/config bundles to admin that contain more files than allowed; accidentally zipping a directory tree (node_modules, .git) into an upload.

Understand the failure class

Background: "File too large" / "file size exceeds limit" errors: why libraries cap file sizes and how to fix them — this error's family across 46 libraries.

Related errors

• entry size exceeds maximum allowed value.
• total size exceeds maximum allowed value.
• Access to localhost is not allowed
• Access to private or internal IP addresses is not allowed
• Access to sensitive ports is not allowed

AI-assisted analysis of apache/shenyu@567142e072 (2026-09-12). Data as JSON: /api/errors/3ebdc91a990e70f3. Report an issue: GitHub.

Appendix: source

Thrown at shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java:111

     * @param maxEntrySize max entry size
     * @param maxTotalSize max total size
     * @param maxEntryCount max entry count
     * @return unzip result
     */
    public static UnZipResult unzip(final byte[] source, final long maxEntrySize,
                                    final long maxTotalSize, final int maxEntryCount) {
        List<ZipItem> itemList = Lists.newArrayList();
        long totalSize = 0L;
        int entryCount = 0;
        try (ZipInputStream zipIn = new ZipInputStream(new ByteArrayInputStream(source))) {
            ZipEntry entry;
            while (Objects.nonNull(entry = zipIn.getNextEntry())) {
                if (entry.isDirectory()) {
                    continue;
                }
                entryCount++;
                if (entryCount > maxEntryCount) {
                    throw new IllegalArgumentException("entry count exceeds maximum of " + maxEntryCount);
                }
                try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {
                    byte[] buffer = new byte[1024];
                    int offset;
                    long entrySize = 0L;
                    while ((offset = zipIn.read(buffer)) != -1) {
                        entrySize += offset;
                        totalSize += offset;
                        if (entrySize > maxEntrySize) {
                            throw new IllegalArgumentException("entry size exceeds maximum allowed value.");
                        }
                        if (totalSize > maxTotalSize) {
                            throw new IllegalArgumentException("total size exceeds maximum allowed value.");
                        }
                        out.write(buffer, 0, offset);
                    }
                    String entryName = entry.getName();
                    itemList.add(new ZipItem(entryName, out.toString(StandardCharsets.UTF_8)));

View on GitHub (pinned to 567142e072)