{"record":{"id":"1614a00e7adaa076","repo":"usebruno/bruno","slug":"the-size-argument-is-too-large","errorCode":null,"errorMessage":"The \"size\" argument is too large","messagePattern":"The \"size\" argument is too large","errorType":"validation","errorClass":"RangeError","httpStatus":null,"severity":"error","filePath":"packages/bruno-js/src/sandbox/quickjs/shims/lib/crypto-utils.js","lineNumber":25,"sourceCode":" * Implements crypto.randomBytes and crypto.getRandomValues functions\n */\nconst addCryptoUtilsShimToContext = async (vm) => {\n  let randomBytesHandle = vm.newFunction('randomBytes', function (sizeHandle) {\n    try {\n      let size = vm.dump(sizeHandle);\n\n      if (typeof size !== 'number') {\n        throw new TypeError('The \"size\" argument must be of type number');\n      }\n\n      size = Math.trunc(size);\n\n      if (size < 0) {\n        throw new RangeError('The \"size\" argument must be >= 0');\n      }\n\n      if (size > 65536) { // 2^31 - 1 (max safe integer for practical use)\n        throw new RangeError('The \"size\" argument is too large');\n      }\n\n      if (size === 0) {\n        return marshallToVm([], vm);\n      }\n\n      const buffer = crypto.randomBytes(size);\n\n      const byteArray = Array.from(buffer);\n\n      return marshallToVm(byteArray, vm);\n    } catch (error) {\n      const vmError = vm.newError(error.message);\n      vm.setProp(vmError, 'name', vm.newString(error.name));\n\n      throw vmError;\n    }\n  });","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/usebruno/bruno/blob/9bdd81c7bdc57006e5f5ebffb79321a8d979f712/packages/bruno-js/src/sandbox/quickjs/shims/lib/crypto-utils.js#L7-L43","documentation":"Thrown by the QuickJS sandbox crypto shim for crypto.randomBytes when `size` exceeds 65536. The cap protects the sandbox host from a single oversized allocation; it mirrors the kind of guard Node applies to random byte generation. The comment in source labels 65536 as a practical safe ceiling.","triggerScenarios":"Passing a large literal (e.g. crypto.randomBytes(100000)) or a computed size that grows unbounded (e.g. derived from a response payload length).","commonSituations":"Generating a one-time pad or test blob with an unreasonably large size; size read from an untrusted input without an upper bound; unit confusion (KB vs bytes).","solutions":["Lower the requested size to <= 65536 bytes.","If a larger buffer is genuinely needed, accumulate across multiple randomBytes calls in a loop.","Cap untrusted input: `const n = Math.min(requested, 65536)`."],"exampleFix":"// before\ncrypto.randomBytes(200000); // too large\n\n// after — chunk if you truly need more\nfunction bigRandom(total) {\n  const out = [];\n  for (let i = 0; i < total; i += 65536) {\n    out.push(...crypto.randomBytes(Math.min(65536, total - i)));\n  }\n  return out;\n}","handlingStrategy":"validation","validationCode":"const MAX = 65536;\nfunction safeRandomBytes(size) {\n  const n = Math.trunc(Number(size));\n  if (n > MAX) throw new RangeError('size too large');\n  return crypto.randomBytes(n);\n}","typeGuard":"const isWithinCap = (v) => Number.isInteger(v) && v >= 0 && v <= 65536;","tryCatchPattern":"try { crypto.randomBytes(n); }\ncatch (err) {\n  if (/too large/.test(err.message)) { crypto.randomBytes(Math.min(65536, n)); }\n  else throw err;\n}","preventionTips":["Cap untrusted size inputs to <= 65536.","Chunk very large requests across multiple calls."],"tags":["bruno-js","quickjs","sandbox","crypto","validation","range"],"backgroundTag":null,"analyzedSha":"9bdd81c7bdc57006e5f5ebffb79321a8d979f712","analyzedAt":"2026-08-13T04:09:25.751Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}