{"record":{"id":"1a669e861d1a0934","repo":"spring-projects/spring-ai","slug":"media-url-response-exceeds-maximum-allowed-size-of","errorCode":null,"errorMessage":"Media URL response exceeds maximum allowed size of  bytes: ","messagePattern":"Media URL response exceeds maximum allowed size of  bytes: ","errorType":"exception","errorClass":"java.lang.SecurityException","httpStatus":null,"severity":"error","filePath":"models/spring-ai-bedrock-converse/src/main/java/org/springframework/ai/bedrock/converse/api/MediaFetcher.java","lineNumber":154,"sourceCode":"\t * @param uri the URI to fetch\n\t * @return the response body as a byte array\n\t * @throws SecurityException if the response exceeds\n\t * {@link #DEFAULT_MAX_FETCH_SIZE_BYTES} or the host resolves to a blocked internal\n\t * address\n\t * @throws org.springframework.web.client.RestClientException on HTTP or I/O errors\n\t */\n\tpublic byte[] fetch(URI uri) {\n\t\tif (!this.allowedHosts.isEmpty()) {\n\t\t\tString host = uri.getHost();\n\t\t\tif (!isHostAllowed(host)) {\n\t\t\t\tthrow new SecurityException(\"Host '\" + host\n\t\t\t\t\t\t+ \"' is not in the allowed hosts list. Configure MediaFetcher with the appropriate allowed hosts.\");\n\t\t\t}\n\t\t}\n\t\treturn this.restClient.get().uri(uri).exchange((request, response) -> {\n\t\t\tlong contentLength = response.getHeaders().getContentLength();\n\t\t\tif (contentLength > DEFAULT_MAX_FETCH_SIZE_BYTES) {\n\t\t\t\tthrow new SecurityException(\"Media URL response exceeds maximum allowed size of \"\n\t\t\t\t\t\t+ DEFAULT_MAX_FETCH_SIZE_BYTES + \" bytes: \" + uri);\n\t\t\t}\n\t\t\ttry (InputStream body = response.getBody()) {\n\t\t\t\treturn readWithSizeLimit(body, DEFAULT_MAX_FETCH_SIZE_BYTES);\n\t\t\t}\n\t\t}, true);\n\t}\n\n\t/**\n\t * Returns {@code true} if {@code host} is permitted by the allowlist. An entry that\n\t * starts with {@code *.} is treated as a suffix wildcard matching any subdomain (e.g.\n\t * {@code *.example.com} matches {@code img.example.com} but not {@code example.com}\n\t * itself).\n\t */\n\tprivate boolean isHostAllowed(String host) {\n\t\tif (host == null) {\n\t\t\treturn false;\n\t\t}","sourceCodeStart":136,"sourceCodeEnd":172,"githubUrl":"https://github.com/spring-projects/spring-ai/blob/98a7beda4f29d80a71c5837eb4053b03a93a46f7/models/spring-ai-bedrock-converse/src/main/java/org/springframework/ai/bedrock/converse/api/MediaFetcher.java#L136-L172","documentation":"MediaFetcher.fetch() checks the HTTP Content-Length header before reading the body and throws SecurityException if it exceeds DEFAULT_MAX_FETCH_SIZE_BYTES, protecting against downloading oversized media. A size limit is also enforced while streaming the body via readWithSizeLimit, guarding responses that lie about or omit Content-Length.","triggerScenarios":"Fetching a media URI whose response declares Content-Length greater than the configured max fetch size, or whose streamed body exceeds the limit while being read.","commonSituations":"Pointing a media URL at a large video or archive file; a server serving a much larger file than expected; proxies that ignore range/size expectations.","solutions":["Reduce the media size or serve a compressed/smaller rendition.","Increase the fetcher's max size limit if legitimate large media is expected.","Ensure the URL points to the specific media asset, not a generic download.","Pre-check size via a HEAD request if the caller wants to fail earlier."],"exampleFix":"// before\nbyte[] data = mediaFetcher.fetch(new URI(\"https://cdn.example.com/huge-video.mp4\")); // 200MB\n// after\nbyte[] data = mediaFetcher.fetch(new URI(\"https://cdn.example.com/clip-5mb.mp4\"));","handlingStrategy":"try-catch","validationCode":"try (Response head = restClient.head()) {\n    // check HEAD content-length against configured max before fetching\n}","typeGuard":null,"tryCatchPattern":"try {\n    byte[] data = mediaFetcher.fetch(uri);\n} catch (SecurityException e) {\n    // oversized media: request a smaller rendition or skip\n} catch (org.springframework.web.client.RestClientException e) {\n    // HTTP/IO failure during streaming\n}","preventionTips":["Serve media under the configured size limit","Point URLs at specific compressed assets, not bulk files","Raise the max fetch size deliberately if large media is expected","Pre-screen sizes with HEAD requests for large assets"],"tags":["security","size-limit","payload","network","bedrock"],"backgroundTag":"payload-too-large","analyzedSha":"98a7beda4f29d80a71c5837eb4053b03a93a46f7","analyzedAt":"2026-09-11T14:15:49.441Z","contentChangedAt":"2026-09-11T14:15:49.441Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}