{"record":{"id":"25c16683f7d6f63c","repo":"apache/shenyu","slug":"response-body-exceeds-maximum-size-of-d-bytes","errorCode":null,"errorMessage":"Response body exceeds maximum size of %d bytes","messagePattern":"Response body exceeds maximum size of (.+?) bytes","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"warning","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/HttpUtils.java","lineNumber":485,"sourceCode":"     * Read response body with a size limit to prevent excessive memory usage.\n     *\n     * @param responseBody the response body to read\n     * @param maxBodySize  maximum allowed body size in bytes\n     * @return the response body as a string\n     * @throws IOException              if an I/O error occurs\n     * @throws IllegalArgumentException if the body exceeds maxBodySize\n     */\n    public static String readLimitedResponseBody(final ResponseBody responseBody, final long maxBodySize) throws IOException {\n        if (Objects.isNull(responseBody)) {\n            throw new IllegalArgumentException(\"Response body is empty\");\n        }\n        if (maxBodySize < 0) {\n            throw new IllegalArgumentException(\"Max response body size must not be negative\");\n        }\n\n        long contentLength = responseBody.contentLength();\n        if (contentLength > maxBodySize) {\n            throw new IllegalArgumentException(String.format(\n                    \"Response body exceeds maximum size of %d bytes\", maxBodySize));\n        }\n\n        ByteArrayOutputStream outputStream = contentLength > 0\n                ? new ByteArrayOutputStream((int) Math.min(contentLength, Integer.MAX_VALUE))\n                : new ByteArrayOutputStream();\n        byte[] buffer = new byte[READ_BUFFER_SIZE];\n        long totalBytes = 0;\n        try (InputStream inputStream = responseBody.byteStream()) {\n            int bytesRead;\n            while ((bytesRead = inputStream.read(buffer)) != -1) {\n                totalBytes += bytesRead;\n                if (totalBytes > maxBodySize) {\n                    throw new IllegalArgumentException(String.format(\n                            \"Response body exceeds maximum size of %d bytes\", maxBodySize));\n                }\n                outputStream.write(buffer, 0, bytesRead);\n            }","sourceCodeStart":467,"sourceCodeEnd":503,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/HttpUtils.java#L467-L503","documentation":"HttpUtils.readLimitedResponseBody guards against consuming an unbounded HTTP response body. Before streaming the body it checks the Content-Length header reported by the OkHttp response and throws IllegalArgumentException if it already exceeds maxBodySize. This is a pre-read fast-fail so an oversized payload is never buffered into memory.","triggerScenarios":"Calling readLimitedResponseBody with a responseBody whose contentLength() is greater than the maxBodySize argument passed in; e.g. an admin-side HTTP request against a backend that returns a multi-megabyte body while maxBodySize is a few KB.","commonSituations":"Configuring a small response size limit for health checks or metadata fetches in shenyu-admin, then pointing the request at an endpoint that returns a large JSON/XML document or an unexpected binary file (e.g. hitting a file download URL instead of an API).","solutions":["Increase the maxBodySize argument passed to the HTTP call to a value that accommodates the real response size.","Check what URL is being requested — a misrouted or wrong endpoint may return a large static file instead of the expected small API response.","If the backend legitimately returns huge bodies, stream/process them directly instead of using the limited reader.","Catch IllegalArgumentException around the call and surface a clear 'response too large' message to the caller."],"exampleFix":"// before\nHttpUtils.readLimitedResponseBody(response, 1024); // fails on large responses\n// after\nHttpUtils.readLimitedResponseBody(response, 10 * 1024 * 1024); // 10 MB cap","handlingStrategy":"try-catch","validationCode":"Response resp = client.newCall(request).execute();\nlong len = resp.body() != null ? resp.body().contentLength() : -1;\nif (len > MAX_BODY_SIZE) { throw new IllegalStateException(\"Response too large: \" + len); }","typeGuard":null,"tryCatchPattern":"try {\n    byte[] body = HttpUtils.readLimitedResponseBody(response, maxBodySize);\n} catch (IllegalArgumentException e) {\n    log.warn(\"Response exceeded {} bytes limit\", maxBodySize, e);\n    return fallbackResult();\n}","preventionTips":["Set maxBodySize generously but bounded (e.g. 1-10 MB) based on the largest legitimate response.","Confirm the URL points to an API endpoint, not a static/download resource.","Prefer endpoints that report Content-Length so the check fails before reading.","Monitor for this exception; repeated hits usually mean a misconfigured target."],"tags":["http","response-body","size-limit","okhttp"],"backgroundTag":"payload-too-large","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}