{"record":{"id":"3ebdc91a990e70f3","repo":"apache/shenyu","slug":"entry-count-exceeds-maximum-of-maxentrycount","errorCode":null,"errorMessage":"entry count exceeds maximum of \" + maxEntryCount","messagePattern":"entry count exceeds maximum of \" \\+ maxEntryCount","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java","lineNumber":111,"sourceCode":"     * @param maxEntrySize max entry size\n     * @param maxTotalSize max total size\n     * @param maxEntryCount max entry count\n     * @return unzip result\n     */\n    public static UnZipResult unzip(final byte[] source, final long maxEntrySize,\n                                    final long maxTotalSize, final int maxEntryCount) {\n        List<ZipItem> itemList = Lists.newArrayList();\n        long totalSize = 0L;\n        int entryCount = 0;\n        try (ZipInputStream zipIn = new ZipInputStream(new ByteArrayInputStream(source))) {\n            ZipEntry entry;\n            while (Objects.nonNull(entry = zipIn.getNextEntry())) {\n                if (entry.isDirectory()) {\n                    continue;\n                }\n                entryCount++;\n                if (entryCount > maxEntryCount) {\n                    throw new IllegalArgumentException(\"entry count exceeds maximum of \" + maxEntryCount);\n                }\n                try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {\n                    byte[] buffer = new byte[1024];\n                    int offset;\n                    long entrySize = 0L;\n                    while ((offset = zipIn.read(buffer)) != -1) {\n                        entrySize += offset;\n                        totalSize += offset;\n                        if (entrySize > maxEntrySize) {\n                            throw new IllegalArgumentException(\"entry size exceeds maximum allowed value.\");\n                        }\n                        if (totalSize > maxTotalSize) {\n                            throw new IllegalArgumentException(\"total size exceeds maximum allowed value.\");\n                        }\n                        out.write(buffer, 0, offset);\n                    }\n                    String entryName = entry.getName();\n                    itemList.add(new ZipItem(entryName, out.toString(StandardCharsets.UTF_8)));","sourceCodeStart":93,"sourceCodeEnd":129,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java#L93-L129","documentation":"ZipUtil.unzip throws this IllegalArgumentException when the archive contains more file entries than the configured maxEntryCount. This is a zip-bomb / resource-exhaustion guard: it caps the number of files extracted from an untrusted or oversized archive.","triggerScenarios":"Unzipping an archive whose non-directory entry count exceeds maxEntryCount, e.g. uploading a zip with thousands of files where the limit is a small value.","commonSituations":"Uploading plugin/config bundles to admin that contain more files than allowed; accidentally zipping a directory tree (node_modules, .git) into an upload.","solutions":["Reduce the number of files in the archive — exclude unneeded directories before zipping.","If the limit is too low for legitimate uploads, raise the maxEntryCount parameter when calling unzip.","Verify the archive contents with `unzip -l file.zip` to count entries first."],"exampleFix":"// before\nZipUtil.unzip(inputStream, 10, maxEntrySize, maxTotalSize);\n// after\nZipUtil.unzip(inputStream, 1000, maxEntrySize, maxTotalSize); // sized to actual bundle","handlingStrategy":"validation","validationCode":"int entryCount;\ntry (ZipFile zf = new ZipFile(zipFile)) {\n    entryCount = (int) zf.stream().filter(e -> !e.isDirectory()).count();\n}\nif (entryCount > maxEntryCount) {\n    throw new IllegalArgumentException(\"zip has \" + entryCount + \" entries, limit \" + maxEntryCount);\n}","typeGuard":null,"tryCatchPattern":"try {\n    ZipUtil.unzip(in, maxEntryCount, maxEntrySize, maxTotalSize);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().startsWith(\"entry count exceeds\")) {\n        log.error(\"Upload rejected: too many files in archive\");\n    }\n}","preventionTips":["Exclude generated directories (.git, node_modules, target) before zipping bundles.","Pre-count archive entries with unzip -l before uploading.","Size maxEntryCount to your real bundle shape, with headroom."],"tags":["zip","resource-limit","security","upload"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}