{"record":{"id":"49a6b1d2092fc675","repo":"theonedev/onedev","slug":"package-metadata-exceeds-maximum-size","errorCode":null,"errorMessage":"Package metadata exceeds maximum size: ","messagePattern":"Package metadata exceeds maximum size: ","errorType":"http","errorClass":"ClientException","httpStatus":406,"severity":"error","filePath":"server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java","lineNumber":318,"sourceCode":"\t\t\tdep.put(\"optional\", publishDep.path(\"optional\").asBoolean(false));\n\t\t\tdep.put(\"default_features\", publishDep.path(\"default_features\").asBoolean(true));\n\t\t\tdep.set(\"target\", publishDep.path(\"target\"));\n\t\t\tdep.put(\"kind\", publishDep.path(\"kind\").asText(\"normal\"));\n\t\t\tdep.set(\"registry\", publishDep.path(\"registry\"));\n\t\t\tif (!explicitName.isMissingNode() && !explicitName.isNull())\n\t\t\t\tdep.put(\"package\", publishDep.path(\"name\").asText());\n\t\t\telse\n\t\t\t\tdep.putNull(\"package\");\n\t\t\tindexDeps.add(dep);\n\t\t}\n\t\treturn indexDeps;\n\t}\n\n\tprivate PublishBody readPublishBody(HttpServletRequest request) {\n\t\ttry (var is = request.getInputStream()) {\n\t\t\tvar metadataLength = readIntLE(is);\n\t\t\tif (metadataLength < 0 || metadataLength > MAX_METADATA_SIZE)\n\t\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Package metadata exceeds maximum size: \" + MAX_METADATA_SIZE);\n\t\t\tvar metadata = readBytes(is, metadataLength);\n\t\t\tvar crateLength = readIntLE(is);\n\t\t\tif (crateLength < 0 || crateLength > MAX_CRATE_SIZE)\n\t\t\t\tthrow new ClientException(SC_NOT_ACCEPTABLE, \"Crate archive exceeds maximum size: \" + MAX_CRATE_SIZE);\n\t\t\tvar crateFile = readBytes(is, crateLength);\n\t\t\treturn new PublishBody(metadata, crateFile);\n\t\t} catch (IOException e) {\n\t\t\tthrow new RuntimeException(e);\n\t\t}\n\t}\n\n\tprivate int readIntLE(InputStream is) throws IOException {\n\t\tvar b1 = is.read();\n\t\tvar b2 = is.read();\n\t\tvar b3 = is.read();\n\t\tvar b4 = is.read();\n\t\tif ((b1 | b2 | b3 | b4) < 0)\n\t\t\tthrow new EOFException();","sourceCodeStart":300,"sourceCodeEnd":336,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-cargo/src/main/java/io/onedev/server/plugin/pack/cargo/CargoPackHandler.java#L300-L336","documentation":"Thrown by CargoPackHandler.readPublishBody when the metadata section length (read as little-endian int from the publish request body) is negative or exceeds MAX_METADATA_SIZE. The server rejects oversized publish payloads with HTTP 406 before reading them. This guards against unbounded memory use from hostile or malformed cargo publish requests.","triggerScenarios":"Running `cargo publish` against the OneDev registry with a crate whose compressed metadata JSON exceeds MAX_METADATA_SIZE, or a malformed/custom client sending a bogus length prefix.","commonSituations":"Very large crate manifests with hundreds of dependencies/features; non-cargo scripts posting to the publish endpoint with hand-crafted bodies; misremembered endpoint protocol versions.","solutions":["Reduce the metadata size (trim dependencies, features, or description in Cargo.toml)","Increase MAX_METADATA_SIZE in CargoPackHandler if large metadata is legitimate for your setup","Ensure the cargo client is using the sparse/standard publish protocol compatible with this registry","Check for a proxy that is mangling the request body framing"],"exampleFix":"// before\n[package]\ndescription = \"...very long text...\"\n// after: shorten metadata or raise limit in CargoPackHandler\nprivate static final int MAX_METADATA_SIZE = 1024 * 1024;","handlingStrategy":"validation","validationCode":"const fs = require('fs');\nconst size = fs.statSync('target/package/<crate>.crate').size;\n// metadata is a small JSON section; if publish fails with size error, inspect Cargo.toml bloat\nif (process.env.VERBOSE) console.log('crate size:', size);","typeGuard":null,"tryCatchPattern":"try { execSync('cargo publish'); } catch (e) { if (/metadata exceeds maximum size/.test(e.message)) { /* trim Cargo.toml metadata */ } }","preventionTips":["Keep [package] description/keywords concise","Trim dependency feature lists","Test with `cargo package --list` before publishing"],"tags":["cargo","publish","payload-size","limit"],"backgroundTag":"payload-too-large","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}