{"record":{"id":"50e76d39ac5f4158","repo":"jdx/mise","slug":"registry-archive-contains-too-many-entries","errorCode":null,"errorMessage":"registry archive contains too many entries","messagePattern":"registry archive contains too many entries","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/registry.rs","lineNumber":372,"sourceCode":"            .to_string();\n        let mut source = String::new();\n        entry.read_to_string(&mut source)?;\n        sources.insert(short, source);\n    }\n\n    ensure!(\n        !sources.is_empty(),\n        \"archive does not contain registry entries\"\n    );\n    registry_from_sources(sources)\n}\n\nfn track_registry_archive_entry(\n    index: usize,\n    entry_size: u64,\n    archive_size: &mut u64,\n) -> Result<()> {\n    ensure!(\n        index < MAX_REGISTRY_ARCHIVE_ENTRIES,\n        \"registry archive contains too many entries\"\n    );\n    ensure!(\n        entry_size <= MAX_REGISTRY_ARCHIVE_ENTRY_SIZE,\n        \"registry archive entry is too large\"\n    );\n    *archive_size = archive_size\n        .checked_add(entry_size)\n        .ok_or_else(|| eyre::eyre!(\"registry archive size overflow\"))?;\n    ensure!(\n        *archive_size <= MAX_REGISTRY_ARCHIVE_SIZE,\n        \"registry archive is too large\"\n    );\n    Ok(())\n}\n\nfn registry_from_sources(sources: BTreeMap<String, String>) -> Result<Registry> {","sourceCodeStart":354,"sourceCodeEnd":390,"githubUrl":"https://github.com/jdx/mise/blob/afd2eddd3a50c16190efc1c7e94404b48f72af57/src/registry.rs#L354-L390","documentation":"When parsing a registry archive, mise counts entries and enforces MAX_REGISTRY_ARCHIVE_ENTRIES. This is a resource-exhaustion guard: a malicious or corrupted archive with a huge number of entries (zip-bomb style) would otherwise consume unbounded time and memory. Exceeding the entry cap aborts parsing immediately.","triggerScenarios":"parse_registry_archive iterating an archive whose entry index reaches MAX_REGISTRY_ARCHIVE_ENTRIES — i.e. an archive with more entries than the configured cap.","commonSituations":"A corrupted or malicious registry archive (decompression bomb), or a publisher accidentally including thousands of unrelated files (e.g. vendored assets or .git objects) in the registry archive.","solutions":["Obtain the registry archive from a trusted source and re-download it; the file is likely corrupted or tampered with.","Inspect `tar -tzf archive.tar.gz | wc -l` to confirm the entry count and identify what was accidentally included.","If you publish the archive, exclude non-registry files (e.g. add .git/ and vendored assets to the packaging exclusion list).","Do not attempt to bypass the cap; use a subset/split registry archive if you legitimately need more entries."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# shell: check entry count against a sane bound before parsing\ncount=$(tar -tzf registry.tar.gz | wc -l); [ \"$count\" -lt 50000 ] && echo OK || echo \"REJECTED: $count entries\"","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only consume registry archives from trusted, official sources.","Exclude non-registry files from packaging to keep entry counts small.","Treat unexplained entry-count growth between registry versions as tampering and re-download."],"tags":["security","archive","resource-limit","registry"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"afd2eddd3a50c16190efc1c7e94404b48f72af57","analyzedAt":"2026-09-09T01:38:25.179Z","contentChangedAt":"2026-09-09T01:38:25.179Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}