{"record":{"id":"5780b47edd9ea58e","repo":"apache/shenyu","slug":"max-response-body-size-must-not-be-negative","errorCode":null,"errorMessage":"Max response body size must not be negative","messagePattern":"Max response body size must not be negative","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":400,"severity":"warning","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/HttpUtils.java","lineNumber":480,"sourceCode":"            return this.name();\n        }\n    }\n\n    /**\n     * Read response body with a size limit to prevent excessive memory usage.\n     *\n     * @param responseBody the response body to read\n     * @param maxBodySize  maximum allowed body size in bytes\n     * @return the response body as a string\n     * @throws IOException              if an I/O error occurs\n     * @throws IllegalArgumentException if the body exceeds maxBodySize\n     */\n    public static String readLimitedResponseBody(final ResponseBody responseBody, final long maxBodySize) throws IOException {\n        if (Objects.isNull(responseBody)) {\n            throw new IllegalArgumentException(\"Response body is empty\");\n        }\n        if (maxBodySize < 0) {\n            throw new IllegalArgumentException(\"Max response body size must not be negative\");\n        }\n\n        long contentLength = responseBody.contentLength();\n        if (contentLength > maxBodySize) {\n            throw new IllegalArgumentException(String.format(\n                    \"Response body exceeds maximum size of %d bytes\", maxBodySize));\n        }\n\n        ByteArrayOutputStream outputStream = contentLength > 0\n                ? new ByteArrayOutputStream((int) Math.min(contentLength, Integer.MAX_VALUE))\n                : new ByteArrayOutputStream();\n        byte[] buffer = new byte[READ_BUFFER_SIZE];\n        long totalBytes = 0;\n        try (InputStream inputStream = responseBody.byteStream()) {\n            int bytesRead;\n            while ((bytesRead = inputStream.read(buffer)) != -1) {\n                totalBytes += bytesRead;\n                if (totalBytes > maxBodySize) {","sourceCodeStart":462,"sourceCodeEnd":498,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/HttpUtils.java#L462-L498","documentation":"readLimitedResponseBody enforces that the caller-supplied maxBodySize limit is non-negative; a negative limit throws IllegalArgumentException('Max response body size must not be negative') before any reading occurs.","triggerScenarios":"Calling HttpUtils.readLimitedResponseBody(body, -1) or passing an uninitialized/computed negative limit — e.g. a config value of -1 used as 'unlimited' by the caller, which this API does not accept.","commonSituations":"Configuring max body size via properties where -1 means unlimited elsewhere; arithmetic producing a negative limit; copy-paste from APIs where -1 is the convention for no limit.","solutions":["Pass a non-negative maxBodySize (e.g. 0, or a real byte limit)","If 'unlimited' is intended, choose a large positive constant or use a different read method that has no cap","Validate/normalize the configured limit at load time (Math.max(0, configured)) before calling"],"exampleFix":"// before\nlong max = config.getMaxBodySize(); // -1 = unlimited\nString body = HttpUtils.readLimitedResponseBody(rb, max);\n// after\nlong max = Math.max(0, config.getMaxBodySize());\nString body = HttpUtils.readLimitedResponseBody(rb, max == UNLIMITED ? Long.MAX_VALUE : max);","handlingStrategy":"validation","validationCode":"if (maxBodySize < 0) throw new ConfigurationException(\"maxBodySize must be >= 0\");","typeGuard":"boolean isValidLimit(long max) { return max >= 0; }","tryCatchPattern":"try { body = HttpUtils.readLimitedResponseBody(rb, max); } catch (IllegalArgumentException e) { if (e.getMessage().contains(\"must not be negative\")) { max = DEFAULT_MAX; body = HttpUtils.readLimitedResponseBody(rb, max); } }","preventionTips":["Never use -1 as 'unlimited' for this API; use Long.MAX_VALUE","Clamp configured limits with Math.max(0, value) at config load","Document the limit semantics where the config property is defined"],"tags":["http","argument-validation","limit","admin"],"backgroundTag":"invalid-argument-value","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}