{"record":{"id":"57cc56f2e2759537","repo":"apache/shenyu","slug":"entry-size-exceeds-maximum-allowed-value","errorCode":null,"errorMessage":"entry size exceeds maximum allowed value.","messagePattern":"entry size exceeds maximum allowed value\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java","lineNumber":121,"sourceCode":"        try (ZipInputStream zipIn = new ZipInputStream(new ByteArrayInputStream(source))) {\n            ZipEntry entry;\n            while (Objects.nonNull(entry = zipIn.getNextEntry())) {\n                if (entry.isDirectory()) {\n                    continue;\n                }\n                entryCount++;\n                if (entryCount > maxEntryCount) {\n                    throw new IllegalArgumentException(\"entry count exceeds maximum of \" + maxEntryCount);\n                }\n                try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {\n                    byte[] buffer = new byte[1024];\n                    int offset;\n                    long entrySize = 0L;\n                    while ((offset = zipIn.read(buffer)) != -1) {\n                        entrySize += offset;\n                        totalSize += offset;\n                        if (entrySize > maxEntrySize) {\n                            throw new IllegalArgumentException(\"entry size exceeds maximum allowed value.\");\n                        }\n                        if (totalSize > maxTotalSize) {\n                            throw new IllegalArgumentException(\"total size exceeds maximum allowed value.\");\n                        }\n                        out.write(buffer, 0, offset);\n                    }\n                    String entryName = entry.getName();\n                    itemList.add(new ZipItem(entryName, out.toString(StandardCharsets.UTF_8)));\n                } catch (IOException e) {\n                    LOG.error(\"unzip error\", e);\n                }\n            }\n        } catch (IOException e) {\n            LOG.error(\"unzip error\", e);\n        }\n        return new UnZipResult(itemList);\n    }\n","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java#L103-L139","documentation":"ZipUtil.unzip throws this IllegalArgumentException when a single archive entry's uncompressed size exceeds maxEntrySize. It enforces the cap incrementally while streaming, so a single huge (possibly zip-bomb) entry is rejected before consuming unbounded memory.","triggerScenarios":"Unzipping an archive containing one file whose decompressed byte length surpasses maxEntrySize.","commonSituations":"Uploading a zip that legitimately contains a large data/config file; malicious zip-bomb archives with highly compressible content.","solutions":["Split large files out of the archive or compress/trim the offending entry.","Raise the maxEntrySize parameter if your valid artifacts are larger than the current limit.","Check the entry's uncompressed size beforehand with `unzip -l file.zip`."],"exampleFix":"// before\nZipUtil.unzip(in, maxEntries, 1_000_000L, maxTotalSize); // 1MB cap\n// after\nZipUtil.unzip(in, maxEntries, 10_000_000L, maxTotalSize); // 10MB cap","handlingStrategy":"validation","validationCode":"try (ZipFile zf = new ZipFile(zipFile)) {\n    long max = zf.stream().filter(e -> !e.isDirectory())\n        .mapToLong(ZipEntry::getSize).max().orElse(0L);\n    if (max > maxEntrySize) {\n        throw new IllegalArgumentException(\"largest entry \" + max + \" exceeds limit \" + maxEntrySize);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    ZipUtil.unzip(in, maxEntryCount, maxEntrySize, maxTotalSize);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"entry size exceeds\")) {\n        log.error(\"Single entry too large; split or compress the file\");\n    }\n}","preventionTips":["Check uncompressed entry sizes with unzip -l before uploading.","Split very large config/data files out of archives.","Treat unexpectedly high compression ratios as a zip-bomb red flag."],"tags":["zip","resource-limit","zip-bomb","security"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}