{"record":{"id":"5a369eb9efbedcce","repo":"crowdsecurity/crowdsec","slug":"max-body-size-must-be-a-positive-integer","errorCode":null,"errorMessage":"max_body_size must be a positive integer","messagePattern":"max_body_size must be a positive integer","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/appsec/appsec.go","lineNumber":1526,"sourceCode":"\treturn w.ChallengeRuntime.SetDifficulty(level)\n}\n\n// SetChallengeDifficultyPerRequest sets a per-request PoW difficulty override (used from pre_eval/post_eval).\nfunc (*AppsecRuntimeConfig) SetChallengeDifficultyPerRequest(state *AppsecRequestState, level string) error {\n\tbits, err := challenge.DifficultyFromLevel(level)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tstate.ChallengeDifficulty = &bits\n\n\treturn nil\n}\n\n// SetMaxBodySize sets the maximum allowed body size in bytes. Intended for use in on_load hooks.\nfunc (w *AppsecRuntimeConfig) SetMaxBodySize(size int64) error {\n\tif size <= 0 {\n\t\treturn errors.New(\"max_body_size must be a positive integer\")\n\t}\n\n\tw.Logger.Debugf(\"setting max body size to %d bytes\", size)\n\tw.BodySettings.MaxSize = size\n\treturn nil\n}\n\n// SendChallenge issues a challenge HTML page for the current request. Cookie\n// and submission handling live in ProcessOnChallengeRules; by the time this\n// runs, state.Fingerprint has already been populated if a valid cookie was\n// presented. If the client already proved a PoW at least as hard as the\n// target difficulty for this request, SendChallenge is a no-op. When the\n// target difficulty is raised (e.g. on_challenge calls SetChallengeDifficulty\n// to punish a suspect fingerprint), the stored difficulty is lower than the\n// target and a fresh challenge is issued.\n// EvaluateMismatches runs all library-native + custom fingerprint mismatch\n// checks, caches the result on state, and emits one structured Debug log\n// line + one metric bump per fired signal on the first call of a given","sourceCodeStart":1508,"sourceCodeEnd":1544,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/appsec/appsec.go#L1508-L1544","documentation":"SetMaxBodySize on AppsecRuntimeConfig enforces that the requested maximum HTTP body size is strictly positive. It is exposed to on_load hooks so rules can tune body inspection limits; a zero or negative value would disable or corrupt body-size accounting, so it is refused and the hook errors out.","triggerScenarios":"Calling max_body_size(0) or a negative value from an on_load hook expression; calling the setter programmatically with size <= 0.","commonSituations":"A user writes `max_body_size(0)` thinking 0 means unlimited; a template or variable expansion yields a negative number; a typo passing a negative constant.","solutions":["Use a positive integer byte count, e.g. max_body_size(10485760) for 10MB","If the goal is unlimited bodies, remove the max_body_size call and use the default body limit instead of passing 0","Check the on_load hook expression for variables that could resolve to zero or negative values"],"exampleFix":"// before (on_load hook)\nmax_body_size(0)\n\n// after\nmax_body_size(10485760)","handlingStrategy":"validation","validationCode":"if size, err := strconv.ParseInt(cfg.MaxBodySize, 10, 64); err != nil || size <= 0 {\n    return fmt.Errorf(\"max_body_size must be > 0, got %q\", cfg.MaxBodySize)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass explicit positive byte counts to max_body_size in on_load hooks","Never use 0 to mean unlimited; omit the call to keep the default"],"tags":["config","appsec","validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}