{"record":{"id":"5ea098d09b5ca25e","repo":"eclipse-vertx/vert.x","slug":"maxsize-must-be-0","errorCode":null,"errorMessage":"maxSize must be > 0","messagePattern":"maxSize must be > 0","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"vertx-core/src/main/java/io/vertx/core/http/QueryParamDecoderConfig.java","lineNumber":75,"sourceCode":"    this.charset = other.charset;\n  }\n\n  /**\n   * @return the maximum number of parameters to decode\n   */\n  public int getMaxSize() {\n    return maxSize;\n  }\n\n  /**\n   * Set the maximum number of parameters to decode.\n   *\n   * @param maxSize the max size\n   * @return a reference to this, so the API can be used fluently\n   */\n  public QueryParamDecoderConfig setMaxSize(int maxSize) {\n    if (maxSize < 1) {\n      throw new IllegalArgumentException(\"maxSize must be > 0\");\n    }\n    this.maxSize = maxSize;\n    return this;\n  }\n\n  /**\n   * @return whether to use the semicolon char {@code ;} as a delimiter for query string parameters.\n   */\n  public boolean isUseSemicolonAsDelimiter() {\n    return useSemicolonAsDelimiter;\n  }\n\n  /**\n   * Configure whether to use the semicolon char {@code ;} as a delimiter for query string parameters.\n   *\n   * @param useSemicolonAsDelimiter whether to allow semicolon to be used as a delimiter or it is a an actual parameter name or value\n   * @return a reference to this, so the API can be used fluently\n   */","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/eclipse-vertx/vert.x/blob/fb308bd8c3f12c79f4ae89bef67fadf6c80d036e/vertx-core/src/main/java/io/vertx/core/http/QueryParamDecoderConfig.java#L57-L93","documentation":"QueryParamDecoderConfig.setMaxSize() requires the maximum number of decoded query parameters to be at least 1. Passing 0 or a negative value throws this IllegalArgumentException, since a decoder that accepts no parameters is invalid.","triggerScenarios":"Calling setMaxSize(0) or a negative value when building custom query-parameter decoder configuration, e.g. trying to 'disable' query parameter parsing by setting the limit to 0.","commonSituations":"Hardening configs meant to limit DoS surface (many parameters) where 0 was used as 'disable'; generated config with unset/zeroed limits.","solutions":["Set maxSize to a positive integer (>= 1); choose a sane bound like 100 for security-sensitive endpoints.","To disable query parsing entirely, do not install a decoder config rather than setting size 0.","Clamp config-driven values to >= 1 before constructing QueryParamDecoderConfig."],"exampleFix":"// before\nnew QueryParamDecoderConfig().setMaxSize(0); // intended 'disable'\n// after\nnew QueryParamDecoderConfig().setMaxSize(100); // bounded positive limit","handlingStrategy":"validation","validationCode":"int max = cfg.getInteger(\"maxSize\", 100);\nif (max < 1) max = 100;\nQueryParamDecoderConfig qpc = new QueryParamDecoderConfig().setMaxSize(max);","typeGuard":"boolean validMaxSize(Integer v) { return v != null && v >= 1; }","tryCatchPattern":"try { config.setMaxSize(max); } catch (IllegalArgumentException e) { log.error(\"maxSize must be >= 1\", e); }","preventionTips":["Use a positive bound; don't encode 'disabled' as 0.","Validate security-hardening configs that set decoder limits."],"tags":["http","query-parameters","configuration","validation"],"backgroundTag":"invalid-config-value","analyzedSha":"fb308bd8c3f12c79f4ae89bef67fadf6c80d036e","analyzedAt":"2026-09-06T11:37:12.241Z","contentChangedAt":"2026-09-06T11:37:12.241Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}