{"record":{"id":"6911d56dd93b4f93","repo":"jdx/mise","slug":"object-exceeds-the-encrypted-content-size-limit","errorCode":null,"errorMessage":"object exceeds the encrypted content size limit","messagePattern":"object exceeds the encrypted content size limit","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/system/history/shadow.rs","lineNumber":1048,"sourceCode":"        if let Some(bytes) = self.transient_blob(oid) {\n            return Ok(bytes);\n        }\n        self.git\n            .output(PlumbingCall::new([\"cat-file\", \"blob\", oid]))\n            .wrap_err_with(|| format!(\"reading {oid}\"))\n    }\n\n    pub(crate) fn blob_starts_with(&self, oid: &str, prefix: &[u8]) -> Result<bool> {\n        if let Some(bytes) = self.transient_blob(oid) {\n            return Ok(bytes.starts_with(prefix));\n        }\n        self.git.blob_starts_with(oid, prefix)\n    }\n\n    pub(crate) fn cat_object_bounded(&self, oid: &str, limit: u64) -> Result<Vec<u8>> {\n        if let Some(bytes) = self.transient_blob(oid) {\n            if bytes.len() as u64 > limit {\n                bail!(\"object exceeds the encrypted content size limit\");\n            }\n            return Ok(bytes);\n        }\n        let size: u64 = self\n            .output_str(PlumbingCall::new([\"cat-file\", \"-s\", oid]))?\n            .trim()\n            .parse()?;\n        if size > limit {\n            eyre::bail!(\"object exceeds the encrypted content size limit\");\n        }\n        self.cat_object(oid)\n    }\n\n    pub(crate) fn hash_blob(&self, bytes: &[u8]) -> Result<String> {\n        self.output_str(PlumbingCall::new([\"hash-object\", \"-w\", \"--stdin\"]).stdin(bytes))\n    }\n\n    /// Compute the normal Git identity without writing an object. Read APIs","sourceCodeStart":1030,"sourceCodeEnd":1066,"githubUrl":"https://github.com/jdx/mise/blob/533346cc374382b41ec5ff70536252b2e96e725c/src/system/history/shadow.rs#L1030-L1066","documentation":"`cat_object_bounded` reads a git object from the encrypted-history repository subject to a caller-provided byte limit (typically `agecrypt::MAX_PLAINTEXT_BYTES`). If the object is a transient in-memory blob whose length exceeds that limit, this bail fires before any data is returned. It prevents unbounded memory use when decrypting or inspecting history objects.","triggerScenarios":"Calling `read`, `envelope`, `encrypt`, or `detect` with an object id whose transient (in-memory) blob is larger than the `limit` argument passed to `cat_object_bounded` (shadow.rs:1042-1049).","commonSituations":"Trying to display or decrypt a snapshot blob that exceeds the encrypted-content size cap — e.g. a user encrypted a very large file (over the plaintext size limit) before the cap existed, or an automated diff/read over an oversized blob.","solutions":["Remove or shrink the oversized file from the tracked/encrypted set; the size cap is intentional.","If you control the call, pass a larger `limit` deliberately (and accept the memory cost).","Read the object in chunks via a different code path if you must process huge blobs (not supported by this API).","Check the blob size first with `git cat-file -s <oid>` to confirm which object is over the cap."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// before reading, check the transient blob size\nif bytes.len() as u64 > agecrypt::MAX_PLAINTEXT_BYTES {\n    eprintln!(\"object too large to read bounded\");\n}","typeGuard":null,"tryCatchPattern":"// Rust\nmatch store.cat_object_bounded(&oid, agecrypt::MAX_PLAINTEXT_BYTES) {\n    Ok(bytes) => render(bytes),\n    Err(e) if e.to_string().contains(\"size limit\") => {\n        eprintln!(\"snapshot blob exceeds encrypted-content cap; exclude the file\");\n    }\n    Err(e) => return Err(e),\n}","preventionTips":["Keep encrypted tracked files well under the plaintext size cap.","Check `git cat-file -s <oid>` before bulk reads over history objects.","Periodically prune oversized files from encrypted tracking."],"tags":["git","encryption","size-limit"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"533346cc374382b41ec5ff70536252b2e96e725c","analyzedAt":"2026-09-17T13:35:38.149Z","contentChangedAt":"2026-09-17T13:35:38.149Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}