{"record":{"id":"6f553c2e6b0a9562","repo":"grafana/k6","slug":"secret-response-exceeds-maximum-size-of-d-bytes","errorCode":null,"errorMessage":"secret response exceeds maximum size of %d bytes","messagePattern":"secret response exceeds maximum size of (.+?) bytes","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/secretsource/url/url.go","lineNumber":245,"sourceCode":"\t// the interval of time after which a new token is replenished. In\n\t// other words, the units are time unit/token.\n\ttokenReplenishInterval := time.Minute / time.Duration(requestsPerMinuteLimit)\n\n\treturn rate.NewLimiter(rate.Every(tokenReplenishInterval), requestsBurst)\n}\n\nfunc extractSecretFromResponse(body io.Reader, responsePath string) (string, error) {\n\tconst maxSecretSize = 24 * 1024\n\n\t// Limit reading to prevent memory exhaustion from large responses\n\tlimitedReader := io.LimitReader(body, maxSecretSize+1)\n\tdata, err := io.ReadAll(limitedReader)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to read response body: %w\", err)\n\t}\n\n\tif len(data) > maxSecretSize {\n\t\treturn \"\", fmt.Errorf(\"secret response exceeds maximum size of %d bytes\", maxSecretSize)\n\t}\n\n\tif responsePath == \"\" {\n\t\t// If no path specified, assume response body is the secret\n\t\treturn string(data), nil\n\t}\n\n\tresult := gjson.GetBytes(data, responsePath)\n\n\tif !result.Exists() {\n\t\treturn \"\", fmt.Errorf(\"path %q not found in response\", responsePath)\n\t}\n\n\tif result.Type != gjson.String {\n\t\treturn \"\", fmt.Errorf(\"secret value at path %q is not a string (got %s)\", responsePath, result.Type)\n\t}\n\n\treturn result.String(), nil","sourceCodeStart":227,"sourceCodeEnd":263,"githubUrl":"https://github.com/grafana/k6/blob/01ffac6f245854c1b8adc6a69857c76a15f90022/internal/secretsource/url/url.go#L227-L263","documentation":"The body returned by the remote secret endpoint exceeded the 24 KiB safety cap enforced by extractSecretFromResponse. Reading is deliberately limited (io.LimitReader with maxSecretSize+1) to prevent memory exhaustion from huge responses; seeing maxSecretSize+1 bytes means the response is larger than a secret should ever be.","triggerScenarios":"Thrown at internal/secretsource/url/url.go:245 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure responsePath so only a small JSON field is extracted instead of the whole body","Fix the service endpoint if it is returning an unexpectedly large payload"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"01ffac6f245854c1b8adc6a69857c76a15f90022","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}