{"record":{"id":"7cbb8352588aeda9","repo":"nodejs/node","slug":"range-too-big-maximum-size-for-range-is-d","errorCode":null,"errorMessage":"range too big, maximum size for range is %d","messagePattern":"range too big, maximum size for range is (.+?)","errorType":"exception","errorClass":"OverflowError","httpStatus":null,"severity":"error","filePath":"tools/inspector_protocol/jinja2/sandbox.py","lineNumber":153,"sourceCode":"\n\ndef inspect_format_method(callable):\n    if not isinstance(callable, (types.MethodType,\n                                 types.BuiltinMethodType)) or \\\n       callable.__name__ != 'format':\n        return None\n    obj = callable.__self__\n    if isinstance(obj, string_types):\n        return obj\n\n\ndef safe_range(*args):\n    \"\"\"A range that can't generate ranges with a length of more than\n    MAX_RANGE items.\n    \"\"\"\n    rng = range(*args)\n    if len(rng) > MAX_RANGE:\n        raise OverflowError('range too big, maximum size for range is %d' %\n                            MAX_RANGE)\n    return rng\n\n\ndef unsafe(f):\n    \"\"\"Marks a function or method as unsafe.\n\n    ::\n\n        @unsafe\n        def delete(self):\n            pass\n    \"\"\"\n    f.unsafe_callable = True\n    return f\n\n\ndef is_internal_attribute(obj, attr):","sourceCodeStart":135,"sourceCodeEnd":171,"githubUrl":"https://github.com/nodejs/node/blob/1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e/tools/inspector_protocol/jinja2/sandbox.py#L135-L171","documentation":"Raised by safe_range inside jinja2.sandbox when the requested range would produce more than MAX_RANGE elements. SandboxedEnvironment replaces the builtin range with safe_range to prevent templates from exhausting memory/CPU with range(10**12). The error is an OverflowError so it surfaces as a resource-limit violation rather than a normal logic error.","triggerScenarios":"A template under SandboxedEnvironment calls {{ range(1, 1000000000) }} or {{ range(n) }} where n is supplied by user input and exceeds MAX_RANGE (default 1<<25 = ~33M). Feeding an untrusted context variable into range() without bounds. Pagination logic that computes range(total_items) instead of range(page_size).","commonSituations":"Rendering templates against untrusted input in a sandbox (web app, report generator). Bad math from upstream producing huge counts. Migrating a template from a non-sandboxed environment where range() was unbounded.","solutions":["Bound the argument before calling range: {{ range(min(n, 10000)) }}.","Re-examine the logic: usually range() in templates should be range(page_size), not range(total).","If a larger cap is genuinely needed and the environment is trusted, subclass SandboxedEnvironment and override is_safe_range / set a higher MAX_RANGE constant - document the risk.","Sanitize context variables in Python before render: ctx['n'] = min(ctx['n'], HARD_CAP)."],"exampleFix":"// before\n<ul>\n{% for i in range(user_count) %}<li>{{ i }}</li>{% endfor %}\n</ul>\n// after\n<ul>\n{% for i in range(user_count if user_count < 1000 else 1000) %}<li>{{ i }}</li>{% endfor %}\n</ul>","handlingStrategy":"validation","validationCode":"from jinja2.sandbox import MAX_RANGE\nctx = dict(user_ctx)\nfor k, v in list(ctx.items()):\n    if isinstance(v, int) and abs(v) > MAX_RANGE:\n        ctx[k] = MAX_RANGE if v > 0 else -MAX_RANGE\n# then render with ctx","typeGuard":"def within_range_bound(n, cap) -> bool:\n    try:\n        return abs(int(n)) <= cap\n    except (TypeError, ValueError):\n        return False","tryCatchPattern":"from jinja2.exceptions import TemplateRuntimeError, OverflowError as JOverflow\ntry:\n    html = env.from_string(tpl).render(**ctx)\nexcept OverflowError:\n    html = env.from_string(fallback_tpl).render(**bounded(ctx))","preventionTips":["Never feed untrusted input straight into range() in templates.","Cap context variables in Python before render.","Prefer iteration over a pre-paged list over range(total)."],"tags":["jinja2","sandbox","range","resource-limit","dos"],"backgroundTag":null,"analyzedSha":"1b2de5e052fc0fb95fd7fb6846dcec4ade598e9e","analyzedAt":"2026-08-13T00:53:24.642Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}