{"record":{"id":"87eea83abf925673","repo":"larksuite/cli","slug":"file-provider-exceeded-maxbytes-d","errorCode":null,"errorMessage":"file provider exceeded maxBytes (%d)","messagePattern":"file provider exceeded maxBytes \\((.+?)\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/binding/secret_resolve_file.go","lineNumber":64,"sourceCode":"\t\treturn \"\", fmt.Errorf(\"file provider security audit failed: %w\", err)\n\t}\n\n\t// Read file content\n\tmaxBytes := pc.MaxBytes\n\tif maxBytes <= 0 {\n\t\tmaxBytes = DefaultFileMaxBytes\n\t}\n\n\t// Note: vfs.ReadFile loads the entire file. maxBytes is enforced post-read\n\t// because vfs does not expose a size-limited reader. For secret files this\n\t// is acceptable (default limit 1 MiB; secrets are typically < 1 KB).\n\tdata, err := vfs.ReadFile(securePath)\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to read secret file %s: %w\", securePath, err)\n\t}\n\n\tif len(data) > maxBytes {\n\t\treturn \"\", fmt.Errorf(\"file provider exceeded maxBytes (%d)\", maxBytes)\n\t}\n\n\tcontent := string(data)\n\tmode := pc.Mode\n\tif mode == \"\" {\n\t\tmode = \"json\" // default mode per OpenClaw\n\t}\n\n\tswitch mode {\n\tcase \"singleValue\":\n\t\t// OpenClaw requires ref.id == SINGLE_VALUE_FILE_REF_ID for singleValue mode\n\t\tif ref.ID != SingleValueFileRefID {\n\t\t\treturn \"\", fmt.Errorf(\"singleValue file provider expects ref id %q, got %q\",\n\t\t\t\tSingleValueFileRefID, ref.ID)\n\t\t}\n\t\t// Entire file content is the secret; trim trailing newline\n\t\treturn strings.TrimRight(content, \"\\r\\n\"), nil\n","sourceCodeStart":46,"sourceCodeEnd":82,"githubUrl":"https://github.com/larksuite/cli/blob/7fd6ef3c07182257ce776cdc5a614e122d5bd4b3/internal/binding/secret_resolve_file.go#L46-L82","documentation":"The secret file content exceeds the provider's maxBytes limit (DefaultFileMaxBytes, 1 MiB by default). Because vfs.ReadFile loads the whole file, the provider enforces the cap after reading and rejects oversized files to avoid unbounded memory use from a potentially hostile or misconfigured path.","triggerScenarios":"Calling resolveSecretRef with a {source:\"file\"} SecretRef where the file at Path is larger than pc.MaxBytes (or the 1 MiB default when MaxBytes <= 0).","commonSituations":"The configured path accidentally points at a large log, dump, or bundle file instead of the secrets file; a legit secrets file grew past a deliberately low custom MaxBytes; someone concatenated multiple secret files.","solutions":["Verify Path points at the actual secrets file, not a larger artifact (log, tarball, backup).","If the secrets file legitimately needs more room, raise ProviderConfig.MaxBytes to a sane bound.","Trim the file to only the secret entries needed."],"exampleFix":"// before\nmaxBytes: 1024  // secrets file is 4 KB\n// after\nmaxBytes: 1048576  // or omit to use the 1 MiB default","handlingStrategy":"validation","validationCode":"info, err := os.Stat(os.ExpandEnv(pc.Path))\nif err == nil && uint64(info.Size()) > maxBytesOrDefault(pc.MaxBytes) {\n    return fmt.Errorf(\"secret file %s is %d bytes, exceeds maxBytes\", pc.Path, info.Size())\n}","typeGuard":null,"tryCatchPattern":"secret, err := resolveSecretRef(ctx, ref)\nif err != nil {\n    if strings.Contains(err.Error(), \"exceeded maxBytes\") {\n        // verify you pointed at the right file or raise maxBytes deliberately\n    }\n    return err\n}","preventionTips":["Keep secret files small and dedicated — never point them at logs, bundles, or backups.","Only raise MaxBytes deliberately; leave the 1 MiB default for normal secrets.","Add a size check to secret-file provisioning scripts."],"tags":["secrets","file-provider","limits"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"7fd6ef3c07182257ce776cdc5a614e122d5bd4b3","analyzedAt":"2026-09-04T21:17:44.649Z","contentChangedAt":"2026-09-04T21:17:44.649Z","schemaVersion":2},"datasetVersion":"2026-09-12T02:17:10.037Z"}