{"record":{"id":"8caeef6e1bfdda3f","repo":"theonedev/onedev","slug":"checksum-exceeds-maximum-size-max-checksum-len","errorCode":null,"errorMessage":"Checksum exceeds maximum size: ${MAX_CHECKSUM_LEN}","messagePattern":"Checksum exceeds maximum size: (.+?)","errorType":"http","errorClass":"HttpResponseAwareException","httpStatus":406,"severity":"error","filePath":"server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java","lineNumber":348,"sourceCode":"\t\t}\n\t}\n\t\n\tprivate void uploadBlob(HttpServletRequest request, HttpServletResponse response,\n\t\t\t\t\t\t\tLong projectId, Long buildId, String groupId, @Nullable String artifactId, \n\t\t\t\t\t\t\t@Nullable String version, String fileName) {\n\t\tsessionService.run(() -> {\n\t\t\tcheckProject(projectId, true);\n\t\t});\n\t\ttry (var is = request.getInputStream()) {\n\t\t\tvar lockName = \"update-pack:\" + projectId + \":\" + TYPE + \":\" + groupId;\n\t\t\tif (artifactId != null && version != null)\n\t\t\t\tlockName += \":\" + artifactId + \":\" + version;\n\t\t\tvar blobName = getBlobName(fileName);\n\t\t\tif (!blobName.equals(fileName)) { // checksum verification\n\t\t\t\tvar baos = new ByteArrayOutputStream();\n\t\t\t\tvar copied = copyWithMaxSize(is, baos, MAX_CHECKSUM_LEN);\n\t\t\t\tif (copied == -1)\n\t\t\t\t\tthrow new HttpResponseAwareException(SC_NOT_ACCEPTABLE, \"Checksum exceeds maximum size: \" + MAX_CHECKSUM_LEN);\n\t\t\t\tvar checksum = new String(baos.toByteArray(), UTF_8);\n\t\t\t\tLockUtils.run(lockName, () -> transactionService.run(() -> {\n\t\t\t\t\tvar project = projectService.load(projectId);\n\t\t\t\t\tPack pack = findPack(project, groupId, artifactId, version);\n\t\t\t\t\tif (pack != null) {\n\t\t\t\t\t\tMavenData data = (MavenData) pack.getData();\n\t\t\t\t\t\tvar sha256BlobHash = data.getSha256BlobHashes().get(blobName);\n\t\t\t\t\t\tif (sha256BlobHash != null) {\n\t\t\t\t\t\t\tPackBlob packBlob;\n\t\t\t\t\t\t\tif ((packBlob = packBlobService.checkPackBlob(projectId, sha256BlobHash)) != null) {\n\t\t\t\t\t\t\t\tString blobHash;\n\t\t\t\t\t\t\t\tif (fileName.endsWith(EXT_SHA256))\n\t\t\t\t\t\t\t\t\tblobHash = sha256BlobHash;\n\t\t\t\t\t\t\t\telse\n\t\t\t\t\t\t\t\t\tblobHash = getNonSha256Hash(packBlob, fileName);\n\t\t\t\t\t\t\t\tif (blobHash.equals(checksum)) {\n\t\t\t\t\t\t\t\t\tpackBlobReferenceService.createIfNotExist(pack, packBlob);\n\t\t\t\t\t\t\t\t\tresponse.setStatus(SC_OK);","sourceCodeStart":330,"sourceCodeEnd":366,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-plugin/server-plugin-pack-maven/src/main/java/io/onedev/server/plugin/pack/maven/MavenPackHandler.java#L330-L366","documentation":"During uploadBlob, when the uploaded file name is a checksum file (e.g. artifact.jar.sha1), the handler copies the body into memory with copyWithLimit/is capped at MAX_CHECKSUM_LEN to read the checksum. If the stream is longer than MAX_CHECKSUM_LEN, copy returns -1 and the handler rejects the upload with HTTP 406, since a legitimate checksum file is tiny.","triggerScenarios":"A client PUTs a file whose name looks like a checksum file (*.sha1, *.sha256, *.md5 — matched by getBlobName/verification logic) but whose body exceeds MAX_CHECKSUM_LEN bytes, usually because the actual artifact was uploaded under the checksum file name or a misconfigured client streams the wrong file.","commonSituations":"Misconfigured Maven deploy uploading artifact under wrong path; hand-crafted REST upload naming the binary file with a .sha1/.md5 suffix; proxy mangling upload paths so the jar lands on the checksum URL.","solutions":["Check the upload path: the file you are uploading is being treated as a checksum file; correct the URL/file name so the real artifact gets the artifact path.","Upload the actual artifact first, then let the client upload its genuine (small) checksum file.","If a proxy/build script rewrites paths, fix the rewriting so checksum files stay separate from binaries."],"exampleFix":"// before — uploading binary under checksum name\ncurl -T app.jar \"$URL/com/acme/app/1.0/app-1.0.jar.sha1\"\n// after\ncurl -T app.jar \"$URL/com/acme/app/1.0/app-1.0.jar\"\ncurl -T app.jar.sha1 \"$URL/com/acme/app/1.0/app-1.0.jar.sha1\"","handlingStrategy":"validation","validationCode":"# Before upload, ensure the file you PUT with a checksum-suffixed name is actually small\nFILE=app-1.0.jar.sha1\nSIZE=$(stat -c%s \"$FILE\")\nMAX=4096  # keep well under MAX_CHECKSUM_LEN\n[ \"$SIZE\" -le \"$MAX\" ] || { echo \"$FILE is $SIZE bytes — not a checksum file\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never upload binaries under *.sha1/*.md5/*.sha256 names.","Generate checksum files directly next to artifacts in the same build step.","Script uploads to iterate over artifacts and derive each checksum filename programmatically."],"tags":["maven","upload","checksum","payload-too-large"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}