{"record":{"id":"8f0fbb6cc5860f59","repo":"theonedev/onedev","slug":"count-should-not-be-greater-than-max-page-size","errorCode":null,"errorMessage":"Count should not be greater than ${MAX_PAGE_SIZE}","messagePattern":"Count should not be greater than (.+?)","errorType":"http","errorClass":"NotAcceptableException","httpStatus":406,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/rest/resource/PackResource.java","lineNumber":90,"sourceCode":"\t@Api(order=300)\n\t@Path(\"/{packId}/blobs\")\n    @GET\n    public Collection<PackBlob> getBlobs(@PathParam(\"packId\") Long packId) {\n\t\tPack pack = packService.load(packId);\n    \tif (!SecurityUtils.canReadPack(pack.getProject())) \n\t\t\tthrow new UnauthorizedException();\n    \treturn pack.getBlobReferences().stream().map(PackBlobReference::getPackBlob).collect(toList());\n    }\n\t\n\t@Api(order=600)\n\t@GET\n    public List<Pack> queryPacks(\n    \t\t@QueryParam(\"query\") @Api(description=\"Syntax of this query is the same as in <a href='/~packages'>packages page</a>\", example=\"\\\"Type\\\" is \\\"Container Image\\\"\") String query, \n    \t\t@QueryParam(\"offset\") @Api(example=\"0\") int offset, \n    \t\t@QueryParam(\"count\") @Api(example=\"100\") int count) {\n\t\tvar subject = SecurityUtils.getSubject();\n\t\tif (!SecurityUtils.isAdministrator(subject) && count > RestConstants.MAX_PAGE_SIZE)\n    \t\tthrow new NotAcceptableException(\"Count should not be greater than \" + RestConstants.MAX_PAGE_SIZE);\n\n\t\tvar parsedQuery = PackQuery.parse(null, query, true);\n    \t\n    \treturn packService.query(subject, null, parsedQuery, false, offset, count);\n    }\n\t\n\t@Api(order=700)\n\t@Path(\"/{packId}\")\n    @DELETE\n    public Response deletePack(@PathParam(\"packId\") Long packId) {\n    \tPack pack = packService.load(packId);\n    \tif (!SecurityUtils.canWritePack(pack.getProject()))\n\t\t\tthrow new UnauthorizedException();\n    \tpackService.delete(pack);\n\t\tvar oldAuditContent = VersionedXmlDoc.fromBean(pack).toXML();\n\t\tauditService.audit(pack.getProject(), \"deleted package \\\"\" + pack.getReference(false) + \"\\\" via RESTful API\", oldAuditContent, null);\n    \treturn Response.ok().build();\n    }","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/rest/resource/PackResource.java#L72-L108","documentation":"queryPacks limits the 'count' query parameter to RestConstants.MAX_PAGE_SIZE for everyone except administrators. Requesting a larger page size throws NotAcceptableException with 'Count should not be greater than <MAX_PAGE_SIZE>'. This protects the server from oversized result pages.","triggerScenarios":"GET /~api/packs?count=1000 (count > MAX_PAGE_SIZE) by a non-administrator subject. Default MAX_PAGE_SIZE is small (typically 100).","commonSituations":"Client tries to fetch all packages in one call; generic REST client defaults count to a large number; pagination loop written without respecting server page-size cap.","solutions":["Reduce the count parameter to MAX_PAGE_SIZE or less (e.g. count=100).","Paginate with offset increments until all results are retrieved.","If truly needed, perform the call as an administrator account (admins bypass the cap).","Read the error message for the exact allowed maximum."],"exampleFix":"// before\ncurl \"http://server/~api/packs?count=1000\"\n// after\ncurl \"http://server/~api/packs?offset=0&count=100\"\ncurl \"http://server/~api/packs?offset=100&count=100\"","handlingStrategy":"validation","validationCode":"int MAX_PAGE_SIZE = 100; // RestConstants.MAX_PAGE_SIZE\nint safeCount = Math.min(requestedCount, MAX_PAGE_SIZE);\nif (requestedCount > MAX_PAGE_SIZE && !SecurityUtils.isAdministrator(SecurityUtils.getSubject()))\n    requestedCount = MAX_PAGE_SIZE;","typeGuard":"boolean validCount = (requestedCount >= 0 && requestedCount <= 100) || SecurityUtils.isAdministrator(SecurityUtils.getSubject());","tryCatchPattern":"try { page = client.queryPacks(query, offset, count); } catch (NotAcceptableException e) { page = client.queryPacks(query, offset, 100); }","preventionTips":["Always paginate with count<=MAX_PAGE_SIZE and loop on offset","Read the exception message: it states the exact maximum","Clamp client-side page size configuration","Only rely on large pages when authenticated as admin"],"tags":["rest","pagination","validation","onedev"],"backgroundTag":"invalid-query-parameter","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}