{"record":{"id":"9ba59ff7739d38af","repo":"apache/shenyu","slug":"total-size-exceeds-maximum-allowed-value","errorCode":null,"errorMessage":"total size exceeds maximum allowed value.","messagePattern":"total size exceeds maximum allowed value\\.","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java","lineNumber":124,"sourceCode":"                if (entry.isDirectory()) {\n                    continue;\n                }\n                entryCount++;\n                if (entryCount > maxEntryCount) {\n                    throw new IllegalArgumentException(\"entry count exceeds maximum of \" + maxEntryCount);\n                }\n                try (ByteArrayOutputStream out = new ByteArrayOutputStream()) {\n                    byte[] buffer = new byte[1024];\n                    int offset;\n                    long entrySize = 0L;\n                    while ((offset = zipIn.read(buffer)) != -1) {\n                        entrySize += offset;\n                        totalSize += offset;\n                        if (entrySize > maxEntrySize) {\n                            throw new IllegalArgumentException(\"entry size exceeds maximum allowed value.\");\n                        }\n                        if (totalSize > maxTotalSize) {\n                            throw new IllegalArgumentException(\"total size exceeds maximum allowed value.\");\n                        }\n                        out.write(buffer, 0, offset);\n                    }\n                    String entryName = entry.getName();\n                    itemList.add(new ZipItem(entryName, out.toString(StandardCharsets.UTF_8)));\n                } catch (IOException e) {\n                    LOG.error(\"unzip error\", e);\n                }\n            }\n        } catch (IOException e) {\n            LOG.error(\"unzip error\", e);\n        }\n        return new UnZipResult(itemList);\n    }\n\n    public static class ZipItem {\n\n        private final String itemName;","sourceCodeStart":106,"sourceCodeEnd":142,"githubUrl":"https://github.com/apache/shenyu/blob/567142e07261b3e615ae8850b30f4421f455cc5d/shenyu-admin/src/main/java/org/apache/shenyu/admin/utils/ZipUtil.java#L106-L142","documentation":"ZipUtil.unzip throws this IllegalArgumentException when the cumulative uncompressed size of all processed entries exceeds maxTotalSize. This is the archive-level counterpart of the per-entry limit, preventing total memory exhaustion from many moderately sized entries.","triggerScenarios":"Unzipping an archive whose entries together decompress beyond maxTotalSize, even if each entry individually stays under maxEntrySize.","commonSituations":"Uploading large config/plugin bundles; zip-bomb archives designed to expand massively.","solutions":["Shrink the archive (remove redundant files, use higher compression) before uploading.","Increase maxTotalSize if legitimate bundles need more room.","Inspect the archive's total uncompressed size with `unzip -l` before uploading."],"exampleFix":"// before\nZipUtil.unzip(in, maxEntries, maxEntrySize, 10_000_000L); // 10MB total\n// after\nZipUtil.unzip(in, maxEntries, maxEntrySize, 50_000_000L); // 50MB total","handlingStrategy":"validation","validationCode":"try (ZipFile zf = new ZipFile(zipFile)) {\n    long total = zf.stream().filter(e -> !e.isDirectory())\n        .mapToLong(ZipEntry::getSize).sum();\n    if (total > maxTotalSize) {\n        throw new IllegalArgumentException(\"total \" + total + \" exceeds limit \" + maxTotalSize);\n    }\n}","typeGuard":null,"tryCatchPattern":"try {\n    ZipUtil.unzip(in, maxEntryCount, maxEntrySize, maxTotalSize);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"total size exceeds\")) {\n        log.error(\"Archive expands beyond total size budget\");\n    }\n}","preventionTips":["Compare the archive's total uncompressed size (unzip -l) against the limit first.","Trim bundles to only the files the gateway needs.","Reject suspicious archives (tiny compressed, huge uncompressed) at upload time."],"tags":["zip","resource-limit","zip-bomb","security"],"backgroundTag":"file-size-limit-exceeded","analyzedSha":"567142e07261b3e615ae8850b30f4421f455cc5d","analyzedAt":"2026-09-12T10:08:21.293Z","contentChangedAt":"2026-09-12T10:08:21.293Z","schemaVersion":2},"datasetVersion":"2026-09-19T12:17:13.211Z"}