{"record":{"id":"ac6b88329514a404","repo":"Hmbown/CodeWhale","slug":"api-key-input-is-unexpectedly-large","errorCode":null,"errorMessage":"API key input is unexpectedly large","messagePattern":"API key input is unexpectedly large","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/cli/src/cloud.rs","lineNumber":1235,"sourceCode":"        return None;\n    }\n    std::env::var(variable)\n        .ok()\n        .filter(|value| !value.trim().is_empty())\n}\n\nfn read_key_from_stdin() -> Result<String> {\n    let mut bytes = Vec::new();\n    io::stdin()\n        .take(MAX_API_KEY_STDIN_BYTES + 1)\n        .read_to_end(&mut bytes)\n        .context(\"failed to read API key from stdin\")?;\n    parse_key_input(bytes)\n}\n\nfn parse_key_input(bytes: Vec<u8>) -> Result<String> {\n    if bytes.len() as u64 > MAX_API_KEY_STDIN_BYTES {\n        bail!(\"API key input is unexpectedly large\");\n    }\n    let value = String::from_utf8(bytes).context(\"API key from stdin is not valid UTF-8\")?;\n    let value = value.trim().to_string();\n    validate_api_key(&value)?;\n    Ok(value)\n}\n\nfn read_key_hidden(provider: &str) -> Result<String> {\n    if !io::stdin().is_terminal() {\n        bail!(\"interactive key entry requires a terminal; use `--api-key-stdin` for piped input\");\n    }\n    let term = console::Term::stderr();\n    term.write_str(&format!(\"Enter {provider} API key: \"))\n        .context(\"failed to write API key prompt\")?;\n    let value = term\n        .read_secure_line()\n        .context(\"failed to read API key securely\")?;\n    term.write_line(\"\").ok();","sourceCodeStart":1217,"sourceCodeEnd":1253,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/73e0f67d83c59909b571efdfc88c4bc28c309cb1/crates/cli/src/cloud.rs#L1217-L1253","documentation":"parse_key_input guards the stdin path for API key entry: if the raw byte buffer read from stdin exceeds MAX_API_KEY_STDIN_BYTES it bails before decoding. This is a sanity/DoS bound — a legitimate key is far smaller, so an oversized input means the wrong data was piped in.","triggerScenarios":"Running a command with --api-key-stdin and piping input whose total byte length exceeds MAX_API_KEY_STDIN_BYTES (crates/cli/src/cloud.rs:1235), e.g. `cat largefile | codewhale ... --api-key-stdin`.","commonSituations":"Piping a whole file intended to contain only the key, accidentally redirecting the wrong file, a script that echoes a large blob plus the key, or forgetting the key file was appended to.","solutions":["Pipe only the key itself: `printf '%s' 'cwc_key_...' | codewhale ... --api-key-stdin`","Check the input size with `wc -c < keyfile` before piping","Ensure the key file contains only the single key line (no concatenated data)","Use --api-key with the value directly if stdin piping is unnecessary"],"exampleFix":"// before\ncat notes-and-key.txt | codewhale account api-keys import --api-key-stdin\n// after\ngrep '^cwc_key_' notes-and-key.txt | codewhale account api-keys import --api-key-stdin","handlingStrategy":"validation","validationCode":"// shell check before piping\n[ \"$(wc -c < keyfile)\" -le 1024 ] || { echo \"key input too large\"; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pipe exactly one key line into --api-key-stdin","Verify input size with `wc -c` before redirecting","Never cat multi-line files into key stdin paths"],"tags":["cli","stdin","validation"],"backgroundTag":"payload-too-large","analyzedSha":"73e0f67d83c59909b571efdfc88c4bc28c309cb1","analyzedAt":"2026-09-22T01:30:00.501Z","contentChangedAt":"2026-09-22T01:30:00.501Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}