{"record":{"id":"bc869bd1a1fa93cd","repo":"JeffreySu/WeiXinMPSDK","slug":"maxbodybytes","errorCode":null,"errorMessage":"微信支付通知请求体超过允许上限 {maxBodyBytes} 字节。","messagePattern":"微信支付通知请求体超过允许上限 (.+?) 字节。","errorType":"exception","errorClass":"InvalidDataException","httpStatus":null,"severity":"error","filePath":"src/Senparc.Weixin.TenPay/Senparc.Weixin.TenPayV3/HttpHandlers/TenPayNotifyHandler.cs","lineNumber":177,"sourceCode":"            HttpContext httpContext,\n            int? maxBodyBytes,\n            CancellationToken cancellationToken)\n        {\n            _ = httpContext ?? throw new ArgumentNullException(nameof(httpContext));\n            if (maxBodyBytes.HasValue && maxBodyBytes.Value <= 0)\n            {\n                throw new ArgumentOutOfRangeException(nameof(maxBodyBytes), \"请求体上限必须大于 0。\");\n            }\n\n            var request = httpContext.Request;\n            if (request.Method != \"POST\" && request.Method != \"PUT\" && request.Method != \"PATCH\")\n            {\n                return NotificationBody.Empty;\n            }\n\n            if (maxBodyBytes.HasValue && request.ContentLength > maxBodyBytes.Value)\n            {\n                throw new InvalidDataException($\"微信支付通知请求体超过允许上限 {maxBodyBytes} 字节。\");\n            }\n\n            if (maxBodyBytes.HasValue)\n            {\n                request.EnableBuffering(bufferThreshold: 30 * 1024, bufferLimit: maxBodyBytes.Value);\n            }\n            else\n            {\n                request.EnableBuffering(bufferThreshold: 30 * 1024);\n            }\n            request.Body.Position = 0;\n\n            using (var linkedCancellation = CancellationTokenSource.CreateLinkedTokenSource(\n                cancellationToken,\n                httpContext.RequestAborted))\n            using (var bodyBuffer = new MemoryStream(request.ContentLength.HasValue\n                ? (int)Math.Min(request.ContentLength.Value, maxBodyBytes ?? int.MaxValue)\n                : 0))","sourceCodeStart":159,"sourceCodeEnd":195,"githubUrl":"https://github.com/JeffreySu/WeiXinMPSDK/blob/be573f6f94bdbf718dd5f6cdecb137fbc7ff651e/src/Senparc.Weixin.TenPay/Senparc.Weixin.TenPayV3/HttpHandlers/TenPayNotifyHandler.cs#L159-L195","documentation":"Before buffering, ReadBodyAsync checks request.ContentLength; if the declared body length exceeds the configured maxBodyBytes limit it throws InvalidDataException with the limit in the message. This protects against oversized or malicious notification payloads.","triggerScenarios":"A POST/PUT/PATCH notification whose Content-Length header exceeds maxBodyBytes passed to ReadBodyAsync/the notify handler.","commonSituations":"Very small maxBodyBytes configured (e.g. a few KB) while WeChat sends a normal notification (~1-2 KB JSON plus padding), or proxy/CDN inflating the body.","solutions":["Increase maxBodyBytes to a safe size (e.g. 1 MB) when constructing the handler","Set maxBodyBytes to null if no limit is needed","Compare against actual WeChat notification sizes before choosing the cap","Check for duplicated/malformed requests behind a proxy that inflate Content-Length"],"exampleFix":"// before\nvar handler = TenPayNotifyHandler.Create(httpContext, settings, maxBodyBytes: 512);\n// after\nvar handler = TenPayNotifyHandler.Create(httpContext, settings, maxBodyBytes: 1024 * 1024);","handlingStrategy":"try-catch","validationCode":"if (httpContext.Request.ContentLength > MaxNotificationBytes)\n    return BadRequest(\"通知体过大。\");","typeGuard":null,"tryCatchPattern":"try { var body = await ReadBodyAsync(httpContext, maxBodyBytes, ct); }\ncatch (InvalidDataException ex) when (ex.Message.Contains(\"超过允许上限\"))\n{ logger.LogWarning(\"通知体超限: {0}\", ex.Message); return BadRequest(); }","preventionTips":["Size the limit above the largest legitimate WeChat notification (~a few KB)","Reject oversized requests at the reverse proxy as first line of defense"],"tags":["payload-too-large","http","tenpay"],"backgroundTag":"payload-too-large","analyzedSha":"be573f6f94bdbf718dd5f6cdecb137fbc7ff651e","analyzedAt":"2026-09-12T10:01:50.733Z","contentChangedAt":"2026-09-12T10:01:50.733Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}