{"record":{"id":"d712f8d0b66cf5fb","repo":"siyuan-note/siyuan","slug":"encrypted-asset-metadata-is-too-large","errorCode":null,"errorMessage":"encrypted asset metadata is too large","messagePattern":"encrypted asset metadata is too large","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/crypto.go","lineNumber":2230,"sourceCode":"\t\tchunkCount = 1\n\t}\n\tmetadata, err := json.Marshal(&encryptedAssetMetadata{\n\t\tOriginalName: originalName,\n\t\tSize:         int64(len(plaintext)),\n\t\tChunks:       chunkCount,\n\t})\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tassetKey := util.DeriveSubKey(dek, \"siyuan/asset\")\n\tdefer zeroAndClear(assetKey)\n\taadPrefix := \"siyuan:asset:\" + boxID + \":assets/\" + diskName\n\tencryptedMetadata, err := util.EncryptWithAAD(assetKey, metadata, []byte(aadPrefix+\":metadata\"))\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\tif len(encryptedMetadata) > encryptedAssetMetadataMaxSize {\n\t\treturn nil, errors.New(\"encrypted asset metadata is too large\")\n\t}\n\tret := bytes.NewBuffer(make([]byte, 0, len(plaintext)+len(encryptedMetadata)+int(chunkCount)*64+12))\n\tret.Write(encryptedAssetMagic)\n\tif err = binary.Write(ret, binary.BigEndian, uint32(len(encryptedMetadata))); err != nil {\n\t\treturn nil, err\n\t}\n\tret.Write(encryptedMetadata)\n\tfor chunkIndex := uint64(0); chunkIndex < chunkCount; chunkIndex++ {\n\t\tstart := int(chunkIndex) * encryptedAssetChunkSize\n\t\tend := start + encryptedAssetChunkSize\n\t\tif end > len(plaintext) {\n\t\t\tend = len(plaintext)\n\t\t}\n\t\tencryptedChunk, encryptErr := util.EncryptWithAAD(\n\t\t\tassetKey,\n\t\t\tplaintext[start:end],\n\t\t\t[]byte(fmt.Sprintf(\"%s:content:%d\", aadPrefix, chunkIndex)),\n\t\t)","sourceCodeStart":2212,"sourceCodeEnd":2248,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/crypto.go#L2212-L2248","documentation":"Thrown by EncryptAsset when the encrypted metadata blob (the ciphertext of the JSON {originalName, size, chunks}) exceeds encryptedAssetMetadataMaxSize (1 MiB). Since the metadata JSON is tiny, this practically requires an absurdly long originalName (hundreds of thousands of characters) that bloats the ciphertext past the limit.","triggerScenarios":"EncryptAsset is called with an originalName that is pathologically long, or a future metadata schema change adds large fields. The check caps metadata so decryption can safely allocate bounded buffers.","commonSituations":"Almost never seen in practice — normal filenames are well under the limit. Could arise from a bug in upstream code that passes a full path or file content instead of a basename to originalName.","solutions":["Verify the originalName argument to EncryptAsset is a basename (filepath.Base) and not a full path or file content.","Sanitize or truncate the filename before encryption: use util.FilterFileName and enforce a reasonable max length (e.g., 255 chars).","If you legitimately need huge metadata, raise encryptedAssetMetadataMaxSize in the source — but this changes the on-disk format and breaks compatibility."],"exampleFix":"// before\nenc, err := EncryptAsset(boxID, diskName, userInput, dek, data)\n// after\nname := filepath.Base(userInput)\nname = util.FilterFileName(name)\nif len(name) > 255 { name = name[:255] }\nenc, err := EncryptAsset(boxID, diskName, name, dek, data)","handlingStrategy":"validation","validationCode":"// Validate filename length before encrypting\nname := filepath.Base(originalName)\nname = util.FilterFileName(name)\nif len(name) > 255 {\n    name = name[:255]\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pass a basename (filepath.Base) as originalName to EncryptAsset, never a full path.","Enforce a max filename length before encryption.","Unit-test EncryptAsset with edge-case filenames (empty, very long, unicode)."],"tags":["encryption","asset","size-limit","crypto"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}